cfc/tests/e2e/api/report-closedloop-contract.spec.js

/**
 * EVD-7 报告闭环批次（23 SC）— 三类流 API 级 e2e
 * ================================================================
 * 覆盖 SC：SC-A-02/A-16、SC-C-06/C-07、SC-P-24/P-25/P-39/P-67/P-84/P-91、
 *         SC-S-09、SC-T-03/T-11/T-12/T-21/T-23、SC-X-02/X-10/X-13。
 * 与 cfc-backend/src/test/java/com/etotem/cfc/unit/*Report*ContractTest 契约 JUnit 互补：
 *   - JUnit：Service/Controller 分支级契约（纯 Mockito，确定性）；
 *   - 本 spec：真实 HTTP + 真实 DB，验证「登录 → 家庭上下文 → 端点 → Result 外壳」主链路。
 * 不在本 spec 覆盖：SC-B-04/B-11（LangGraph 报告解读/追问，见
 *   cfc-langgraph/tests_contract/test_growth_report_contract.py）、SC-P-82（MCP JSON-RPC
 *   需 Mcp-Api-Key，见 GlobalSearchScP82ContractTest）。
 *
 * 运行（默认远端；可用 CFC_API_BASE 指向本地 9082）：
 *   npx playwright test api/report-closedloop-contract.spec.js \
 *     -c playwright.config.api.js --project=desktop
 *   CFC_API_BASE=http://127.0.0.1:9082 npx playwright test api/report-closedloop-contract.spec.js \
 *     -c playwright.config.api.js --project=desktop
 *
 * 安全约定：用例只自注册临时账号、只读写自己的数据；不打印 token / 手机号。
 */
const { test, expect } = require('@playwright/test');
const { registerRole, apiPost, pickMemberByUserId, uniqueSuffix } = require('../helpers/api');

test.describe('EVD-7 报告闭环 三类流（23 SC）', () => {
  let parent;
  let teacher;
  let selfMemberId;
  let teacherMemberId;

  test.beforeAll(async ({ request }) => {
    parent = await registerRole(request, 'parent', 'QA-EVD7-P' + uniqueSuffix());
    const list = await apiPost(request, '/api/family/member/list', {}, parent.token);
    expect(list.code, list.message).toBe(200);
    const self = pickMemberByUserId(list.data, parent.userId);
    expect(self, '成员列表应包含登录用户自身').toBeTruthy();
    selfMemberId = self.id;

    teacher = await registerRole(request, 'teacher', 'QA-EVD7-T' + uniqueSuffix());
    const teacherList = await apiPost(request, '/api/family/member/list', {}, teacher.token);
    expect(teacherList.code, teacherList.message).toBe(200);
    const teacherSelf = pickMemberByUserId(teacherList.data, teacher.userId);
    expect(teacherSelf, 'teacher 成员列表应包含自身').toBeTruthy();
    teacherMemberId = teacherSelf.id;
  });

  // ==================== 正常流 ====================

  test.describe('正常流', () => {
    test('SC-C-06/P-24 报告列表按成员返回数组（只读）', async ({ request }) => {
      const r = await apiPost(request, '/api/health/report/list', { memberId: selfMemberId }, parent.token);
      expect(r.code, r.message).toBe(200);
      expect(Array.isArray(r.data)).toBe(true);
    });

    test('SC-P-24/X-02 家庭报告列表返回数组', async ({ request }) => {
      const r = await apiPost(request, '/api/health/reports/family', {}, parent.token);
      expect(r.code, r.message).toBe(200);
      expect(Array.isArray(r.data)).toBe(true);
    });

    test('SC-P-25/X-10 报告趋势返回 scores/dates 结构', async ({ request }) => {
      const r = await apiPost(request, '/api/health/nutrition/trend', { memberId: selfMemberId }, parent.token);
      expect(r.code, r.message).toBe(200);
      expect(r.data && Array.isArray(r.data.scores)).toBe(true);
      expect(r.data && Array.isArray(r.data.dates)).toBe(true);
    });

    test('SC-P-84 授权→查询→撤销闭环（成员级报告权限）', async ({ request }) => {
      const grant = await apiPost(request, '/api/health/report/member-permission/grant',
        { targetMemberId: selfMemberId, granteeUserId: parent.userId }, parent.token);
      expect(grant.code, grant.message).toBe(200);
      expect(grant.data).toBe(true);

      const byMember = await apiPost(request,
        '/api/health/report/member-permission/members/' + selfMemberId, {}, parent.token);
      expect(byMember.code, byMember.message).toBe(200);
      expect(byMember.data.map(String)).toContain(String(parent.userId));

      const all = await apiPost(request, '/api/health/report/member-permission/list', {}, parent.token);
      expect(all.code, all.message).toBe(200);
      expect(Array.isArray(all.data)).toBe(true);

