OAPERM1 收紧启用前权限冻结

server/tests/unit/routes/search.test.js

@@ -109,6 +109,27 @@ async function buildApp({ employee, prisma }) {
 }
 
 describe("global search R23 confidential boundary", () => {
+  it("does not expose contract registry or confidential document refs to project managers through search", async () => {
+    const prisma = createPrisma();
+    const app = await buildApp({
+      employee: { id: "manager-1", department_id: null, permissionCodes: ["project.view_all", "project.manage"] },
+      prisma,
+    });
+
+    const response = await app.inject({
+      method: "GET",
+      url: "/api/search?q=HT-001",
+      headers: { authorization: "Bearer test-token" },
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json().data.items).toEqual([]);
+    expect(prisma.contractRegistry.findMany).not.toHaveBeenCalled();
+    expect(prisma.confidentialDocumentRef.findMany).not.toHaveBeenCalled();
+
+    await app.close();
+  });
+
   it("does not match sensitive summary text but still matches minimal identifiers", async () => {
     const prisma = createPrisma();
     const app = await buildApp({