Scoreboard/server/internal/httpapi/display_command_test.go

package httpapi_test

import (
	"database/sql"
	"errors"
	"net/http"
	"strings"
	"testing"
	"time"

	"git.yeij.top/AskaEth/Scoreboard/server/internal/httpapi"
	"git.yeij.top/AskaEth/Scoreboard/server/internal/realtime"
)

// waitDisplayAudit 取最后一条 display.command 审计的 after_json。
// 审计中间件在响应写完之后才落库，所以这里给一小段重试窗口。
func waitDisplayAudit(t *testing.T, env *testEnv) string {
	t.Helper()
	for i := 0; i < 100; i++ {
		var after sql.NullString
		err := env.ev.QueryRow(
			`SELECT after_json FROM audit_logs WHERE action = 'display.command' ORDER BY id DESC LIMIT 1`).Scan(&after)
		switch {
		case err == nil:
			return after.String
		case errors.Is(err, sql.ErrNoRows):
			time.Sleep(10 * time.Millisecond)
		default:
			t.Fatalf("查询审计: %v", err)
		}
	}
	t.Fatal("等不到 display.command 的审计记录")
	return ""
}

// settingOrEmpty 读 settings 表里的点号键，缺行返回空串（没写过公告时就没有这一行）。
func settingOrEmpty(t *testing.T, env *testEnv, key string) string {
	t.Helper()
	var v sql.NullString
	err := env.ev.QueryRow(`SELECT value FROM settings WHERE key = ?`, key).Scan(&v)
	switch {
	case err == nil:
		return v.String
	case errors.Is(err, sql.ErrNoRows):
		return ""
	default:
		t.Fatalf("读取配置 %s: %v", key, err)
	}
	return ""
}

// newDisplayEnv 建一个带 recorder 客户端与指令桩的环境。
func newDisplayEnv(t *testing.T, sender *strictDisplaySender) (*testEnv, *http.Client) {
	t.Helper()
	env := newTestEnvWith(t, func(o *httpapi.Options) { o.Display = sender })
	env.createUser("recorder", "recorder-pass", "recorder")
	client, _ := env.client()
	env.login(client, "recorder", "recorder-pass")
	return env, client
}

// 带 targets 的指令只发给点名的实例，命中数与目标一并进审计。
func TestDisplayCommandTargetsInstances(t *testing.T) {
	sender := &strictDisplaySender{}
	env, client := newDisplayEnv(t, sender)

	status, env2 := env.do(client, http.MethodPost, "/api/display/command", map[string]any{
		"action":  "goto",
		"payload": map[string]any{"page": "medals"},
		"targets": []string{"screen-a", "screen-b"},
	}, true)
	if status != http.StatusOK || !env2.OK {
		t.Fatalf("定向下发应 200，得到 %d %+v", status, env2.Error)
	}
	if len(sender.targets) != 1 || len(sender.targets[0]) != 2 ||
		sender.targets[0][0] != "screen-a" || sender.targets[0][1] != "screen-b" {
		t.Fatalf("targets 应原样传给实时层，得到 %+v", sender.targets)
	}

	after := waitDisplayAudit(t, env)
	for _, want := range []string{`"action":"goto"`, `"targets":["screen-a","screen-b"]`, `"matched":2`} {
		if !strings.Contains(after, want) {
			t.Fatalf("审计应含 %s，得到 %s", want, after)
		}
	}
}

// 不带 targets = 广播：实时层收到空 targets，公告这条链路照旧。
func TestDisplayCommandBroadcastKeepsWorking(t *testing.T) {
	sender := &strictDisplaySender{}
	env, client := newDisplayEnv(t, sender)

	status, env2 := env.do(client, http.MethodPost, "/api/display/command", map[string]any{
		"action":  "announce",
		"payload": map[string]any{"text": "决赛推迟到 15:00", "seconds": 30},
	}, true)
	if status != http.StatusOK || !env2.OK {
		t.Fatalf("广播公告应 200，得到 %d %+v", status, env2.Error)
	}
	if len(sender.targets) != 1 || sender.targets[0] != nil {
		t.Fatalf("不带 targets 时应按广播下发（nil），得到 %+v", sender.targets)
	}
	if got := settingValue(t, env, "display.announce_text"); got != "决赛推迟到 15:00" {
		t.Fatalf("广播公告仍应落库，得到 %q", got)
	}
	if after := waitDisplayAudit(t, env); !strings.Contains(after, `"matched":1`) {
		t.Fatalf("广播也要记命中数，得到 %s", after)
	}
}

