feat(P15A-1,P15A-5): 解耦请假审批权限

server/src/plugins/auth.js

@@ -1,7 +1,11 @@
 const fastifyJwt = require("@fastify/jwt");
 const fp = require("fastify-plugin");
 const { AppError } = require("../utils/AppError");
-const { resolvePermissionsForRoles, hasPermission } = require("../constants/permissions");
+const {
+  resolvePermissionsForRoles,
+  hasPermission,
+  resolveEntityPermission,
+} = require("../constants/permissions");
 
 async function authPlugin(fastify) {
   const { jwtSecret, accessTokenTtl } = fastify.config;
@@ -26,18 +30,44 @@ async function authPlugin(fastify) {
     return hasPermission(employee?.permissionCodes ?? [], permissionCode);
   });
 
+  fastify.decorate("assertPermission", (employee, permissionCode, details = {}) => {
+    if (!permissionCode || !fastify.hasPermission(employee, permissionCode)) {
+      throw new AppError({
+        code: "PERM_001",
+        message: "无权限",
+        statusCode: 403,
+        details: { permission: permissionCode, ...details },
+      });
+    }
+
+    return permissionCode;
+  });
+
+  fastify.decorate("assertEntityPermission", (employee, entityType, action) => {
+    const permissionCode = resolveEntityPermission(entityType, action);
+    if (!permissionCode) {
+      throw new AppError({
+        code: "VALID_001",
+        message: "参数校验失败",
+        statusCode: 409,
+        details: { entityType, action, permission: "unsupported_entity_action" },
+      });
+    }
+
+    return fastify.assertPermission(employee, permissionCode, { entityType, action });
+  });
+
   fastify.decorate("requirePermission", (permissionCode) => {
     return async (request) => {
       await fastify.authenticate(request);
+      fastify.assertPermission(request.employee, permissionCode);
+    };
+  });
 
-      if (!fastify.hasPermission(request.employee, permissionCode)) {
-        throw new AppError({
-          code: "PERM_001",
-          message: "无权限",
-          statusCode: 403,
-          details: { permission: permissionCode },
-        });
-      }
+  fastify.decorate("requireEntityPermission", (entityType, action) => {
+    return async (request) => {
+      await fastify.authenticate(request);
+      fastify.assertEntityPermission(request.employee, entityType, action);
     };
   });