richard/mp-pilates
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(booking): 允许管理员/老师通过同一接口取消任意预约

Browse Source 
将 cancelBooking 改为接收 actor（{ id, isAdmin }），服务端按 JWT role
分流：普通成员仅能取消自己的预约，管理员跳过 owner check。
history 备注自动按 actor 选择「学员/管理员」前缀，审计可追溯。

客户端无感，仍调 PUT /booking/:id/cancel，前端零改动。

Co-Authored-By: Claude Code <noreply@anthropic.com>
This commit is contained in:
richarjiang
2026-09-09 19:50:41 +08:00
parent d941f1b6a9
commit 22407a7ff9
3 changed files with 110 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

104
packages/server/src/booking/__tests__/booking.service.spec.ts
View File

@@ -20,6 +20,10 @@ const MOCK_SLOT_ID = 'slot-001'
const MOCK_MEMBERSHIP_ID = 'mem-001'
const MOCK_BOOKING_ID = 'booking-001'
const MEMBER_ACTOR = { id: MOCK_USER_ID, isAdmin: false }
const MOCK_ADMIN_ID = 'admin-001'
const ADMIN_ACTOR = { id: MOCK_ADMIN_ID, isAdmin: true }
const mockTimesCardType = {
id: 'ct-times-001',
name: '10次卡',
@@ -762,7 +766,7 @@ describe('BookingService', () => {
;(prisma.$transaction as jest.Mock).mockImplementation((fn) => fn(tx))
const result = await service.cancelBooking(MOCK_USER_ID, MOCK_BOOKING_ID)
const result = await service.cancelBooking(MEMBER_ACTOR, MOCK_BOOKING_ID)
expect(tx.booking.update).toHaveBeenCalledWith(
expect.objectContaining({
@@ -813,7 +817,7 @@ describe('BookingService', () => {
})
;(prisma.$transaction as jest.Mock).mockImplementation((fn) => fn(tx))
const result = await service.cancelBooking(MOCK_USER_ID, MOCK_BOOKING_ID)
const result = await service.cancelBooking(MEMBER_ACTOR, MOCK_BOOKING_ID)
expect(tx.membership.update).toHaveBeenCalledWith(
expect.objectContaining({
@@ -846,7 +850,7 @@ describe('BookingService', () => {
tx.timeSlot.update.mockResolvedValue({ ...futureSlot, bookedCount: 0 })
;(prisma.$transaction as jest.Mock).mockImplementation((fn) => fn(tx))
const result = await service.cancelBooking(MOCK_USER_ID, MOCK_BOOKING_ID)
const result = await service.cancelBooking(MEMBER_ACTOR, MOCK_BOOKING_ID)
expect(tx.membership.update).not.toHaveBeenCalled()
expect(result.refunded).toBe(false)
@@ -875,7 +879,7 @@ describe('BookingService', () => {
tx.timeSlot.update.mockResolvedValue({ ...futureSlot, bookedCount: 0 })
;(prisma.$transaction as jest.Mock).mockImplementation((fn) => fn(tx))
const result = await service.cancelBooking(MOCK_USER_ID, MOCK_BOOKING_ID)
const result = await service.cancelBooking(MEMBER_ACTOR, MOCK_BOOKING_ID)
expect(tx.membership.update).not.toHaveBeenCalled()
expect(result.refunded).toBe(false)
@@ -897,7 +901,7 @@ describe('BookingService', () => {
;(prisma.$transaction as jest.Mock).mockImplementation((fn) => fn(tx))
const result = await service.cancelBooking(MOCK_USER_ID, MOCK_BOOKING_ID)
const result = await service.cancelBooking(MEMBER_ACTOR, MOCK_BOOKING_ID)
expect(result.refunded).toBe(false)
// membership.update must NOT be called
@@ -920,7 +924,7 @@ describe('BookingService', () => {
;(prisma.$transaction as jest.Mock).mockImplementation((fn) => fn(tx))
await service.cancelBooking(MOCK_USER_ID, MOCK_BOOKING_ID)
await service.cancelBooking(MEMBER_ACTOR, MOCK_BOOKING_ID)
// slot was FULL → should be restored to OPEN
expect(tx.timeSlot.update).toHaveBeenCalledWith(
@@ -955,7 +959,7 @@ describe('BookingService', () => {
;(prisma.$transaction as jest.Mock).mockImplementation((fn) => fn(tx))
const result = await service.cancelBooking(MOCK_USER_ID, MOCK_BOOKING_ID)
const result = await service.cancelBooking(MEMBER_ACTOR, MOCK_BOOKING_ID)
expect(tx.membership.update).toHaveBeenCalledWith(
expect.objectContaining({
@@ -971,7 +975,7 @@ describe('BookingService', () => {
it('throws NotFoundException when booking does not exist', async () => {
;(prisma.booking.findUnique as jest.Mock).mockResolvedValue(null)
await expect(service.cancelBooking(MOCK_USER_ID, 'nonexistent')).rejects.toThrow(