      // 家庭管理员 visible-members 返回 null（全部可见语义）；普通成员返回集合
      const visible = await apiPost(request,
        '/api/health/report/member-permission/visible-members', {}, parent.token);
      expect(visible.code, visible.message).toBe(200);
      expect(visible.data === null || Array.isArray(visible.data)).toBe(true);

      const revoke = await apiPost(request, '/api/health/report/member-permission/revoke',
        { targetMemberId: selfMemberId, granteeUserId: parent.userId }, parent.token);
      expect(revoke.code, revoke.message).toBe(200);
      expect(revoke.data).toBe(true);
    });

    test('SC-C-07/P-39/T-12 DAN 报告列表返回数组', async ({ request }) => {
      const r = await apiPost(request, '/api/dan-report/list', { memberId: selfMemberId }, parent.token);
      expect(r.code, r.message).toBe(200);
      expect(Array.isArray(r.data)).toBe(true);
    });

    test('SC-S-09/A-02 报告解析类型↔商品链接列表（服务商接入真实契约）', async ({ request }) => {
      const r = await apiPost(request, '/api/report-parser/types/links', {}, parent.token);
      expect(r.code, r.message).toBe(200);
      expect(Array.isArray(r.data)).toBe(true);
    });

    test('SC-X-13 报告转交请求列表返回 incoming/outgoing', async ({ request }) => {
      const r = await apiPost(request, '/api/health/report/transfer/list', {}, parent.token);
      expect(r.code, r.message).toBe(200);
      expect(Array.isArray(r.data && r.data.incoming)).toBe(true);
      expect(Array.isArray(r.data && r.data.outgoing)).toBe(true);
    });

    test('SC-T-03/T-23 代传确认（teacher 角色通过权限闸门后进入参数校验）', async ({ request }) => {
      // teacher 属于代传上传者角色：通过 isProxyUploader 后，缺 draftId 返回业务错误而非「无权」
      const r = await apiPost(request, '/api/health/report/proxy-confirm', {}, teacher.token);
      expect(r.code, r.message).not.toBe(200);
      expect(String(r.message)).toContain('draftId');
    });
  });

  // ==================== 异常流 ====================

  test.describe('异常流', () => {
    test('SC-P-25 趋势缺 memberId → memberId不能为空', async ({ request }) => {
      const r = await apiPost(request, '/api/health/nutrition/trend', {}, parent.token);
      expect(r.code, r.message).not.toBe(200);
      expect(String(r.message)).toContain('memberId不能为空');
    });

    test('SC-P-24 指标对比缺 reportId → reportId不能为空', async ({ request }) => {
      const r = await apiPost(request, '/api/health/report/indicators', {}, parent.token);
      expect(r.code, r.message).not.toBe(200);
      expect(String(r.message)).toContain('reportId不能为空');
    });

    test('SC-P-91 指标对比 reportId 不存在 → 报告不存在', async ({ request }) => {
      const r = await apiPost(request, '/api/health/report/indicators', { reportId: 999999999 }, parent.token);
      expect(r.code, r.message).not.toBe(200);
      expect(String(r.message)).toContain('报告不存在');
    });

    test('SC-A-02/A-16 解析检测缺 filePath → filePath 不能为空', async ({ request }) => {
      const r = await apiPost(request, '/api/report-parser/detect', {}, parent.token);
      expect(r.code, r.message).not.toBe(200);
      expect(String(r.message)).toContain('filePath');
    });

    test('SC-P-84 授权缺参数 → targetMemberId/granteeUserId 不能为空', async ({ request }) => {
      const r = await apiPost(request, '/api/health/report/member-permission/grant', {}, parent.token);
      expect(r.code, r.message).not.toBe(200);
      expect(String(r.message)).toContain('不能为空');
    });

    test('SC-T-21/X-10 新成员无两次测评 → 对比返回业务错误', async ({ request }) => {
      const r = await apiPost(request, '/api/assessment/compare/by-child', { memberId: selfMemberId }, parent.token);
      expect(r.code, r.message).not.toBe(200);
      expect(String(r.message)).toContain('两次');
    });

