R5-M1-M5 收口正式审批规则与移动反馈

server/src/routes/leave.js

@@ -1015,6 +1015,7 @@ async function leaveRoutes(fastify) {
           startIndex: 0,
           ownerId: leave.owner_id,
           logger: fastify.log,
+          blockOnUnresolvedAssignee: true,
         });
         if (!actionable) {
           throw buildValidationError({ workflow: "no_actionable_approver" }, 409);

server/src/routes/purchaseRequests.js

@@ -1524,6 +1524,7 @@ async function purchaseRequestRoutes(fastify) {
         startIndex: 0,
         ownerId: unlockedPurchaseRequest.applicant_id,
         logger: fastify.log,
+        blockOnUnresolvedAssignee: true,
       });
 
       if (!actionable) {

server/src/routes/reimbursements.js

@@ -3179,6 +3179,7 @@ async function reimbursementRoutes(fastify) {
           startIndex: 0,
           ownerId: reimbursement.owner_id,
           logger: fastify.log,
+          blockOnUnresolvedAssignee: true,
         });
 
         if (!actionable) {

server/src/routes/travelRequests.js

@@ -986,6 +986,7 @@ async function createTravelRequestsRoutes(fastify) {
           startIndex: 0,
           ownerId: travelRequest.applicant_employee_id,
           logger: fastify.log,
+          blockOnUnresolvedAssignee: true,
         });
         if (!actionable) {
           throw buildValidationError({ workflow: "no_actionable_approver" }, 409);

server/src/routes/workflow.js

@@ -2,7 +2,7 @@ const { z } = require("zod");
 const { AppError } = require("../utils/AppError");
 const { buildAuditLogData } = require("../utils/audit");
 const { sendData } = require("../utils/reply");
-const { resolvePermissionsForRoles, hasPermission, ROLE_PERMISSIONS, resolveEntityPermission } = require("../constants/permissions");
+const { hasPermission, ROLE_PERMISSIONS, resolveEntityPermission } = require("../constants/permissions");
 const { getWorkflowStepsSnapshot, resolveActionableStep, toMoneyString } = require("../utils/workflow");
 const { consumeReservedLeave, releaseReservedLeave, formatDateOnly } = require("../services/leave");
 const { FEATURE_FLAG_KEYS, evaluateFeatureFlag } = require("../services/featureFlags");
@@ -525,6 +525,7 @@ async function loadWorkflowInstanceForTask(tx, instanceId) {
       id: true,
       entity_type: true,
       entity_id: true,
+      submitter_id: true,
       current_step_id: true,
       context_data: true,
       workflow_definition: {
@@ -674,6 +675,102 @@ async function loadWorkflowNotifyContext(tx, entityType, entityId) {
   };
 }
 
