diff --git a/client/src/api/errorMessages.ts b/client/src/api/errorMessages.ts index 56f6cb02..f1a3ac2d 100644 --- a/client/src/api/errorMessages.ts +++ b/client/src/api/errorMessages.ts @@ -163,6 +163,18 @@ export function mapApiErrorMessage( return "不能将任务转审给自己。"; } + if (details?.workflow === "self_approval_not_allowed") { + return "自己的申请不能审批，请等待下一审批人处理。"; + } + + if (details?.workflow === "business_approval_role_required") { + return "系统管理员不自动获得业务审批权，请配置正式审批角色后处理。"; + } + + if (details?.workflow === "no_actionable_approver") { + return "当前审批规则未找到审批人，请联系管理员修正规则。"; + } + if (details?.toApproverId === "target_not_approver") { return "目标人员不具备审批权限。"; } diff --git a/client/src/components/common/EmployeeAvatar.tsx b/client/src/components/common/EmployeeAvatar.tsx index e76874ef..e791338b 100644 --- a/client/src/components/common/EmployeeAvatar.tsx +++ b/client/src/components/common/EmployeeAvatar.tsx @@ -16,12 +16,17 @@ function buildInitials(name: string) { return "员工"; } + const cjkMatch = trimmed.match(/[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}]/u); + if (cjkMatch?.[0]) { + return cjkMatch[0]; + } + if (/^[A-Za-z0-9 ]+$/.test(trimmed)) { const segments = trimmed.split(/\s+/).filter(Boolean); return segments.slice(0, 2).map((item) => item[0]?.toUpperCase() ?? "").join("") || trimmed.slice(0, 2).toUpperCase(); } - return trimmed.slice(0, 2); + return Array.from(trimmed).slice(0, 2).join(""); } export function EmployeeAvatar({ diff --git a/client/src/features/mobile/navigation.ts b/client/src/features/mobile/navigation.ts index 432d209a..c6af5ac5 100644 --- a/client/src/features/mobile/navigation.ts +++ b/client/src/features/mobile/navigation.ts @@ -20,7 +20,7 @@ export const MOBILE_LEAVE_PERMISSIONS = ["leave.view_own", "leave.view_all"] as export const MOBILE_REIMBURSEMENT_PERMISSIONS = ["expense.view_own", "expense.view_all"] as const; export type MobileNavItem = { - key: "home" | "approvals" | "capture" | "me"; + key: "home" | "approvals" | "reimbursements" | "me"; to: string; label: string; icon: string; @@ -30,6 +30,6 @@ export type MobileNavItem = { export const MOBILE_NAV_ITEMS: MobileNavItem[] = [ { key: "home", to: "/mobile", label: "首页", icon: "home" }, { key: "approvals", to: "/mobile/approvals", label: "审批", icon: "fact_check", anyOf: MOBILE_APPROVAL_PERMISSIONS }, - { key: "capture", to: "/mobile/capture", label: "票据", icon: "receipt_long", anyOf: MOBILE_CAPTURE_PERMISSIONS }, + { key: "reimbursements", to: "/mobile/reimbursements", label: "报销", icon: "request_quote", anyOf: MOBILE_REIMBURSEMENT_PERMISSIONS }, { key: "me", to: "/mobile/me", label: "我的", icon: "person" }, ]; diff --git a/client/src/layouts/AppShellLayout.tsx b/client/src/layouts/AppShellLayout.tsx index b85ef41f..bda4e124 100644 --- a/client/src/layouts/AppShellLayout.tsx +++ b/client/src/layouts/AppShellLayout.tsx @@ -11,6 +11,8 @@ import { resolveMobileEquivalentPath, shouldPreferMobileWorkplace } from "../lib export function AppShellLayout() { const location = useLocation(); const isMobileRoute = location.pathname.startsWith("/mobile"); + const isMobileDeepRoute = /^\/mobile\/reimbursements\/[^/]+$/.test(location.pathname); + const showMobileBottomNav = isMobileRoute && !isMobileDeepRoute; const mobileEquivalentPath = !isMobileRoute && shouldPreferMobileWorkplace() ? resolveMobileEquivalentPath(location.pathname, location.search) : null; @@ -42,7 +44,7 @@ export function AppShellLayout() { - {isMobileRoute ? : null} + {showMobileBottomNav ? : null} ); diff --git a/client/src/pages/MobileReimbursementDetailPage.tsx b/client/src/pages/MobileReimbursementDetailPage.tsx index 687ec0b6..c6513840 100644 --- a/client/src/pages/MobileReimbursementDetailPage.tsx +++ b/client/src/pages/MobileReimbursementDetailPage.tsx @@ -758,9 +758,12 @@ export function MobileReimbursementDetailPage() { } const displayCode = resolveReimbursementDisplayCode(detail); + const showSubmitAction = Boolean(canEdit && canSubmitExpense); + const showStickyActions = Boolean(showSubmitAction || canOpenInvoiceDialog); + const showSecondaryActions = Boolean(actionError || canDeleteDraft || !canEdit); return ( - +
+ ) : null} + {!canEdit ?
当前状态不可编辑。
: null} + + + ) : null} + + {showStickyActions ? ( +
+
+ {canOpenInvoiceDialog ? ( + + ) : null} + {showSubmitAction ? ( + + ) : null}
- ) : null} -
- {canEdit && canSubmitExpense ? ( - - ) : null} - {canDeleteDraft ? ( - - ) : null} - {!canEdit ?
当前状态不可编辑。
: null}
- + ) : null} { await page.goto("/mobile"); await expect(page.getByTestId("mobile-nav-home")).toBeVisible(); await expect(page.getByTestId("mobile-nav-approvals")).toBeVisible(); - await expect(page.getByTestId("mobile-nav-capture")).toBeVisible(); + await expect(page.getByTestId("mobile-nav-reimbursements")).toBeVisible(); await expect(page.getByTestId("mobile-nav-me")).toBeVisible(); await expectNoDesignRegressionCopy(page); await page.screenshot({ path: screenshotPath("mobile-home.png"), fullPage: true }); diff --git a/client/tests/e2e/r105-pretrial-visual.spec.ts b/client/tests/e2e/r105-pretrial-visual.spec.ts index c8f9a6ee..a39e28c6 100644 --- a/client/tests/e2e/r105-pretrial-visual.spec.ts +++ b/client/tests/e2e/r105-pretrial-visual.spec.ts @@ -77,7 +77,7 @@ test.describe("R105 pretrial visual acceptance", () => { await page.goto("/mobile"); await expect(page.getByTestId("mobile-nav-home")).toBeVisible(); - await expect(page.getByTestId("mobile-nav-capture")).toBeVisible(); + await expect(page.getByTestId("mobile-nav-reimbursements")).toBeVisible(); await expectNoDesktopTableOnMobile(page); await expectNoLegacyDesignCopy(page); await expectNotBlackSurface(page.getByTestId("mobile-nav-home")); diff --git a/client/tests/e2e/r124-mobile-entry-matrix.spec.ts b/client/tests/e2e/r124-mobile-entry-matrix.spec.ts index 27f6ca1f..7d713707 100644 --- a/client/tests/e2e/r124-mobile-entry-matrix.spec.ts +++ b/client/tests/e2e/r124-mobile-entry-matrix.spec.ts @@ -469,7 +469,12 @@ test.describe("R124 企业微信移动入口矩阵", () => { await expect(mobile.page.getByTestId("mobile-nav-home")).toBeVisible(); await expectMobilePageContract(mobile.page); - await mobile.page.getByTestId("mobile-nav-capture").click(); + await mobile.page.getByTestId("mobile-nav-reimbursements").click(); + await expect(mobile.page).toHaveURL(/\/mobile\/reimbursements$/); + await expect(mobile.page.getByTestId("mobile-reimbursements-list")).toBeVisible(); + await expectMobilePageContract(mobile.page); + + await mobile.page.goto("/mobile/capture"); await expect(mobile.page).toHaveURL(/\/mobile\/capture$/); await expect(mobile.page.getByTestId("mobile-capture-camera-file")).toBeAttached(); await expect(mobile.page.getByTestId("mobile-capture-image-file")).toBeAttached(); diff --git a/client/tests/e2e/r5-real-device-feedback-mobile-ux.spec.ts b/client/tests/e2e/r5-real-device-feedback-mobile-ux.spec.ts new file mode 100644 index 00000000..13dc6bf5 --- /dev/null +++ b/client/tests/e2e/r5-real-device-feedback-mobile-ux.spec.ts @@ -0,0 +1,260 @@ +import { mkdirSync } from "node:fs"; +import path from "node:path"; +import { expect, test, type Page, type Route } from "@playwright/test"; + +const ROOT_DIR = path.resolve(process.cwd(), ".."); +const SCREENSHOT_DIR = path.join(ROOT_DIR, "output/playwright/r5-real-device-feedback-mobile-ux"); +const WECOM_UA = + "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 wxwork/4.1.20 MicroMessenger/8.0.1 Language/zh_CN"; + +const employee = { + id: "11111111-1111-4111-8111-111111111111", + employeeNo: "HYD000006", + name: "王顺利", + phone: "13800000000", + email: "wangshunli@hyinda.com", + departmentId: "dept-1", + directManagerId: "manager-1", + status: "active", + notificationPushEnabled: true, + roleCodes: ["employee"], + profileCompleteness: { + hasEmergencyContact: true, + hasBankAccount: true, + hasAvatar: false, + hasIdNumber: false, + score: 50, + }, + wecomBinding: null, +}; + +function envelope(data: unknown) { + return { requestId: "mock-r5-mobile-ux", data }; +} + +async function fulfillJson(route: Route, data: unknown, status = 200) { + await route.fulfill({ + status, + contentType: "application/json", + body: JSON.stringify(envelope(data)), + }); +} + +function screenshotPath(fileName: string) { + mkdirSync(SCREENSHOT_DIR, { recursive: true }); + return path.join(SCREENSHOT_DIR, `${fileName}.png`); +} + +async function mockApis(page: Page) { + await page.route((url) => url.pathname.startsWith("/api/"), async (route) => { + const request = route.request(); + const url = new URL(request.url()); + const pathName = url.pathname; + + if (pathName === "/api/auth/login" || pathName === "/api/auth/refresh") { + await route.fulfill({ + status: 200, + contentType: "application/json", + headers: { "set-cookie": "has_session=1; Path=/; SameSite=Lax" }, + body: JSON.stringify(envelope({ accessToken: "mock-r5-token", expiresIn: 900 })), + }); + return; + } + + if (pathName === "/api/me") { + await fulfillJson(route, employee); + return; + } + + if (pathName === `/api/employees/${employee.id}/profile`) { + await fulfillJson(route, { + employee: { + ...employee, + title: "负责人", + avatarUrl: null, + department: { id: "dept-1", name: "管理部" }, + directManager: { id: "manager-1", name: "马建勇" }, + }, + lifecycle: { events: [], checklistTasks: [], blockers: { openAssetCount: 0, pendingWorkflowTaskCount: 0, canCompleteOffboarding: true } }, + assignedAssets: [], + organization: { reportingChain: [], directReports: [] }, + }); + return; + } + + if (pathName === "/api/reimbursements" && request.method() === "GET") { + await fulfillJson(route, { + page: 1, + pageSize: 20, + total: 1, + scope: "own", + items: [ + { + id: "r5-reimbursement-1", + formNumber: null, + status: "draft", + reimbursementDate: "2026-05-10", + totalAmount: "168.30", + description: "R5 移动交互验收", + payment: {}, + owner: { id: employee.id, employeeNo: employee.employeeNo, name: employee.name }, + submitter: { id: employee.id, employeeNo: employee.employeeNo, name: employee.name }, + project: null, + pendingWorkflow: null, + createdAt: "2026-05-10T08:00:00.000Z", + updatedAt: "2026-05-10T08:00:00.000Z", + }, + ], + }); + return; + } + + if (pathName === "/api/reimbursements/r5-reimbursement-1") { + await fulfillJson(route, { + id: "r5-reimbursement-1", + formNumber: null, + submitterId: employee.id, + ownerId: employee.id, + departmentId: "dept-1", + department: { id: "dept-1", name: "管理部" }, + status: "draft", + createdAt: "2026-05-10T08:00:00.000Z", + submittedAt: null, + reimbursementDate: "2026-05-10", + totalAmount: "168.30", + description: "R5 移动交互验收", + projectId: null, + linkedTravelRequestId: null, + linkedTravelRequest: null, + project: null, + owner: { id: employee.id, employee_no: employee.employeeNo, name: employee.name }, + submitter: { id: employee.id, employee_no: employee.employeeNo, name: employee.name }, + invoices: [], + attachments: [], + budgetHint: null, + pendingWorkflow: null, + workflowProgress: null, + approvalHistory: [], + riskFlags: [], + items: [ + { + id: "item-1", + expenseTypeId: "expense-type-1", + expenseDate: "2026-05-10", + amount: "168.30", + description: "正式运行口径验证", + expenseType: { id: "expense-type-1", code: "office", name: "办公费", category: "office", enabled: true }, + }, + ], + }); + return; + } + + if (pathName === "/api/expense-types") { + await fulfillJson(route, { + page: 1, + pageSize: 20, + total: 1, + items: [{ id: "expense-type-1", code: "office", name: "办公费", category: "office", enabled: true }], + }); + return; + } + + if (pathName === "/api/auth/sso/providers") { + await fulfillJson(route, []); + return; + } + + if (pathName === "/api/auth/wecom/config") { + await fulfillJson(route, { + enabled: true, + entryEnabled: true, + oauthEnabled: true, + corpId: "wx-test-corp", + agentId: "1000002", + loginUrl: "/api/auth/wecom/login?returnTo=%2Fmobile", + bindEnabled: true, + defaultReturnTo: "/mobile", + status: "ready", + statusReasons: [], + }); + return; + } + + await fulfillJson(route, {}); + }); +} + +async function login(page: Page) { + await page.goto("/login"); + const accountLogin = page.getByRole("button", { name: "使用账号密码登录" }); + if (await accountLogin.isVisible().catch(() => false)) { + await accountLogin.click(); + } + await page.getByTestId("login-identifier").fill(employee.email); + await page.getByTestId("login-password").fill("Password1234"); + await page.getByTestId("login-submit").click(); + await page.waitForURL(/\/(portal|mobile)/, { timeout: 30_000 }); +} + +async function collectMobileMetrics(page: Page) { + return page.evaluate(() => { + const bottomNav = document.querySelector("[data-testid='mobile-nav-reimbursements']")?.closest("nav"); + const stickyActions = document.querySelector("[data-testid='mobile-reimbursement-sticky-actions']"); + const stickyRect = stickyActions?.getBoundingClientRect(); + return { + width: window.innerWidth, + scrollWidth: Math.max(document.documentElement.scrollWidth, document.body?.scrollWidth ?? 