    test('SC-C-07/T-12 DAN 对比缺 uploadId → 缺少 uploadIdA 与 uploadIdB', async ({ request }) => {
      const r = await apiPost(request, '/api/dan-report/compare', {}, parent.token);
      expect(r.code, r.message).not.toBe(200);
      expect(String(r.message)).toContain('uploadIdA');
    });

    test('SC-X-13 转交审批缺 requestId → 请求ID不能为空', async ({ request }) => {
      const r = await apiPost(request, '/api/health/report/transfer/approve', {}, parent.token);
      expect(r.code, r.message).not.toBe(200);
      expect(String(r.message)).toContain('申请ID不能为空');
    });

    test('SC-T-03/X-02 确认不存在的草稿 → 草稿不存在或已归档', async ({ request }) => {
      const r = await apiPost(request, '/api/health/report/audit/confirm', { draftId: 999999999 }, parent.token);
      expect(r.code, r.message).not.toBe(200);
      expect(String(r.message)).toContain('草稿不存在');
    });
  });

  // ==================== 权限流 ====================

  test.describe('权限流', () => {
    test('SC-C-06/X-02 报告列表无 token → 401', async ({ request }) => {
      const r = await apiPost(request, '/api/health/report/list', { memberId: selfMemberId }, null);
      expect(r.status).toBe(401);
    });

    test('SC-X-13 转交列表无 token → 401', async ({ request }) => {
      const r = await apiPost(request, '/api/health/report/transfer/list', {}, null);
      expect(r.status).toBe(401);
    });

    test('SC-P-67/T-03 代传确认无 token → 401（LOGIN_REQUIRED_PATHS 闸门）', async ({ request }) => {
      const r = await apiPost(request, '/api/health/report/proxy-confirm', { draftId: 1 }, null);
      expect(r.status).toBe(401);
    });

    test('SC-C-07/T-12 DAN 列表非法 token → 401', async ({ request }) => {
      const r = await apiPost(request, '/api/dan-report/list', { memberId: selfMemberId }, 'invalid-token-value');
      expect(r.status).toBe(401);
    });

    test('SC-S-09 解析类型链接非法 token → 401', async ({ request }) => {
      const r = await apiPost(request, '/api/report-parser/types/links', {}, 'invalid-token-value');
      expect(r.status).toBe(401);
    });

    test('SC-P-67/T-23 家长非代传角色调用代传确认 → 无权', async ({ request }) => {
      const r = await apiPost(request, '/api/health/report/proxy-confirm', { draftId: 1 }, parent.token);
      expect(r.code, r.message).not.toBe(200);
      expect(String(r.message)).toContain('无权');
    });

    test('SC-T-03/X-02 非草稿所有者确认他人草稿 → 无权确认他人创建的草稿', async ({ request }) => {
      const pending = await apiPost(request, '/api/health/report/audit/pending', { page: 1, size: 20 }, parent.token);
      expect(pending.code, pending.message).toBe(200);
      const othersDraft = (pending.data || []).find((d) => String(d.userId) !== String(parent.userId));
      if (!othersDraft) {
        test.skip(true, '当前测试库无他人待审草稿，跳过越权确认用例');
        return;
      }
      const r = await apiPost(request, '/api/health/report/audit/confirm',
        { draftId: othersDraft.id }, parent.token);
      expect(r.code, r.message).not.toBe(200);
      expect(String(r.message)).toContain('无权确认他人创建的草稿');
    });

    test('SC-P-84/C-06 跨家庭成员报告查询 → 空列表（成员级权限隔离，不泄露）', async ({ request }) => {
      // parent 传 teacher 家庭的成员 ID：非本人、非本家庭管理员、未授权 → 返回空列表而非他人报告
      const r = await apiPost(request, '/api/health/report/list', { memberId: teacherMemberId }, parent.token);
      expect(r.code, r.message).toBe(200);
      expect(Array.isArray(r.data)).toBe(true);
      expect(r.data.length).toBe(0);

      const dan = await apiPost(request, '/api/dan-report/list', { memberId: teacherMemberId }, parent.token);
      expect(dan.code, dan.message).toBe(200);
      expect(Array.isArray(dan.data)).toBe(true);
      expect(dan.data.length).toBe(0);
    });
  });
});