fix(review): enforce pending-review submission and remove auto reply

store/reviews.ts

@@ -1,5 +1,7 @@
 import { create } from "zustand"
 import { generateId } from "@/lib/id"
+import { allow, deny } from "@/lib/policy/assert"
+import type { PolicyDecision } from "@/lib/policy/decision"
 import { mockReviews, mockUsers } from "@/lib/mock"
 import type { Review } from "@/lib/types"
 import { useOrderStore } from "@/store/orders"
@@ -13,13 +15,11 @@ interface SubmitReviewInput {
 
 interface ReviewState {
   reviews: Review[]
-  submitReview: (input: SubmitReviewInput) => void
+  submitReview: (input: SubmitReviewInput) => PolicyDecision
   getReviewsByOrder: (orderId: string) => Review[]
   hasUserReviewed: (orderId: string, userId: string) => boolean
 }
 
-const autoReplyTimers = new Map<string, ReturnType<typeof setTimeout>>()
-
 function resolveUser(userId: string) {
   return mockUsers.find((user) => user.id === userId)
 }
@@ -53,11 +53,32 @@ export const useReviewStore = create<ReviewState>((set, get) => ({
   hasUserReviewed: (orderId, userId) =>
     get().reviews.some((review) => review.orderId === orderId && review.fromUserId === userId),
   submitReview: (input) => {
+    if (!input.fromUserId) {
+      return deny("AUTH_REQUIRED", "请先登录")
+    }
+
+    if (!Number.isFinite(input.rating) || input.rating < 1 || input.rating > 5) {
+      return deny("VALIDATION_FAILED", "评分范围应为 1-5")
+    }
+
+    const order = useOrderStore.getState().orders.find((item) => item.id === input.orderId)
+    if (!order) {
+      return deny("NOT_FOUND", "订单不存在")
+    }
+
+    if (order.status !== "pending_review") {
+      return deny("INVALID_STATUS", "仅待评价订单可提交评价")
+    }
+
     const relation = resolveOrderUser(input.orderId, input.fromUserId)
-    if (!relation) return
+    if (!relation) {
+      return deny("NOT_PARTICIPANT", "仅订单参与方可评价")
+    }
 
     const exists = get().hasUserReviewed(input.orderId, input.fromUserId)
-    if (exists) return
+    if (exists) {
+      return deny("ALREADY_DONE", "该订单已提交过评价")
+    }
 
     const fromUser = resolveUser(input.fromUserId)
     const createdAt = new Date().toISOString()
@@ -79,37 +100,13 @@ export const useReviewStore = create<ReviewState>((set, get) => ({
 
     const orderReviews = get().getReviewsByOrder(input.orderId)
     if (orderReviews.length >= 2) {
-      const timer = autoReplyTimers.get(input.orderId)
-      if (timer) {
-        clearTimeout(timer)
-        autoReplyTimers.delete(input.orderId)
-      }
-
       set((state) => ({
         reviews: state.reviews.map((item) =>
           item.orderId === input.orderId ? { ...item, sealed: false } : item,
         ),
       }))
-      useOrderStore.getState().updateOrderStatus(input.orderId, "completed")
-      return
     }
 
-    if (autoReplyTimers.has(input.orderId)) return
-
-    const timer = setTimeout(() => {
-      autoReplyTimers.delete(input.orderId)
-      if (get().hasUserReviewed(input.orderId, relation.toUserId)) {
-        return
-      }
-
-      get().submitReview({
-        orderId: input.orderId,
-        fromUserId: relation.toUserId,
-        rating: 5,
-        content: `收到 ${relation.toUserName} 的评价，感谢本次对局。`,
-      })
-    }, 3000)
-
-    autoReplyTimers.set(input.orderId, timer)
+    return allow()
   },
 }))