fix: 用专用权限收窄经理 AP 访问（09-07-manager-ap-access-scope）

server/tests/unit/constants/permissions.test.js

@@ -5,6 +5,18 @@ const {
 } = require("../../../src/constants/permissions");
 
 describe("Permission Constants", () => {
+  it("separates full AP reading from payment review and preserves multi-role grants", () => {
+    for (const role of ["ceo", "finance", "finance_mgr"]) {
+      expect(hasPermission(resolvePermissionsForRoles([role]), "finance.ledger.view")).toBe(true);
+    }
+    for (const role of ["manager", "employee", "system_admin", "hr", "administration"]) {
+      expect(hasPermission(resolvePermissionsForRoles([role]), "finance.ledger.view")).toBe(false);
+    }
+    expect(hasPermission(resolvePermissionsForRoles(["manager", "finance"]), "finance.ledger.view")).toBe(true);
+    expect(hasPermission(resolvePermissionsForRoles(["manager"]), "payment.batch.review")).toBe(true);
+    expect(hasPermission(resolvePermissionsForRoles(["ceo"]), "payment.batch.manage")).toBe(false);
+  });
+
   it("grants leave self-service permissions to employee roles", () => {
     const employeePermissions = resolvePermissionsForRoles(["employee"]);
 

server/tests/unit/routes/apOperations.permissions.test.js

@@ -0,0 +1,97 @@
+const Fastify = require("fastify");
+const apOperationsRoutes = require("../../../src/routes/apOperations");
+const { hasPermission, resolvePermissionsForRoles } = require("../../../src/constants/permissions");
+
+const paths = [
+  "/api/ap-operations",
+  "/api/ap-operations/reimbursement-ledger",
+  "/api/ap-operations/reimbursement-ledger?page=2&pageSize=10&status=approved&invoiceStatus=none&dateFrom=2026-01-01&dateTo=2026-09-07&q=synthetic",
+];
+
+async function buildApp(permissionCodes, enabled = true) {
+  const app = Fastify();
+  const queries = [];
+  const prisma = {
+    featureFlag: {
+      findUnique: vi.fn().mockResolvedValue({
+        flag_key: "payment_batch_v1",
+        override_mode: enabled ? "force_on" : "force_off",
+        rollout_type: "global",
+        department_ids: [],
+      }),
+    },
+  };
+  for (const model of ["paymentBatch", "paymentBatchItem", "entityRiskFlag", "travelReconciliationItem", "reimbursementForm"]) {
+    prisma[model] = {
+      findMany: vi.fn().mockResolvedValue([]),
+      count: vi.fn().mockResolvedValue(0),
+    };
+    queries.push(...Object.values(prisma[model]));
+  }
+  app.decorate("config", { paymentBatchEnabled: true });
+  app.decorate("prisma", prisma);
+  app.decorate("authenticate", async (request) => {
+    request.employee = { id: "synthetic-actor", permissionCodes };
+  });
+  app.decorate("hasPermission", (employee, permission) => hasPermission(employee.permissionCodes, permission));
+  app.setErrorHandler((error, request, reply) => {
+    reply.code(error.statusCode ?? 500).send({ error: { code: error.code } });
+  });
+  await app.register(apOperationsRoutes, { prefix: "/api" });
+  return { app, queries };
+}
+
+describe("AP full-ledger permission boundary", () => {
+  it.each([
+    ["employee", false], ["manager", false], ["system_admin", false],
+    ["ceo", true], ["finance", true], ["finance_mgr", true], ["admin", true],
+  ])("checks both reads for %s", async (role, allowed) => {
+    const { app, queries } = await buildApp(resolvePermissionsForRoles([role]));
+    try {
+      for (const url of paths) {
+        const response = await app.inject({ method: "GET", url });
+        expect(response.statusCode).toBe(allowed ? 200 : 403);
+        if (!allowed) {
+          expect(response.json()).toEqual({ error: { code: "PERM_001" } });
+          for (const query of queries) expect(query).not.toHaveBeenCalled();
+        }
+      }
+      if (allowed) expect(queries.some((query) => query.mock.calls.length > 0)).toBe(true);
+    } finally {
+      await app.close();
+    }
+  });
+
+  it.each(["payment.batch.manage", "payment.batch.review", "risk.review.manage", "expense.finance.pay"])(
+    "does not infer ledger reading from %s", async (permission) => {
+      const { app, queries } = await buildApp([permission]);
+      try {
+        for (const url of paths) expect((await app.inject({ method: "GET", url })).statusCode).toBe(403);
+        for (const query of queries) expect(query).not.toHaveBeenCalled();
+      } finally {
+        await app.close();
+      }
+    },
+  );
+
+  it.each([["finance.ledger.view"], resolvePermissionsForRoles(["manager", "finance"])].map((permissions) => [permissions]))(
+    "honors explicit or combined-role ledger authority %j", async (permissions) => {
+      const { app } = await buildApp(permissions);
+      try {
+        for (const url of paths) expect((await app.inject({ method: "GET", url })).statusCode).toBe(200);
+      } finally {
+        await app.close();
+      }
+    },
+  );
+
+  it("preserves feature-off refusal without querying financial data", async () => {
+    const { app, queries } = await buildApp(["finance.ledger.view"], false);
+    try {
+      for (const url of paths) expect((await app.inject({ method: "GET", url })).statusCode).toBe(409);
+      for (const query of queries) expect(query).not.toHaveBeenCalled();
+    } finally {
+      await app.close();
+    }
+  });
+});