+function resolveBusinessApprovePermission(entityType) {
+  return resolveEntityPermission(normalizeWorkflowEntityType(entityType), "approve");
+}
+
+function roleHasBusinessApprovePermission(roleCode, approvePermission) {
+  if (!roleCode || roleCode === "admin" || !approvePermission) {
+    return false;
+  }
+
+  return (ROLE_PERMISSIONS[roleCode] ?? []).includes(approvePermission);
+}
+
+function employeeHasBusinessApproveRole(employee, entityType) {
+  const approvePermission = resolveBusinessApprovePermission(entityType);
+  return Boolean(
+    approvePermission &&
+      (employee?.roleCodes ?? []).some((roleCode) =>
+        roleHasBusinessApprovePermission(roleCode, approvePermission),
+      ),
+  );
+}
+
+function ensureBusinessApproveRole(employee, entityType) {
+  if (employeeHasBusinessApproveRole(employee, entityType)) {
+    return;
+  }
+
+  throw new AppError({
+    code: "PERM_002",
+    message: "不在审批范围/非当前处理人",
+    statusCode: 403,
+    details: { workflow: "business_approval_role_required" },
+  });
+}
+
+function collectWorkflowApplicantIds(workflowInstance, record) {
+  const entityType = normalizeWorkflowEntityType(workflowInstance.entity_type);
+
+  if (entityType === "reimbursement") {
+    return uniq([record?.owner_id, record?.submitter_id, workflowInstance.submitter_id]);
+  }
+
+  if (entityType === "leave") {
+    return uniq([record?.owner_id, workflowInstance.submitter_id]);
+  }
+
+  if (entityType === "purchase_request") {
+    return uniq([record?.applicant_id, record?.submitter_id, workflowInstance.submitter_id]);
+  }
+
+  if (entityType === "travel_request") {
+    return uniq([record?.applicant_employee_id, record?.submitter_id, workflowInstance.submitter_id]);
+  }
+
+  return uniq([workflowInstance.submitter_id]);
+}
+
+async function loadWorkflowApplicantIds(tx, workflowInstance) {
+  const { record } = await loadWorkflowNotifyContext(
+    tx,
+    workflowInstance.entity_type,
+    workflowInstance.entity_id,
+  );
+
+  if (!record) {
+    throw new AppError({
+      code: "VALID_001",
+      message: "参数校验失败",
+      statusCode: 409,
+      details: { workflow: "entity_not_processable" },
+    });
+  }
+
+  return collectWorkflowApplicantIds(workflowInstance, record);
+}
+
+function ensureNoSelfApproval(actorIds, applicantIds) {
+  if (!actorIds.some((actorId) => applicantIds.includes(actorId))) {
+    return;
+  }
+
+  throw new AppError({
+    code: "VALID_001",
+    message: "参数校验失败",
+    statusCode: 409,
+    details: { workflow: "self_approval_not_allowed" },
+  });
+}
+
+async function ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment) {
+  ensureBusinessApproveRole(request.employee, workflowInstance.entity_type);
+  const applicantIds = await loadWorkflowApplicantIds(tx, workflowInstance);
+  ensureNoSelfApproval(uniq([request.employee.id, assignment?.principalId]), applicantIds);
+  return applicantIds;
+}
+
 function resolveWorkflowOutcomeNotificationType(entityType, outcome) {
   const normalizedEntityType = normalizeWorkflowEntityType(entityType);
 
@@ -877,8 +974,7 @@ async function ensureTransferTargetEligible(tx, toApproverId, approvePermission)
   }
 
   const roleCodes = target.roles.map((item) => item.role_code);
-  const permissionCodes = resolvePermissionsForRoles(roleCodes);
-  if (!approvePermission || !hasPermission(permissionCodes, approvePermission)) {
+  if (!roleCodes.some((roleCode) => roleHasBusinessApprovePermission(roleCode, approvePermission))) {
     throw new AppError({
       code: "VALID_001",
       message: "参数校验失败",
@@ -943,6 +1039,7 @@ async function executeApproveWorkflowTask({
     const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id);
     ensureWorkflowEntityType(workflowInstance, allowedEntityType);
     fastify.assertEntityPermission(request.employee, workflowInstance.entity_type, "approve");
+    await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment);
     const steps = getWorkflowStepsSnapshot(workflowInstance);
     const currentStepIndex = steps.findIndex((step) => step.id === workflowInstance.current_step_id);
     if (currentStepIndex < 0) {
@@ -1238,6 +1335,7 @@ async function executeRejectWorkflowTask({
     const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id);
     ensureWorkflowEntityType(workflowInstance, allowedEntityType);
     fastify.assertEntityPermission(request.employee, workflowInstance.entity_type, "approve");
+    await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment);
     const now = new Date();
 
     await tx.workflowTask.update({
@@ -1406,6 +1504,14 @@ function mapBatchTaskError(taskId, error) {
     };
   }
 
