WuYongJie/furniture-3d-system-Wu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

merge: supplier barcode-only access

Browse Source
This commit is contained in:
WuYongJie 2026-07-28 17:39:17 +08:00
commit 7f0561df35
2 changed files with 31 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
furniture-3d-system/src/server/core/response.test.ts
View File

@ -7,7 +7,19 @@ jest.mock('@/lib/storage', () => ({
mockResolveObjectStorageUrlForClientAccess(...args),
}))
import { success, successWithPagination } from './response'
import type { NextRequest } from 'next/server'
import {
isSupplierAllowedApiRequest,
success,
successWithPagination,
} from './response'
function createRequest(path: string, method: string): NextRequest {
return {
method,
nextUrl: new URL(`http://localhost${path}`),
} as NextRequest
}
describe('response storage url normalization', () => {
beforeEach(() => {
@ -111,3 +123,20 @@ describe('response storage url normalization', () => {
})
})
})
describe('supplier request boundary', () => {
it.each([
['GET', '/api/auth/me', true],
['GET', '/api/intake/barcode-print', true],
['POST', '/api/intake/barcode-print', true],
['DELETE', '/api/intake/barcode-print', true],
['GET', '/api/intake/node-permission-settings', false],
['GET', '/api/intake/non-integrated', false],
['GET', '/api/intake/non-integrated/product-1', false],
['GET', '/api/intake/non-integrated/product-1/order-sheet', false],
['GET', '/api/intake/non-integrated/product-1/contracts', false],
['POST', '/api/users', false],
])('supplier %s %s is allowed: %s', (method, path, expected) => {
expect(isSupplierAllowedApiRequest(createRequest(path, method))).toBe(expected)
})
})

9
furniture-3d-system/src/server/core/response.ts
View File

@ -201,7 +201,7 @@ interface HandleRequestOptions {
requireDesignWorkspaceWrite?: boolean
}
function isSupplierAllowedApiRequest(request: NextRequest) {
export function isSupplierAllowedApiRequest(request: NextRequest) {
const { pathname } = request.nextUrl
const method = request.method.toUpperCase()
@ -209,13 +209,6 @@ function isSupplierAllowedApiRequest(request: NextRequest) {
if (pathname === '/api/intake/barcode-print') {
return method === 'GET' || method === 'POST' || method === 'DELETE'
}
if (method !== 'GET') return false
if (pathname === '/api/intake/node-permission-settings') return true
if (pathname === '/api/intake/non-integrated') return true
if (/^\/api\/intake\/non-integrated\/[^/]+$/.test(pathname)) return true
if (/^\/api\/intake\/non-integrated\/[^/]+\/order-sheet$/.test(pathname)) return true
if (/^\/api\/intake\/non-integrated\/[^/]+\/contracts$/.test(pathname)) return true
return false
}