300 lines
17 KiB
JavaScript
300 lines
17 KiB
JavaScript
// 问鼎 · 重要证明 —— 单测。钉三条铁律，一条都不许松：
|
||
// ① 递交=待审核，【对定品零影响】(自评上传绝不自动生效)；
|
||
// ② 只有【超管审核 verified】才进 effortBonus（用户不能自评生效·防冒充）；
|
||
// ③ 生效力度(level)由审核给，不认自评 claimLevel。
|
||
// 另钉：属主隔离(IDOR)、超管门(非超管审核=403)、防刷(条数上限)、撤回只能撤没审的、零游戏味文案墙。
|
||
//
|
||
// 纯函数层恒跑（verifiedLevel/effortBonus/office5d 效果）；DB 集成层需本地 MongoDB，连不上整组 skip。
|
||
process.env.NODE_ENV = 'test';
|
||
process.env.MONGO_DB = process.env.MONGO_DB_TEST || 'digital_me_test';
|
||
|
||
import { test, before, after } from 'node:test';
|
||
import assert from 'node:assert/strict';
|
||
import express from 'express';
|
||
import http from 'node:http';
|
||
|
||
import { verifiedLevel, MAX_ITEMS, parseVerdict, verifyZhengming } from '../src/services/zhengming.js';
|
||
import { effortBonus, computeOffice5D, zhengmingRating } from '../src/office5d.js';
|
||
import { computeAxes } from '../src/dynasties.js';
|
||
import { subsFromAttrs } from '../src/attributes.js';
|
||
import { assertNoGameMechanics } from '../src/decisions.js';
|
||
|
||
// ══════════════════════════════════════════════════════════════════════════
|
||
// 纯函数层（无 DB，恒跑）
|
||
// ══════════════════════════════════════════════════════════════════════════
|
||
|
||
test('铁律③ verifiedLevel：只认 status===verified，取已验证里最高 level', () => {
|
||
assert.equal(verifiedLevel(null), 0, '空 twin → 0');
|
||
assert.equal(verifiedLevel({}), 0, '无 zhengming → 0');
|
||
assert.equal(verifiedLevel({ zhengming: [] }), 0, '空数组 → 0');
|
||
// 待审核/驳回/自评 level 一律不算 —— 这是防刷的全部
|
||
assert.equal(verifiedLevel({ zhengming: [{ status: 'pending', level: 3 }] }), 0, '待审核 level 不算');
|
||
assert.equal(verifiedLevel({ zhengming: [{ status: 'rejected', level: 3 }] }), 0, '驳回不算');
|
||
// 只有 verified 才算，取最高
|
||
assert.equal(verifiedLevel({ zhengming: [
|
||
{ status: 'verified', level: 1 },
|
||
{ status: 'verified', level: 3 },
|
||
{ status: 'pending', level: 3 },
|
||
] }), 3, '取已验证里最高');
|
||
// level 越界夹紧
|
||
assert.equal(verifiedLevel({ zhengming: [{ status: 'verified', level: 99 }] }), 3, 'level 上限 3');
|
||
assert.equal(verifiedLevel({ zhengming: [{ status: 'verified', level: -5 }] }), 0, 'level 下限 0');
|
||
});
|
||
|
||
test('问鼎独立·zhengmingRating：已核验证明 0..3【自成一维，不再进改命 effortBonus】', () => {
|
||
// ★ 2026-07-24 拆维后：改命(effortBonus)=打卡/王/劳/知识，【不含证明】
|
||
assert.equal(effortBonus({ zhengming: 3 }), 0, '问鼎不再进改命 effortBonus');
|
||
assert.equal(effortBonus({ gaimingPoints: 6 }), 2, '改命·打卡档满 +2');
|
||
assert.equal(effortBonus({ gaimingPoints: 6, lao: 30 }), 3, '改命仍由打卡+熬时间等驱动，满 3');
|
||
// zhengmingRating：只认核定 level 0..3（自评/待审核=0，同 verifiedLevel 口径）
|
||
assert.equal(zhengmingRating({}), 0, '无 → 0');
|
||
assert.equal(zhengmingRating({ zhengming: 1 }), 1);
|
||
assert.equal(zhengmingRating({ zhengming: 3 }), 3);
|
||
assert.equal(zhengmingRating({ zhengming: 99 }), 3, '上限 3');
|
||
assert.equal(zhengmingRating({ zhengming: -5 }), 0, '下限 0');
|
||
});
|
||
|
||
test('问鼎独立·office5d：证明抬【问鼎(zheng)】这一维、不动改命；★无死维:改命满了问鼎照样推得动 tier', () => {
|
||
const base = {
|
||
professionLei: 'wen',
|
||