+  if (error instanceof AppError && error.details?.workflow === "self_approval_not_allowed") {
+    return {
+      taskId,
+      outcome: "error",
+      reason: "self_approval_not_allowed",
+    };
+  }
+
   if (error instanceof AppError) {
     return {
       taskId,
@@ -2219,6 +2325,7 @@ async function workflowRoutes(fastify) {
 
         const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id);
         fastify.assertEntityPermission(request.employee, workflowInstance.entity_type, "approve");
+        await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment);
         const now = new Date();
 
         await tx.workflowTask.update({
@@ -2421,8 +2528,10 @@ async function workflowRoutes(fastify) {
             details: { transfer: "unsupported_entity_type" },
           });
         }
+        const applicantIds = await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment);
         const transferCount = await ensureTransferChainNotExceeded(tx, taskId);
         await ensureTransferTargetEligible(tx, toApproverId, approvePermission);
+        ensureNoSelfApproval([toApproverId], applicantIds);
 
         if (toApproverId === request.employee.id) {
           throw new AppError({

server/src/services/feeControl.js

@@ -597,14 +597,14 @@ async function buildReimbursementPrecheck(tx, { reimbursementId, config, logger
     blocking.push(buildRiskFlagPreview("missing_approval_rule", RISK_LEVELS.high, "缺少审批规则", "当前金额范围未匹配到有效报销审批规则。"));
   } else {
     const workflowSteps = buildWorkflowStepsFromApprovalRule(approvalRule);
-    const { actionable } = await resolveActionableStep({
+    const { actionable, skipped } = await resolveActionableStep({
       tx,
       steps: workflowSteps,
       startIndex: 0,
       ownerId: reimbursement.owner_id,
       logger,
     });
-    if (!actionable) {
+    if (!actionable || skipped.length) {
       blocking.push(buildRiskFlagPreview("no_actionable_approver", RISK_LEVELS.high, "缺少可执行审批人", "当前审批链未解析出有效审批人。"));
     }
   }
@@ -718,14 +718,14 @@ async function buildPurchaseRequestPrecheck(tx, { purchaseRequestId, config, log
     blocking.push(buildRiskFlagPreview("workflow_definition_missing", RISK_LEVELS.high, "缺少流程定义", "采购申请缺少有效流程定义。"));
   } else {
     const workflowSteps = parseWorkflowSteps(workflowDefinition.definition_json);
-    const { actionable } = await resolveActionableStep({
+    const { actionable, skipped } = await resolveActionableStep({
       tx,
       steps: workflowSteps,
       startIndex: 0,
       ownerId: purchaseRequest.applicant_id,
       logger,
     });
-    if (!actionable) {
+    if (!actionable || skipped.length) {
       blocking.push(buildRiskFlagPreview("no_actionable_approver", RISK_LEVELS.high, "缺少可执行审批人", "当前采购流程未解析出有效审批人。"));
     }
   }
@@ -850,14 +850,14 @@ async function buildTravelRequestPrecheck(tx, { travelRequestId, config, logger
     blocking.push(buildRiskFlagPreview("workflow_definition_missing", RISK_LEVELS.high, "缺少流程定义", "差旅申请缺少有效流程定义。"));
   } else {
     const workflowSteps = parseWorkflowSteps(workflowDefinition.definition_json);
-    const { actionable } = await resolveActionableStep({
+    const { actionable, skipped } = await resolveActionableStep({
       tx,
       steps: workflowSteps,
       startIndex: 0,
       ownerId: travelRequest.applicant_employee_id,
       logger,
     });
-    if (!actionable) {
+    if (!actionable || skipped.length) {
       blocking.push(buildRiskFlagPreview("no_actionable_approver", RISK_LEVELS.high, "缺少可执行审批人", "当前差旅流程未解析出有效审批人。"));
     }
   }

server/src/utils/workflow.js

@@ -2,6 +2,13 @@ const { AppError } = require("./AppError");
 
 const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const MAX_MANAGER_DEPTH = 10;
+const BLOCKING_ASSIGNEE_SKIP_REASONS = new Set([
+  "no_manager_found",
+  "chain_broken",
+  "self_loop",
+  "cycle_detected",
+  "max_depth_exceeded",
+]);
 
 function parseWorkflowSteps(definitionJson) {
   const steps = definitionJson?.steps;
@@ -233,7 +240,14 @@ async function resolveAssigneeFromRule(rule, options = {}) {
   });
 }
 
