test(mobile-oa-h5): expect presign detail actions to be order-level only

Co-authored-by: Cursor <cursoragent@cursor.com>

mobile-oa-h5/src/market/module-actions.test.js

@@ -148,7 +148,7 @@ test('presign order actions reject transfer-only backend action codes', () => {
   )
 })
 
-test('presign transfer actions accept only raw transfer authorization codes without mutation', () => {
+test('presign detail actions ignore nested transfer authorization codes', () => {
   const detail = {
     allowedActions: [],
     transfers: [{
@@ -168,16 +168,11 @@ test('presign transfer actions accept only raw transfer authorization codes with
 
   const actions = collectAllowedActions('presign', 'manager', detail)
 
-  assert.deepEqual(actions.map((item) => item.code), [
-    'edit-presign-transfer',
-    'delete-transfer',
-    'submit-transfer',
-    'withdraw-transfer'
-  ])
+  assert.deepEqual(actions, [])
   assert.deepEqual(detail, before)
 })
 
-test('collects only backend-authorized presign order and nested transfer actions', () => {
+test('collects only backend-authorized presign order-level detail actions', () => {
   const detail = {
     allowedActions: ['create', 'edit', 'convert', 'delete', 'withdraw-transfer', 'admin-only'],
     transferAllowedActions: ['create-transfer', 'admin-only'],
@@ -190,25 +185,13 @@ test('collects only backend-authorized presign order and nested transfer actions
   const before = structuredClone(detail)
   const actions = collectAllowedActions('presign', 'manager', detail)
 
-  assert.deepEqual(
-    actions.map((item) => [typeof item === 'string' ? item : item.code, item.transferId]),
-    [
-      ['edit-presign-transfer', 'draft'],
-      ['delete-transfer', 'draft'],
-      ['submit-transfer', 'draft'],
-      ['withdraw-transfer', 'pending'],
-      ['edit', undefined],
-      ['convert', undefined],
-      ['delete', undefined],
-      ['create-transfer', undefined]
-    ]
-  )
-  assert.equal(actions.some((item) => item.code === 'finance-confirm'), false)
-  assert.equal(actions.some((item) => item.code === 'admin-only'), false)
+  assert.deepEqual(actions, ['edit', 'convert', 'delete'])
+  assert.equal(actions.some((item) => (typeof item === 'string' ? item : item.code) === 'create-transfer'), false)
+  assert.equal(actions.some((item) => (typeof item === 'string' ? item : item.code) === 'submit-transfer'), false)
   assert.deepEqual(detail, before)
 })
 
-test('create transfer requires the dedicated backend authorization field', () => {
+test('presign detail actions never surface create-transfer', () => {
   assert.deepEqual(
     collectAllowedActions('presign', 'specialist', {
       allowedActions: ['edit', 'create-transfer'],
@@ -222,6 +205,6 @@ test('create transfer requires the dedicated backend authorization field', () =>
       transferAllowedActions: ['create-transfer'],
       transfers: []
     }),
-    ['create-transfer']
+    []
   )
 })