axes: computeAxes(subsFromAttrs(['poetic', 'story', 'vivid'], ['warm'])),
|
||
credentials: { zhicheng: 2 }, jiashi: 1, wang: 0, lao: 0, knowledge: 0,
|
||
};
|
||
const without = computeOffice5D({ ...base, zhengming: 0 }, 'tang');
|
||
const withZ = computeOffice5D({ ...base, zhengming: 3 }, 'tang');
|
||
// 问鼎(zheng)品第：有证明的更高；★ 改命(gai)品第不受它影响(已拆开、不再共用)
|
||
assert.ok(withZ.parts.pins.zheng.rank > without.parts.pins.zheng.rank, '证明抬高问鼎品第');
|
||
assert.equal(withZ.parts.pins.zheng.rank, 3);
|
||
assert.equal(without.parts.pins.zheng.rank, 0);
|
||
assert.equal(withZ.parts.pins.gai.rank, without.parts.pins.gai.rank, '证明不再动改命品第(已独立成维)');
|
||
// parts.zhengming 顶层仍在（level + 是否顶到宗师顶，供前端标「照见巅峰」）
|
||
assert.equal(withZ.parts.zhengming.level, 3);
|
||
assert.equal(typeof withZ.parts.zhengming.atCeiling, 'boolean');
|
||
// tier 单调不降 + 不越宗师顶
|
||
assert.ok(withZ.rank.tier >= without.rank.tier, 'tier 单调：证明只会抬不会降');
|
||
assert.ok(withZ.rank.tier <= withZ.parts.ceilTier, '证明不越宗师顶');
|
||
// ★★ 无死维核心：改命打卡已满(gaimingPoints=6)时，问鼎 0→3 仍能把 tier 往上推 —— 修掉「改命满则问鼎死」。
|
||
const dc = { professionLei: 'wen', axes: computeAxes(subsFromAttrs(['poetic'], ['warm'])), credentials: { zhicheng: 2 }, jiashi: 1, gaimingPoints: 6 };
|
||
const dcNoZ = computeOffice5D({ ...dc, zhengming: 0 }, 'tang');
|
||
const dcZ = computeOffice5D({ ...dc, zhengming: 3 }, 'tang');
|
||
assert.ok(dcZ.rank.tier > dcNoZ.rank.tier, '改命满时问鼎(lv3)仍推得动 tier(问鼎非死维)');
|
||
});
|
||
|
||
test('分身核验·parseVerdict：抠得出裁决取之，抠不出/形状不对一律 null(留 pending·不错认)', () => {
|
||
// 查实
|
||
assert.deepEqual(parseVerdict('{"verified":true,"level":3,"reason":"官网可查"}'), { verified: true, level: 3, reason: '官网可查' });
|
||
// 查否 → level 归 0
|
||
assert.deepEqual(parseVerdict('{"verified":false,"level":3,"reason":"查不到"}'), { verified: false, level: 0, reason: '查不到' });
|
||
// LLM 裹了自然语言也能抠出第一个 JSON
|
||
assert.equal(parseVerdict('好的，我核实了：{"verified":true,"level":1,"reason":"x"} 以上')?.verified, true);
|
||
// verified 缺失/非布尔 → null(不下结论)
|
||
assert.equal(parseVerdict('{"level":3}'), null);
|
||
assert.equal(parseVerdict('{"verified":"yes"}'), null);
|
||
// 抠不出 JSON / 空 → null
|
||
assert.equal(parseVerdict('查不到相关信息'), null);
|
||
assert.equal(parseVerdict(''), null);
|
||
assert.equal(parseVerdict(null), null);
|
||
// verified:true 但 level 越界 → 夹到 [1,3]
|
||
assert.equal(parseVerdict('{"verified":true,"level":99}')?.level, 3);
|
||
assert.equal(parseVerdict('{"verified":true,"level":0}')?.level, 1);
|
||
});
|
||
|
||
test('零游戏味：office5d 含证明的输出不带禁词（养成/解锁/成就/进度/百分比…）', () => {
|
||
const r = computeOffice5D({
|
||
professionLei: 'wen',
|
||
axes: computeAxes(subsFromAttrs(['poetic', 'story'], ['warm'])),
|
||
credentials: {}, jiashi: 0, zhengming: 3,
|
||
}, 'tang');
|
||
assertNoGameMechanics(JSON.stringify(r)); // 复用全站那一份禁词清单，不另写
|
||
});
|
||
|
||
// ══════════════════════════════════════════════════════════════════════════
|
||
// DB 集成层（需本地 MongoDB；连不上整组 skip）
|
||
// ══════════════════════════════════════════════════════════════════════════
|
||
let server, base, db, closeDb, ObjectId, signToken, config;
|
||
const OWNER = { id: null, email: 'zm-owner@test.local' };