-async function resolveActionableStep({ tx, steps, startIndex, ownerId, logger }) {
+async function resolveActionableStep({
+  tx,
+  steps,
+  startIndex,
+  ownerId,
+  logger,
+  blockOnUnresolvedAssignee = false,
+}) {
   const skipped = [];
 
   for (let index = startIndex; index < steps.length; index += 1) {
@@ -257,6 +271,19 @@ async function resolveActionableStep({ tx, steps, startIndex, ownerId, logger })
     }
 
     if (resolved.skipReason) {
+      if (blockOnUnresolvedAssignee && BLOCKING_ASSIGNEE_SKIP_REASONS.has(resolved.skipReason)) {
+        throw new AppError({
+          code: "VALID_001",
+          message: "参数校验失败",
+          statusCode: 409,
+          details: {
+            workflow: "no_actionable_approver",
+            reason: resolved.skipReason,
+            stepId: step.id,
+          },
+        });
+      }
+
       skipped.push({
         index,
         step,

server/tests/unit/routes/workflow.batch.test.js

@@ -4,6 +4,7 @@ const workflowRoutes = require("../../../src/routes/workflow");
 const { AppError } = require("../../../src/utils/AppError");
 
 const ACTOR_ID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
+const OWNER_ID = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
 
 function buildTask(taskId, overrides = {}) {
   return {
@@ -112,7 +113,14 @@ async function buildApp(options = {}) {
     },
     reimbursementForm: {
       update: vi.fn(async () => ({})),
-      findUnique: vi.fn(async () => null),
+      findUnique: vi.fn(async () => ({
+        id: "reimbursement-1",
+        form_number: "BX-TEST",
+        total_amount: "100.00",
+        owner_id: options.reimbursementOwnerId ?? OWNER_ID,
+        submitter_id: options.reimbursementSubmitterId ?? options.reimbursementOwnerId ?? OWNER_ID,
+        owner: { id: options.reimbursementOwnerId ?? OWNER_ID, name: "申请人" },
+      })),
     },
     leaveRequest: {
       findUnique: vi.fn(async () => null),
@@ -180,6 +188,30 @@ async function buildApp(options = {}) {
 }
 
 describe("workflow batch routes", () => {
+  it("rejects self approval on a single task action", async () => {
+    const { app, state } = await buildApp({
+      reimbursementOwnerId: ACTOR_ID,
+    });
+
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/workflow/tasks/11111111-1111-4111-8111-111111111111/approve",
+    });
+
+    expect(response.statusCode).toBe(409);
+    expect(response.json().error).toEqual(
+      expect.objectContaining({
+        code: "VALID_001",
+        details: expect.objectContaining({
+          workflow: "self_approval_not_allowed",
+        }),
+      }),
+    );
+    expect(state.tasks.get("11111111-1111-4111-8111-111111111111").status).toBe("pending");
+
+    await app.close();
+  });
+
   it("approves reimbursement tasks and skips already processed ones", async () => {
     const { app, prisma, state } = await buildApp();
 
@@ -311,6 +343,40 @@ describe("workflow batch routes", () => {
     await app.close();
   });
 
+  it("rejects self approval in batch actions without changing the task", async () => {
+    const { app, state } = await buildApp({
+      reimbursementOwnerId: ACTOR_ID,
+    });
+
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/workflow/batch-approve",
+      payload: {
+        taskIds: ["11111111-1111-4111-8111-111111111111"],
+      },
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json().data).toEqual({
+      results: [
+        {
+          taskId: "11111111-1111-4111-8111-111111111111",
+          outcome: "error",
+          reason: "self_approval_not_allowed",
+        },
+      ],
+      summary: {
+        approved: 0,
+        rejected: 0,
+        skipped: 0,
+        errored: 1,
+      },
+    });
+    expect(state.tasks.get("11111111-1111-4111-8111-111111111111").status).toBe("pending");
+
+    await app.close();
+  });
+
   it("rejects oversized batch payloads and missing permissions", async () => {
     const { app } = await buildApp();
     const oversizedPayload = {

server/tests/unit/routes/workflow.transfer.test.js

@@ -3,6 +3,8 @@ const Fastify = require("fastify");
 const { AppError } = require("../../../src/utils/AppError");
 const workflowRoutes = require("../../../src/routes/workflow");
 
