R40: 完成档案编辑扩展与员工导出

server/src/routes/employees.js

@@ -14,6 +14,7 @@ const PROFILE_PATCH_SCHEMA = z
     departmentId: UUID_SCHEMA.optional(),
     directManagerId: UUID_SCHEMA.nullable().optional(),
     title: z.string().trim().min(1).max(100).optional(),
+    hireDate: DATE_SCHEMA.nullable().optional(),
     probationEndDate: DATE_SCHEMA.nullable().optional(),
     lastWorkingDate: DATE_SCHEMA.nullable().optional(),
     workLocation: z.string().trim().max(100).nullable().optional(),
@@ -370,7 +371,11 @@ async function employeesRoutes(fastify) {
     const body = parseBody(PROFILE_PATCH_SCHEMA, request.body);
     const managerMode = canManageLifecycle(fastify, request);
     const selfEditableKeys = ["workLocation", "emergencyContactName", "emergencyContactPhone", "notes"];
-    if (!managerMode && request.employee.id === employeeId) {
+    if (!managerMode) {
+      if (request.employee.id !== employeeId) {
+        throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: "employee.profile.write" } });
+      }
+
       const invalidKeys = Object.keys(body).filter((key) => !selfEditableKeys.includes(key));
       if (invalidKeys.length) {
         throw buildValidationError({ body: `self_profile_fields_forbidden:${invalidKeys.join(",")}` }, 403);
@@ -384,6 +389,7 @@ async function employeesRoutes(fastify) {
         ...(body.departmentId !== undefined ? { department_id: body.departmentId } : {}),
         ...(body.directManagerId !== undefined ? { direct_manager_id: body.directManagerId } : {}),
         ...(body.title !== undefined ? { title: body.title } : {}),
+        ...(body.hireDate !== undefined ? { hire_date: body.hireDate ? new Date(`${body.hireDate}T00:00:00.000Z`) : null } : {}),
         ...(body.probationEndDate !== undefined ? { probation_end_date: body.probationEndDate ? new Date(`${body.probationEndDate}T00:00:00.000Z`) : null } : {}),
         ...(body.lastWorkingDate !== undefined ? { last_working_date: body.lastWorkingDate ? new Date(`${body.lastWorkingDate}T00:00:00.000Z`) : null } : {}),
         ...(body.workLocation !== undefined ? { work_location: body.workLocation ?? null } : {}),