完成五人团队正式内用最小收口（07-18-small-team-internal-readiness）

2026-07-18 15:46:14 +08:00
@@ -6,10 +6,18 @@ const { AppError } = require("../../../src/utils/AppError");
 const ACTOR_ID = "11111111-1111-4111-8111-111111111111";
 const DEPARTMENT_ID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
 const USER_ID = "22222222-2222-4222-8222-222222222222";
+const MANAGER_ID = "33333333-3333-4333-8333-333333333333";

 async function buildApp({
  createdEmployeeNo = "HYD000001",
  currentEmployee = null,
+  actor = {
+    id: ACTOR_ID,
+    department_id: DEPARTMENT_ID,
+    roleCodes: ["system_admin"],
+    permissionCodes: ["system.accounts.manage", "system.roles.manage"],
+  },
+  currentRoles = ["employee"],
 } = {}) {
  const app = Fastify();

@@ -56,11 +64,25 @@ async function buildApp({
    );
  const employeeUpdate = vi.fn();
  const employeeRoleCreateMany = vi.fn().mockResolvedValue({ count: 1 });
-  const employeeRoleFindMany = vi.fn().mockResolvedValue([{ role_code: "employee" }]);
+  const employeeRoleFindMany = vi.fn().mockResolvedValue(currentRoles.map((role_code) => ({ role_code })));
+  const employeeRoleDeleteMany = vi.fn().mockResolvedValue({ count: currentRoles.length });
  const auditCreate = vi.fn().mockResolvedValue({ id: "audit-1" });
  const authSessionUpdateMany = vi.fn().mockResolvedValue({ count: 0 });
  const passwordResetCodeUpdateMany = vi.fn().mockResolvedValue({ count: 0 });
  const emailLoginCodeUpdateMany = vi.fn().mockResolvedValue({ count: 0 });
+  const lifecycleEventCreate = vi.fn().mockResolvedValue({ id: "lifecycle-1" });
+  const checklistTaskCreateMany = vi.fn().mockResolvedValue({ count: 1 });
+  const wecomSyncRunCreate = vi.fn().mockResolvedValue({ id: "sync-run-1" });
+  const queryRaw = vi.fn(async (strings, employeeId) => {
+    const sql = Array.isArray(strings) ? strings.join(" ") : String(strings ?? "");
+    if (sql.includes('FROM "employee_roles"')) {
+      return currentRoles.map((role_code) => ({ role_code }));
+    }
+    if (sql.includes('FROM "employees"')) {
+      return [{ id: employeeId }];
+    }
+    return [];
+  });

  const tx = {
    department: {
@@ -73,6 +95,13 @@ async function buildApp({
    },
    employeeRole: {
      createMany: employeeRoleCreateMany,
+      deleteMany: employeeRoleDeleteMany,
+    },
+    employeeLifecycleEvent: {
+      create: lifecycleEventCreate,
+    },
+    employeeChecklistTask: {
+      createMany: checklistTaskCreateMany,
    },
    auditLog: {
      create: auditCreate,
@@ -86,9 +115,10 @@ async function buildApp({
    emailLoginCode: {
      updateMany: emailLoginCodeUpdateMany,
    },
+    $queryRaw: queryRaw,
  };

-  app.decorate("config", {});
+  app.decorate("config", { employeeLifecycleEnabled: true });
  app.decorate("prisma", {
    department: {
      findUnique: departmentFindUnique,
@@ -99,27 +129,36 @@ async function buildApp({
    employeeRole: {
      findMany: employeeRoleFindMany,
    },
+    featureFlag: {
+      findUnique: vi.fn().mockResolvedValue({
+        id: "flag-employee-lifecycle",
+        flag_key: "employee_lifecycle_v1",
+        override_mode: "force_on",
+        rollout_type: "global",
+        department_ids: [],
+        version: 1,
+      }),
+    },
+    wecomDirectorySyncRun: {
+      create: wecomSyncRunCreate,
+    },
+    wecomIdentityBinding: {},
    $transaction: vi.fn(async (callback) => callback(tx)),
  });
  app.decorate("requirePermission", (permissionCode) => async (request) => {
-    request.employee = {
-      id: ACTOR_ID,
-      department_id: DEPARTMENT_ID,
-      permissionCodes: ["system.users"],
-    };
+    request.employee = actor;
    const permissions = request.employee.permissionCodes ?? [];
    if (!permissions.includes("*") && !permissions.includes(permissionCode)) {
      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
    }
  });
  app.decorate("authenticate", async (request) => {
-    request.employee = {
-      id: ACTOR_ID,
-      department_id: DEPARTMENT_ID,
-      permissionCodes: ["system.users"],
-    };
+    request.employee = actor;
+  });
+  app.decorate("hasPermission", (employee, permissionCode) => {
+    const permissions = employee?.permissionCodes ?? [];
+    return permissions.includes("*") || permissions.includes(permissionCode);
  });
-  app.decorate("hasPermission", () => true);
  app.setErrorHandler((error, request, reply) => {
    if (error instanceof AppError) {
      return reply.status(error.statusCode).send({
@@ -143,10 +182,15 @@ async function buildApp({
    employeeUpdate,
    employeeRoleCreateMany,
    employeeRoleFindMany,
+    employeeRoleDeleteMany,
    auditCreate,
    authSessionUpdateMany,
    passwordResetCodeUpdateMany,
    emailLoginCodeUpdateMany,
+    lifecycleEventCreate,
+    checklistTaskCreateMany,
+    wecomSyncRunCreate,
+    queryRaw,
  };
 }

