water/server/tests/water_finance_dashboard_test.php

<?php
/** Finance reconciliation regression; all fixtures and receipt effects roll back. */
require dirname(__DIR__).'/vendor/autoload.php';
\Dotenv\Dotenv::createUnsafeMutable(dirname(__DIR__))->load();
\support\App::loadAllConfig(['route']);
date_default_timezone_set('Asia/Shanghai');

use plugin\saiadmin\app\model\water\{WaterModel,WaterOrder,WaterEnterprise,WaterAccount,WaterSku,WaterLedger};
use plugin\saiadmin\app\service\{WaterBusiness,WaterFinanceDashboard};
use plugin\saiadmin\app\service\finance\FinanceFilters;
use plugin\saiadmin\app\controller\water\WaterController;
use plugin\saiadmin\exception\ApiException;

$checks=0;
function check(bool $ok,string $label): void { global $checks; $checks++; if (!$ok) throw new RuntimeException($label); }
function rejects(callable $fn,string $label): void { try {$fn();} catch (ApiException $e) {check(true,$label);return;} throw new RuntimeException($label); }
function workbook(string $bytes): array {
    $path=tempnam(sys_get_temp_dir(),'finance-test-');
    $reader=new \OpenSpout\Reader\XLSX\Reader();
    try {
        file_put_contents($path,$bytes); $reader->open($path); $rows=[];
        foreach ($reader->getSheetIterator() as $sheet) foreach ($sheet->getRowIterator() as $row) $rows[]=$row->toArray();
        return $rows;
    } finally { $reader->close(); unlink($path); }
}
function request(string $method,string $path,array $data=[]): \support\Request {
    $body=$method==='POST'?json_encode($data):'';
    return new \support\Request($method.' '.$path." HTTP/1.1\r\nHost: localhost\r\nContent-Type: application/json\r\nContent-Length: ".strlen($body)."\r\n\r\n".$body);
}
$now=new DateTimeImmutable('2026-09-17 12:00:00',new DateTimeZone('Asia/Shanghai'));
$finance=new WaterFinanceDashboard($now); $business=new WaterBusiness();
$tag='FIN-'.bin2hex(random_bytes(5));
$beforeOrders=WaterOrder::query()->count(); $beforeLedger=WaterLedger::query()->count();
$db=(new WaterOrder())->getConnection(); $db->beginTransaction();
try {
    $baseline=$finance->dashboard([]);
    $enterprise=$business->save('enterprise',['name'=>'=客户-'.$tag,'contact'=>'TEST','phone'=>'TEST','address'=>'测试，不实际配送'],1)['id'];
    $fixtures=[
        ['2026-08-31 23:59:59',100,'prev','standard'],
        ['2026-09-01 00:00:00',200,'first','standard'],
        ['2026-09-16 23:59:59',300,'yesterday','standard'],
        ['2026-09-17 00:00:00',400,'today','standard'],
        ['2026-09-17 12:00:00',500,'now','standard'],
        ['2026-09-17 12:00:01',600,'future','standard'],
        ['2026-09-18 00:00:00',700,'tomorrow','standard'],
        ['2026-09-10 00:00:00',800,'demo-ref','standard'],
        ['2026-09-10 00:00:00',900,'demo-package','测试套餐'],
        ['2004-02-29 23:59:59',12345,'leap','@SUM(1,1)'],
        ['2004-03-01 00:00:00',10000,'march','standard']
    ];
    $ids=[];
    foreach ($fixtures as [$at,$amount,$key,$package]) {
        $reference=($key==='demo-ref'?'TEST-':($key==='leap'?'+':'' )).$tag.'-'.$key;
        $ids[$key]=WaterOrder::query()->insertGetId(['enterprise_id'=>$enterprise,'package_id'=>0,'sku_id'=>0,
            'package_name'=>$package,'buckets'=>2,'amount_cents'=>$amount,'reference'=>$reference,'created_by'=>1,'created_at'=>$at]);
    }
    $query=['keyword'=>' '.$tag.' ','limit'=>2];
    $first=$finance->dashboard($query);
    $second=$finance->dashboard(array_replace($query,['page'=>2]));
    $third=$finance->dashboard(array_replace($query,['page'=>3]));
    check($first['list']['total']===6 && count($first['list']['data'])===2 && count($third['list']['data'])===2,'month, current time and pagination');
    $expected=[$ids['now'],$ids['today'],$ids['yesterday'],$ids['demo-package'],$ids['demo-ref'],$ids['first']];