0), + tableCount: Array.from(document.querySelectorAll("table")).filter((item) => item.getBoundingClientRect().height > 0).length, + bottomNavVisible: Boolean(bottomNav && bottomNav.getBoundingClientRect().height > 0), + stickyActionsVisible: Boolean(stickyRect && stickyRect.height > 0 && stickyRect.bottom <= window.innerHeight + 2), + text: document.body?.innerText ?? "", + }; + }); +} + +test.describe("R5 真机反馈移动交互", () => { + test.use({ + viewport: { width: 390, height: 844 }, + isMobile: true, + hasTouch: true, + userAgent: WECOM_UA, + locale: "zh-CN", + serviceWorkers: "block", + }); + + test("中文头像首字、报销底部 Tab 和详情深层页交互符合企业微信体验", async ({ page }) => { + await mockApis(page); + await login(page); + + await page.goto("/mobile/me"); + await expect(page.getByText("王", { exact: true })).toBeVisible(); + await page.screenshot({ path: screenshotPath("mobile-me-avatar"), fullPage: true }); + + await page.goto("/mobile/reimbursements"); + await expect(page.getByTestId("mobile-nav-reimbursements")).toBeVisible(); + await expect(page.getByTestId("mobile-reimbursements-list")).toBeVisible(); + await page.screenshot({ path: screenshotPath("mobile-reimbursements-tab"), fullPage: true }); + + const listMetrics = await collectMobileMetrics(page); + expect(listMetrics.bottomNavVisible).toBe(true); + expect(listMetrics.scrollWidth).toBeLessThanOrEqual(listMetrics.width + 2); + + await page.goto("/mobile/reimbursements/r5-reimbursement-1"); + await expect(page.getByTestId("mobile-reimbursement-detail")).toBeVisible(); + await expect(page.getByTestId("mobile-nav-reimbursements")).toHaveCount(0); + await expect(page.getByRole("link", { name: "返回" })).toBeVisible(); + await expect(page.getByTestId("mobile-reimbursement-sticky-actions")).toBeVisible(); + await expect(page.getByTestId("mobile-reimbursement-sticky-invoice-add")).toBeVisible(); + await expect(page.getByTestId("reimbursement-submit")).toBeVisible(); + await page.screenshot({ path: screenshotPath("mobile-reimbursement-detail-sticky"), fullPage: true }); + + const detailMetrics = await collectMobileMetrics(page); + expect(detailMetrics.bottomNavVisible).toBe(false); + expect(detailMetrics.stickyActionsVisible).toBe(true); + expect(detailMetrics.tableCount).toBe(0); + expect(detailMetrics.scrollWidth).toBeLessThanOrEqual(detailMetrics.width + 2); + expect(detailMetrics.text).not.toContain("发票池"); + expect(detailMetrics.text).not.toContain("绑定整单"); + }); +}); diff --git a/client/tests/e2e/r89-mobile-login-navigation.spec.ts b/client/tests/e2e/r89-mobile-login-navigation.spec.ts index cb179fd3..30e018cd 100644 --- a/client/tests/e2e/r89-mobile-login-navigation.spec.ts +++ b/client/tests/e2e/r89-mobile-login-navigation.spec.ts @@ -309,6 +309,16 @@ async function mockR89Apis(page: Page) { return; } + if (path === "/api/reimbursements") { + await fulfillJson(route, { + page: 1, + pageSize: Number(url.searchParams.get("pageSize") ?? 20), + total: 0, + items: [], + }); + return; + } + if (path === `/api/employees/${mockMe.id}/profile`) { await fulfillJson(route, { employee: { @@ -385,7 +395,7 @@ test.describe("R89 企业微信移动入口", () => { test.describe("R89 移动底部导航与核心页面", () => { test.use(browserAgnosticDevice("iPhone 13")); - test("密码登录后可完成移动首页、审批、票据和我的页关键路径", async ({ page }, testInfo) => { + test("密码登录后可完成移动首页、审批、报销和我的页关键路径", async ({ page }, testInfo) => { await mockR89Apis(page); await loginByPassword(page); @@ -396,7 +406,7 @@ test.describe("R89 移动底部导航与核心页面", () => { await expect(page.getByTestId("mobile-nav-home")).toBeVisible(); await expect(page.getByTestId("mobile-nav-approvals")).toBeVisible(); - await expect(page.getByTestId("mobile-nav-capture")).toBeVisible(); + await expect(page.getByTestId("mobile-nav-reimbursements")).toBeVisible(); await expect(page.getByTestId("mobile-nav-me")).toBeVisible(); await page.getByTestId("mobile-nav-approvals").click(); @@ -408,7 +418,12 @@ test.describe("R89 移动底部导航与核心页面", () => { await expect(page.getByTestId("mobile-approvals-reject")).toBeVisible(); await attachScreenshot(page, testInfo, "r97-mobile-approvals.png"); - await page.getByTestId("mobile-nav-capture").click(); + await page.getByTestId("mobile-nav-reimbursements").click(); + await expect(page).toHaveURL(/\/mobile\/reimbursements/); + await expect(page.getByTestId("mobile-reimbursements-list")).toBeVisible(); + await attachScreenshot(page, testInfo, "r97-mobile-reimbursements.png"); + + await page.goto("/mobile/capture"); await expect(page).toHaveURL(/\/mobile\/capture/); await expect(page.getByRole("heading", { name: "票据上传" })).toBeVisible(); await expect(page.getByRole("button", { name: /选择 PDF/ })).toBeVisible(); diff --git a/docs/trialrun/real-device-public-checklist.md b/docs/trialrun/real-device-public-checklist.md index 04a80a34..bba13f05 100644 --- a/docs/trialrun/real-device-public-checklist.md +++ b/docs/trialrun/real-device-public-checklist.md @@ -9,7 +9,7 @@ - 测试日期： - 测试人： - 公网地址：`https://oa.hyinda.com` -- 账号角色：员工 / 经理 / 财务 / 管理员 +- 账号角色：专用员工 / 经理 / 财务 / 管理员 / 后台公司负责人 - 设备：iPhone / Android - 系统版本： - 企业微信版本： @@ -23,7 +23,8 @@ - 已绑定账号应直接进入移动工作台，不应反复要求登录。 - 未绑定账号应显示明确绑定或登录提示，登录后能回到目标页。 - 首屏应为移动工作台，不应出现 PC 侧边栏、桌面表格或路径式标题。 -- 底部导航可切换：首页、审批、票据、我的。 +- 底部导航可切换：首页、审批、报销、我的。 +- 报销详情、审批详情等深层页应使用顶部返回和上下文操作，不应继续显示底部导航造成焦点混乱。 ## 手机浏览器入口 @@ -60,6 +61,10 @@ ## 审批与通知 +- 正式审批口径：`majianyong` 是员工可见的直属主管；`wangshunli` 是后台公司负责人，配置为 `ceo + admin`，不配置为普通 `manager`。 +- 专用员工提交的普通低/中额单据应由 `majianyong` 审批；高额、高风险或例外单据按规则进入 `wangshunli` 二审。 +- `majianyong` 本人提交的单据应由 `wangshunli` 审批。 +- `wangshunli` 本人提交的单据不得由自己审批；若触发本人审批节点，应阻断或改派给明确的非本人兜底审批人。 - 经理账号可在移动端看到审批待办。 - 审批详情可查看申请摘要、附件、发票、审批记录。 - 通过、驳回、退回等操作有确认和结果反馈。 diff --git a/issues/2026-05-10_12-39-37-release-readiness-live-smoke.csv b/issues/2026-05-10_12-39-37-release-readiness-live-smoke.csv index 31975c34..1f86f1af 100644 --- a/issues/2026-05-10_12-39-37-release-readiness-live-smoke.csv +++ b/issues/2026-05-10_12-39-37-release-readiness-live-smoke.csv @@ -3,5 +3,5 @@ R1,发布候选证据整理,"固定首轮主线 release candidate，汇总 A1-A8 R2,本地门禁与 Runbook 补强,"把 A8 本地回归真实需要的本地服务参数、命令顺序、live smoke 检查和 SKIP 规则写入当前操作手册，避免后续误判。","1) Runbook 写明 SERVE_CLIENT_DIST、OCR_PROVIDER、IM_NOTIFIER_ENABLED、FIELD_ENCRYPTION_KEY 和项目 feature env 的本地门禁用途；2) live smoke 清单链接到发布准备清单；3) 不新增业务 API、数据库迁移或部署操作。","流程级验证：人工阅读 Runbook 能复现 A8 本地门禁准备；命令：rg -n \"发布候选|SERVE_CLIENT_DIST|OCR_PROVIDER|IM_NOTIFIER_ENABLED|FIELD_ENCRYPTION_KEY|PROJECT_DOMAIN_ENABLED|release-readiness-checklist\" docs/trialrun-runbook.md docs/trialrun/live-smoke-readiness.md docs/文档索引.md。","rg|manual",DONE,DONE,DONE,"docs/trialrun-runbook.md|docs/trialrun/live-smoke-readiness.md|docs/文档索引.md","[\"R1\"]","仅补文档和清单；测试 FIELD_ENCRYPTION_KEY 只能用于本地回归，生产必须使用安全密钥且不得提交。" R3,权限直连审计,"在部署前用员工、主管、财务、管理员账号直连主路径和备用路径，确认导航隐藏没有掩盖服务端授权缺口。","1) 形成角色 x 路径允许/拒绝矩阵；2) 普通员工直连预算、AP、ERP、完整差旅、票据中心、合同台账、付款批次等备用路径不得获得越权数据；3) 若发现服务端权限缺口，先拆独立修复 Issue，不进入部署。","流程级验证：分别登录员工、主管、财务、管理员账号 -> 直连 /budgets、/ap、/system/integrations/erp、/travel-requests、/invoice-pool、/contracts-registry、/payment-batches 和对应 API -> 记录 HTTP 状态、页面提示和是否泄露数据；命令：cd client && npm run test:e2e -- permission-direct-access.spec.ts settings-governance.spec.ts login-portal-ux.spec.ts --workers=1。","playwright|curl|manual",DONE,DONE,DONE,"client/tests/e2e/permission-direct-access.spec.ts|docs/trialrun/permission-direct-access-audit.md|docs/trialrun/release-readiness-checklist.md|issues/2026-05-10_12-39-37-release-readiness-live-smoke.csv","[\"R2\"]","R3 已完成：新增权限直连 E2E 和审计记录；首次 E2E 因 127.0.0.1:3000 未启动失败，启动本地 OA 服务后重跑通过 10 passed；typecheck/build/CSV/diff check 通过；未发现权限泄漏，未改业务代码，R4 仍未执行。" R4,部署预检,"检查生产/公网环境变量、数据库迁移状态、备份、回滚命令、Caddy/systemd 状态、/ready 和前端资源版本；未经批准不部署。","1) 生产环境变量缺项和敏感项不打印；2) 数据库迁移状态明确且有备份/回滚路径；3) Caddy/systemd 或既有部署方式健康；4) /ready 与前端资源版本可核对；5) 若需要修改生产配置，必须先获得确认。","流程级验证：只读检查部署目录、服务状态和 /ready；命令：node scripts/qa/check-live-smoke-env.mjs；命令：LIVE_SMOKE_BASE_URL=https://oa.hyinda.com bash scripts/qa/run-live-smoke-readiness.sh；生产变更前必须停止等待批准。","ssh|bash|node|manual",DONE,DONE,DONE,"deploy/*|scripts/qa/*|docs/trialrun/release-readiness-checklist.md","[\"R3\"]","R4 