fix(dispute): enforce participant checks and phase constraints

store/disputes.ts

@@ -1,6 +1,9 @@
 import { create } from "zustand"
 import { DISPUTE_TO_RESOLVED_MS, DISPUTE_TO_REVIEWING_MS } from "@/lib/config/demo-timers"
 import { generateId } from "@/lib/id"
+import { allow, deny } from "@/lib/policy/assert"
+import type { Actor } from "@/lib/policy/actor"
+import type { PolicyDecision } from "@/lib/policy/decision"
 import { mockDisputes } from "@/lib/mock"
 import type { Dispute } from "@/lib/types"
 import { useOrderStore } from "@/store/orders"
@@ -30,12 +33,22 @@ interface SubmitDisputeInput {
   evidence: string[]
 }
 
+interface DisputeMutationResult {
+  decision: PolicyDecision
+  dispute?: DisputeRecord
+}
+
 interface DisputeState {
   disputes: DisputeRecord[]
   getDisputeByOrderId: (orderId: string) => DisputeRecord | undefined
-  submitDispute: (input: SubmitDisputeInput) => DisputeRecord
-  submitResponse: (disputeId: string, reason: string, evidence: string[]) => void
-  submitAppeal: (disputeId: string, reason: string) => void
+  submitDispute: (input: SubmitDisputeInput) => DisputeMutationResult
+  submitResponse: (
+    disputeId: string,
+    actorId: string,
+    reason: string,
+    evidence: string[],
+  ) => PolicyDecision
+  submitAppeal: (disputeId: string, actorId: string, reason: string) => PolicyDecision
 }
 
 const progressTimers = new Map<string, ReturnType<typeof setTimeout>[]>()
@@ -49,6 +62,29 @@ function clearProgressTimers(disputeId: string) {
   progressTimers.delete(disputeId)
 }
 
+function resolveParticipantActor(orderId: string, userId: string): Actor | null {
+  const order = useOrderStore.getState().orders.find((item) => item.id === orderId)
+  if (!order) return null
+
+  if (order.consumerId === userId) {
+    return {
+      userId,
+      role: "consumer",
+      shopId: order.shopId,
+    }
+  }
+
+  if (order.playerId === userId) {
+    return {
+      userId,
+      role: "player",
+      shopId: order.shopId,
+    }
+  }
+
+  return null
+}
+
 function asRecord(dispute: Dispute): DisputeRecord {
   const timeline: DisputeTimelineItem[] = [
     {
@@ -143,6 +179,29 @@ export const useDisputeStore = create<DisputeState>((set, get) => {
     disputes: mockDisputes.map(asRecord),
     getDisputeByOrderId: (orderId) => get().disputes.find((dispute) => dispute.orderId === orderId),
     submitDispute: (input) => {
+      const order = useOrderStore.getState().orders.find((item) => item.id === input.orderId)
+      if (!order) {
+        return { decision: deny("NOT_FOUND", "订单不存在") }
+      }
+
+      if (order.status !== "in_progress" && order.status !== "pending_close") {
+        return { decision: deny("INVALID_STATUS", "当前阶段不可发起争议") }
+      }
+
+      if (!input.reason.trim()) {
+        return { decision: deny("VALIDATION_FAILED", "请填写争议原因") }
+      }
+
+      const actor = resolveParticipantActor(input.orderId, input.initiatorId)
+      if (!actor) {
+        return { decision: deny("NOT_PARTICIPANT", "仅订单参与方可发起争议") }
+      }
+
+      const markResult = useOrderStore.getState().markDisputed(input.orderId, actor)
+      if (!markResult.decision.ok) {
+        return { decision: markResult.decision }
+      }
+
       const createdAt = new Date().toISOString()
       const dispute: DisputeRecord = {
         id: generateId("disp"),
@@ -165,22 +224,46 @@ export const useDisputeStore = create<DisputeState>((set, get) => {
       }
 
       set((state) => ({ disputes: [dispute, ...state.disputes] }))
-      useOrderStore.getState().updateOrderStatus(input.orderId, "disputed")
       scheduleProgress(dispute.id)
-      return dispute
+      return { decision: allow(), dispute }
     },
-    submitResponse: (disputeId, reason, evidence) => {
-      if (!reason.trim()) return
+    submitResponse: (disputeId, actorId, reason, evidence) => {
+      const dispute = get().disputes.find((item) => item.id === disputeId)
+      if (!dispute) {
+        return deny("NOT_FOUND", "争议不存在")
+      }
+
+      const actor = resolveParticipantActor(dispute.orderId, actorId)
+      if (!actor) {
+        return deny("NOT_PARTICIPANT", "仅订单参与方可提交回应")
+      }
+
+      if (actorId === dispute.initiatorId) {
+        return deny("ROLE_FORBIDDEN", "争议发起方不可提交回应")
+      }
+
+      if (dispute.respondentReason) {
+        return deny("ALREADY_DONE", "回应已提交")
+      }
+
+      if (dispute.status !== "open" && dispute.status !== "reviewing") {
+        return deny("INVALID_STATUS", "当前状态不可提交回应")
+      }
+
+      if (!reason.trim()) {
+        return deny("VALIDATION_FAILED", "请填写回应理由")
+      }
+
       set((state) => ({
-        disputes: state.disputes.map((dispute) => {
-          if (dispute.id !== disputeId || dispute.respondentReason) return dispute
+        disputes: state.disputes.map((item) => {
+          if (item.id !== disputeId) return item
 
           return {
-            ...dispute,
+            ...item,
             respondentReason: reason.trim(),
             respondentEvidence: evidence,
             timeline: [
-              ...dispute.timeline,
+              ...item.timeline,
               {
                 id: generateId("timeline"),
                 type: "response",
@@ -191,22 +274,43 @@ export const useDisputeStore = create<DisputeState>((set, get) => {
           }
         }),
       }))
+
+      return allow()
     },
-    submitAppeal: (disputeId, reason) => {
-      if (!reason.trim()) return
+    submitAppeal: (disputeId, actorId, reason) => {
+      const dispute = get().disputes.find((item) => item.id === disputeId)
+      if (!dispute) {
+        return deny("NOT_FOUND", "争议不存在")
+      }
+
+      const actor = resolveParticipantActor(dispute.orderId, actorId)
+      if (!actor) {
+        return deny("NOT_PARTICIPANT", "仅订单参与方可提交申诉")
+      }
+
+      if (dispute.status !== "resolved") {
+        return deny("INVALID_STATUS", "当前状态不可申诉")
+      }
+
+      if (dispute.appealedAt) {
+        return deny("ALREADY_DONE", "该争议已申诉过")
+      }
+
+      if (!reason.trim()) {
+        return deny("VALIDATION_FAILED", "请填写申诉理由")
+      }
+
       set((state) => ({
-        disputes: state.disputes.map((dispute) => {
-          if (dispute.id !== disputeId || dispute.appealedAt || dispute.status !== "resolved") {
-            return dispute
-          }
+        disputes: state.disputes.map((item) => {
+          if (item.id !== disputeId) return item
 
           return {
-            ...dispute,
+            ...item,
             status: "appealed",
             appealReason: reason.trim(),
             appealedAt: new Date().toISOString(),
             timeline: [
-              ...dispute.timeline,
+              ...item.timeline,
               {
                 id: generateId("timeline"),
                 type: "appealed",
@@ -217,7 +321,9 @@ export const useDisputeStore = create<DisputeState>((set, get) => {
           }
         }),
       }))
+
       scheduleProgress(disputeId)
+      return allow()
     },
   }
 })