// 目标全部离线：返回可读的 404，且公告不落库、不产生新的 settings 变更。
func TestDisplayCommandOfflineTargetReturns404(t *testing.T) {
	matched := 0
	sender := &strictDisplaySender{matched: &matched}
	env, client := newDisplayEnv(t, sender)

	status, env2 := env.do(client, http.MethodPost, "/api/display/command", map[string]any{
		"action":  "announce",
		"payload": map[string]any{"text": "这条不该落库", "seconds": 30},
		"targets": []string{"gone-screen"},
	}, true)
	if status != http.StatusNotFound || env2.Error == nil {
		t.Fatalf("目标离线应 404，得到 %d %+v", status, env2.Error)
	}
	if env2.Error.Message != "目标大屏已离线，请刷新在线列表" {
		t.Fatalf("404 消息应为可读中文，得到 %q", env2.Error.Message)
	}
	if got := settingOrEmpty(t, env, "display.announce_text"); got != "" {
		t.Fatalf("没命中任何屏时公告不该落库，得到 %q", got)
	}
	// 定向失败的请求没有成功审计（审计只记 2xx）。
	var n int
	if err := env.ev.QueryRow(`SELECT COUNT(*) FROM audit_logs WHERE action = 'display.command'`).Scan(&n); err != nil {
		t.Fatalf("统计审计: %v", err)
	}
	if n != 0 {
		t.Fatalf("失败的指令不该留 display.command 审计，得到 %d 条", n)
	}
}

// GET /api/display/instances 要把屏号带出来，方便面板把本机显示器与在线实例对上。
func TestDisplayInstancesExposeScreen(t *testing.T) {
	fake := &fakeRealtime{}
	env := newTestEnvWith(t, func(o *httpapi.Options) { o.Realtime = fake })
	fake.db = env.ev
	env.createUser("recorder", "recorder-pass", "recorder")
	client, _ := env.client()
	env.login(client, "recorder", "recorder-pass")

	fake.instances = []realtime.Instance{
		{ID: "console-1", Online: true, Page: "standings", Screen: "2", RemoteAddr: "192.168.1.9:51000"},
		{ID: "lan-1", Online: true, Page: "medals"},
	}
	status, env2 := env.do(client, http.MethodGet, "/api/display/instances", nil, false)
	if status != http.StatusOK || !env2.OK {
		t.Fatalf("读取大屏实例应 200，得到 %d %+v", status, env2.Error)
	}
	rows := decodeData[[]map[string]any](t, env2)
	if len(rows) != 2 {
		t.Fatalf("应返回 2 个实例，得到 %+v", rows)
	}
	if rows[0]["screen"] != "2" || rows[1]["screen"] != "" {
		t.Fatalf("屏号字段应原样带出（无屏号为空串），得到 %+v", rows)
	}
	if rows[0]["page"] != "standings" || rows[1]["page"] != "medals" {
		t.Fatalf("当前页字段应原样带出，得到 %+v", rows)
	}
}

// 权限：指令与实例列表都要求 recorder 及以上，guest 一律拒绝。
func TestDisplayEndpointsRequireRecorder(t *testing.T) {
	sender := &strictDisplaySender{}
	env := newTestEnvWith(t, func(o *httpapi.Options) { o.Display = sender })
	guest, _ := env.client()

	if status, _ := env.do(guest, http.MethodPost, "/api/display/command",
		map[string]any{"action": "goto", "payload": map[string]any{"page": "medals"}}, false); status == http.StatusOK {
		t.Fatalf("guest 下发指令不该成功，得到 %d", status)
	}
	if status, _ := env.do(guest, http.MethodGet, "/api/display/instances", nil, false); status != http.StatusForbidden {
		t.Fatalf("guest 读实例列表应 403，得到 %d", status)
	}

	env, client := newDisplayEnv(t, sender)
	if status, env2 := env.do(client, http.MethodPost, "/api/display/command", map[string]any{
		"action": "goto", "payload": map[string]any{"page": "medals"},
	}, true); status != http.StatusOK {
		t.Fatalf("recorder 下发指令应 200，得到 %d %+v", status, env2.Error)
	}
	if status, env2 := env.do(client, http.MethodGet, "/api/display/instances", nil, false); status != http.StatusOK || !env2.OK {
		t.Fatalf("recorder 读实例列表应 200，得到 %d %+v", status, env2.Error)
	}
}

// 未知 action 仍要被实时层拒收（走 strictDisplaySender 的同口径校验），
// 但它是请求体入参不合法：按 400 报，现场才看得懂要改 action 而不是「服务端异常」。
func TestDisplayCommandRejectsUnknownAction(t *testing.T) {
	sender := &strictDisplaySender{}
	env, client := newDisplayEnv(t, sender)

	status, env2 := env.do(client, http.MethodPost, "/api/display/command",
		map[string]any{"action": "nope"}, true)
	if status != http.StatusBadRequest || env2.Error == nil {
		t.Fatalf("未知 action 应被拒收为 400，得到 %d %+v", status, env2.Error)
	}
	if env2.Error.Code != "VALIDATION_FAILED" {
		t.Fatalf("未知 action 的错误码应为 VALIDATION_FAILED，得到 %+v", env2.Error)
	}
	// message 保持实时层那句中文原文（现场要看懂），detail 带上原始 action（便于检索）。
	if !strings.Contains(env2.Error.Message, "未知的大屏指令") {
		t.Fatalf("message 应保持可读的中文原文，得到 %q", env2.Error.Message)
	}
	if got := string(env2.Error.Detail); got != `"nope"` {
		t.Fatalf("detail 应带上原始 action，得到 %s", got)
	}
	if len(sender.sent) != 0 {
		t.Fatalf("未知 action 不该下发，得到 %v", sender.sent)
	}
}