package com.ruoyi.app.mendian;

import com.ruoyi.system.utils.Auth;
import org.junit.jupiter.api.Test;
import org.springframework.web.bind.annotation.RequestHeader;

import java.lang.reflect.Method;
import java.util.Arrays;

import static org.junit.jupiter.api.Assertions.*;

/** 防止旧管理入口绕过登录；业务授权回归另覆盖伪造门店和记录 ID。 */
class MerchantBusinessEntryAccessTest {
    @Test
    void managementMethodsRequireAuthenticatedToken() {
        assertProtected(OperatingHoursController.class, "addHours", "setHours", "delHours");
        assertProtected(ShPosReviewController.class, "list", "getInfo", "edit", "remove");
        assertProtected(ShQuanyiController.class, "list", "getInfo", "add", "edit", "remove");
        assertProtected(ShSalesPromotionController.class, "list", "getInfo", "add", "edit", "remove");
        assertProtected(ShindexController.class, "getshindex");
    }

    private void assertProtected(Class<?> controller, String... names) {
        for (String name : names) {
            Method method = Arrays.stream(controller.getDeclaredMethods())
                    .filter(m -> m.getName().equals(name)).findFirst().orElseThrow();
            assertNotNull(method.getAnnotation(Auth.class), controller.getSimpleName() + "." + name);
            assertTrue(Arrays.stream(method.getParameters()).anyMatch(p ->
                    p.getType() == String.class && p.isAnnotationPresent(RequestHeader.class)), name);
        }
    }
}