feat(P19AI1-1,P19AI1-2): 实现AI建议引擎与权限门禁后端

2026-03-10 14:20:59 +08:00
@@ -0,0 +1,320 @@
+const Fastify = require("fastify");
+
+const { AppError } = require("../../../src/utils/AppError");
+const aiRoutes = require("../../../src/routes/ai");
+
+function buildFeatureFlagRecord({
+  overrideMode = "force_on",
+  rolloutType = "global",
+  departmentIds = [],
+} = {}) {
+  const now = new Date("2026-03-10T00:00:00.000Z");
+  return {
+    id: "flag-ai-assist",
+    flag_key: "ai_assist",
+    override_mode: overrideMode,
+    rollout_type: rolloutType,
+    department_ids: departmentIds,
+    note: "unit-test",
+    version: 1,
+    created_at: now,
+    created_by: null,
+    updated_at: now,
+    updated_by: null,
+  };
+}
+
+function buildPrisma({
+  reimbursement = null,
+  purchaseRequest = null,
+  asset = null,
+  flagRecord = buildFeatureFlagRecord(),
+} = {}) {
+  return {
+    featureFlag: {
+      findUnique: vi.fn().mockImplementation(async ({ where }) => {
+        if (where.flag_key === "ai_assist") {
+          return flagRecord;
+        }
+        return null;
+      }),
+    },
+    reimbursementForm: {
+      findUnique: vi.fn().mockResolvedValue(reimbursement),
+    },
+    purchaseRequest: {
+      findUnique: vi.fn().mockResolvedValue(purchaseRequest),
+    },
+    assetCard: {
+      findUnique: vi.fn().mockResolvedValue(asset),
+    },
+    budgetPool: {
+      findMany: vi.fn().mockResolvedValue([]),
+    },
+    auditLog: {
+      create: vi.fn().mockResolvedValue({ id: "audit-1" }),
+    },
+  };
+}
+
+async function buildTestApp({ employee, prisma, config }) {
+  const app = Fastify();
+
+  app.decorate("prisma", prisma);
+  app.decorate("config", {
+    aiAssistEnabled: true,
+    aiProvider: "mock",
+    budgetControlMode: "warn",
+    ...config,
+  });
+  app.decorate("authenticate", async (request) => {
+    if (!request.headers.authorization) {
+      throw new AppError({
+        code: "AUTH_001",
+        message: "未登录",
+        statusCode: 401,
+      });
+    }
+    request.employee = employee;
+  });
+
+  app.setErrorHandler((error, request, reply) => {
+    if (error instanceof AppError) {
+      return reply.status(error.statusCode).send({
+        requestId: request.id,
+        error: {
+          code: error.code,
+          message: error.message,
+          details: error.details ?? {},
+        },
+      });
+    }
+
+    return reply.status(500).send({
+      requestId: request.id,
+      error: {
+        code: "SYS_001",
+        message: "服务器内部错误",
+        details: {},
+      },
+    });
+  });
+
+  await app.register(aiRoutes, { prefix: "/api" });
+  return app;
+}
+
+describe("AI routes", () => {
+  it("returns AI status for authenticated user", async () => {
+    const app = await buildTestApp({
+      employee: { id: "employee-1", permissionCodes: [] },
+      prisma: buildPrisma(),
+      config: { aiAssistEnabled: false },
+    });
+
+    const response = await app.inject({
+      method: "GET",
+      url: "/api/ai/status",
+      headers: { authorization: "Bearer test-token" },
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json().data).toEqual(
+      expect.objectContaining({
+        enabled: false,
+        permissions: { canAccess: false },
+        featureFlag: expect.objectContaining({ effectiveReason: "env_hard_off" }),
+      }),
+    );
+
+    await app.close();
+  });
+
+  it("returns 401 when auth header is missing", async () => {
+    const app = await buildTestApp({
+      employee: { id: "employee-1", permissionCodes: ["ai.assist"] },
+      prisma: buildPrisma(),
+    });
+
+    const response = await app.inject({ method: "GET", url: "/api/ai/status" });
+
+    expect(response.statusCode).toBe(401);
+    expect(response.json().error.code).toBe("AUTH_001");
+
+    await app.close();
+  });
+
+  it("rejects reimbursement suggestion when actor lacks ai.assist", async () => {
+    const app = await buildTestApp({
+      employee: { id: "employee-1", permissionCodes: ["expense.view_own"] },
+      prisma: buildPrisma({
+        reimbursement: {
+          id: "r-1",
+          form_number: "BX-001",
+          submitter_id: "employee-2",
+          owner_id: "employee-1",
+          department_id: "dept-1",
+          reimbursement_date: new Date("2026-03-10T00:00:00.000Z"),
+          total_amount: 120,
+          status: "reviewing",
+          items: [],
+          invoice_pool_items: [],
+          workflow_instances: [],
+        },
+      }),
+    });
+
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/ai/suggestions/reimbursements/11111111-1111-4111-8111-111111111111",
+      headers: { authorization: "Bearer test-token" },
+      payload: {},
+    });
+
+    expect(response.statusCode).toBe(403);
+    expect(response.json().error.code).toBe("PERM_001");
+
+    await app.close();
+  });
+
+  it("returns 409 when purchase suggestion is disabled by department gate", async () => {