|
||
const OTHER = { id: null, email: 'zm-other@test.local' };
|
||
const ADMIN = { id: null, email: 'zm-admin@test.local' };
|
||
let twinId, otherTwinId, mongoUp = true;
|
||
const CLERK = ['rigorous', 'datadriven', 'concise', 'shortfirst', 'patient', 'calm'];
|
||
|
||
before(async () => {
|
||
const dbm = await import('../src/db.js');
|
||
closeDb = dbm.closeDb;
|
||
try { db = await dbm.connectDb(); }
|
||
catch { mongoUp = false; return; }
|
||
({ ObjectId } = await import('mongodb'));
|
||
({ signToken } = await import('../src/middleware/auth.js'));
|
||
({ config } = await import('../src/config.js'));
|
||
// ★ 造一个超管（审核台要它）：直接往 config 里塞（isSuperAdmin 调用时才读）。
|
||
if (!config.security.superAdmins.includes(ADMIN.email)) config.security.superAdmins.push(ADMIN.email);
|
||
const { shishuRouter } = await import('../src/routes/shishu.js');
|
||
const { adminRouter } = await import('../src/routes/admin.js');
|
||
|
||
OWNER.id = new ObjectId(); OTHER.id = new ObjectId(); ADMIN.id = new ObjectId();
|
||
await db.collection('users').insertMany([
|
||
{ _id: OWNER.id, email: OWNER.email },
|
||
{ _id: OTHER.id, email: OTHER.email },
|
||
{ _id: ADMIN.id, email: ADMIN.email },
|
||
]);
|
||
const t = await db.collection('twins').insertOne({
|
||
ownerId: OWNER.id, displayName: '某', profession: '', talents: { sub_talents: CLERK }, isPublic: false,
|
||
});
|
||
twinId = t.insertedId;
|
||
const t2 = await db.collection('twins').insertOne({
|
||
ownerId: OTHER.id, displayName: '他', talents: { sub_talents: CLERK }, isPublic: false,
|
||
});
|
||
otherTwinId = t2.insertedId;
|
||
|
||
const app = express();
|
||
app.use(express.json());
|
||
app.use('/api/shishu', shishuRouter);
|
||
app.use('/api/admin', adminRouter);
|
||
server = http.createServer(app).listen(0);
|
||
await new Promise((ok) => server.once('listening', ok));
|
||
base = `http://127.0.0.1:${server.address().port}`;
|
||
});
|
||
|
||
after(async () => {
|
||
if (server) server.close();
|
||
if (mongoUp) {
|
||
await db.collection('twins').deleteMany({ _id: { $in: [twinId, otherTwinId] } });
|
||
await db.collection('users').deleteMany({ _id: { $in: [OWNER.id, OTHER.id, ADMIN.id] } });
|
||
if (closeDb) await closeDb();
|
||
}
|
||
});
|
||
|
||
const auth = (u = OWNER) => ({ authorization: `Bearer ${signToken({ id: u.id.toString(), email: u.email })}` });
|
||
const get = (p, u) => fetch(base + p, { headers: auth(u) });
|
||
const post = (p, body, u) => fetch(base + p, { method: 'POST', headers: { 'content-type': 'application/json', ...auth(u) }, body: JSON.stringify(body || {}) });
|
||
const del = (p, u) => fetch(base + p, { method: 'DELETE', headers: auth(u) });
|
||
const resetZM = () => db.collection('twins').updateOne({ _id: twinId }, { $set: { zhengming: [] } });
|
||
|
||
test('铁律① 递交=待审核，对定品零影响；审核通过后才生效', async (t) => {
|
||
if (!mongoUp) return t.skip('无本地 MongoDB');
|
||
await resetZM();
|
||
// 递交一条
|
||
const r = await post(`/api/shishu/zhengming/${twinId}`, { title: '某国家级奖项', domain: 'wen', claimLevel: 3, note: '证书编号 X' });
|
||
assert.equal(r.status, 200);
|
||
const rec = await r.json();
