feat(P20T1-1,P20T1-2,P20T1-3): 差旅模型、申请/订单接口与工作流分支

2026-03-10 19:58:46 +08:00
@@ -44,6 +44,14 @@ describe("Permission Constants", () => {
    expect(hasPermission(resolvePermissionsForRoles(["administration"]), "procurement.manage")).toBe(true);
  });

+  it("grants travel permissions to configured roles", () => {
+    expect(hasPermission(resolvePermissionsForRoles(["employee"]), "travel.create")).toBe(true);
+    expect(hasPermission(resolvePermissionsForRoles(["employee"]), "travel.submit")).toBe(true);
+    expect(hasPermission(resolvePermissionsForRoles(["manager"]), "travel.approve")).toBe(true);
+    expect(hasPermission(resolvePermissionsForRoles(["finance"]), "travel.approve")).toBe(false);
+    expect(hasPermission(resolvePermissionsForRoles(["finance_mgr"]), "travel.manage")).toBe(true);
+    expect(hasPermission(resolvePermissionsForRoles(["administration"]), "travel.manage")).toBe(true);
+  });

  it("grants ai.assist only to finance manager and admin", () => {
    expect(hasPermission(resolvePermissionsForRoles(["finance_mgr"]), "ai.assist")).toBe(true);
@@ -142,6 +142,28 @@ describe("documentSequence service", () => {
  });


+  it("falls back to default travel category code for travel requests", async () => {
+    const prisma = buildPrisma({
+      categoryMap: {
+        TR_STANDARD: {
+          code: "TR_STANDARD",
+          entity_type: "travel_request",
+          sequence_prefix: "CL",
+          number_length: 4,
+          reset_period: "yearly",
+          enabled: true,
+          archived_at: null,
+        },
+      },
+    });
+
+    const config = await resolveDocumentSequenceConfig(prisma, { documentType: "travel_request" });
+
+    expect(config.source).toBe("document_category");
+    expect(config.documentCategoryCode).toBe("TR_STANDARD");
+    expect(config.prefix).toBe("CL");
+  });
+
  it("falls back to default asset category code for asset cards", async () => {
    const prisma = buildPrisma({
      categoryMap: {
@@ -11,3 +11,9 @@ describe("resolveEntityPermission", () => {
    expect(resolveEntityPermission("procurement", "manage")).toBe("procurement.manage");
  });
 });
+
+it("maps travel_request approvals to travel permissions", () => {
+  expect(resolveEntityPermission("travel_request", "approve")).toBe("travel.approve");
+  expect(resolveEntityPermission("travel_request", "submit")).toBe("travel.submit");
+  expect(resolveEntityPermission("travel", "manage")).toBe("travel.manage");
+});
@@ -0,0 +1,203 @@
+const Fastify = require("fastify");
+
+const { AppError } = require("../../../src/utils/AppError");
+const travelOrdersRoutes = require("../../../src/routes/travelOrders");
+
+function buildPrisma({ employees = [], travelRequests = [], upsertImpl } = {}) {
+  return {
+    employee: {
+      findMany: vi.fn().mockResolvedValue(employees),
+    },
+    travelRequest: {
+      findMany: vi.fn().mockResolvedValue(travelRequests),
+    },
+    travelOrder: {
+      upsert: vi.fn().mockImplementation(upsertImpl ?? (async ({ create }) => ({
+        id: "order-1",
+        source: create.source,
+        external_order_no: create.external_order_no,
+        employee_id: create.employee_id,
+        department_id: create.department_id,
+        linked_reimbursement_id: create.linked_reimbursement_id,
+        travel_request_id: create.travel_request_id,
+        occurred_at: create.occurred_at,
+        amount: create.amount,
+        currency: create.currency,
+        status: create.status,
+        created_at: new Date("2026-03-10T00:00:00.000Z"),
+        updated_at: new Date("2026-03-10T00:00:00.000Z"),
+      }))),
+    },
+    auditLog: {
+      create: vi.fn().mockResolvedValue({ id: "audit-1" }),
+    },
+  };
+}
+
+async function buildApp({ prisma }) {
+  const app = Fastify();
+
+  app.decorate("prisma", prisma);
+  app.decorate("config", { travelSyncEnabled: true });
+  app.decorate("authenticate", async (request) => {
+    if (!request.headers.authorization) {
+      throw new AppError({ code: "AUTH_001", message: "未登录", statusCode: 401 });
+    }
+    request.employee = { id: "actor-1", permissionCodes: ["integration.manage"] };
+  });
+  app.decorate("hasPermission", (employee, permissionCode) => (employee?.permissionCodes ?? []).includes(permissionCode));
+  app.decorate("requirePermission", (permissionCode) => async (request) => {
