《互联网产品的服务端架构·交易、增长与平台化》2.3 订单查询与用户可见性

if order.UserID == session.UserID || session.IsAdmin { allow }

if order.UserID == path.UserID { allow }

// file: internal/order/visibility.go
// tier: L1
// verify: go test ./internal/order/

package order

import "fmt"

// Viewer 描述一次查询的发起者。Admin 表示后台身份，可以查看任意订单，
// 但金额明细仍会被 Mask 裁剪。
type Viewer struct {
	UserID string
	Admin  bool
}

// Visible 判断查看者能否访问这张订单。
func Visible(o Order, v Viewer) error {
	if v.UserID == "" && !v.Admin {
		return fmt.Errorf("order: viewer must have a user id or admin flag")
	}
	if v.Admin || (o.UserID != "" && v.UserID == o.UserID) {
		return nil
	}
	return fmt.Errorf("order: user %q is not allowed to view order %q", v.UserID, o.ID)
}

// Mask 返回一个适合展示给 v 的订单副本。
//
// 本人看到完整订单；管理员和通过 Visible 检查的其他身份看到同样的
// 订单编号、用户、状态和商品结构，但每行金额被置零。函数不修改入参，
// 也不会让返回值与入参共享底层切片。
func Mask(o Order, v Viewer) (Order, error) {
	if err := Visible(o, v); err != nil {
		return Order{}, err
	}
	out := Order{
		ID:     o.ID,
		UserID: o.UserID,
		State:  o.State,
	}
	if len(o.Items) > 0 {
		out.Items = make([]Item, len(o.Items))
		copy(out.Items, o.Items)
	}
	if o.UserID == v.UserID {
		return out, nil
	}
	for i := range out.Items {
		out.Items[i].PriceCents = 0
	}
	return out, nil
}

// file: internal/order/visibility_test.go
// tier: L1
// verify: go test ./internal/order/

package order

import (
	"strings"
	"testing"
)

func sampleOrder() Order {
	return Order{
		ID:     "o-1",
		UserID: "u-1",
		Items: []Item{
			{SKU: "a", PriceCents: 1999, Qty: 2},
			{SKU: "b", PriceCents: 500, Qty: 1},
		},
		State: StatePaid,
	}
}

func TestVisibleAllowsOwnerAndAdmin(t *testing.T) {
	o := sampleOrder()
	if err := Visible(o, Viewer{UserID: "u-1"}); err != nil {
		t.Fatalf("owner rejected: %v", err)
	}
	if err := Visible(o, Viewer{UserID: "ops-9", Admin: true}); err != nil {
		t.Fatalf("admin rejected: %v", err)
	}
}

func TestVisibleRejectsStranger(t *testing.T) {
	err := Visible(sampleOrder(), Viewer{UserID: "u-2"})
	if err == nil {
		t.Fatal("want error for stranger")
	}
	if !strings.Contains(err.Error(), "not allowed") {
		t.Fatalf("error %q does not mention authorization", err)
	}
}

func TestVisibleRejectsAnonymous(t *testing.T) {
	if err := Visible(sampleOrder(), Viewer{}); err == nil {
		t.Fatal("want error for anonymous viewer")
	}
}

func TestMaskKeepsOwnerViewIntact(t *testing.T) {
	o := sampleOrder()
	got, err := Mask(o, Viewer{UserID: "u-1"})
	if err != nil {
		t.Fatal(err)
	}
	if len(got.Items) != len(o.Items) {
		t.Fatalf("items = %d, want %d", len(got.Items), len(o.Items))
	}
	for i := range o.Items {
		if got.Items[i] != o.Items[i] {
			t.Fatalf("item %d = %+v, want %+v", i, got.Items[i], o.Items[i])
		}
	}
}

func TestMaskHidesAmountsFromNonOwner(t *testing.T) {
	o := sampleOrder()
	got, err := Mask(o, Viewer{UserID: "ops-9", Admin: true})
	if err != nil {
		t.Fatal(err)
	}
	if got.State != StatePaid {
		t.Fatalf("state = %q, want kept", got.State)
	}
	if len(got.Items) != 2 {
		t.Fatalf("items = %d, want 2", len(got.Items))
	}
	for i, it := range got.Items {
		if it.PriceCents != 0 {
			t.Fatalf("item %d price = %d, want 0", i, it.PriceCents)
		}
		if it.SKU != o.Items[i].SKU || it.Qty != o.Items[i].Qty {
			t.Fatalf("item %d structure changed: %+v", i, it)
		}
	}
}

func TestMaskDoesNotMutateInput(t *testing.T) {
	o := sampleOrder()
	if _, err := Mask(o, Viewer{UserID: "ops-9", Admin: true}); err != nil {
		t.Fatal(err)
	}
	if o.Items[0].PriceCents != 1999 || o.Items[1].PriceCents != 500 {
		t.Fatalf("input mutated: %+v", o.Items)
	}
}

func TestMaskReturnsIndependentSlice(t *testing.T) {
	o := sampleOrder()
	got, err := Mask(o, Viewer{UserID: "u-1"})
	if err != nil {
		t.Fatal(err)
	}
	got.Items[0].PriceCents = 1
	if o.Items[0].PriceCents != 1999 {
		t.Fatalf("masked copy shares backing array with input")
	}
}

func TestMaskRejectsStranger(t *testing.T) {
	if _, err := Mask(sampleOrder(), Viewer{UserID: "u-2"}); err == nil {
		t.Fatal("want error for stranger")
	}
}

cd .local/checks/webapp-lab && go test ./internal/order/ -run 'TestVisible|TestMask' -count=1 -v

=== RUN   TestVisibleAllowsOwnerAndAdmin
--- PASS: TestVisibleAllowsOwnerAndAdmin (0.00s)
=== RUN   TestVisibleRejectsStranger
--- PASS: TestVisibleRejectsStranger (0.00s)
=== RUN   TestVisibleRejectsAnonymous
--- PASS: TestVisibleRejectsAnonymous (0.00s)
=== RUN   TestMaskKeepsOwnerViewIntact
--- PASS: TestMaskKeepsOwnerViewIntact (0.00s)
=== RUN   TestMaskHidesAmountsFromNonOwner
--- PASS: TestMaskHidesAmountsFromNonOwner (0.00s)
=== RUN   TestMaskDoesNotMutateInput
--- PASS: TestMaskDoesNotMutateInput (0.00s)
=== RUN   TestMaskReturnsIndependentSlice
--- PASS: TestMaskReturnsIndependentSlice (0.00s)
=== RUN   TestMaskRejectsStranger
--- PASS: TestMaskRejectsStranger (0.00s)
PASS
ok  	webapp/internal/order	0.361s