|
||
assert.equal(rec.status, 'pending', '落库即待审核');
|
||
assert.equal(rec.level, 0, '待审核 level=0（对定品零影响）');
|
||
// 此刻 verifiedLevel 仍是 0 —— 定品不受影响
|
||
let twin = await db.collection('twins').findOne({ _id: twinId });
|
||
assert.equal(verifiedLevel(twin), 0, '未审核 → verifiedLevel 0');
|
||
|
||
// 超管审核通过，核定 level 2
|
||
const rv = await post(`/api/admin/zhengming/${twinId}/${rec.id}/review`, { status: 'verified', level: 2 }, ADMIN);
|
||
assert.equal(rv.status, 200);
|
||
twin = await db.collection('twins').findOne({ _id: twinId });
|
||
assert.equal(verifiedLevel(twin), 2, '审核通过后 verifiedLevel=2（这一刻才生效）');
|
||
});
|
||
|
||
test('铁律② 超管门：非超管不能审核（403）', async (t) => {
|
||
if (!mongoUp) return t.skip('无本地 MongoDB');
|
||
await resetZM();
|
||
const r = await post(`/api/shishu/zhengming/${twinId}`, { title: 'A' });
|
||
const rec = await r.json();
|
||
// 分身主人自己审 → 403（不能自评生效）
|
||
const self = await post(`/api/admin/zhengming/${twinId}/${rec.id}/review`, { status: 'verified', level: 3 }, OWNER);
|
||
assert.equal(self.status, 403, '本人不能自审');
|
||
// 陌生人审 → 403
|
||
const other = await post(`/api/admin/zhengming/${twinId}/${rec.id}/review`, { status: 'verified', level: 3 }, OTHER);
|
||
assert.equal(other.status, 403);
|
||
// 审核后仍是 pending（没被非法改动）
|
||
const twin = await db.collection('twins').findOne({ _id: twinId });
|
||
assert.equal(twin.zhengming[0].status, 'pending');
|
||
assert.equal(verifiedLevel(twin), 0);
|
||
});
|
||
|
||
test('属主隔离(IDOR)：拿不到/递交不了别人的分身', async (t) => {
|
||
if (!mongoUp) return t.skip('无本地 MongoDB');
|
||
// OTHER 递交到 OWNER 的分身 → 404
|
||
const r = await post(`/api/shishu/zhengming/${twinId}`, { title: '偷' }, OTHER);
|
||
assert.equal(r.status, 404, '别人的分身递交不了');
|
||
// OTHER 列 OWNER 的分身 → 404
|
||
const l = await get(`/api/shishu/zhengming/${twinId}`, OTHER);
|
||
assert.equal(l.status, 404, '别人的分身列不了');
|
||
});
|
||
|
||
test('防刷：条数到上限拒收（409）', async (t) => {
|
||
if (!mongoUp) return t.skip('无本地 MongoDB');
|
||
// 直接塞满到上限
|
||
const full = Array.from({ length: MAX_ITEMS }, (_, i) => ({ id: 'x' + i, title: 't', status: 'pending', level: 0 }));
|
||
await db.collection('twins').updateOne({ _id: twinId }, { $set: { zhengming: full } });
|
||
const r = await post(`/api/shishu/zhengming/${twinId}`, { title: '再来一条' });
|
||
assert.equal(r.status, 409, '到上限拒收');
|
||
});
|
||
|
||
test('撤回：只能撤没审的；审过的撤不动', async (t) => {
|
||
if (!mongoUp) return t.skip('无本地 MongoDB');
|
||
await resetZM();
|
||
const p = await (await post(`/api/shishu/zhengming/${twinId}`, { title: '待审的' })).json();
|
||
const v = await (await post(`/api/shishu/zhengming/${twinId}`, { title: '将审的' })).json();
|
||
await post(`/api/admin/zhengming/${twinId}/${v.id}/review`, { status: 'verified', level: 1 }, ADMIN);
|
||
// 撤待审的 → 掉
|
||
const d1 = await del(`/api/shishu/zhengming/${twinId}/${p.id}`);
|
||
assert.equal(d1.status, 200);
|
||
// 撤已审的 → 撤不动（仍在）
|
||
await del(`/api/shishu/zhengming/${twinId}/${v.id}`);
|
||
const twin = await db.collection('twins').findOne({ _id: twinId });
|
||
const ids = (twin.zhengming || []).map((z) => z.id);
|
||