+    await app.authenticate(request);
+    if (!app.hasPermission(request.employee, permissionCode)) {
+      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
+    }
+  });
+
+  app.setErrorHandler((error, request, reply) => {
+    if (error instanceof AppError) {
+      return reply.status(error.statusCode).send({
+        requestId: request.id,
+        error: {
+          code: error.code,
+          message: error.message,
+          details: error.details ?? {},
+        },
+      });
+    }
+    return reply.status(500).send({
+      requestId: request.id,
+      error: { code: "SYS_001", message: "服务器内部错误", details: {} },
+    });
+  });
+
+  await app.register(travelOrdersRoutes, { prefix: "/api" });
+  return app;
+}
+
+describe("travelOrders routes", () => {
+  it("imports rows with legal travelRequestId linkage", async () => {
+    const prisma = buildPrisma({
+      employees: [{ id: "employee-1", department_id: "dept-1" }],
+      travelRequests: [{ id: "11111111-1111-4111-8111-111111111111", applicant_employee_id: "employee-1" }],
+    });
+    const app = await buildApp({ prisma });
+
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/travel/orders/import",
+      headers: { authorization: "Bearer test" },
+      payload: {
+        orders: [
+          {
+            source: "ctrip",
+            externalOrderNo: "EXT-001",
+            employeeId: "employee-1",
+            travelRequestId: "11111111-1111-4111-8111-111111111111",
+            amount: "1888.00",
+          },
+        ],
+      },
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json().data).toEqual(
+      expect.objectContaining({
+        imported: 1,
+        linkedTravelRequestCount: 1,
+      }),
+    );
+    expect(response.json().data.items[0].travelRequestId).toBe("11111111-1111-4111-8111-111111111111");
+
+    await app.close();
+  });
+
+  it("skips rows when travel request employee mismatches", async () => {
+    const prisma = buildPrisma({
+      employees: [{ id: "employee-1", department_id: "dept-1" }],
+      travelRequests: [{ id: "11111111-1111-4111-8111-111111111111", applicant_employee_id: "employee-2" }],
+    });
+    const app = await buildApp({ prisma });
+
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/travel/orders/import",
+      headers: { authorization: "Bearer test" },
+      payload: {
+        orders: [{ source: "ctrip", externalOrderNo: "EXT-002", employeeId: "employee-1", travelRequestId: "11111111-1111-4111-8111-111111111111" }],
+      },
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json().data.imported).toBe(0);
+    expect(response.json().data.skipped).toEqual([
+      expect.objectContaining({ reason: "travel_request_employee_mismatch" }),
+    ]);
+
+    await app.close();
+  });
+
+  it("skips rows when travel request does not exist", async () => {
+    const prisma = buildPrisma({
+      employees: [{ id: "employee-1", department_id: "dept-1" }],
+      travelRequests: [],
+    });
+    const app = await buildApp({ prisma });
+
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/travel/orders/import",
+      headers: { authorization: "Bearer test" },
+      payload: {
+        orders: [{ source: "ctrip", externalOrderNo: "EXT-003", employeeId: "employee-1", travelRequestId: "11111111-1111-4111-8111-111111111111" }],
+      },
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json().data.imported).toBe(0);
+    expect(response.json().data.skipped).toEqual([
+      expect.objectContaining({ reason: "travel_request_not_found" }),
+    ]);
+
+    await app.close();
+  });
+
+  it("preserves existing travel linkage when new row omits travelRequestId", async () => {
+    const prisma = buildPrisma({
+      employees: [{ id: "employee-1", department_id: "dept-1" }],
+      travelRequests: [],
+      upsertImpl: async ({ create, update }) => {
+        expect(update.travel_request_id).toBeUndefined();
+        return {
+          id: "order-2",
+          source: create.source,
+          external_order_no: create.external_order_no,
+          employee_id: create.employee_id,
+          department_id: create.department_id,
+          linked_reimbursement_id: create.linked_reimbursement_id,
+          travel_request_id: "existing-travel-request",
+          occurred_at: create.occurred_at,
+          amount: create.amount,
+          currency: create.currency,