    check(array_column(array_merge($first['list']['data'],$second['list']['data'],$third['list']['data']),'id')===$expected,'stable time and ID ordering');
    check($first['summary']===$second['summary'] && $first['trend']===$third['trend'],'pagination does not alter cards or trend');
    check($first['summary']['month_cents']-$baseline['summary']['month_cents']===3100,'month sum excludes past month and future');
    check($first['summary']['today_cents']-$baseline['summary']['today_cents']===900,'today includes midnight and exact current second');
    check($first['summary']['month_count']-$baseline['summary']['month_count']===6,'monthly count');
    check($first['summary']['today_count']-$baseline['summary']['today_count']===2,'today count');
    check($first['summary']['demo_cents']-$baseline['summary']['demo_cents']===1700,'both test markers counted once');
    check($first['summary']['demo_count']-$baseline['summary']['demo_count']===2,'demo count');
    check(count($first['trend'])===17 && $first['trend'][16]['day']==='2026-09-17','daily trend ends today');
    check(array_sum(array_column($first['trend'],'receipt_cents'))===$first['summary']['month_cents'],'trend reconciles with monthly cents');
    check(array_sum(array_column($first['trend'],'count'))===$first['summary']['month_count'],'trend reconciles with monthly count');
    $empty=$finance->dashboard(['keyword'=>$tag.'-missing']);
    check($empty['list']['total']===0 && $empty['summary']===$first['summary'],'keyword only affects details');
    check($finance->dashboard(['keyword'=>$tag.'-now'])['list']['total']===1,'reference search');
    check($finance->dashboard(['keyword'=>'=客户-'.$tag])['list']['total']===6,'enterprise search');
    check($finance->dashboard(['keyword'=>$tag,'page'=>10])['list']['data']===[],'out of range page is empty');
    $regular=$finance->dashboard(['keyword'=>$tag,'source'=>'regular']);
    $demo=$finance->dashboard(['keyword'=>$tag,'source'=>'demo']);
    check($regular['list']['total']===4 && $demo['list']['total']===2,'source partition');
    check($regular['summary']['demo_cents']===0 && $regular['summary']['demo_count']===0,'regular summary excludes demo');
    check($regular['summary']['month_cents']+$demo['summary']['month_cents']===$first['summary']['month_cents'],'source totals reconcile');
    check(count(array_filter($demo['list']['data'],fn($r)=>$r['is_demo']))===2,'test rows marked');
    foreach (['today_refund_cents','month_refund_cents','pending_withdrawal_cents','net_rate'] as $field) check($first['summary'][$field]===null,'unavailable '.$field.' is null');
    check($first['summary']['pending_commission_cents']===$baseline['summary']['pending_commission_cents'],'only recorded commissions are shown');
    check($first['capabilities']['commissions']===true && $first['capabilities']['withdrawals']===false && $first['withdrawals']===[],'commission accrual does not enable withdrawals');
    $leap=$finance->dashboard(['month'=>'2004-02','keyword'=>$tag]);
    check(count($leap['trend'])===29 && $leap['period']['end']==='2004-02-29','leap month full range');
    check($leap['list']['total']===1 && $leap['list']['data'][0]['amount_cents']===12345,'month final second included, next month excluded');
    check($leap['trend'][0]['receipt_cents']===0,'missing dates filled with zero');
    check($leap['summary']['today_cents']===$first['summary']['today_cents'],'today independent of selected month');
    check(count($finance->dashboard(['month'=>'2003-02'])['trend'])===28,'non-leap February');
    $timezone=new WaterFinanceDashboard(new DateTimeImmutable('2026-08-31 16:00:00',new DateTimeZone('UTC')));
    check($timezone->dashboard(['keyword'=>$tag])['period']['month']==='2026-09','Shanghai date conversion');
    $export=workbook($finance->export(['keyword'=>$tag,'page'=>3,'limit'=>1]));
    check(count($export)===7,'export ignores pagination');