+const APPLICANT_ID = "55555555-5555-4555-8555-555555555555";
+
 function buildTaskRow() {
   return {
     id: "11111111-1111-4111-8111-111111111111",
@@ -51,6 +53,39 @@ function buildTx({ entityType, targetRoleCode = "manager", transferCount = 0 })
     employee: {
       findUnique: vi.fn().mockResolvedValue(buildTarget(targetRoleCode)),
     },
+    reimbursementForm: {
+      findUnique: vi.fn().mockResolvedValue({
+        id: "33333333-3333-4333-8333-333333333333",
+        owner_id: APPLICANT_ID,
+        submitter_id: APPLICANT_ID,
+        owner: { id: APPLICANT_ID, name: "申请人" },
+      }),
+    },
+    leaveRequest: {
+      findUnique: vi.fn().mockResolvedValue({
+        id: "33333333-3333-4333-8333-333333333333",
+        owner_id: APPLICANT_ID,
+        owner: { id: APPLICANT_ID, name: "申请人" },
+      }),
+    },
+    purchaseRequest: {
+      findUnique: vi.fn().mockResolvedValue({
+        id: "33333333-3333-4333-8333-333333333333",
+        request_no: "CG-TEST",
+        applicant_id: APPLICANT_ID,
+        submitter_id: APPLICANT_ID,
+        applicant: { id: APPLICANT_ID, name: "申请人" },
+      }),
+    },
+    travelRequest: {
+      findUnique: vi.fn().mockResolvedValue({
+        id: "33333333-3333-4333-8333-333333333333",
+        request_no: "CL-TEST",
+        applicant_employee_id: APPLICANT_ID,
+        submitter_id: APPLICANT_ID,
+        applicant: { id: APPLICANT_ID, name: "申请人" },
+      }),
+    },
     workflowTask: {
       update: vi.fn().mockResolvedValue({ id: "11111111-1111-4111-8111-111111111111" }),
     },
@@ -132,7 +167,7 @@ describe("workflow transfer route", () => {
         prisma: buildPrisma(tx),
         employee: {
           id: "actor-1",
-          roleCodes: [],
+          roleCodes: ["manager"],
           permissionCodes: ["expense.transfer"],
         },
       });
@@ -188,7 +223,7 @@ describe("workflow transfer route", () => {
       prisma: buildPrisma(tx),
       employee: {
         id: "actor-1",
-        roleCodes: [],
+        roleCodes: ["manager"],
         permissionCodes: ["expense.transfer"],
       },
     });
@@ -217,13 +252,80 @@ describe("workflow transfer route", () => {
     await app.close();
   });
 
