完成五人团队正式内用最小收口（07-18-small-team-internal-readiness）

server/tests/unit/constants/permissions.test.js

@@ -42,6 +42,40 @@ describe("Permission Constants", () => {
     expect(hrPermissions).toEqual(expect.arrayContaining(["leave.view_all", "leave.manage"]));
   });
 
+  it("keeps the OA system administrator separate from business and sensitive-data roles", () => {
+    const permissions = resolvePermissionsForRoles(["system_admin"]);
+
+    expect(permissions).toEqual(expect.arrayContaining([
+      "system.accounts.manage",
+      "system.roles.manage",
+      "system.settings",
+      "integration.manage",
+      "notification.channel.manage",
+      "system.audit.view",
+    ]));
+    expect(hasPermission(permissions, "expense.approve")).toBe(false);
+    expect(hasPermission(permissions, "expense.finance.pay")).toBe(false);
+    expect(hasPermission(permissions, "payment.batch.manage")).toBe(false);
+    expect(hasPermission(permissions, "payment.batch.review")).toBe(false);
+    expect(hasPermission(permissions, "payroll.manage")).toBe(false);
+    expect(hasPermission(permissions, "employee.bank.read")).toBe(false);
+    expect(hasPermission(permissions, "employee.bank.manage")).toBe(false);
+    expect(hasPermission(permissions, "employee.identity.manage")).toBe(false);
+    expect(hasPermission(permissions, "employee.contract.manage")).toBe(false);
+  });
+
+  it("assigns the new sensitive permissions only to their intended duties", () => {
+    expect(hasPermission(resolvePermissionsForRoles(["finance"]), "employee.bank.read")).toBe(true);
+    expect(hasPermission(resolvePermissionsForRoles(["finance"]), "employee.bank.manage")).toBe(false);
+    expect(hasPermission(resolvePermissionsForRoles(["finance"]), "payroll.manage")).toBe(true);
+    expect(hasPermission(resolvePermissionsForRoles(["finance_mgr"]), "payroll.manage")).toBe(true);
+    expect(hasPermission(resolvePermissionsForRoles(["hr"]), "employee.bank.manage")).toBe(true);
+    expect(hasPermission(resolvePermissionsForRoles(["hr"]), "employee.identity.manage")).toBe(true);
+    expect(hasPermission(resolvePermissionsForRoles(["hr"]), "employee.contract.manage")).toBe(true);
+    expect(hasPermission(resolvePermissionsForRoles(["manager"]), "payment.batch.review")).toBe(true);
+    expect(hasPermission(resolvePermissionsForRoles(["ceo"]), "payment.batch.review")).toBe(true);
+  });
+
   it("grants procurement permissions to configured roles", () => {
     expect(hasPermission(resolvePermissionsForRoles(["employee"]), "procurement.create")).toBe(true);
     expect(hasPermission(resolvePermissionsForRoles(["employee"]), "procurement.view_own")).toBe(true);