完成：先发现远端运行时代码未对齐，后续按治理合同完成部署前备份、D3 受控同步和 D4 只读复检；远端关键运行时文件哈希已对齐，本机/公网 /ready 200，Prisma up to date，Caddy 正常，企业微信 config 不含 secret，公网 bundle 扫描 0 findings；R5 仍未执行。" -R5,公网企业微信和真实 OCR live smoke,"在 R4 预检通过且真实测试账号、企业微信配置和真实 OCR 样票齐备后，执行公网登录、企业微信入口、移动审批、报销/OCR 上传和通知 deeplink。","1) LIVE_SMOKE_* 从缺失变为可执行；2) 企业微信 config、OAuth 跳转和手机入口可验证；3) 真实 OCR 样票上传能进入可解释终态；4) 缺配置时继续 SKIP，不得宣称真机或真实 OCR 通过。","流程级验证：node scripts/qa/check-live-smoke-env.mjs --strict；命令：LIVE_SMOKE_BASE_URL=https://oa.hyinda.com bash scripts/qa/run-live-smoke-readiness.sh；人工真机：手机企业微信工作台打开海音达工作台 -> deeplink 回 OA 审批或详情页 -> 记录结果。","node|bash|playwright|manual",DOING,TODO,TODO,"scripts/qa/*|docs/trialrun/live-smoke-readiness.md|docs/trialrun/real-device-public-checklist.md","[\"R4\"]","R5 smoke 密码重置合同 issues/2026-05-10_17-10-42-r5-smoke-password-reset-and-live-smoke.csv 已完成 K1-K5；SMOKE001/SMOKE002 已重置为仓库外安全凭据，登录标识按公网 auth 契约使用 smoke 邮箱；check-live-smoke-env --strict 通过；run-live-smoke-readiness.sh 通过，证据目录 artifacts/qa-flow/live-smoke-readiness-20260510-172421，公网 bundle findings=0，live smoke 3 passed，真实 OCR 样票不再 SKIP 且终态为重复发票/ocr_failed 可解释；pending OCR 辅助扫描因缺 DATABASE_URL 继续 SKIP；K4 审计 authSessions 555->572、auditLogs 258->263，发票/报销数量未新增；企业微信真机人工验收尚未执行，所以主 R5 仍保持 DOING/TODO/TODO，R6 保持 TODO。" +R5,公网企业微信和真实 OCR live smoke,"在 R4 预检通过且真实测试账号、企业微信配置和真实 OCR 样票齐备后，执行公网登录、企业微信入口、移动审批、报销/OCR 上传和通知 deeplink。","1) LIVE_SMOKE_* 从缺失变为可执行；2) 企业微信 config、OAuth 跳转和手机入口可验证；3) 真实 OCR 样票上传能进入可解释终态；4) 缺配置时继续 SKIP，不得宣称真机或真实 OCR 通过。","流程级验证：node scripts/qa/check-live-smoke-env.mjs --strict；命令：LIVE_SMOKE_BASE_URL=https://oa.hyinda.com bash scripts/qa/run-live-smoke-readiness.sh；人工真机：手机企业微信工作台打开海音达工作台 -> deeplink 回 OA 审批或详情页 -> 记录结果。","node|bash|playwright|manual",DOING,TODO,TODO,"scripts/qa/*|docs/trialrun/live-smoke-readiness.md|docs/trialrun/real-device-public-checklist.md","[\"R4\"]","R5 smoke 密码重置合同 issues/2026-05-10_17-10-42-r5-smoke-password-reset-and-live-smoke.csv 已完成 K1-K5；SMOKE001/SMOKE002 已重置为仓库外安全凭据，登录标识按公网 auth 契约使用 smoke 邮箱；check-live-smoke-env --strict 通过；run-live-smoke-readiness.sh 通过，证据目录 artifacts/qa-flow/live-smoke-readiness-20260510-172421，公网 bundle findings=0，live smoke 3 passed，真实 OCR 样票不再 SKIP 且终态为重复发票/ocr_failed 可解释；pending OCR 辅助扫描因缺 DATABASE_URL 继续 SKIP；K4 审计 authSessions 555->572、auditLogs 258->263，发票/报销数量未新增；本轮 R5 真机反馈与正式运行口径代码收口已完成：issues/2026-05-10_17-47-39-r5-real-device-feedback-mobile-ux.csv M1-M5 DONE，后端禁止自审/admin-only 审批，移动底部 Tab 改为报销，头像中文首字；正式组织配置另拆 issues/2026-05-10_18-25-33-formal-approval-org-config.csv，O1-O3 仍为 TODO；企业微信真机正式链路验收尚未执行，且本轮未部署，所以主 R5 仍保持 DOING/TODO/TODO，R6 保持 TODO。" R6,小范围试运行,"公网和真机 smoke 通过后，只开放 2-3 个内部用户按清单试运行报销、请假、采购、审批、企业微信移动入口、付款和导出；反馈转新 Issue。","1) 试运行名单、角色、时间窗口和回滚联系人明确；2) 员工提交、审批人审批、财务付款/导出、企业微信 deeplink 回 OA 均有记录；3) 每日问题只登记和分级，不现场扩大 P2 功能范围；4) 试运行结束形成继续/回滚/修复判断。","流程级验证：员工提交报销/请假/采购 -> 主管或财务审批 -> 财务付款或导出 -> 企业微信通知 deeplink 回 OA -> 管理员检查审计和状态；人工记录问题、截图和处理结论。","manual|playwright",TODO,TODO,TODO,"docs/trialrun/release-readiness-checklist.md|docs/trialrun/manual-trialrun-report.md|issues/*.csv","[\"R5\"]","小范围试运行前不得扩 P2 预算、ERP、AI、完整差旅、复杂 BPM；反馈必须进入新 Issue CSV。" diff --git a/issues/2026-05-10_17-47-39-r5-real-device-feedback-mobile-ux.csv b/issues/2026-05-10_17-47-39-r5-real-device-feedback-mobile-ux.csv new file mode 100644 index 00000000..86c17d55 --- /dev/null +++ b/issues/2026-05-10_17-47-39-r5-real-device-feedback-mobile-ux.csv @@ -0,0 +1,6 @@ +ID,Title,Description,Acceptance,Test_Method,Tools,Dev_Status,Review1_Status,Regression_Status,Files,Dependencies,Notes +M1,核实与合同建档,"记录 R5 真机反馈三项问题的核实结论，并将审批组织测试口径从临时互审修正为正式运行：majianyong 是员工可见直属主管；wangshunli 是后台公司负责人，使用 ceo+admin，不配置为普通 manager；不部署、不关闭主 R5。","1) Issue CSV 校验通过；2) admin 不自动获得业务审批权；3) wangshunli 自审应禁止；4) 中文头像取首字；5) 报销进入移动底部一级入口且详情页隐藏底部 Tab；6) 正式测试数据配置另拆 Issue，不混入本轮代码。","流程级验证：读取 docs/需求-统一审批中心规约.md、docs/product-design-rules.md、docs/reimbursement-invoice-rules.md；只读核实公网 wangshunli/majianyong 当前角色与直属上级；命令：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-10_17-47-39-r5-real-device-feedback-mobile-ux.csv。","python3|ssh|manual",DONE,DONE,DONE,"issues/2026-05-10_17-47-39-r5-real-device-feedback-mobile-ux.csv","[]","本轮不新增 schema、不部署；主 R5 仍需部署后公网 smoke 与企业微信真机记录。正式配置默认：员工直属主管 majianyong；majianyong 直属领导 wangshunli；普通员工单据仅高额/高风险/例外进入 wangshunli 二审。已另建正式审批组织配置合同 issues/2026-05-10_18-25-33-formal-approval-org-config.csv。回滚路径：回滚本合同和本轮代码提交。" +M2,审批自审拦截与提示,"在 workflow 动作入口统一禁止申请人/提交人审批自己的单据，覆盖单任务、批量通过、批量驳回、退回和转审；同时要求审批动作来自正式业务审批角色，admin 的 * 权限不能单独作为业务审批依据；提交阶段缺直属主管时阻断半截流程。","1) 自审返回 workflow=self_approval_not_allowed；2) 报销 owner/submitter、请假 owner、采购 applicant/submitter、差旅 applicant/submitter 均被识别；3) admin-only 审批人或转审目标不被视为业务审批人；4) 缺直属主管返回 no_actionable_approver；5) 非申请人审批不回归；6) 前端错误文案可理解。","流程级验证：申请人同时具备审批角色 -> 单任务与批量审批均被拒绝；admin-only 不能以系统管理权限审批；缺直属主管的提交/预检被阻断；非申请人审批仍可通过。命令：cd server && npm run prisma:validate；命令：cd server && node --check src/routes/workflow.js；命令：cd server && npm test -- tests/unit/routes/workflow.batch.test.js tests/unit/routes/workflow.transfer.test.js tests/unit/utils/workflow.test.js。","node|vitest",DONE,DONE,DONE,"server/src/routes/workflow.js|server/src/utils/workflow.js|server/src/services/feeControl.js|server/tests/unit/routes/workflow.batch.test.js|server/tests/unit/routes/workflow.transfer.test.js|server/tests/unit/utils/workflow.test.js|client/src/api/errorMessages.ts","[""M1""]","已通过 prisma:validate、node --check workflow.js/utils/feeControl、workflow.batch/transfer/task-detail/utils 单测 23 passed。涉及 workflow 权限和审批规则，review 重点：不得阻断转审给非本人、不得影响已办详情、不得让 admin-only 绕过正式业务角色；回滚路径：回退 workflow 自审/业务角色拦截、缺主管阻断、前端错误映射和新增测试。" +M3,中文头像首字规则,"调整 EmployeeAvatar fallback：中文/CJK 姓名默认显示首字；英文/拼音继续显示两段首字母；空姓名仍显示员工。","1) 王顺利显示王；2) 张三显示张；3) Wang Shunli 显示 WS；4) 空姓名显示员工；5) 不影响真实头像图片展示。","流程级验证：企业微信 UA 打开 /mobile/me，个人信息头像 fallback 显示首字；命令：cd client && npm run typecheck；命令：cd client && npm run test:e2e -- r5-real-device-feedback-mobile-ux.spec.ts --workers=1。","typescript|playwright",DONE,DONE,DONE,"client/src/components/common/EmployeeAvatar.tsx|client/tests/e2e/r5-real-device-feedback-mobile-ux.spec.ts","[""M1""]","已通过 client typecheck/build 与 r5-real-device-feedback-mobile-ux.spec.ts；纯前端显示规则，无 API 变更；回滚路径：恢复 buildInitials 原逻辑。" +M4,移动报销导航与深层页交互,"将报销设为移动底部一级入口，票据上传降为首页/报销内快捷入口；报销详情隐藏底部 Tab，并提供顶部返回和吸底主操作。","1) /mobile/reimbursements 底部报销 Tab 选中；2) /mobile/reimbursements/:id 不显示底部 Tab；3) 草稿/驳回详情页首屏或吸底区域可见提交审批和添加发票；4) 无横向滚动或遮挡。","流程级验证：企业微信 UA -> /mobile -> 报销 -> 新建/进入详情 -> 验证底部导航、返回和吸底操作；命令：cd client && npm run typecheck；命令：cd client && npm run build；命令：cd client && npm run test:e2e -- r89-mobile-login-navigation.spec.ts r109-mobile-reimbursement-feedback.spec.ts r110-mobile-pc-routing.spec.ts r111-invoice-reimbursement-guard.spec.ts r124-mobile-entry-matrix.spec.ts r5-real-device-feedback-mobile-ux.spec.ts --workers=1。","typescript|playwright",DONE,DONE,DONE,"client/src/features/mobile/navigation.ts|client/src/components/mobile/MobileBottomNav.tsx|client/src/layouts/AppShellLayout.tsx|client/src/pages/MobileReimbursementDetailPage.tsx|client/tests/e2e/*.ts","[""M2"",""M3""]","已通过 client typecheck/build 和移动报销 E2E 10 passed；不删除 /mobile/capture；仅从底部一级 Tab 移除。