+          status: "imported",
+          created_at: new Date("2026-03-10T00:00:00.000Z"),
+          updated_at: new Date("2026-03-10T00:00:00.000Z"),
+        };
+      },
+    });
+    const app = await buildApp({ prisma });
+
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/travel/orders/import",
+      headers: { authorization: "Bearer test" },
+      payload: {
+        orders: [{ source: "ctrip", externalOrderNo: "EXT-004", employeeId: "employee-1", amount: "500.00" }],
+      },
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json().data.items[0].travelRequestId).toBe("existing-travel-request");
+
+    await app.close();
+  });
+});
@@ -0,0 +1,200 @@
+const Fastify = require("fastify");
+
+const { AppError } = require("../../../src/utils/AppError");
+const travelRequestsRoutes = require("../../../src/routes/travelRequests");
+
+function buildTravelRequestRecord({
+  id = "11111111-1111-4111-8111-111111111111",
+  applicantId = "employee-1",
+  submitterId = null,
+  status = "draft",
+} = {}) {
+  const now = new Date("2026-03-10T00:00:00.000Z");
+  return {
+    id,
+    request_no: status === "draft" ? null : "CL-20260310-0001",
+    applicant_employee_id: applicantId,
+    submitter_id: submitterId,
+    department_id: "dept-1",
+    legal_entity_id: "legal-1",
+    cost_center_id: "cc-1",
+    budget_pool_id: null,
+    purpose: "上海客户拜访",
+    trip_type: "domestic",
+    start_date: new Date("2026-03-15T00:00:00.000Z"),
+    end_date: new Date("2026-03-17T00:00:00.000Z"),
+    estimated_amount: "1280.00",
+    status,
+    created_at: now,
+    updated_at: now,
+    applicant: {
+      id: applicantId,
+      employee_no: "E001",
+      name: "张三",
+    },
+    submitter: submitterId
+      ? {
+          id: submitterId,
+          employee_no: "E009",
+          name: "李四",
+        }
+      : null,
+    department: { id: "dept-1", name: "销售部" },
+    legal_entity: { id: "legal-1", code: "HY", name: "海音达" },
+    cost_center: { id: "cc-1", code: "CC001", name: "销售中心", legal_entity_id: "legal-1" },
+    budget_pool: null,
+    segments: [
+      {
+        id: "seg-1",
+        sort_order: 1,
+        segment_role: "outbound",
+        transport_type: "flight",
+        from_city: "深圳",
+        to_city: "上海",
+        depart_at: new Date("2026-03-15T01:00:00.000Z"),
+        arrive_at: new Date("2026-03-15T03:30:00.000Z"),
+        created_at: now,
+        updated_at: now,
+      },
+    ],
+    travel_orders: [],
+    workflow_instances: [],
+  };
+}
+
+function buildPrisma({ items = [], detail = null } = {}) {
+  return {
+    travelRequest: {
+      findMany: vi.fn().mockResolvedValue(items),
+      count: vi.fn().mockResolvedValue(items.length),
+      findUnique: vi.fn().mockResolvedValue(detail),
+    },
+  };
+}
+
+async function buildApp({ employee, prisma }) {
+  const app = Fastify();
+
+  app.decorate("prisma", prisma);
+  app.decorate("config", { appTimezone: "Asia/Shanghai" });
+  app.decorate("authenticate", async (request) => {
+    if (!request.headers.authorization) {
+      throw new AppError({
+        code: "AUTH_001",
+        message: "未登录",
+        statusCode: 401,
+      });
+    }
+    request.employee = employee;
+  });
+  app.decorate("hasPermission", (actor, permissionCode) => {
+    return (actor?.permissionCodes ?? []).includes("*") || (actor?.permissionCodes ?? []).includes(permissionCode);
+  });
+  app.decorate("requirePermission", (permissionCode) => async (request) => {
+    await app.authenticate(request);
+    if (!app.hasPermission(request.employee, permissionCode)) {
+      throw new AppError({
+        code: "PERM_001",
+        message: "无权限",
+        statusCode: 403,
+        details: { permission: permissionCode },
+      });
+    }
+  });
+
+  app.setErrorHandler((error, request, reply) => {
+    if (error instanceof AppError) {
+      return reply.status(error.statusCode).send({
+        requestId: request.id,
+        error: {
+          code: error.code,
+          message: error.message,
+          details: error.details ?? {},
+        },
+      });
+    }
+
+    return reply.status(500).send({
+      requestId: request.id,
+      error: { code: "SYS_001", message: "服务器内部错误", details: {} },
+    });
+  });
+
+  await app.register(travelRequestsRoutes, { prefix: "/api" });
+  return app;
+}
+
+describe("travelRequests routes", () => {
