修复(08-28-reimbursement-detail-material-preview-fixes): 收紧撤回展示并校正材料图片尺寸

server/tests/unit/routes/reimbursements.withdraw.test.js

@@ -162,6 +162,7 @@ function buildPrisma({ processedTaskCount = 0 } = {}) {
 async function buildApp(options = {}) {
   const { prisma, tx, state } = buildPrisma(options);
   const permissionCodes = options.permissionCodes ?? ["expense.withdraw", "invoice.upload"];
+  const employeeId = options.employeeId ?? OWNER_ID;
   const app = Fastify();
 
   app.decorate("prisma", prisma);
@@ -178,7 +179,7 @@ async function buildApp(options = {}) {
       throw new AppError({ code: "AUTH_001", message: "未登录", statusCode: 401 });
     }
     request.employee = {
-      id: OWNER_ID,
+      id: employeeId,
       department_id: "dept-1",
       roleCodes: [],
       permissionCodes,
@@ -222,6 +223,28 @@ async function buildApp(options = {}) {
 }
 
 describe("POST /api/reimbursements/:id/withdraw invoice release", () => {
+  it("rejects a non-participant even when the employee has withdraw permission", async () => {
+    const { app, tx, state } = await buildApp({ employeeId: "77777777-7777-4777-8777-777777777777" });
+
+    const response = await app.inject({
+      method: "POST",
+      url: `/api/reimbursements/${REIMBURSEMENT_ID}/withdraw`,
+      headers: { authorization: "Bearer test" },
+      payload: { comment: "不应允许非参与人撤回" },
+    });
+
+    expect(response.statusCode).toBe(403);
+    expect(response.json().error).toMatchObject({
+      code: "PERM_001",
+      details: { withdraw: "only_owner_or_submitter" },
+    });
+    expect(tx.reimbursementForm.update).not.toHaveBeenCalled();
+    expect(tx.invoicePool.updateMany).not.toHaveBeenCalled();
+    expect(state.reimbursement.status).toBe("reviewing");
+
+    await app.close();
+  });
+
   it("releases bound invoice on withdraw and allows rebinding to the draft reimbursement", async () => {
     const { app, tx, state } = await buildApp();