@@ -162,6 +206,7 @@ describe("usersRoutes write flows", () => {
        phone: "13800000001",
        email: "[email protected]",
        roles: ["employee"],
+        syncWecomDirectory: false,
      },
    });

@@ -223,6 +268,185 @@ describe("usersRoutes write flows", () => {
    await app.close();
  });

+  it("prevents a system administrator from creating protected administrator roles", async () => {
+    const { app, departmentFindUnique, employeeCreate } = await buildApp();
+
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/users",
+      payload: {
+        name: "受限账号",
+        phone: "13800000002",
+        email: "[email protected]",
+        roles: ["employee", "system_admin"],
+      },
+    });
+
+    expect(response.statusCode).toBe(403);
+    expect(response.json().error.details).toEqual({ role: "protected_role_change_not_allowed" });
+    expect(departmentFindUnique).not.toHaveBeenCalled();
+    expect(employeeCreate).not.toHaveBeenCalled();
+
+    await app.close();
+  });
+
+  it("prevents a system administrator from granting or revoking protected roles before mutation", async () => {
+    const grantApp = await buildApp();
+    const grantResponse = await grantApp.app.inject({
+      method: "POST",
+      url: `/api/users/${USER_ID}/roles`,
+      payload: { roles: ["employee", "admin"] },
+    });
+
+    expect(grantResponse.statusCode).toBe(403);
+    expect(grantApp.employeeRoleDeleteMany).not.toHaveBeenCalled();
+    expect(grantApp.employeeRoleCreateMany).not.toHaveBeenCalled();
+    await grantApp.app.close();
+
+    const revokeApp = await buildApp({ currentRoles: ["employee", "system_admin"] });
+    const revokeResponse = await revokeApp.app.inject({
+      method: "POST",
+      url: `/api/users/${USER_ID}/roles`,
+      payload: { roles: ["employee"] },
+    });
+
+    expect(revokeResponse.statusCode).toBe(403);
+    expect(revokeApp.employeeRoleDeleteMany).not.toHaveBeenCalled();
+    expect(revokeApp.employeeRoleCreateMany).not.toHaveBeenCalled();
+    await revokeApp.app.close();
+  });
+
+  it("prevents a system administrator from changing their own business roles before lookup", async () => {
+    const testApp = await buildApp();
+
+    const response = await testApp.app.inject({
+      method: "POST",
+      url: `/api/users/${ACTOR_ID}/roles`,
+      payload: { roles: ["employee", "manager", "system_admin"] },
+    });
+
+    expect(response.statusCode).toBe(403);
+    expect(response.json().error.details).toEqual({ user: "self_role_change_not_allowed" });
+    expect(testApp.employeeRoleFindMany).not.toHaveBeenCalled();
+    expect(testApp.employeeRoleDeleteMany).not.toHaveBeenCalled();
+    expect(testApp.employeeRoleCreateMany).not.toHaveBeenCalled();
+
+    await testApp.app.close();
+  });
+
+  it.each([
+    {
+      name: "批量调部门",
+      url: "/api/users/batch/transfer-department",
+      payload: { employeeIds: [USER_ID], departmentId: DEPARTMENT_ID },
+    },
+    {
+      name: "批量设直属经理",
+      url: "/api/users/batch/set-manager",
+      payload: { employeeIds: [USER_ID], managerId: MANAGER_ID },
+    },
+    {
+      name: "批量停用",
+      url: "/api/users/batch/disable",
+      payload: { employeeIds: [USER_ID] },
+    },
+    {
+      name: "批量启用",
+      url: "/api/users/batch/enable",
+      payload: { employeeIds: [USER_ID] },
+    },
+  ])("rejects $name when any target has a protected role before all writes", async ({ url, payload }) => {
+    const testApp = await buildApp({ currentRoles: ["employee", "system_admin"] });
+
