fix: 用专用权限收窄经理 AP 访问（09-07-manager-ap-access-scope）

server/tests/unit/routes/exports.apOperations.test.js

@@ -217,6 +217,21 @@ async function buildApp(options = {}) {
 }
 
 describe("ap operations export route", () => {
+  it.each(["manager", "ceo", "system_admin"])("does not grant AP export through ledger or reviewer access for %s", async (role) => {
+    const { resolvePermissionsForRoles } = require("../../../src/constants/permissions");
+    const { app, paymentBatchFindMany, auditCreate } = await buildApp({
+      actor: { id: ACTOR_ID, permissionCodes: resolvePermissionsForRoles([role]) },
+    });
+    try {
+      const response = await app.inject({ method: "POST", url: "/api/exports/ap-operations", payload: { format: "csv" } });
+      expect(response.statusCode).toBe(403);
+      expect(paymentBatchFindMany).not.toHaveBeenCalled();
+      expect(auditCreate).not.toHaveBeenCalled();
+    } finally {
+      await app.close();
+    }
+  });
+
   it("exports ap operations as csv with section blocks and filters", async () => {
     const {
       app,