server/tests/unit/routes/exports.apOperations.test.js

@@ -217,6 +217,21 @@ async function buildApp(options = {}) {
 }
 
 describe("ap operations export route", () => {
+  it.each(["manager", "ceo", "system_admin"])("does not grant AP export through ledger or reviewer access for %s", async (role) => {
+    const { resolvePermissionsForRoles } = require("../../../src/constants/permissions");
+    const { app, paymentBatchFindMany, auditCreate } = await buildApp({
+      actor: { id: ACTOR_ID, permissionCodes: resolvePermissionsForRoles([role]) },
+    });
+    try {
+      const response = await app.inject({ method: "POST", url: "/api/exports/ap-operations", payload: { format: "csv" } });
+      expect(response.statusCode).toBe(403);
+      expect(paymentBatchFindMany).not.toHaveBeenCalled();
+      expect(auditCreate).not.toHaveBeenCalled();
+    } finally {
+      await app.close();
+    }
+  });
+
   it("exports ap operations as csv with section blocks and filters", async () => {
     const {
       app,

server/tests/unit/workspaceSettings.navigation.test.js

@@ -55,6 +55,19 @@ function buildConfig() {
 }
 
 describe("workspace small-team navigation defaults", () => {
+  it.each(["manager", "ceo", "finance", "finance_mgr", "system_admin"])("projects AP separately from payment navigation for %s", async (role) => {
+    const employee = { id: "synthetic-actor", roleCodes: [role], permissionCodes: resolvePermissionsForRoles([role]) };
+    const navigation = await getSystemNavigation({
+      prisma: buildPrisma(["payment_batch_v1"]),
+      config: { ...buildConfig(), paymentBatchEnabled: true },
+      employee,
+      hasPermission: (candidate, permission) => hasPermission(candidate.permissionCodes, permission),
+    });
+    const keys = Object.values(navigation.sections).flat().map((item) => item.key);
+    expect(keys.includes("apOperations")).toBe(["ceo", "finance", "finance_mgr"].includes(role));
+    if (role === "manager") expect(keys).toContain("paymentBatches");
+  });
+
   it("keeps only the small-team task path in default main navigation", () => {
     const mainModules = Object.entries(DEFAULT_MODULE_VISIBILITY)
       .filter(([, placement]) => placement === "main")
@@ -224,7 +237,7 @@ describe("workspace small-team navigation defaults", () => {
 
     const mainLabels = navigation.sections.main.map((item) => item.label);
     expect(mainLabels).toContain("付款");
-    expect(mainLabels).toContain("应付账款");
+    expect(mainLabels).not.toContain("应付账款");
     expect(mainLabels).not.toContain("票据");
   });
 });