回滚路径：恢复 MOBILE_NAV_ITEMS、AppShellLayout 底部导航显示规则和详情页操作区。" +M5,自动化视觉验证与 R5 证据回填,"执行本轮后端、前端、E2E 与视觉检查，截图输出到 output/playwright/r5-real-device-feedback-mobile-ux/；回填主 R5 Notes 但不标 DONE。","1) 后端 workflow 检查通过；2) 前端 typecheck/build 通过；3) 关键 E2E 和新增视觉用例通过；4) 主 R5 记录本轮仍需部署后公网 smoke 和企业微信真机；5) git diff --check 通过。","流程级验证：执行 M2-M4 所列命令；命令：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-10_17-47-39-r5-real-device-feedback-mobile-ux.csv；命令：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-10_12-39-37-release-readiness-live-smoke.csv；命令：git diff --check。","python3|git|playwright",DONE,DONE,DONE,"issues/2026-05-10_17-47-39-r5-real-device-feedback-mobile-ux.csv|issues/2026-05-10_12-39-37-release-readiness-live-smoke.csv|issues/2026-05-10_18-25-33-formal-approval-org-config.csv|docs/trialrun/real-device-public-checklist.md|output/playwright/r5-real-device-feedback-mobile-ux","[""M2"",""M3"",""M4""]","本轮本地完成且不部署；截图输出到 output/playwright/r5-real-device-feedback-mobile-ux/。部署后需重跑 LIVE_SMOKE_BASE_URL=https://oa.hyinda.com bash scripts/qa/run-live-smoke-readiness.sh 并补企业微信真机验收。" diff --git a/issues/2026-05-10_18-25-33-formal-approval-org-config.csv b/issues/2026-05-10_18-25-33-formal-approval-org-config.csv new file mode 100644 index 00000000..b7f110de --- /dev/null +++ b/issues/2026-05-10_18-25-33-formal-approval-org-config.csv @@ -0,0 +1,4 @@ +ID,Title,Description,Acceptance,Test_Method,Tools,Dev_Status,Review1_Status,Regression_Status,Files,Dependencies,Notes +O1,正式审批组织配置确认,"按正式公司运行口径确认公网组织关系和业务审批角色：majianyong 是员工可见直属主管；wangshunli 是后台公司负责人，使用 ceo+admin，不配置为普通 manager。","1) 远端当前角色和直属上级只读核实；2) 形成待写配置清单；3) 明确 admin 不自动获得业务审批权；4) 未经批准不写远端数据库。","流程级验证：只读查询公网员工 wangshunli/majianyong 的 roleCodes、directManagerId、department；核对 docs/需求-统一审批中心规约.md；不执行 UPDATE。","ssh|manual",TODO,TODO,TODO,"external|issues/2026-05-10_18-25-33-formal-approval-org-config.csv","[]","默认待配置：wangshunli roleCodes 包含 admin+ceo；majianyong roleCodes 包含 manager；员工直属主管为 majianyong；majianyong 直属领导为 wangshunli。回滚路径：恢复修改前角色和 direct_manager_id。" +O2,专用正式测试账号准备,"准备不使用真实员工日常账号的公网专用测试账号，并按正式组织关系挂到 majianyong 主管链路。","1) 专用员工、主管、财务或负责人测试账号 active；2) 密码只保存在仓库外安全位置；3) 自动化不使用真实员工日常账号；4) 账号角色满足正式审批链验证。","流程级验证：只读检查账号存在与状态；如需创建或重置密码，必须另行批准远端写操作；node scripts/qa/check-live-smoke-env.mjs --strict。","ssh|node|manual",TODO,TODO,TODO,"external","[""O1""]","本 Issue 若执行写操作，仅限测试账号和正式组织配置；不得部署、迁移或修改远端 .env。" +O3,正式审批链公网验收,"使用专用测试账号验证正式审批链：员工 -> majianyong；majianyong -> wangshunli；高额/例外单据触发 wangshunli 二审。","1) 普通低/中额员工单据由 majianyong 处理；2) 高额/高风险/例外进入 wangshunli；3) majianyong 本人申请由 wangshunli 处理；4) wangshunli 本人不能自审。","流程级验证：公网/企业微信专用账号提交报销或请假 -> 对应审批人处理 -> 检查审批历史、通知 deeplink 和业务状态；失败项记录截图/录屏位置。","playwright|manual",TODO,TODO,TODO,"docs/trialrun/real-device-public-checklist.md","[""O2""]","通过前不得把主 R5 标记为 DONE；如需清理测试数据，另拆 destructive cleanup Issue。" diff --git a/server/src/routes/leave.js b/server/src/routes/leave.js index d248022a..b3edbef8 100644 --- a/server/src/routes/leave.js +++ b/server/src/routes/leave.js @@ -1015,6 +1015,7 @@ async function leaveRoutes(fastify) { startIndex: 0, ownerId: leave.owner_id, logger: fastify.log, + blockOnUnresolvedAssignee: true, }); if (!actionable) { throw buildValidationError({ workflow: "no_actionable_approver" }, 409); diff --git a/server/src/routes/purchaseRequests.js b/server/src/routes/purchaseRequests.js index cbfae0b8..71e95bf1 100644 --- a/server/src/routes/purchaseRequests.js +++ b/server/src/routes/purchaseRequests.js @@ -1524,6 +1524,7 @@ async function purchaseRequestRoutes(fastify) { startIndex: 0, ownerId: unlockedPurchaseRequest.applicant_id, logger: fastify.log, + blockOnUnresolvedAssignee: true, }); if (!actionable) { diff --git a/server/src/routes/reimbursements.js b/server/src/routes/reimbursements.js index 3e7f9385..f376627b 100644 --- a/server/src/routes/reimbursements.js +++ b/server/src/routes/reimbursements.js @@ -3179,6 +3179,7 @@ async function reimbursementRoutes(fastify) { startIndex: 0, ownerId: reimbursement.owner_id, logger: fastify.log, + blockOnUnresolvedAssignee: true, }); if (!actionable) { diff --git a/server/src/routes/travelRequests.js b/server/src/routes/travelRequests.js index a6426159..271b8299 100644 --- a/server/src/routes/travelRequests.js +++ b/server/src/routes/travelRequests.js @@ -986,6 +986,7 @@ async function createTravelRequestsRoutes(fastify) { startIndex: 0, ownerId: travelRequest.applicant_employee_id, logger: fastify.log, + blockOnUnresolvedAssignee: true, }); if (!actionable) { throw buildValidationError({ workflow: "no_actionable_approver" }, 409); diff --git a/server/src/routes/workflow.js b/server/src/routes/workflow.js index a2ef6015..9239ada5 100644 --- a/server/src/routes/workflow.js +++ b/server/src/routes/workflow.js @@ -2,7 +2,7 @@ const { z } = require("zod"); const { AppError } = require("../utils/AppError"); const { buildAuditLogData } = require("../utils/audit"); const { sendData } = require("../utils/reply"); -const { resolvePermissionsForRoles, hasPermission, ROLE_PERMISSIONS, resolveEntityPermission } = require("../constants/permissions"); +const { hasPermission, ROLE_PERMISSIONS, resolveEntityPermission } = require("../constants/permissions"); const { getWorkflowStepsSnapshot, resolveActionableStep, toMoneyString } = require("../utils/workflow"); const { consumeReservedLeave, releaseReservedLeave, formatDateOnly } = require("../services/leave"); const { FEATURE_FLAG_KEYS, evaluateFeatureFlag } = require("../services/featureFlags"); @@ -525,6 +525,7 @@ async function loadWorkflowInstanceForTask(tx, instanceId) { id: true, entity_type: true, entity_id: true, + submitter_id: true, current_step_id: true, context_data: true, workflow_definition: { @@ -674,6 +675,102 @@ async function loadWorkflowNotifyContext(tx, entityType, entityId) { }; } +function resolveBusinessApprovePermission(entityType) { + return resolveEntityPermission(normalizeWorkflowEntityType(entityType), "approve"); +} + +function roleHasBusinessApprovePermission(roleCode, approvePermission) { + if (!roleCode || roleCode === "admin" || !approvePermission) { + return false; + } + + return (ROLE_PERMISSIONS[roleCode] ?? []).includes(approvePermission); +} + +function employeeHasBusinessApproveRole(employee, entityType) { + const approvePermission = resolveBusinessApprovePermission(entityType); + return Boolean( + approvePermission && + (employee?.roleCodes ?? []).some((roleCode) => + roleHasBusinessApprovePermission(roleCode, approvePermission), + ), + ); +} + +function ensureBusinessApproveRole(employee, entityType) { + if (employeeHasBusinessApproveRole(employee, entityType)) { + return; + } + + throw new AppError({ + code: "PERM_002", + message: "不在审批范围/非当前处理人", + statusCode: 403, + details: { workflow: "business_approval_role_required" }, + }); +} + +function