+  it("lists only own records when actor lacks view_all", async () => {
+    const prisma = buildPrisma({
+      items: [buildTravelRequestRecord()],
+    });
+    const app = await buildApp({
+      employee: { id: "employee-1", department_id: "dept-1", permissionCodes: ["travel.view_own"] },
+      prisma,
+    });
+
+    const response = await app.inject({
+      method: "GET",
+      url: "/api/travel-requests?mine=0&page=1&pageSize=10",
+      headers: { authorization: "Bearer test" },
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json().data).toEqual(
+      expect.objectContaining({
+        mine: true,
+        total: 1,
+      }),
+    );
+    expect(prisma.travelRequest.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: expect.objectContaining({
+          OR: [
+            { applicant_employee_id: "employee-1" },
+            { submitter_id: "employee-1" },
+          ],
+        }),
+      }),
+    );
+
+    await app.close();
+  });
+
+  it("allows owner to fetch detail and blocks outsiders", async () => {
+    const detail = buildTravelRequestRecord();
+    const ownerApp = await buildApp({
+      employee: { id: "employee-1", department_id: "dept-1", permissionCodes: ["travel.view_own"] },
+      prisma: buildPrisma({ detail }),
+    });
+    const outsiderApp = await buildApp({
+      employee: { id: "employee-9", department_id: "dept-9", permissionCodes: ["travel.view_own"] },
+      prisma: buildPrisma({ detail }),
+    });
+
+    const ownerResponse = await ownerApp.inject({
+      method: "GET",
+      url: `/api/travel-requests/${detail.id}`,
+      headers: { authorization: "Bearer test" },
+    });
+    const outsiderResponse = await outsiderApp.inject({
+      method: "GET",
+      url: `/api/travel-requests/${detail.id}`,
+      headers: { authorization: "Bearer test" },
+    });
+
+    expect(ownerResponse.statusCode).toBe(200);
+    expect(ownerResponse.json().data).toEqual(
+      expect.objectContaining({
+        id: detail.id,
+        purpose: detail.purpose,
+        permissions: expect.objectContaining({ canEditDraft: true }),
+      }),
+    );
+    expect(outsiderResponse.statusCode).toBe(403);
+    expect(outsiderResponse.json().error.code).toBe("PERM_001");
+
+    await ownerApp.close();
+    await outsiderApp.close();
+  });
+});
@@ -42,6 +42,19 @@ describe("Workflow Route Permissions", () => {
    expect(actions).toEqual(["approve", "reject", "return"]);
  });

+  it("allows travel approvers to act on travel tasks", () => {
+    const actions = listAllowedActionsForTask(
+      { employee: { permissionCodes: ["travel.approve"] } },
+      {
+        status: "pending",
+        workflow_instance: { entity_type: "travel_request" },
+      },
+      true,
+    );
+
+    expect(actions).toEqual(["approve", "reject", "return"]);
+  });
+
  it("keeps transfer action limited to reimbursement tasks", () => {
    const reimbursementActions = listAllowedActionsForTask(
      { employee: { permissionCodes: ["expense.approve", "expense.transfer"] } },
@@ -0,0 +1,33 @@
+const { NOTIFICATION_TYPES } = require("../../../src/constants/notificationTypes");
+const workflowRoutes = require("../../../src/routes/workflow");
+
+describe("workflow travel helpers", () => {
+  const { getWorkflowEntityMeta, resolveWorkflowOutcomeNotificationType } = workflowRoutes.__testables;
+
+  it("builds travel entity meta with deep-link detail path", () => {
+    const meta = getWorkflowEntityMeta(
+      "travel_request",
+      { request_no: "CL-20260310-0001" },
+      "11111111-1111-4111-8111-111111111111",
+    );
+
+    expect(meta).toEqual(
+      expect.objectContaining({
+        label: "差旅申请",
+        reference: "CL-20260310-0001",
+        targetType: "travel_request",
+        detailPath: "/travel-requests?id=11111111-1111-4111-8111-111111111111",
+      }),
+    );
+  });
+
+  it("resolves approved and rejected notification types for travel workflows", () => {
+    expect(resolveWorkflowOutcomeNotificationType("travel_request", "approved")).toBe(
+      NOTIFICATION_TYPES.travelRequestApproved,
+    );
+    expect(resolveWorkflowOutcomeNotificationType("travel_request", "rejected")).toBe(
+      NOTIFICATION_TYPES.travelRequestRejected,
+    );
+    expect(resolveWorkflowOutcomeNotificationType("travel_request", "returned")).toBeNull();
+  });
+});