feat: implement gas and delivery admin systems

backend/api/internal/routers/delivery_test.go

@@ -0,0 +1,51 @@
+package routers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestDeliveryRoutesRequireAuthentication(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	engine := gin.New()
+	RegisterDelivery("heqi", engine)
+	response := httptest.NewRecorder()
+	engine.ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/heqi/delivery/v1/delivery_menu", nil))
+	if response.Code == http.StatusOK {
+		t.Fatal("delivery menu must reject anonymous access")
+	}
+}
+
+func TestDeliveryOrderActionBoundary(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	engine := gin.New()
+	RegisterDelivery("heqi", engine)
+	routes := map[string]bool{}
+	for _, route := range engine.Routes() {
+		routes[route.Method+" "+route.Path] = true
+	}
+	for _, forbidden := range []string{
+		"POST /heqi/delivery/v1/gasorder_basic/:identity/filling",
+		"POST /heqi/delivery/v1/gasorder_basic/:identity/ready",
+		"POST /heqi/delivery/v1/gasorder_basic/:identity/delivering",
+		"POST /heqi/delivery/v1/gasorder_basic/:identity/awaiting-confirmation",
+		"POST /heqi/delivery/v1/gasorder_basic/:identity/complete",
+	} {
+		if routes[forbidden] {
+			t.Fatalf("delivery web must not expose app or gas action %s", forbidden)
+		}
+	}
+	for _, required := range []string{
+		"POST /heqi/delivery/v1/gasorder_basic",
+		"POST /heqi/delivery/v1/gasorder_basic/:identity/assign",
+		"POST /heqi/delivery/v1/gasorder_basic/:identity/reclaim",
+		"POST /heqi/delivery/v1/gasorder_basic/:identity/adjust-amount",
+	} {
+		if !routes[required] {
+			t.Fatalf("missing confirmed delivery action %s", required)
+		}
+	}
+}