    check(array_column(array_slice($export,1),0)===array_map(fn($id)=>'WS'.str_pad((string)$id,10,'0',STR_PAD_LEFT),$expected),'export matches full ordered list');
    check($export[1][2]==="'=客户-".$tag,'enterprise formula injection prevented');
    check($export[1][6]===5,'amount exported in yuan');
    $special=workbook($finance->export(['month'=>'2004-02','keyword'=>$tag]));
    check($special[1][3]==="'+".$tag.'-leap' && $special[1][4]==="'@SUM(1,1)",'reference and package formula injection prevented');
    check($special[1][6]===123.45,'fractional currency preserved');
    check(count(workbook($finance->export(['keyword'=>$tag.'-missing'])))===1,'empty export contains headers');
    check(count(workbook($finance->export(['keyword'=>$tag,'source'=>'demo'])))===3,'export source matches dashboard');
    $invalids=[['month'=>'2026-13'],['month'=>'2026-9'],['month'=>'1999-12'],['month'=>'2026-10'],['month'=>"20\0-01"],['month'=>[]],['source'=>'bad'],['keyword'=>[]],['keyword'=>str_repeat('字',121)],['page'=>0],['page'=>'1.5'],['limit'=>101],['limit'=>[]]];
    foreach ($invalids as $invalid) {
        rejects(fn()=>$finance->dashboard($invalid),'invalid dashboard filters rejected');
        rejects(fn()=>$finance->export($invalid),'invalid export filters rejected');
    }
    $reflection=new ReflectionClass(WaterController::class); $controller=$reflection->newInstanceWithoutConstructor();
    $reflection->getProperty('adminId')->setValue($controller,0);
    rejects(fn()=>$controller->financeDashboard(request('GET','/core/water/finance/dashboard')),'unauthorized dashboard');
    rejects(fn()=>$controller->financeExport(request('POST','/core/water/finance/export')),'unauthorized export');
    rejects(fn()=>$controller->save(request('POST','/core/water/finance',['action'=>'purchase']),'finance'),'unauthorized receipt');
    $reflection->getProperty('adminId')->setValue($controller,1);
    $response=$controller->financeExport(request('POST','/core/water/finance/export',['month'=>'2004-02','keyword'=>$tag]));
    check($response->getStatusCode()===200 && count(workbook($response->rawBody()))===2,'authorized JSON export controller');
    $sku=$business->save('sku',['name'=>$tag,'liters'=>18.9],1)['id'];
    $package=$business->save('package',['name'=>$tag,'sku_id'=>$sku,'buckets'=>5,'price_cents'=>12345],1)['id'];
    $receipt=['enterprise_id'=>$enterprise,'package_id'=>$package,'reference'=>$tag.'-receipt','action'=>'purchase'];
    $saved=json_decode($controller->save(request('POST','/core/water/finance',$receipt),'finance')->rawBody(),true);
    check(($saved['code']??0)===200,'receipt controller succeeds');
    check((int)WaterAccount::query()->where('enterprise_id',$enterprise)->where('sku_id',$sku)->value('entitlement')===5,'receipt credits entitlement');
    $replay=json_decode($controller->save(request('POST','/core/water/finance',$receipt),'finance')->rawBody(),true);
    check(($replay['data']['replayed']??false)===true,'receipt replay detected');
    check((int)WaterAccount::query()->where('enterprise_id',$enterprise)->where('sku_id',$sku)->value('entitlement')===5,'replay does not duplicate entitlement');
    check(WaterOrder::query()->where('reference',$receipt['reference'])->count()===1,'one receipt for one reference');
    check((int)WaterSku::query()->find($sku)->available===0,'receipt does not create inventory');
    rejects(fn()=>$business->purchase(array_replace($receipt,['enterprise_id'=>99999999]),1),'mismatched receipt rejected');
    $model=new ReflectionMethod(WaterFinanceDashboard::class,'excelText');
    foreach (["=1+1",'+1','-1','@SUM(A1)',"\t=1","\r=1","\n=1"] as $unsafe) check($model->invoke(null,$unsafe)==="'".$unsafe,'unsafe export prefix escaped');
    // Enforce the all-matching export cap with isolated, batched fixture rows.