await expect(service.cancelBooking(MEMBER_ACTOR, 'nonexistent')).rejects.toThrow(
NotFoundException,
)
})
@@ -980,7 +984,7 @@ describe('BookingService', () => {
const otherBooking = { ...mockConfirmedBooking, userId: 'other-user', timeSlot: futureSlot, membership: mockActiveMembership }
;(prisma.booking.findUnique as jest.Mock).mockResolvedValue(otherBooking)
await expect(service.cancelBooking(MOCK_USER_ID, MOCK_BOOKING_ID)).rejects.toThrow(
await expect(service.cancelBooking(MEMBER_ACTOR, MOCK_BOOKING_ID)).rejects.toThrow(
ForbiddenException,
)
})
@@ -994,10 +998,90 @@ describe('BookingService', () => {
}
;(prisma.booking.findUnique as jest.Mock).mockResolvedValue(cancelledBooking)
await expect(service.cancelBooking(MOCK_USER_ID, MOCK_BOOKING_ID)).rejects.toThrow(
await expect(service.cancelBooking(MEMBER_ACTOR, MOCK_BOOKING_ID)).rejects.toThrow(
BadRequestException,
)
})
// ─── Admin actor branch ─────────────────────────────────────────────────
it('admin actor can cancel another user\'s booking (skips owner check)', async () => {
const otherUserBooking = {
...mockConfirmedBooking,
userId: 'other-user',
timeSlot: { ...futureSlot, bookedCount: 1 },
membership: mockActiveMembership,
}
;(prisma.booking.findUnique as jest.Mock).mockResolvedValue(otherUserBooking)
const tx = buildTxMock()
tx.booking.update.mockResolvedValue({ ...otherUserBooking, status: BookingStatus.CANCELLED, cancelledAt: new Date() })
tx.timeSlot.update.mockResolvedValue({ ...futureSlot, bookedCount: 0 })
tx.membership.update.mockResolvedValue({ ...mockActiveMembership, remainingTimes: 6 })
;(prisma.$transaction as jest.Mock).mockImplementation((fn) => fn(tx))
const result = await service.cancelBooking(ADMIN_ACTOR, MOCK_BOOKING_ID)
expect(result.refunded).toBe(true)
expect(tx.booking.update).toHaveBeenCalledWith(
expect.objectContaining({
data: expect.objectContaining({ status: BookingStatus.CANCELLED }),
}),
)
})
it('admin actor records 管理员 remark in bookingStatusHistory', async () => {
const otherUserBooking = {
...mockConfirmedBooking,
userId: 'other-user',
timeSlot: { ...futureSlot, bookedCount: 1 },
membership: mockActiveMembership,
}
;(prisma.booking.findUnique as jest.Mock).mockResolvedValue(otherUserBooking)
const tx = buildTxMock()
tx.booking.update.mockResolvedValue({ ...otherUserBooking, status: BookingStatus.CANCELLED, cancelledAt: new Date() })
tx.timeSlot.update.mockResolvedValue({ ...futureSlot, bookedCount: 0 })
tx.membership.update.mockResolvedValue({ ...mockActiveMembership, remainingTimes: 6 })
;(prisma.$transaction as jest.Mock).mockImplementation((fn) => fn(tx))
await service.cancelBooking(ADMIN_ACTOR, MOCK_BOOKING_ID)
expect(tx.bookingStatusHistory.create).toHaveBeenCalledWith(
expect.objectContaining({
data: expect.objectContaining({
operatorId: MOCK_ADMIN_ID,
remark: '管理员取消预约（超时退款）',
}),
}),
)
})
it('member actor records 学员 remark when cancelling own booking', async () => {
const ownBooking = {
...mockConfirmedBooking,
timeSlot: { ...futureSlot, bookedCount: 1 },
membership: mockActiveMembership,
}
;(prisma.booking.findUnique as jest.Mock).mockResolvedValue(ownBooking)
const tx = buildTxMock()
tx.booking.update.mockResolvedValue({ ...ownBooking, status: BookingStatus.CANCELLED, cancelledAt: new Date() })
tx.timeSlot.update.mockResolvedValue({ ...futureSlot, bookedCount: 0 })
tx.membership.update.mockResolvedValue({ ...mockActiveMembership, remainingTimes: 6 })
;(prisma.$transaction as jest.Mock).mockImplementation((fn) => fn(tx))
await service.cancelBooking(MEMBER_ACTOR, MOCK_BOOKING_ID)
expect(tx.bookingStatusHistory.create).toHaveBeenCalledWith(
expect.objectContaining({
data: expect.objectContaining({
operatorId: MOCK_USER_ID,
remark: '学员取消预约（超时退款）',
}),
}),
)
})
})
// ─── getMyBookings ────────────────────────────────────────────────────────