collectWorkflowApplicantIds(workflowInstance, record) { + const entityType = normalizeWorkflowEntityType(workflowInstance.entity_type); + + if (entityType === "reimbursement") { + return uniq([record?.owner_id, record?.submitter_id, workflowInstance.submitter_id]); + } + + if (entityType === "leave") { + return uniq([record?.owner_id, workflowInstance.submitter_id]); + } + + if (entityType === "purchase_request") { + return uniq([record?.applicant_id, record?.submitter_id, workflowInstance.submitter_id]); + } + + if (entityType === "travel_request") { + return uniq([record?.applicant_employee_id, record?.submitter_id, workflowInstance.submitter_id]); + } + + return uniq([workflowInstance.submitter_id]); +} + +async function loadWorkflowApplicantIds(tx, workflowInstance) { + const { record } = await loadWorkflowNotifyContext( + tx, + workflowInstance.entity_type, + workflowInstance.entity_id, + ); + + if (!record) { + throw new AppError({ + code: "VALID_001", + message: "参数校验失败", + statusCode: 409, + details: { workflow: "entity_not_processable" }, + }); + } + + return collectWorkflowApplicantIds(workflowInstance, record); +} + +function ensureNoSelfApproval(actorIds, applicantIds) { + if (!actorIds.some((actorId) => applicantIds.includes(actorId))) { + return; + } + + throw new AppError({ + code: "VALID_001", + message: "参数校验失败", + statusCode: 409, + details: { workflow: "self_approval_not_allowed" }, + }); +} + +async function ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment) { + ensureBusinessApproveRole(request.employee, workflowInstance.entity_type); + const applicantIds = await loadWorkflowApplicantIds(tx, workflowInstance); + ensureNoSelfApproval(uniq([request.employee.id, assignment?.principalId]), applicantIds); + return applicantIds; +} + function resolveWorkflowOutcomeNotificationType(entityType, outcome) { const normalizedEntityType = normalizeWorkflowEntityType(entityType); @@ -877,8 +974,7 @@ async function ensureTransferTargetEligible(tx, toApproverId, approvePermission) } const roleCodes = target.roles.map((item) => item.role_code); - const permissionCodes = resolvePermissionsForRoles(roleCodes); - if (!approvePermission || !hasPermission(permissionCodes, approvePermission)) { + if (!roleCodes.some((roleCode) => roleHasBusinessApprovePermission(roleCode, approvePermission))) { throw new AppError({ code: "VALID_001", message: "参数校验失败", @@ -943,6 +1039,7 @@ async function executeApproveWorkflowTask({ const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id); ensureWorkflowEntityType(workflowInstance, allowedEntityType); fastify.assertEntityPermission(request.employee, workflowInstance.entity_type, "approve"); + await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment); const steps = getWorkflowStepsSnapshot(workflowInstance); const currentStepIndex = steps.findIndex((step) => step.id === workflowInstance.current_step_id); if (currentStepIndex < 0) { @@ -1238,6 +1335,7 @@ async function executeRejectWorkflowTask({ const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id); ensureWorkflowEntityType(workflowInstance, allowedEntityType); fastify.assertEntityPermission(request.employee, workflowInstance.entity_type, "approve"); + await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment); const now = new Date(); await tx.workflowTask.update({ @@ -1406,6 +1504,14 @@ function mapBatchTaskError(taskId, error) { }; } + if (error instanceof AppError && error.details?.workflow === "self_approval_not_allowed") { + return { + taskId, + outcome: "error", + reason: "self_approval_not_allowed", + }; + } + if (error instanceof AppError) { return { taskId, @@ -2219,6 +2325,7 @@ async function workflowRoutes(fastify) { const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id); fastify.assertEntityPermission(request.employee, workflowInstance.entity_type, "approve"); + await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment); const now = new Date(); await tx.workflowTask.update({ @@ -2421,8 +2528,10 @@ async function workflowRoutes(fastify) { details: { transfer: "unsupported_entity_type" }, }); } + const applicantIds = await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment); const transferCount = await ensureTransferChainNotExceeded(tx, taskId); await ensureTransferTargetEligible(tx, toApproverId, approvePermission); + ensureNoSelfApproval([toApproverId], applicantIds); if (toApproverId === request.employee.id) { throw new AppError({ diff --git a/server/src/services/feeControl.js b/server/src/services/feeControl.js index 07114a07..3aec2171 100644 --- a/server/src/services/feeControl.js +++ b/server/src/services/feeControl.js @@ -597,14 +597,14 @@ async function buildReimbursementPrecheck(tx, { reimbursementId, config, logger blocking.push(buildRiskFlagPreview("missing_approval_rule", RISK_LEVELS.high, "缺少审批规则", "当前金额范围未匹配到有效报销审批规则。")); } else { const workflowSteps = buildWorkflowStepsFromApprovalRule(approvalRule); - const { actionable } = await resolveActionableStep({ + const { actionable, skipped } = await resolveActionableStep({ tx, steps: workflowSteps, startIndex: 0, ownerId: reimbursement.owner_id, logger, }); - if (!actionable) { + if (!actionable || skipped.length) { blocking.push(buildRiskFlagPreview("no_actionable_approver", RISK_LEVELS.high, "缺少可执行审批人", "当前审批链未解析出有效审批人。")); } } @@ -718,14 +718,14 @@ async function buildPurchaseRequestPrecheck(tx, { purchaseRequestId, config, log blocking.push(buildRiskFlagPreview("workflow_definition_missing", RISK_LEVELS.high, "缺少流程定义", "采购申请缺少有效流程定义。")); } else { const workflowSteps = parseWorkflowSteps(workflowDefinition.definition_json); - const { actionable } = await resolveActionableStep({ + const { actionable, skipped } = await resolveActionableStep({ tx, steps: workflowSteps, startIndex: 0, ownerId: purchaseRequest.applicant_id, logger, }); - if (!actionable) { + if (!actionable || skipped.length) { blocking.push(buildRiskFlagPreview("no_actionable_approver", RISK_LEVELS.high, "缺少可执行审批人", "当前采购流程未解析出有效审批人。")); } } @@ -850,14 +850,14 @@ async function buildTravelRequestPrecheck(tx, { travelRequestId, config, logger blocking.push(buildRiskFlagPreview("workflow_definition_missing", RISK_LEVELS.high, "缺少流程定义", "差旅申请缺少有效流程定义。")); } else { const workflowSteps = parseWorkflowSteps(workflowDefinition.definition_json); - const { actionable } = await resolveActionableStep({ + const { actionable, skipped } = await resolveActionableStep({ tx, steps: workflowSteps, startIndex: 0, ownerId: travelRequest.applicant_employee_id, logger, }); - if (!actionable) { + if (!actionable || skipped.length) { blocking.push(buildRiskFlagPreview("no_actionable_approver", RISK_LEVELS.high, "缺少可执行审批人", "当前差旅流程未解析出有效审批人。")); } } diff --git a/server/src/utils/workflow.js b/server/src/utils/workflow.js index bcd22991..c795efdd 100644 --- a/server/src/utils/workflow.js +++ b/server/src/utils/workflow.js @@ -2,6 +2,13 @@ const { AppError } = require("./AppError"); const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i; const