93 lines
8.9 KiB
PHP
93 lines
8.9 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
namespace {
|
|
const MINIAPI_TOKEN_KEY = 'test';
|
|
const PAY_MARK = 'evuscn';
|
|
function authcode($value, ...$args) { return $value; }
|
|
function config($key) { return 'https://example.test/home/users/list'; }
|
|
}
|
|
namespace think\facade { class Log { static function warning($message) {} } }
|
|
namespace api {
|
|
class Httpcurl {
|
|
public static array $result = [];
|
|
public static array $lastPayload = [];
|
|
static function request($url, $method, $data) { parse_str($data, self::$lastPayload); return [json_encode(self::$result), null, null, '']; }
|
|
}
|
|
}
|
|
namespace app\miniapi\service\Payment {
|
|
class MiniPayService {
|
|
public static int $calls = 0;
|
|
public static bool $throws = false;
|
|
public static array $result = ['code'=>0,'msg'=>'temporary failure'];
|
|
function requestForTarget(...$args) { self::$calls++; if (self::$throws) throw new \RuntimeException('offline'); return self::$result; }
|
|
}
|
|
}
|
|
namespace app\miniapi\controller {
|
|
class Base {
|
|
public array $input = ['openid'=>'test-openid'];
|
|
public string $appCode = 'evus_jn_mp';
|
|
protected function requireLogin() { return 7; }
|
|
protected function postData() { return $this->input; }
|
|
protected function currentMiniAppCode() { return $this->appCode; }
|
|
protected function currentMiniAppContext($business) { return new \stdClass(); }
|
|
protected function ok($data, $msg = '') { return ['code'=>1,'data'=>$data,'msg'=>$msg]; }
|
|
protected function fail($msg, $code = 0, $data = []) { return ['code'=>$code,'msg'=>$msg,'data'=>$data]; }
|
|
}
|
|
}
|
|
namespace {
|
|
require __DIR__ . '/../app/miniapi/service/VisaApplication/VisaApplicationService.php';
|
|
require __DIR__ . '/../app/miniapi/controller/VisaApplication.php';
|
|
function checkSubmit($condition, $message) { if (!$condition) throw new RuntimeException($message); }
|
|
$controller = new app\miniapi\controller\VisaApplication();
|
|
$data = ['order_sn'=>'TEST1','requires_payment'=>true,'total_price'=>7900,'payment_ready'=>true,'payment_business'=>'arrival_card','target_orders'=>[['target_table'=>'singapore','target_order_sn'=>'TEST1','applicant_index'=>0]]];
|
|
api\Httpcurl::$result = ['code'=>1,'data'=>$data];
|
|
$result = $controller->submit();
|
|
checkSubmit($result['code'] === 1 && $result['data']['submission_status'] === 'submitted' && !isset($result['data']['pay']), 'parameter failure must not undo submission');
|
|
app\miniapi\service\Payment\MiniPayService::$throws = true;
|
|
checkSubmit($controller->submit()['code'] === 1, 'transport exception must not undo submission');
|
|
app\miniapi\service\Payment\MiniPayService::$throws = false;
|
|
$data['target_orders'][] = ['target_table'=>'singapore','target_order_sn'=>'TEST2','applicant_index'=>1];
|
|
api\Httpcurl::$result['data'] = $data;
|
|
$before = app\miniapi\service\Payment\MiniPayService::$calls;
|
|
checkSubmit($controller->submit()['code'] === 1 && app\miniapi\service\Payment\MiniPayService::$calls === $before, 'batch must not auto-charge first applicant');
|
|
api\Httpcurl::$result = ['code'=>0,'msg'=>'validation failed'];
|
|
checkSubmit($controller->submit()['code'] === 0, 'actual submission failure remains a failure');
|
|
api\Httpcurl::$result = ['code'=>0,'msg'=>'validation failed','data'=>['field_errors'=>[['module_key'=>'traveler','field'=>'passport_number','path'=>'data.applicants.0.traveler.passport_number','message'=>'护照号格式不正确','value'=>'SECRET','money'=>'0.01','mark'=>'forged','target_table'=>'secret']],'target_orders'=>[['target_table'=>'secret']],'pay_url'=>'https://secret.test']];
|
|
checkSubmit(($controller->submit()['data'] ?? []) === [], 'legacy submit rejection must not expose direct field metadata');
|
|
$controller->appCode = 'evus_jn_app';
|
|
$controller->input = ['request_id'=>str_repeat('d',64),'service_code'=>'TEST'];
|
|
api\Httpcurl::$result = ['code'=>1,'data'=>['order_sn'=>'TEST1','requires_payment'=>true,'total_price'=>7900,'payment_ready'=>true,'payment_business'=>'arrival_card','target_orders'=>[['target_table'=>'singapore','target_order_sn'=>'TEST1','applicant_index'=>0]],'submission_status'=>'submitted', 'pay_url'=>'https://secret.test']];
|
|
$androidStatus = $controller->directStatus();
|
|
checkSubmit(($androidStatus['data']['app_payment'] ?? null) === ['order_sn'=>'TEST1','money'=>'79.00','mark'=>'evuscnsingapore','business'=>'arrival_card'] && !isset($androidStatus['data']['target_orders'], $androidStatus['data']['pay_url']), 'android direct status must sanitize internal targets and expose trusted payment business');
