From 1f2dc1434bbc7c0977e400ef5a2fbd0c1d66ee5d Mon Sep 17 00:00:00 2001
From: zetaloop <zetaloop@outlook.com>
Date: Sun, 22 Feb 2026 15:21:32 +0800
Subject: [PATCH] fix(dispute): enforce participant checks and phase
 constraints

---
 app/(order)/dispute/[id]/page.tsx |  45 ++++++++--
 store/disputes.ts                 | 144 ++++++++++++++++++++++++++----
 2 files changed, 164 insertions(+), 25 deletions(-)

diff --git a/app/(order)/dispute/[id]/page.tsx b/app/(order)/dispute/[id]/page.tsx
index 30a387d..455cf9f 100644
--- a/app/(order)/dispute/[id]/page.tsx
+++ b/app/(order)/dispute/[id]/page.tsx
@@ -17,6 +17,7 @@ import { Badge } from "@/components/ui/badge"
 import { Button } from "@/components/ui/button"
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card"
 import { DISPUTE_TO_RESOLVED_MS } from "@/lib/config/demo-timers"
+import { notifyInfo } from "@/lib/toast"
 import { Label } from "@/components/ui/label"
 import { Separator } from "@/components/ui/separator"
 import { Textarea } from "@/components/ui/textarea"
@@ -108,13 +109,17 @@ export default function DisputePage({ params }: { params: Promise<{ id: string }
 
   const handleSubmit = () => {
     if (!userId || !userName || !reason.trim()) return
-    submitDispute({
+    const result = submitDispute({
       orderId: id,
       initiatorId: userId,
       initiatorName: userName,
       reason,
       evidence: files,
     })
+    if (!result.decision.ok) {
+      notifyInfo(result.decision.message ?? "提交争议失败")
+      return
+    }
     router.replace(`/dispute/${id}?submitted=1`)
   }
 
@@ -128,13 +133,26 @@ export default function DisputePage({ params }: { params: Promise<{ id: string }
     )
   }
 
+  const isParticipant = Boolean(
+    userId && (order.consumerId === userId || order.playerId === userId),
+  )
+  if (!isParticipant) {
+    return (
+      <div className="container mx-auto py-8 px-4 max-w-lg text-center text-muted-foreground">
+        仅该订单参与方可访问争议页面
+      </div>
+    )
+  }
+
   if (existingDispute) {
     const isInitiator = userId === existingDispute.initiatorId
     const canRespond =
+      isParticipant &&
       !isInitiator &&
       !existingDispute.respondentReason &&
       (existingDispute.status === "open" || existingDispute.status === "reviewing")
-    const canAppeal = existingDispute.status === "resolved" && !existingDispute.appealedAt
+    const canAppeal =
+      isParticipant && existingDispute.status === "resolved" && !existingDispute.appealedAt
 
     return (
       <div className="container mx-auto py-8 px-4 max-w-2xl">
@@ -267,9 +285,18 @@ export default function DisputePage({ params }: { params: Promise<{ id: string }
                     </div>
                   )}
                   <Button
-                    onClick={() =>
-                      submitResponse(existingDispute.id, responseReason, responseFiles)
-                    }
+                    onClick={() => {
+                      if (!userId) return
+                      const decision = submitResponse(
+                        existingDispute.id,
+                        userId,
+                        responseReason,
+                        responseFiles,
+                      )
+                      if (!decision.ok) {
+                        notifyInfo(decision.message ?? "提交回应失败")
+                      }
+                    }}
                     disabled={!responseReason.trim()}
                   >
                     提交回应
@@ -308,7 +335,13 @@ export default function DisputePage({ params }: { params: Promise<{ id: string }
                   />
                   <Button
                     variant="outline"
-                    onClick={() => submitAppeal(existingDispute.id, appealReason)}
+                    onClick={() => {
+                      if (!userId) return
+                      const decision = submitAppeal(existingDispute.id, userId, appealReason)
+                      if (!decision.ok) {
+                        notifyInfo(decision.message ?? "提交申诉失败")
+                      }
+                    }}
                     disabled={!appealReason.trim()}
                   >
                     提交申诉
diff --git a/store/disputes.ts b/store/disputes.ts
index a239f55..5cdc3b0 100644
--- a/store/disputes.ts
+++ b/store/disputes.ts
@@ -1,6 +1,9 @@
 import { create } from "zustand"
 import { DISPUTE_TO_RESOLVED_MS, DISPUTE_TO_REVIEWING_MS } from "@/lib/config/demo-timers"
 import { generateId } from "@/lib/id"
+import { allow, deny } from "@/lib/policy/assert"
+import type { Actor } from "@/lib/policy/actor"
+import type { PolicyDecision } from "@/lib/policy/decision"
 import { mockDisputes } from "@/lib/mock"
 import type { Dispute } from "@/lib/types"
 import { useOrderStore } from "@/store/orders"
@@ -30,12 +33,22 @@ interface SubmitDisputeInput {
   evidence: string[]
 }
 