MAX_MANAGER_DEPTH = 10; +const BLOCKING_ASSIGNEE_SKIP_REASONS = new Set([ + "no_manager_found", + "chain_broken", + "self_loop", + "cycle_detected", + "max_depth_exceeded", +]); function parseWorkflowSteps(definitionJson) { const steps = definitionJson?.steps; @@ -233,7 +240,14 @@ async function resolveAssigneeFromRule(rule, options = {}) { }); } -async function resolveActionableStep({ tx, steps, startIndex, ownerId, logger }) { +async function resolveActionableStep({ + tx, + steps, + startIndex, + ownerId, + logger, + blockOnUnresolvedAssignee = false, +}) { const skipped = []; for (let index = startIndex; index < steps.length; index += 1) { @@ -257,6 +271,19 @@ async function resolveActionableStep({ tx, steps, startIndex, ownerId, logger }) } if (resolved.skipReason) { + if (blockOnUnresolvedAssignee && BLOCKING_ASSIGNEE_SKIP_REASONS.has(resolved.skipReason)) { + throw new AppError({ + code: "VALID_001", + message: "参数校验失败", + statusCode: 409, + details: { + workflow: "no_actionable_approver", + reason: resolved.skipReason, + stepId: step.id, + }, + }); + } + skipped.push({ index, step, diff --git a/server/tests/unit/routes/workflow.batch.test.js b/server/tests/unit/routes/workflow.batch.test.js index 58fca15f..0d38ff30 100644 --- a/server/tests/unit/routes/workflow.batch.test.js +++ b/server/tests/unit/routes/workflow.batch.test.js @@ -4,6 +4,7 @@ const workflowRoutes = require("../../../src/routes/workflow"); const { AppError } = require("../../../src/utils/AppError"); const ACTOR_ID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa"; +const OWNER_ID = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb"; function buildTask(taskId, overrides = {}) { return { @@ -112,7 +113,14 @@ async function buildApp(options = {}) { }, reimbursementForm: { update: vi.fn(async () => ({})), - findUnique: vi.fn(async () => null), + findUnique: vi.fn(async () => ({ + id: "reimbursement-1", + form_number: "BX-TEST", + total_amount: "100.00", + owner_id: options.reimbursementOwnerId ?? OWNER_ID, + submitter_id: options.reimbursementSubmitterId ?? options.reimbursementOwnerId ?? OWNER_ID, + owner: { id: options.reimbursementOwnerId ?? OWNER_ID, name: "申请人" }, + })), }, leaveRequest: { findUnique: vi.fn(async () => null), @@ -180,6 +188,30 @@ async function buildApp(options = {}) { } describe("workflow batch routes", () => { + it("rejects self approval on a single task action", async () => { + const { app, state } = await buildApp({ + reimbursementOwnerId: ACTOR_ID, + }); + + const response = await app.inject({ + method: "POST", + url: "/api/workflow/tasks/11111111-1111-4111-8111-111111111111/approve", + }); + + expect(response.statusCode).toBe(409); + expect(response.json().error).toEqual( + expect.objectContaining({ + code: "VALID_001", + details: expect.objectContaining({ + workflow: "self_approval_not_allowed", + }), + }), + ); + expect(state.tasks.get("11111111-1111-4111-8111-111111111111").status).toBe("pending"); + + await app.close(); + }); + it("approves reimbursement tasks and skips already processed ones", async () => { const { app, prisma, state } = await buildApp(); @@ -311,6 +343,40 @@ describe("workflow batch routes", () => { await app.close(); }); + it("rejects self approval in batch actions without changing the task", async () => { + const { app, state } = await buildApp({ + reimbursementOwnerId: ACTOR_ID, + }); + + const response = await app.inject({ + method: "POST", + url: "/api/workflow/batch-approve", + payload: { + taskIds: ["11111111-1111-4111-8111-111111111111"], + }, + }); + + expect(response.statusCode).toBe(200); + expect(response.json().data).toEqual({ + results: [ + { + taskId: "11111111-1111-4111-8111-111111111111", + outcome: "error", + reason: "self_approval_not_allowed", + }, + ], + summary: { + approved: 0, + rejected: 0, + skipped: 0, + errored: 1, + }, + }); + expect(state.tasks.get("11111111-1111-4111-8111-111111111111").status).toBe("pending"); + + await app.close(); + }); + it("rejects oversized batch payloads and missing permissions", async () => { const { app } = await buildApp(); const oversizedPayload = { diff --git a/server/tests/unit/routes/workflow.transfer.test.js b/server/tests/unit/routes/workflow.transfer.test.js index b8192631..71447e5c 100644 --- a/server/tests/unit/routes/workflow.transfer.test.js +++ b/server/tests/unit/routes/workflow.transfer.test.js @@ -3,6 +3,8 @@ const Fastify = require("fastify"); const { AppError } = require("../../../src/utils/AppError"); const workflowRoutes = require("../../../src/routes/workflow"); +const APPLICANT_ID = "55555555-5555-4555-8555-555555555555"; + function buildTaskRow() { return { id: "11111111-1111-4111-8111-111111111111", @@ -51,6 +53,39 @@ function buildTx({ entityType, targetRoleCode = "manager", transferCount = 0 }) employee: { findUnique: vi.fn().mockResolvedValue(buildTarget(targetRoleCode)), }, + reimbursementForm: { + findUnique: vi.fn().mockResolvedValue({ + id: "33333333-3333-4333-8333-333333333333", + owner_id: APPLICANT_ID, + submitter_id: APPLICANT_ID, + owner: { id: APPLICANT_ID, name: "申请人" }, + }), + }, + leaveRequest: { + findUnique: vi.fn().mockResolvedValue({ + id: "33333333-3333-4333-8333-333333333333", + owner_id: APPLICANT_ID, + owner: { id: APPLICANT_ID, name: "申请人" }, + }), + }, + purchaseRequest: { + findUnique: vi.fn().mockResolvedValue({ + id: "33333333-3333-4333-8333-333333333333", + request_no: "CG-TEST", + applicant_id: APPLICANT_ID, + submitter_id: APPLICANT_ID, + applicant: { id: APPLICANT_ID, name: "申请人" }, + }), + }, + travelRequest: { + findUnique: vi.fn().mockResolvedValue({ + id: "33333333-3333-4333-8333-333333333333", + request_no: "CL-TEST", + applicant_employee_id: APPLICANT_ID, + submitter_id: APPLICANT_ID, + applicant: { id: APPLICANT_ID, name: "申请人" }, + }), + }, workflowTask: { update: vi.fn().mockResolvedValue({ id: "11111111-1111-4111-8111-111111111111" }), }, @@ -132,7 +167,7 @@ describe("workflow transfer route", () => { prisma: buildPrisma(tx), employee: { id: "actor-1", - roleCodes: [], + roleCodes: ["manager"], permissionCodes: ["expense.transfer"], }, }); @@ -188,7 +223,7 @@ describe("workflow transfer route", () => { prisma: buildPrisma(tx), employee: { id: "actor-1", - roleCodes: [], + roleCodes: ["manager"], permissionCodes: ["expense.transfer"], }, }); @@ -217,13 +252,80 @@ describe("workflow transfer route", () => { await app.close(); }); + it("does not treat admin-only target as a business approver", async () => { + const tx = buildTx({ entityType: "reimbursement", targetRoleCode: "admin" }); + const app = await buildApp({ + prisma: buildPrisma(tx), + employee: { + id: "actor-1", + roleCodes: ["manager"], + permissionCodes: ["expense.transfer"], + }, + }); + + const response = await app.inject({ + method: "POST", + url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`, + headers: { authorization: "Bearer test" }, + payload: { + toApproverId: "44444444-4444-4444-8444-444444444444", + reason: "当前事项需转交对应审批人继续处理，请及时跟进。", + }, + }); + + expect(response.statusCode).toBe(409); + expect(response.json().error.details).toEqual( + expect.objectContaining({ + toApproverId: "target_not_approver", + }), + ); + expect(tx.workflowTask.update).not.toHaveBeenCalled(); + + await app.close(); + }); + + it("rejects transfer to the applicant", async () => { + const tx = buildTx({ entityType: "leave", targetRoleCode: "manager" }); + const app = await buildApp({ + prisma: buildPrisma(tx), + employee: { + id: "actor-1", + roleCodes: ["manager"], + permissionCodes: ["expense.transfer"], + }, + }); + + const response = await app.inject({ + method: "POST", + url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`, + headers: { authorization: "Bearer test" }, + payload: { + toApproverId: APPLICANT_ID, + reason: "当前事项需转交对应审批人继续处理，请及时跟进。", + }, + }); + + expect(response.statusCode).toBe(409); + expect(response.json().error).toEqual( + expect.objectContaining({ + code: "VALID_001", + details: expect.objectContaining({ + workflow: "self_approval_not_allowed", + }), + }), + ); + expect(tx.workflowTask.update).not.toHaveBeenCalled(); + + await app.close(); + }); + it("returns WORKFLOW_003 when transfer chain exceeds limit", async () => { const tx = buildTx({ entityType: "leave", transferCount: 3 }); const app = await buildApp({ prisma: buildPrisma(tx), employee: { id: "actor-1", - roleCodes: [], + roleCodes: ["manager"], permissionCodes: ["expense.transfer"], }, }); diff --git a/server/tests/unit/utils/workflow.test.js b/server/tests/unit/utils/workflow.test.js index f8c84a10..fac9d9a8 100644 --- a/server/tests/unit/utils/workflow.test.js +++ b/server/tests/unit/utils/workflow.test.js @@ -1,53 +1,132 @@ - const workflowUtils = require("../../../src/utils/workflow"); -describe("Workflow Utils", () => { - describe("parseWorkflowSteps", () => { - it("throws error for invalid steps array", () => { - expect(() => workflowUtils.parseWorkflowSteps({})).toThrow(/参数校验失败/); - expect(() => workflowUtils.parseWorkflowSteps({ steps: [] })).toThrow(/参数校验失败/); - }); +const { resolveActionableStep } = workflowUtils; - it("parses valid steps array", () => { - expect(workflowUtils.parseWorkflowSteps({ steps: [{ id: 1 }] })).toEqual([{ id: 1 }]); - }); +const OWNER_ID = "11111111-1111-4111-8111-111111111111"; + +function buildSteps() { + return [ + { + id: "approval_1_manager", + name: "主管审批", + type: "approval", + assignee_rule: { type: "department_manager" }, + }, + { + id: "approval_2_finance", + name: "财务复核", + type: "approval", + assignee_rule: { type: "role", value: "finance" }, + }, + ]; +} + +describe("workflow assignee resolution", () => { + describe("parseWorkflowSteps", () => { + it("throws error for invalid steps array", () => { + expect(() => workflowUtils.parseWorkflowSteps({})).toThrow(/参数校验失败/); + expect(() => workflowUtils.parseWorkflowSteps({ steps: [] })).toThrow(/参数校验失败/); }); - describe("buildWorkflowStepsFromApprovalRule", () => { - it("builds steps correctly for valid rule", () => { - const result = workflowUtils.buildWorkflowStepsFromApprovalRule({ - level1_role: "manager", - level2_role: "finance", - }); - expect(result.length).toBe(2); - expect(result[0].assignee_rule.type).toBe("department_manager"); - expect(result[1].assignee_rule.type).toBe("role"); - expect(result[1].assignee_rule.value).toBe("finance"); - }); + it("parses valid steps array", () => { + expect(workflowUtils.parseWorkflowSteps({ steps: [{ id: 1 }] })).toEqual([{ id: 1 }]); + }); + }); - it("throws if rule is empty or missing roles", () => { - expect(() => workflowUtils.buildWorkflowStepsFromApprovalRule({})).toThrow(/参数校验失败/); - }); + describe("buildWorkflowStepsFromApprovalRule", () => { + it("builds steps correctly for valid rule", () => { + const result = workflowUtils.buildWorkflowStepsFromApprovalRule({ + level1_role: "manager", + level2_role: "finance", + }); + + expect(result.length).toBe(2); + expect(result[0].assignee_rule.type).toBe("department_manager"); + expect(result[1].assignee_rule.type).toBe("role"); + expect(result[1].assignee_rule.value).toBe("finance"); }); - describe("resolveAssigneeFromRule", () => { - it("resolves role type", async () => { - const res = await workflowUtils.resolveAssigneeFromRule({ type: "role", value: "hr" }); - expect(res.assigneeRole).toBe("hr"); - expect(res.assigneeId).toBe(null); - }); + it("throws if rule is empty or missing roles", () => { + expect(() => workflowUtils.buildWorkflowStepsFromApprovalRule({})).toThrow(/参数校验失败/); + }); + }); - it("throws for invalid rule", async () => { - await expect(workflowUtils.resolveAssigneeFromRule(null)).rejects.toThrow(/参数校验失败/); - await expect(workflowUtils.resolveAssigneeFromRule({ type: "unknown" })).rejects.toThrow(/参数校验失败/); - }); + describe("resolveAssigneeFromRule", () => { + it("resolves role type", async () => { + const result = await workflowUtils.resolveAssigneeFromRule({ type: "role", value: "hr" }); + + expect(result.assigneeRole).toBe("hr"); + expect(result.assigneeId).toBe(null); }); - describe("toMoneyString", () => { - it("converts values to string correctly", () => { - expect(workflowUtils.toMoneyString(null)).toBe(null); - expect(workflowUtils.toMoneyString("10.0")).toBe("10.0"); - expect(workflowUtils.toMoneyString(10)).toBe("10"); - }); + it("throws for invalid rule", async () => { + await expect(workflowUtils.resolveAssigneeFromRule(null)).rejects.toThrow(/参数校验失败/); + await expect(workflowUtils.resolveAssigneeFromRule({ type: "unknown" })).rejects.toThrow(/参数校验失败/); }); + }); + + describe("toMoneyString", () => { + it("converts values to string correctly", () => { + expect(workflowUtils.toMoneyString(null)).toBe(null); + expect(workflowUtils.toMoneyString("10.0")).toBe("10.0"); + expect(workflowUtils.toMoneyString(10)).toBe("10"); + }); + }); + + it("blocks submit-time workflow resolution when the direct manager is missing", async () => { + const tx = { + employee: { + findUnique: vi.fn(async () => ({ + id: OWNER_ID, + direct_manager_id: null, + })), + }, + }; + + await expect( + resolveActionableStep({ + tx, + steps: buildSteps(), + startIndex: 0, + ownerId: OWNER_ID, + blockOnUnresolvedAssignee: true, + }), + ).rejects.toMatchObject({ + details: { + workflow: "no_actionable_approver", + reason: "no_manager_found", + stepId: "approval_1_manager", + }, + }); + }); + + it("keeps legacy skip behavior when strict submit resolution is not requested", async () => { + const tx = { + employee: { + findUnique: vi.fn(async () => ({ + id: OWNER_ID, + direct_manager_id: null, + })), + }, + }; + + const result = await resolveActionableStep({ + tx, + steps: buildSteps(), + startIndex: 0, + ownerId: OWNER_ID, + }); + + expect(result.actionable).toEqual( + expect.objectContaining({ + step: expect.objectContaining({ id: "approval_2_finance" }), + assigneeRole: "finance", + }), + ); + expect(result.skipped).toEqual([ + expect.objectContaining({ + reason: "no_manager_found", + }), + ]); + }); });