+  it("does not treat admin-only target as a business approver", async () => {
+    const tx = buildTx({ entityType: "reimbursement", targetRoleCode: "admin" });
+    const app = await buildApp({
+      prisma: buildPrisma(tx),
+      employee: {
+        id: "actor-1",
+        roleCodes: ["manager"],
+        permissionCodes: ["expense.transfer"],
+      },
+    });
+
+    const response = await app.inject({
+      method: "POST",
+      url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
+      headers: { authorization: "Bearer test" },
+      payload: {
+        toApproverId: "44444444-4444-4444-8444-444444444444",
+        reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
+      },
+    });
+
+    expect(response.statusCode).toBe(409);
+    expect(response.json().error.details).toEqual(
+      expect.objectContaining({
+        toApproverId: "target_not_approver",
+      }),
+    );
+    expect(tx.workflowTask.update).not.toHaveBeenCalled();
+
+    await app.close();
+  });
+
+  it("rejects transfer to the applicant", async () => {
+    const tx = buildTx({ entityType: "leave", targetRoleCode: "manager" });
+    const app = await buildApp({
+      prisma: buildPrisma(tx),
+      employee: {
+        id: "actor-1",
+        roleCodes: ["manager"],
+        permissionCodes: ["expense.transfer"],
+      },
+    });
+
+    const response = await app.inject({
+      method: "POST",
+      url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
+      headers: { authorization: "Bearer test" },
+      payload: {
+        toApproverId: APPLICANT_ID,
+        reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
+      },
+    });
+
+    expect(response.statusCode).toBe(409);
+    expect(response.json().error).toEqual(
+      expect.objectContaining({
+        code: "VALID_001",
+        details: expect.objectContaining({
+          workflow: "self_approval_not_allowed",
+        }),
+      }),
+    );
+    expect(tx.workflowTask.update).not.toHaveBeenCalled();
+
+    await app.close();
+  });
+
   it("returns WORKFLOW_003 when transfer chain exceeds limit", async () => {
     const tx = buildTx({ entityType: "leave", transferCount: 3 });
     const app = await buildApp({
       prisma: buildPrisma(tx),
       employee: {
         id: "actor-1",
-        roleCodes: [],
+        roleCodes: ["manager"],
         permissionCodes: ["expense.transfer"],
       },
     });

server/tests/unit/utils/workflow.test.js

@@ -1,53 +1,132 @@
-
 const workflowUtils = require("../../../src/utils/workflow");
 
-describe("Workflow Utils", () => {
-    describe("parseWorkflowSteps", () => {
-        it("throws error for invalid steps array", () => {
-            expect(() => workflowUtils.parseWorkflowSteps({})).toThrow(/参数校验失败/);
-            expect(() => workflowUtils.parseWorkflowSteps({ steps: [] })).toThrow(/参数校验失败/);
-        });
+const { resolveActionableStep } = workflowUtils;
 
-        it("parses valid steps array", () => {
-            expect(workflowUtils.parseWorkflowSteps({ steps: [{ id: 1 }] })).toEqual([{ id: 1 }]);
-        });
+const OWNER_ID = "11111111-1111-4111-8111-111111111111";
+
+function buildSteps() {
+  return [
+    {
+      id: "approval_1_manager",
+      name: "主管审批",
+      type: "approval",
+      assignee_rule: { type: "department_manager" },
+    },
+    {
+      id: "approval_2_finance",
+      name: "财务复核",
+      type: "approval",
+      assignee_rule: { type: "role", value: "finance" },
+    },
+  ];
+}
+
+describe("workflow assignee resolution", () => {
+  describe("parseWorkflowSteps", () => {
+    it("throws error for invalid steps array", () => {
+      expect(() => workflowUtils.parseWorkflowSteps({})).toThrow(/参数校验失败/);
+      expect(() => workflowUtils.parseWorkflowSteps({ steps: [] })).toThrow(/参数校验失败/);
     });
 
-    describe("buildWorkflowStepsFromApprovalRule", () => {
-        it("builds steps correctly for valid rule", () => {
-            const result = workflowUtils.buildWorkflowStepsFromApprovalRule({
-                level1_role: "manager",
-                level2_role: "finance",
-            });
-            expect(result.length).toBe(2);
-            expect(result[0].assignee_rule.type).toBe("department_manager");
-            expect(result[1].assignee_rule.type).toBe("role");
-            expect(result[1].assignee_rule.value).toBe("finance");
-        });
+    it("parses valid steps array", () => {
+      expect(workflowUtils.parseWorkflowSteps({ steps: [{ id: 1 }] })).toEqual([{ id: 1 }]);
+    });
+  });
 