8
packages/server/src/booking/booking.controller.ts
View File

@@ -14,6 +14,7 @@ import { JwtAuthGuard } from '../auth/jwt-auth.guard'
import { RolesGuard } from '../auth/roles.guard'
import { Roles } from '../auth/roles.decorator'
import { CurrentUser } from '../common/decorators/current-user.decorator'
import { AuthenticatedUser } from '../auth/jwt.strategy'
import { BookingService } from './booking.service'
import { CreateBookingDto } from './dto/create-booking.dto'
import { AdminArrangeBookingDto } from './dto/admin-arrange-booking.dto'
@@ -36,10 +37,13 @@ export class BookingController {
@Put('booking/:id/cancel')
@UseGuards(JwtAuthGuard)
async cancelBooking(
@CurrentUser('sub') userId: string,
@CurrentUser() user: AuthenticatedUser,
@Param('id') id: string,
) {
return this.bookingService.cancelBooking(userId, id)
return this.bookingService.cancelBooking(
{ id: user.sub, isAdmin: user.role === UserRole.ADMIN },
id,
)
}
@Get('booking/my/activity')

17
packages/server/src/booking/booking.service.ts
View File

@@ -487,7 +487,7 @@ export class BookingService {
// ─── Cancel Booking ──────────────────────────────────────────────────────
async cancelBooking(
userId: string,
actor: { id: string; isAdmin: boolean },
bookingId: string,
): Promise<CancelBookingResult> {
const booking = await this.prisma.booking.findUnique({
@@ -495,17 +495,18 @@ export class BookingService {
include: {
timeSlot: true,
membership: { include: { cardType: true } },
review: { select: { rating: true } },
},
})
if (!booking) {
throw new NotFoundException(`Booking ${bookingId} not found`)
}
if (booking.userId !== userId) {
// Members can only cancel their own bookings; admins can cancel any.
if (!actor.isAdmin && booking.userId !== actor.id) {
throw new ForbiddenException('This booking does not belong to you')
}
const actorLabel = actor.isAdmin ? '管理员' : '学员'
let refunded = false
// PENDING_CONFIRMATION: can cancel directly, no refund needed (times never deducted)
@@ -521,8 +522,8 @@ export class BookingService {
bookingId,
fromStatus: BookingStatus.PENDING_CONFIRMATION,
toStatus: BookingStatus.CANCELLED,
operatorId: userId,
remark: '学员取消预约（待确认状态）',
operatorId: actor.id,
remark: `${actorLabel}取消预约（待确认状态）`,
},
})
})
@@ -602,8 +603,10 @@ export class BookingService {
bookingId,
fromStatus: BookingStatus.CONFIRMED,
toStatus: BookingStatus.CANCELLED,
operatorId: userId,
remark: refunded ? '学员取消预约（超时退款）' : '学员取消预约（未超时不退款）',
operatorId: actor.id,
remark: refunded
? `${actorLabel}取消预约（超时退款）`
: `${actorLabel}取消预约（未超时不退款）`,
},
})