邻县外卖分站系统选型：商家查询与骑手派单的站点授权验证

// Local procurement example, Node.js built-ins only; no product implementation.
const assert = require('node:assert/strict');
const actor = {id:'admin-A', stations:new Set(['A'])};
const shops = [{id:'S1',station:'A'},{id:'S2',station:'B'}];
const riders = [{id:'R1',station:'A',version:1}];
function scopedList(user, station, rows) {
  if (!user.stations.has(station)) throw Error('FORBIDDEN');
  return rows.filter(x => x.station === station).map(x => ({...x}));
}
function assign(user, task, rider) {
  if (!user.stations.has(task.station)) throw Error('FORBIDDEN');
  if (task.station !== rider.station) throw Error('RIDER_STATION_MISMATCH');
  if (task.state !== 'WAITING') throw Error('TASK_NOT_WAITING');
  task.riderId = rider.id;
  task.riderVersion = rider.version;
  task.state = 'ASSIGNED';
  return {...task};
}
assert.deepEqual(scopedList(actor,'A',shops).map(x=>x.id),['S1']);
assert.throws(()=>scopedList(actor,'B',shops),/FORBIDDEN/);
assert.deepEqual(scopedList(actor,'A',riders).map(x=>x.id),['R1']);
const task={id:'T1',station:'A',state:'WAITING'};
assert.equal(assign(actor,task,riders[0]).riderVersion,1);
assert.throws(()=>assign(actor,task,riders[0]),/TASK_NOT_WAITING/);
const wrong={id:'T2',station:'B',state:'WAITING'};
assert.throws(()=>assign(actor,wrong,riders[0]),/FORBIDDEN/);
assert.throws(()=>assign({stations:new Set(['B'])},wrong,riders[0]),/RIDER_STATION_MISMATCH/);
assert.equal(wrong.state,'WAITING');
actor.stations.delete('A');
assert.throws(()=>scopedList(actor,'A',shops),/FORBIDDEN/);
console.log(JSON.stringify({assertions:9,visibleShop:'S1',assignedTask:task,deniedTask:wrong,revokedAccess:'FORBIDDEN'}));