assert.ok(!ids.includes(p.id), '待审的已撤走');
|
||
assert.ok(ids.includes(v.id), '已审的撤不动、留痕');
|
||
});
|
||
|
||
test('分身核验·查实就认(自动)：mock 查实→verified+level+by:ai；查否→rejected；不下结论→留 pending', async (t) => {
|
||
if (!mongoUp) return t.skip('无本地 MongoDB');
|
||
await resetZM();
|
||
// 递交三条（注意：路由里 submit 会 detach 触发真 llmVerify，但测试环境无 DASHSCOPE key → 留 pending，
|
||
// 不影响；这里用【注入 mock verifier】直接、确定性地测编排。）
|
||
const a = await (await post(`/api/shishu/zhengming/${twinId}`, { title: '查得到的顶尖奖' })).json();
|
||
const b = await (await post(`/api/shishu/zhengming/${twinId}`, { title: '查不到的' })).json();
|
||
const c = await (await post(`/api/shishu/zhengming/${twinId}`, { title: '一时查不准的' })).json();
|
||
|
||
// 查实 → verified + level + by:'ai'
|
||
await verifyZhengming(twinId, a.id, async () => ({ verified: true, level: 3, reason: '官网可查' }));
|
||
// 查否 → rejected
|
||
await verifyZhengming(twinId, b.id, async () => ({ verified: false, level: 0, reason: '同名不同人' }));
|
||
// 不下结论(null) → 保持 pending
|
||
await verifyZhengming(twinId, c.id, async () => null);
|
||
|
||
const twin = await db.collection('twins').findOne({ _id: twinId });
|
||
const byId = Object.fromEntries((twin.zhengming || []).map((z) => [z.id, z]));
|
||
assert.equal(byId[a.id].status, 'verified'); assert.equal(byId[a.id].level, 3); assert.equal(byId[a.id].by, 'ai');
|
||
assert.equal(byId[b.id].status, 'rejected'); assert.equal(byId[b.id].level, 0);
|
||
assert.equal(byId[c.id].status, 'pending', '不下结论 → 留 pending，等重核/人工兜底');
|
||
// 生效：已查实的 level 3 进 verifiedLevel
|
||
assert.equal(verifiedLevel(twin), 3);
|
||
|
||
// 幂等：对已 verified 的再核，不改（skipped）
|
||
const again = await verifyZhengming(twinId, a.id, async () => ({ verified: false, level: 0 }));
|
||
assert.ok(again.skipped, '已核过的不再动');
|
||
const twin2 = await db.collection('twins').findOne({ _id: twinId });
|
||
assert.equal(twin2.zhengming.find((z) => z.id === a.id).status, 'verified', '幂等：仍是 verified');
|
||
});
|
||
|
||
test('分身核验·reverify 路由：卡在 pending 的可再核一次(属主)', async (t) => {
|
||
if (!mongoUp) return t.skip('无本地 MongoDB');
|
||
await resetZM();
|
||
const rec = await (await post(`/api/shishu/zhengming/${twinId}`, { title: '再核测试' })).json();
|
||
// 无 DASHSCOPE key → 真 llmVerify 留 pending；reverify 路由应 200（走真核验，仍 pending）
|
||
const r = await post(`/api/shishu/zhengming/${twinId}/${rec.id}/reverify`, {});
|
||
assert.equal(r.status, 200);
|
||
// 别人的分身重核不了
|
||
const other = await post(`/api/shishu/zhengming/${twinId}/${rec.id}/reverify`, {}, OTHER);
|
||
assert.equal(other.status, 404);
|
||
});
|
||
|
||
test('审核台：列出待审 + 递交需标题 + note 上限', async (t) => {
|
||
if (!mongoUp) return t.skip('无本地 MongoDB');
|
||
await resetZM();
|
||
// 无标题 → 400
|
||
const noTitle = await post(`/api/shishu/zhengming/${twinId}`, { note: '只有说明' });
|
||
assert.equal(noTitle.status, 400);
|
||
// 递交一条 → 出现在超管待审台
|
||
await post(`/api/shishu/zhengming/${twinId}`, { title: '待审台可见' });
|
||
const pend = await (await get('/api/admin/zhengming/pending', ADMIN)).json();
|
||
assert.ok(pend.items.some((x) => x.twinId === twinId.toString() && x.title === '待审台可见'), '待审台列出这一条');
|
||
});
|