tenant: admin orders sort whitelist

backend/app/services/order_test.go

@@ -12,6 +12,7 @@ import (
 	"quyun/v2/app/commands/testx"
 	"quyun/v2/app/errorx"
 	"quyun/v2/app/http/tenant/dto"
+	"quyun/v2/app/requests"
 	"quyun/v2/database"
 	"quyun/v2/database/models"
 	"quyun/v2/pkg/consts"
@@ -590,6 +591,58 @@ func (s *OrderTestSuite) Test_AdminOrderPage() {
 			So(pager.Total, ShouldEqual, 1)
 		})
 
+		Convey("按排序字段（asc/desc）排序（白名单）", func() {
+			s.truncate(ctx, models.TableNameOrderItem, models.TableNameOrder)
+
+			o1 := &models.Order{
+				TenantID:   tenantID,
+				UserID:     2,
+				Type:       consts.OrderTypeContentPurchase,
+				Status:     consts.OrderStatusPaid,
+				Currency:   consts.CurrencyCNY,
+				AmountPaid: 500,
+				Snapshot:   types.JSON([]byte("{}")),
+				PaidAt:     now,
+				CreatedAt:  now.Add(-time.Hour),
+				UpdatedAt:  now.Add(-time.Hour),
+			}
+			So(o1.Create(ctx), ShouldBeNil)
+
+			o2 := &models.Order{
+				TenantID:   tenantID,
+				UserID:     3,
+				Type:       consts.OrderTypeContentPurchase,
+				Status:     consts.OrderStatusPaid,
+				Currency:   consts.CurrencyCNY,
+				AmountPaid: 100,
+				Snapshot:   types.JSON([]byte("{}")),
+				PaidAt:     now,
+				CreatedAt:  now,
+				UpdatedAt:  now,
+			}
+			So(o2.Create(ctx), ShouldBeNil)
+
+			asc := "amount_paid"
+			pagerAsc, err := Order.AdminOrderPage(ctx, tenantID, &dto.AdminOrderListFilter{
+				SortQueryFilter: requests.SortQueryFilter{Asc: &asc},
+			})
+			So(err, ShouldBeNil)
+			So(pagerAsc.Total, ShouldEqual, 2)
+			itemsAsc, ok := pagerAsc.Items.([]*models.Order)
+			So(ok, ShouldBeTrue)
+			So(itemsAsc[0].AmountPaid, ShouldEqual, 100)
+
+			desc := "created_at"
+			pagerDesc, err := Order.AdminOrderPage(ctx, tenantID, &dto.AdminOrderListFilter{
+				SortQueryFilter: requests.SortQueryFilter{Desc: &desc},
+			})
+			So(err, ShouldBeNil)
+			So(pagerDesc.Total, ShouldEqual, 2)
+			itemsDesc, ok := pagerDesc.Items.([]*models.Order)
+			So(ok, ShouldBeTrue)
+			So(itemsDesc[0].CreatedAt.After(itemsDesc[1].CreatedAt), ShouldBeTrue)
+		})
+
 		Convey("按 type 过滤", func() {
 			s.truncate(ctx, models.TableNameOrderItem, models.TableNameOrder)