+interface DisputeMutationResult {
+  decision: PolicyDecision
+  dispute?: DisputeRecord
+}
+
 interface DisputeState {
   disputes: DisputeRecord[]
   getDisputeByOrderId: (orderId: string) => DisputeRecord | undefined
-  submitDispute: (input: SubmitDisputeInput) => DisputeRecord
-  submitResponse: (disputeId: string, reason: string, evidence: string[]) => void
-  submitAppeal: (disputeId: string, reason: string) => void
+  submitDispute: (input: SubmitDisputeInput) => DisputeMutationResult
+  submitResponse: (
+    disputeId: string,
+    actorId: string,
+    reason: string,
+    evidence: string[],
+  ) => PolicyDecision
+  submitAppeal: (disputeId: string, actorId: string, reason: string) => PolicyDecision
 }
 
 const progressTimers = new Map<string, ReturnType<typeof setTimeout>[]>()
@@ -49,6 +62,29 @@ function clearProgressTimers(disputeId: string) {
   progressTimers.delete(disputeId)
 }
 
+function resolveParticipantActor(orderId: string, userId: string): Actor | null {
+  const order = useOrderStore.getState().orders.find((item) => item.id === orderId)
+  if (!order) return null
+
+  if (order.consumerId === userId) {
+    return {
+      userId,
+      role: "consumer",
+      shopId: order.shopId,
+    }
+  }
+
+  if (order.playerId === userId) {
+    return {
+      userId,
+      role: "player",
+      shopId: order.shopId,
+    }
+  }
+
+  return null
+}
+
 function asRecord(dispute: Dispute): DisputeRecord {
   const timeline: DisputeTimelineItem[] = [
     {
@@ -143,6 +179,29 @@ export const useDisputeStore = create<DisputeState>((set, get) => {
     disputes: mockDisputes.map(asRecord),
     getDisputeByOrderId: (orderId) => get().disputes.find((dispute) => dispute.orderId === orderId),
     submitDispute: (input) => {
+      const order = useOrderStore.getState().orders.find((item) => item.id === input.orderId)
+      if (!order) {
+        return { decision: deny("NOT_FOUND", "订单不存在") }
+      }
+
+      if (order.status !== "in_progress" && order.status !== "pending_close") {
+        return { decision: deny("INVALID_STATUS", "当前阶段不可发起争议") }
+      }
+
+      if (!input.reason.trim()) {
+        return { decision: deny("VALIDATION_FAILED", "请填写争议原因") }
+      }
+
+      const actor = resolveParticipantActor(input.orderId, input.initiatorId)
+      if (!actor) {
+        return { decision: deny("NOT_PARTICIPANT", "仅订单参与方可发起争议") }
+      }
+
+      const markResult = useOrderStore.getState().markDisputed(input.orderId, actor)
+      if (!markResult.decision.ok) {
+        return { decision: markResult.decision }
+      }
+
       const createdAt = new Date().toISOString()
       const dispute: DisputeRecord = {
         id: generateId("disp"),
@@ -165,22 +224,46 @@ export const useDisputeStore = create<DisputeState>((set, get) => {
       }
 
