OAPERM1 收紧启用前权限冻结

server/src/routes/workflow.js

@@ -561,6 +561,29 @@ async function buildTaskVisibilityFilters(tx, request) {
   return assigneeFilters;
 }
 
+function canViewWorkflowEntityType(request, entityType) {
+  const normalizedEntityType = normalizeWorkflowEntityType(entityType);
+  if (normalizedEntityType === "travel_request") {
+    return hasPermission(request.employee.permissionCodes ?? [], "*")
+      || hasPermission(request.employee.permissionCodes ?? [], "system.settings");
+  }
+  return true;
+}
+
+function buildWorkflowEntityVisibilityWhere(request, entityType = null) {
+  if (entityType) {
+    return canViewWorkflowEntityType(request, entityType)
+      ? { entity_type: normalizeWorkflowEntityType(entityType) }
+      : { entity_type: "__forbidden__" };
+  }
+
+  const hiddenEntityTypes = [];
+  if (!canViewWorkflowEntityType(request, "travel_request")) {
+    hiddenEntityTypes.push("travel_request");
+  }
+  return hiddenEntityTypes.length ? { entity_type: { notIn: hiddenEntityTypes } } : {};
+}
+
 function listAllowedActionsForTask(request, task, actionable) {
   if (task.status !== "pending" || !actionable) {
     return [];
@@ -1957,6 +1980,7 @@ async function workflowRoutes(fastify) {
       const where = {
         status: "pending",
         ...(visibilityFilters ? { OR: visibilityFilters } : {}),
+        workflow_instance: { is: buildWorkflowEntityVisibilityWhere(request) },
       };
 
       const tasks = await fastify.prisma.workflowTask.findMany({
@@ -1998,9 +2022,7 @@ async function workflowRoutes(fastify) {
       const where = {
         status: query.status,
         OR: assigneeFilters,
-        ...(query.entityType
-          ? { workflow_instance: { is: { entity_type: query.entityType } } }
-          : {}),
+        workflow_instance: { is: buildWorkflowEntityVisibilityWhere(request, query.entityType ?? null) },
       };
 
       const [tasks, total] = await Promise.all([
@@ -2151,6 +2173,7 @@ async function workflowRoutes(fastify) {
         where: {
           id: taskId,
           OR: assigneeFilters,
+          workflow_instance: { is: buildWorkflowEntityVisibilityWhere(request) },
         },
         select: {
           id: true,
@@ -3199,7 +3222,9 @@ module.exports.__testables = {
   buildReturnedCopy,
   buildWorkflowTaskSummaryPayload,
   buildWorkflowEntityMeta,
+  buildWorkflowEntityVisibilityWhere,
   calculateWorkflowTaskDueAt,
+  canViewWorkflowEntityType,
   handlePurchaseApprovalErpSync,
   isWorkflowTaskOverdue,
   listAllowedActionsForTask,