    $template=['enterprise_id'=>$enterprise,'package_id'=>0,'sku_id'=>0,'package_name'=>$tag.'-cap','buckets'=>1,'amount_cents'=>1,'created_by'=>1,'created_at'=>'2005-01-01 00:00:00'];
    for ($offset=0;$offset<50001;$offset+=1000) {
        $batch=[];
        for ($i=$offset;$i<min($offset+1000,50001);$i++) $batch[]=array_replace($template,['reference'=>$tag.'-cap-'.$i]);
        WaterOrder::query()->insert($batch);
    }
    rejects(fn()=>$finance->export(['month'=>'2005-01','keyword'=>$tag.'-cap']),'over 50000 matching rows rejected');
} finally { $db->rollBack(); }
check(WaterOrder::query()->count()===$beforeOrders && WaterLedger::query()->count()===$beforeLedger,'all receipt and ledger fixtures rolled back');
check(!WaterEnterprise::query()->where('name','like','%'.$tag.'%')->exists(),'enterprise fixtures rolled back');

if (in_array('--http',$argv,true)) {
    $token=\Tinywan\Jwt\JwtToken::generateToken(['id'=>1,'username'=>'admin','plat'=>'saiadmin','type'=>'web','client'=>$tag,'access_exp'=>120,'refresh_exp'=>120])['access_token'];
    $live=function(string $method,string $path,array $data=[],bool $authenticated=true) use ($token) {
        $ch=curl_init('http://127.0.0.1:8787/core/water/finance/'.$path);
        $headers=['Content-Type: application/json']; if ($authenticated) $headers[]='Authorization: Bearer '.$token;
        curl_setopt_array($ch,[CURLOPT_RETURNTRANSFER=>true,CURLOPT_TIMEOUT=>20,CURLOPT_HTTPHEADER=>$headers]);
        if ($method==='POST') curl_setopt_array($ch,[CURLOPT_POST=>true,CURLOPT_POSTFIELDS=>json_encode($data)]);
        $raw=curl_exec($ch); $status=curl_getinfo($ch,CURLINFO_HTTP_CODE); $error=curl_error($ch); curl_close($ch);
        check($raw!==false,'HTTP transport '.$error); return [$status,(string)$raw];
    };
    [$status,$raw]=$live('GET','dashboard?limit=1'); $body=json_decode($raw,true);
    check($status===200 && ($body['code']??0)===200,'HTTP finance dashboard');
    check(count($body['data']['list']['data'])<=1 && $body['data']['summary']['month_refund_cents']===null,'HTTP contract');
    [$status,$raw]=$live('POST','export',['month'=>'2004-02']);
    check($status===200 && str_starts_with($raw,'PK') && count(workbook($raw))>=1,'HTTP workbook');
    [$status,$raw]=$live('GET','dashboard',[],false);
    check((json_decode($raw,true)['code']??0)!==200,'HTTP dashboard requires login');
    [$status,$raw]=$live('POST','export',[],false);
    check(!str_starts_with($raw,'PK') && (json_decode($raw,true)['code']??0)!==200,'HTTP export requires login');
    [$status,$raw]=$live('GET','dashboard?month=2026-13');
    check((json_decode($raw,true)['code']??0)!==200,'HTTP invalid month rejected');
}
echo "PASS: $checks finance checks; all fixtures rolled back.\n";