|
|
$androidForm = $controller->directForm();
|
|
checkSubmit(($androidForm['data']['app_payment']['business'] ?? '') === 'arrival_card' && !isset($androidForm['data']['target_orders'], $androidForm['data']['pay_url']), 'android existing direct form result uses the same safe payment shape');
|
|
api\Httpcurl::$result = ['code'=>1,'data'=>['order_sn'=>'TEST1','requires_payment'=>true,'total_price'=>7900,'payment_ready'=>false,'directory_synced'=>true,'payment_business'=>'arrival_card','target_orders'=>[['target_table'=>'singapore','target_order_sn'=>'TEST1','applicant_index'=>0]]]];
|
|
checkSubmit(!isset($controller->directStatus()['data']['app_payment']), 'android status must not create payment before directory payment readiness');
|
|
api\Httpcurl::$result = ['code'=>0,'msg'=>'validation failed','data'=>['field_errors'=>[['module_key'=>'traveler','field'=>'passport_number','path'=>'data.applicants.0.traveler.passport_number','message'=>'护照号格式不正确','value'=>'SECRET','money'=>'0.01','mark'=>'forged','target_table'=>'secret']],'target_orders'=>[['target_table'=>'secret']],'pay_url'=>'https://secret.test']];
|
|
$controller->input = ['request_id'=>str_repeat('f',64),'service_code'=>'TEST','nationality_iso2'=>'CN','destination_iso2'=>'SG'];
|
|
$safeFailure = $controller->directSubmit();
|
|
checkSubmit($safeFailure['code'] === 0 && ($safeFailure['data']['field_errors'] ?? null) === [['module_key'=>'traveler','field_id'=>'passport_number','path'=>'data.applicants.0.traveler.passport_number','message'=>'护照号格式不正确']], 'direct rejection forwards only bounded field location metadata');
|
|
checkSubmit(!str_contains(json_encode($safeFailure['data']), 'SECRET') && !str_contains(json_encode($safeFailure['data']), 'forged') && !str_contains(json_encode($safeFailure['data']), 'secret'), 'direct rejection must drop sensitive upstream keys and values');
|
|
$controller->appCode = 'evus_jn_mp';
|
|
$controller->input = ['openid'=>'test-openid'];
|
|
api\Httpcurl::$result = ['code'=>1,'data'=>$data];
|
|
$controller->input += ['business'=>'singapore','order_sn'=>'TEST1','total_price'=>1,'target_table'=>'evus'];
|
|
api\Httpcurl::$result = ['code'=>1,'data'=>array_merge($data, ['target_orders'=>[$data['target_orders'][0]]])];
|
|
app\miniapi\service\Payment\MiniPayService::$result = ['code'=>1,'data'=>['package'=>'prepay_id=test']];
|
|
checkSubmit($controller->orderPayment()['code'] === 1, 'per-person payment parameters are forwarded');
|
|
checkSubmit(!isset(api\Httpcurl::$lastPayload['total_price'], api\Httpcurl::$lastPayload['target_table']), 'client cannot choose amount or target table');
|
|
$controller->input = ['openid'=>'test-openid','request_id'=>str_repeat('a',64),'service_code'=>'TEST','nationality_iso2'=>'CN','destination_iso2'=>'SG'];
|
|
checkSubmit($controller->directSubmit()['code'] === 1, 'new direct submit still obtains original native payment parameters');
|
|
checkSubmit(api\Httpcurl::$lastPayload['request_id'] === str_repeat('a',64) && !isset(api\Httpcurl::$lastPayload['application_token'],api\Httpcurl::$lastPayload['submission_token']), 'direct submit needs no application credentials');
|
|
$claims=json_decode(api\Httpcurl::$lastPayload['user_token'],true);
|
|
checkSubmit($claims['order_source']==='jnwxmini' && $claims['user_id']===7, 'new endpoint forwards verified account and source');
|
|
$controller->appCode = 'evus_jn_app';
|
|
$controller->input = ['request_id'=>str_repeat('b',64),'service_code'=>'TEST','nationality_iso2'=>'CN','destination_iso2'=>'SG','mark'=>'forged','money'=>'0.01','target_table'=>'evus'];
|
|
$androidSubmit = $controller->directSubmit();
|
|
checkSubmit(($androidSubmit['data']['app_payment'] ?? null) === ['order_sn'=>'TEST1','money'=>'79.00','mark'=>'evuscnsingapore','business'=>'arrival_card'] && !isset($androidSubmit['data']['pay']), 'android direct submit must expose only the server-derived app payment target and business');
|
|
$controller->input = ['business'=>'singapore','order_sn'=>'TEST1','mark'=>'forged','money'=>'0.01','target_table'=>'evus'];
|
|
$androidRepay = $controller->orderPayment();
|
|
checkSubmit(($androidRepay['data']['app_payment'] ?? null) === ['order_sn'=>'TEST1','money'=>'79.00','mark'=>'evuscnsingapore','business'=>'singapore'] && !isset($androidRepay['data']['pay']), 'android repeat payment must only echo the upstream-verified public business');
|
|
echo "PASS visa_submission_payment_self_check\n";
|
|
}
|