+    const app = await buildTestApp({
+      employee: { id: "employee-1", permissionCodes: ["procurement.view_all", "ai.assist"] },
+      prisma: buildPrisma({
+        flagRecord: buildFeatureFlagRecord({
+          overrideMode: "force_on",
+          rolloutType: "department_allowlist",
+          departmentIds: ["dept-2"],
+        }),
+        purchaseRequest: {
+          id: "p-1",
+          request_no: "PR-001",
+          applicant_id: "employee-1",
+          submitter_id: "employee-1",
+          department_id: "dept-1",
+          title: "办公电脑采购",
+          currency_code: "CNY",
+          total_amount: 6000,
+          status: "approved",
+          supplier: { code: "SUP-1", name: "供应商" },
+          legal_entity: { code: "HY", name: "海音达" },
+          cost_center: { code: "IT001", name: "IT中心" },
+          budget_pool: { code: "B-001", name: "年度预算" },
+          items: [{ is_asset_candidate: true }],
+          order_archive: null,
+        },
+      }),
+    });
+
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/ai/suggestions/purchase-requests/22222222-2222-4222-8222-222222222222",
+      headers: { authorization: "Bearer test-token" },
+      payload: {},
+    });
+
+    expect(response.statusCode).toBe(409);
+    expect(response.json().error.details).toEqual(
+      expect.objectContaining({ ai: "disabled", featureFlagReason: "department_not_allowed" }),
+    );
+
+    await app.close();
+  });
+
+  it("enforces reimbursement own-view permission on suggestion route", async () => {
+    const prisma = buildPrisma({
+      reimbursement: {
+        id: "r-1",
+        form_number: "BX-001",
+        submitter_id: "employee-2",
+        owner_id: "employee-1",
+        department_id: "dept-1",
+        reimbursement_date: new Date("2026-03-10T00:00:00.000Z"),
+        total_amount: 120,
+        status: "reviewing",
+        items: [],
+        invoice_pool_items: [],
+        workflow_instances: [],
+      },
+    });
+
+    const ownerApp = await buildTestApp({
+      employee: { id: "employee-1", permissionCodes: ["expense.view_own", "ai.assist"] },
+      prisma,
+    });
+    const ownerResponse = await ownerApp.inject({
+      method: "POST",
+      url: "/api/ai/suggestions/reimbursements/11111111-1111-4111-8111-111111111111",
+      headers: { authorization: "Bearer test-token" },
+      payload: {},
+    });
+
+    expect(ownerResponse.statusCode).toBe(200);
+    expect(ownerResponse.json().data.targetType).toBe("reimbursement");
+    await ownerApp.close();
+
+    const outsiderApp = await buildTestApp({
+      employee: { id: "employee-9", permissionCodes: ["expense.view_own", "ai.assist"] },
+      prisma,
+    });
+    const outsiderResponse = await outsiderApp.inject({
+      method: "POST",
+      url: "/api/ai/suggestions/reimbursements/11111111-1111-4111-8111-111111111111",
+      headers: { authorization: "Bearer test-token" },
+      payload: {},
+    });
+
+    expect(outsiderResponse.statusCode).toBe(403);
+    expect(outsiderResponse.json().error.code).toBe("PERM_001");
+    await outsiderApp.close();
+  });
+
+  it("enforces asset assignee own-view permission on suggestion route", async () => {
+    const prisma = buildPrisma({
+      asset: {
+        id: "a-1",
+        asset_no: "ZC-001",
+        name: "Laptop",
+        status: "in_use",
+        assignee_employee_id: "employee-1",
+        category: { code: "LAPTOP", name: "笔记本电脑", document_category: { code: "ASSET_STD" } },
+        legal_entity: { code: "HY", name: "海音达" },
+        cost_center: { code: "IT001", name: "IT中心" },
+        purchase_request: null,
+        location: "办公室",
+        activated_at: new Date("2026-03-10T00:00:00.000Z"),
+        retired_at: null,
+      },
+    });
+
+    const ownerApp = await buildTestApp({
+      employee: { id: "employee-1", permissionCodes: ["asset.view_own", "ai.assist"] },
+      prisma,
+    });
+    const ownerResponse = await ownerApp.inject({
+      method: "POST",
+      url: "/api/ai/suggestions/assets/33333333-3333-4333-8333-333333333333",
+      headers: { authorization: "Bearer test-token" },
+      payload: {},
+    });
+
+    expect(ownerResponse.statusCode).toBe(200);
+    expect(ownerResponse.json().data.targetType).toBe("asset_card");
+    await ownerApp.close();
+
+    const outsiderApp = await buildTestApp({
+      employee: { id: "employee-9", permissionCodes: ["asset.view_own", "ai.assist"] },
+      prisma,
+    });
+    const outsiderResponse = await outsiderApp.inject({
+      method: "POST",
+      url: "/api/ai/suggestions/assets/33333333-3333-4333-8333-333333333333",
+      headers: { authorization: "Bearer test-token" },
+      payload: {},
+    });
+
+    expect(outsiderResponse.statusCode).toBe(403);
+    expect(outsiderResponse.json().error.code).toBe("PERM_001");
+    await outsiderApp.close();
+  });
+});