       set((state) => ({ disputes: [dispute, ...state.disputes] }))
-      useOrderStore.getState().updateOrderStatus(input.orderId, "disputed")
       scheduleProgress(dispute.id)
-      return dispute
+      return { decision: allow(), dispute }
     },
-    submitResponse: (disputeId, reason, evidence) => {
-      if (!reason.trim()) return
+    submitResponse: (disputeId, actorId, reason, evidence) => {
+      const dispute = get().disputes.find((item) => item.id === disputeId)
+      if (!dispute) {
+        return deny("NOT_FOUND", "争议不存在")
+      }
+
+      const actor = resolveParticipantActor(dispute.orderId, actorId)
+      if (!actor) {
+        return deny("NOT_PARTICIPANT", "仅订单参与方可提交回应")
+      }
+
+      if (actorId === dispute.initiatorId) {
+        return deny("ROLE_FORBIDDEN", "争议发起方不可提交回应")
+      }
+
+      if (dispute.respondentReason) {
+        return deny("ALREADY_DONE", "回应已提交")
+      }
+
+      if (dispute.status !== "open" && dispute.status !== "reviewing") {
+        return deny("INVALID_STATUS", "当前状态不可提交回应")
+      }
+
+      if (!reason.trim()) {
+        return deny("VALIDATION_FAILED", "请填写回应理由")
+      }
+
       set((state) => ({
-        disputes: state.disputes.map((dispute) => {
-          if (dispute.id !== disputeId || dispute.respondentReason) return dispute
+        disputes: state.disputes.map((item) => {
+          if (item.id !== disputeId) return item
 
           return {
-            ...dispute,
+            ...item,
             respondentReason: reason.trim(),
             respondentEvidence: evidence,
             timeline: [
-              ...dispute.timeline,
+              ...item.timeline,
               {
                 id: generateId("timeline"),
                 type: "response",
@@ -191,22 +274,43 @@ export const useDisputeStore = create<DisputeState>((set, get) => {
           }
         }),
       }))
+
+      return allow()
     },
-    submitAppeal: (disputeId, reason) => {
-      if (!reason.trim()) return
+    submitAppeal: (disputeId, actorId, reason) => {
+      const dispute = get().disputes.find((item) => item.id === disputeId)
+      if (!dispute) {
+        return deny("NOT_FOUND", "争议不存在")
+      }
+
+      const actor = resolveParticipantActor(dispute.orderId, actorId)
+      if (!actor) {
+        return deny("NOT_PARTICIPANT", "仅订单参与方可提交申诉")
+      }
+
+      if (dispute.status !== "resolved") {
+        return deny("INVALID_STATUS", "当前状态不可申诉")
+      }
+
+      if (dispute.appealedAt) {
+        return deny("ALREADY_DONE", "该争议已申诉过")
+      }
+
+      if (!reason.trim()) {
+        return deny("VALIDATION_FAILED", "请填写申诉理由")
+      }
+
       set((state) => ({
-        disputes: state.disputes.map((dispute) => {
-          if (dispute.id !== disputeId || dispute.appealedAt || dispute.status !== "resolved") {
-            return dispute
-          }
+        disputes: state.disputes.map((item) => {
+          if (item.id !== disputeId) return item
 
           return {
-            ...dispute,
+            ...item,
             status: "appealed",
             appealReason: reason.trim(),
             appealedAt: new Date().toISOString(),
             timeline: [
-              ...dispute.timeline,
+              ...item.timeline,
               {
                 id: generateId("timeline"),
                 type: "appealed",
@@ -217,7 +321,9 @@ export const useDisputeStore = create<DisputeState>((set, get) => {
           }
         }),
       }))
+
       scheduleProgress(disputeId)
+      return allow()
     },
   }
 })