+    const response = await testApp.app.inject({ method: "POST", url, payload });
+
+    expect(response.statusCode).toBe(403);
+    expect(response.json().error.details).toEqual({ user: "protected_account_not_manageable" });
+    expect(testApp.queryRaw).toHaveBeenCalledTimes(2);
+    expect(testApp.employeeUpdate).not.toHaveBeenCalled();
+    expect(testApp.lifecycleEventCreate).not.toHaveBeenCalled();
+    expect(testApp.checklistTaskCreateMany).not.toHaveBeenCalled();
+    expect(testApp.authSessionUpdateMany).not.toHaveBeenCalled();
+    expect(testApp.auditCreate).not.toHaveBeenCalled();
+    expect(testApp.wecomSyncRunCreate).not.toHaveBeenCalled();
+
+    await testApp.app.close();
+  });
+
+  it.each([
+    { name: "更新账号", method: "PATCH", path: "", payload: { name: "受保护账号" } },
+    { name: "归档账号", method: "POST", path: "/archive" },
+    { name: "停用账号", method: "POST", path: "/disable" },
+    { name: "启用账号", method: "POST", path: "/enable" },
+    { name: "解锁账号", method: "POST", path: "/unlock" },
+  ])("rejects $name for a protected target before account side effects", async ({ method, path, payload }) => {
+    const testApp = await buildApp({ currentRoles: ["employee", "admin"] });
+
+    const response = await testApp.app.inject({
+      method,
+      url: `/api/users/${USER_ID}${path}`,
+      ...(payload ? { payload } : {}),
+    });
+
+    expect(response.statusCode).toBe(403);
+    expect(response.json().error.details).toEqual({ user: "protected_account_not_manageable" });
+    expect(testApp.employeeUpdate).not.toHaveBeenCalled();
+    expect(testApp.authSessionUpdateMany).not.toHaveBeenCalled();
+    expect(testApp.auditCreate).not.toHaveBeenCalled();
+    expect(testApp.wecomSyncRunCreate).not.toHaveBeenCalled();
+
+    await testApp.app.close();
+  });
+
+  it("allows an emergency administrator to assign system_admin with before/after role audit", async () => {
+    const testApp = await buildApp({
+      actor: {
+        id: ACTOR_ID,
+        department_id: DEPARTMENT_ID,
+        roleCodes: ["admin"],
+        permissionCodes: ["*"],
+      },
+    });
+
+    const response = await testApp.app.inject({
+      method: "POST",
+      url: `/api/users/${USER_ID}/roles`,
+      payload: { roles: ["employee", "system_admin"] },
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(testApp.employeeRoleDeleteMany).toHaveBeenCalledTimes(1);
+    expect(testApp.auditCreate).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        action: "SYSTEM_USER_ROLES_SET",
+        extra: {
+          beforeRoleCodes: ["employee"],
+          afterRoleCodes: ["employee", "system_admin"],
+        },
+      }),
+    });
+
+    await testApp.app.close();
+  });
+
+  it("prevents a system administrator from resetting a protected account", async () => {
+    const testApp = await buildApp({ currentRoles: ["employee", "admin"] });
+
+    const response = await testApp.app.inject({
+      method: "POST",
+      url: `/api/users/${USER_ID}/reset-password`,
+      payload: { newPassword: "AdministratorReset1234" },
+    });
+
+    expect(response.statusCode).toBe(403);
+    expect(response.json().error.details).toEqual({ user: "protected_account_not_manageable" });
+    expect(testApp.employeeUpdate).not.toHaveBeenCalled();
+    expect(testApp.authSessionUpdateMany).not.toHaveBeenCalled();
+    expect(testApp.auditCreate).not.toHaveBeenCalled();
+
+    await testApp.app.close();
+  });
+
  it("revokes sessions and outstanding challenges during an administrator password reset", async () => {
    const {
      app,