koc-loop/tests/owner-scope.test.mjs

import assert from "node:assert/strict";
import test from "node:test";
import {
  isDistributionOwner,
  isTaskOwner,
  ownerScopeUserid,
} from "../lib/owner-scope.ts";
import { getTaskReportData } from "../lib/mvp-db.ts";

function captureDb(rowsByPattern) {
  const captured = [];
  const makeStatement = (sql, values) => ({
    async first() {
      captured.push({ sql, values });
      for (const [pattern, rows] of rowsByPattern) {
        if (pattern.test(sql)) return rows(values) ?? null;
      }
      return null;
    },
    async all() {
      captured.push({ sql, values });
      for (const [pattern, rows] of rowsByPattern) {
        if (pattern.test(sql)) return { results: rows(values) ?? [] };
      }
      return { results: [] };
    },
  });
  const db = {
    prepare(sql) {
      const unbound = makeStatement(sql, []);
      return {
        bind(...values) {
          return makeStatement(sql, values);
        },
        first: unbound.first,
        all: unbound.all,
      };
    },
  };
  return { db, captured };
}

test("isTaskOwner union-matches task owner or project owner", async () => {
  const { db, captured } = captureDb([
    [
      /FROM tasks t\s+LEFT JOIN projects p ON p\.id = t\.project_id/,
      (values) =>
        values[0] === "task-1" &&
        values[1] === "zhangsan" &&
        values[2] === "zhangsan"
          ? { id: "task-1" }
          : null,
    ],
  ]);
  assert.equal(await isTaskOwner(db, "task-1", "zhangsan"), true);
  assert.equal(await isTaskOwner(db, "task-2", "zhangsan"), false);
  assert.equal(captured.length, 2);
  assert.match(
    captured[0].sql,
    /t\.owner_userid = \? OR p\.owner_userid = \?/,
  );
  assert.deepEqual(captured[0].values, ["task-1", "zhangsan", "zhangsan"]);
});

test("isTaskOwner strict mode only matches task owner_userid", async () => {
  const { db, captured } = captureDb([
    [
      /FROM tasks WHERE id = \? AND owner_userid = \?/,
      (values) =>
        values[0] === "task-1" && values[1] === "zhangsan"
          ? { id: "task-1" }
          : null,
    ],
  ]);
  assert.equal(await isTaskOwner(db, "task-1", "zhangsan", { strict: true }), true);
  assert.equal(
    await isTaskOwner(db, "task-1", "project-owner", { strict: true }),
    false,
    "strict 门不允许项目负责人代操作任务负责人的客户群",
  );
  assert.equal(captured.length, 2);
  assert.ok(
    !/LEFT JOIN projects/.test(captured[0].sql),
    "strict 查询不应 JOIN projects",
  );
  assert.deepEqual(captured[0].values, ["task-1", "zhangsan"]);
});

test("isTaskOwner guards empty taskId / wecomUserId without querying", async () => {
  const { db, captured } = captureDb([]);
  assert.equal(await isTaskOwner(db, "task-1", ""), false);
  assert.equal(await isTaskOwner(db, "", "zhangsan"), false);
  assert.equal(await isTaskOwner(db, "  ", "zhangsan"), false);
  assert.equal(captured.length, 0);
});

test("isDistributionOwner union-matches via task or project owner", async () => {
  const { db, captured } = captureDb([
    [
      /FROM distributions d\s+JOIN tasks t ON t\.id = d\.task_id\s+LEFT JOIN projects p ON p\.id = t\.project_id/,
      (values) =>
        values[0] === "dist-1" &&
        values[1] === "zhangsan" &&
        values[2] === "zhangsan"
          ? { id: "dist-1" }
          : null,
    ],
  ]);
  assert.equal(await isDistributionOwner(db, "dist-1", "zhangsan"), true);
  assert.equal(await isDistributionOwner(db, "dist-9", "zhangsan"), false);
  assert.equal(await isDistributionOwner(db, "dist-1", ""), false);
  assert.match(
    captured[0].sql,
    /t\.owner_userid = \? OR p\.owner_userid = \?/,
  );
  assert.deepEqual(captured[0].values, ["dist-1", "zhangsan", "zhangsan"]);
});

test("ownerScopeUserid maps scope kinds to filter value", () => {
  assert.equal(ownerScopeUserid({ kind: "full" }), undefined);
  assert.equal(ownerScopeUserid({ kind: "owner", wecomUserId: "zhangsan" }), "zhangsan");
  assert.equal(ownerScopeUserid({ kind: "owner", wecomUserId: "" }), "");
});

test("getTaskReportData filters by owner when ownerUserid given", async () => {
  const { db, captured } = captureDb([[/FROM tasks t/, () => []]]);
  await getTaskReportData(db, "zhangsan");
  assert.equal(captured.length, 1);
  assert.match(
    captured[0].sql,
    /WHERE \(t\.owner_userid = \? OR p\.owner_userid = \?\)/,
  );
  assert.deepEqual(captured[0].values, ["zhangsan", "zhangsan"]);
});

test("getTaskReportData keeps global aggregation without ownerUserid", async () => {
  const { db, captured } = captureDb([[/FROM tasks t/, () => []]]);
  await getTaskReportData(db);
  assert.equal(captured.length, 1);
  assert.ok(!/owner_userid = \?/.test(captured[0].sql));
  assert.ok(!captured[0].values?.length);
});

test("getTaskReportData returns empty list for unbound owner (empty string scope)", async () => {
  const { db, captured } = captureDb([[/FROM tasks t/, () => [{ id: "task-x" }]]]);
  const rows = await getTaskReportData(db, "");
  assert.deepEqual(rows, []);
  assert.equal(captured.length, 0, "空范围不应执行查询（绑定 '' 会误配 owner_userid='' 的任务）");
});