platforms/backend/api/internal/routers/delivery_test.go

package routers

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gin-gonic/gin"
)

func TestDeliveryRoutesRequireAuthentication(t *testing.T) {
	gin.SetMode(gin.TestMode)
	engine := gin.New()
	RegisterDelivery("heqi", engine)
	response := httptest.NewRecorder()
	engine.ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/heqi/delivery/v1/delivery_menu", nil))
	if response.Code == http.StatusOK {
		t.Fatal("delivery menu must reject anonymous access")
	}
}

func TestDeliveryOrderActionBoundary(t *testing.T) {
	gin.SetMode(gin.TestMode)
	engine := gin.New()
	RegisterDelivery("heqi", engine)
	routes := map[string]bool{}
	for _, route := range engine.Routes() {
		routes[route.Method+" "+route.Path] = true
	}
	for _, forbidden := range []string{
		"POST /heqi/delivery/v1/gasorder_basic/:identity/filling",
		"POST /heqi/delivery/v1/gasorder_basic/:identity/ready",
		"POST /heqi/delivery/v1/gasorder_basic/:identity/delivering",
		"POST /heqi/delivery/v1/gasorder_basic/:identity/awaiting-confirmation",
		"POST /heqi/delivery/v1/gasorder_basic/:identity/complete",
	} {
		if routes[forbidden] {
			t.Fatalf("delivery web must not expose app or gas action %s", forbidden)
		}
	}
	for _, required := range []string{
		"POST /heqi/delivery/v1/gasorder_basic",
		"POST /heqi/delivery/v1/gasorder_basic/:identity/assign",
		"POST /heqi/delivery/v1/gasorder_basic/:identity/reclaim",
		"POST /heqi/delivery/v1/gasorder_basic/:identity/adjust-amount",
		"GET /heqi/delivery/v1/wallet_recharge",
		"GET /heqi/delivery/v1/wallet_recharge/:identity",
	} {
		if !routes[required] {
			t.Fatalf("missing confirmed delivery action %s", required)
		}
	}
}