-        it("throws if rule is empty or missing roles", () => {
-            expect(() => workflowUtils.buildWorkflowStepsFromApprovalRule({})).toThrow(/参数校验失败/);
-        });
+  describe("buildWorkflowStepsFromApprovalRule", () => {
+    it("builds steps correctly for valid rule", () => {
+      const result = workflowUtils.buildWorkflowStepsFromApprovalRule({
+        level1_role: "manager",
+        level2_role: "finance",
+      });
+
+      expect(result.length).toBe(2);
+      expect(result[0].assignee_rule.type).toBe("department_manager");
+      expect(result[1].assignee_rule.type).toBe("role");
+      expect(result[1].assignee_rule.value).toBe("finance");
     });
 
-    describe("resolveAssigneeFromRule", () => {
-        it("resolves role type", async () => {
-            const res = await workflowUtils.resolveAssigneeFromRule({ type: "role", value: "hr" });
-            expect(res.assigneeRole).toBe("hr");
-            expect(res.assigneeId).toBe(null);
-        });
+    it("throws if rule is empty or missing roles", () => {
+      expect(() => workflowUtils.buildWorkflowStepsFromApprovalRule({})).toThrow(/参数校验失败/);
+    });
+  });
 
-        it("throws for invalid rule", async () => {
-            await expect(workflowUtils.resolveAssigneeFromRule(null)).rejects.toThrow(/参数校验失败/);
-            await expect(workflowUtils.resolveAssigneeFromRule({ type: "unknown" })).rejects.toThrow(/参数校验失败/);
-        });
+  describe("resolveAssigneeFromRule", () => {
+    it("resolves role type", async () => {
+      const result = await workflowUtils.resolveAssigneeFromRule({ type: "role", value: "hr" });
+
+      expect(result.assigneeRole).toBe("hr");
+      expect(result.assigneeId).toBe(null);
     });
 
-    describe("toMoneyString", () => {
-        it("converts values to string correctly", () => {
-            expect(workflowUtils.toMoneyString(null)).toBe(null);
-            expect(workflowUtils.toMoneyString("10.0")).toBe("10.0");
-            expect(workflowUtils.toMoneyString(10)).toBe("10");
-        });
+    it("throws for invalid rule", async () => {
+      await expect(workflowUtils.resolveAssigneeFromRule(null)).rejects.toThrow(/参数校验失败/);
+      await expect(workflowUtils.resolveAssigneeFromRule({ type: "unknown" })).rejects.toThrow(/参数校验失败/);
     });
+  });
+
+  describe("toMoneyString", () => {
+    it("converts values to string correctly", () => {
+      expect(workflowUtils.toMoneyString(null)).toBe(null);
+      expect(workflowUtils.toMoneyString("10.0")).toBe("10.0");
+      expect(workflowUtils.toMoneyString(10)).toBe("10");
+    });
+  });
+
+  it("blocks submit-time workflow resolution when the direct manager is missing", async () => {
+    const tx = {
+      employee: {
+        findUnique: vi.fn(async () => ({
+          id: OWNER_ID,
+          direct_manager_id: null,
+        })),
+      },
+    };
+
+    await expect(
+      resolveActionableStep({
+        tx,
+        steps: buildSteps(),
+        startIndex: 0,
+        ownerId: OWNER_ID,
+        blockOnUnresolvedAssignee: true,
+      }),
+    ).rejects.toMatchObject({
+      details: {
+        workflow: "no_actionable_approver",
+        reason: "no_manager_found",
+        stepId: "approval_1_manager",
+      },
+    });
+  });
+
+  it("keeps legacy skip behavior when strict submit resolution is not requested", async () => {
+    const tx = {
+      employee: {
+        findUnique: vi.fn(async () => ({
+          id: OWNER_ID,
+          direct_manager_id: null,
+        })),
+      },
+    };
+
+    const result = await resolveActionableStep({
+      tx,
+      steps: buildSteps(),
+      startIndex: 0,
+      ownerId: OWNER_ID,
+    });
+
+    expect(result.actionable).toEqual(
+      expect.objectContaining({
+        step: expect.objectContaining({ id: "approval_2_finance" }),
+        assigneeRole: "finance",
+      }),
+    );
+    expect(result.skipped).toEqual([
+      expect.objectContaining({
+        reason: "no_manager_found",
+      }),
+    ]);
+  });
 });