R5-M1-M5 收口正式审批规则与移动反馈

server/src/routes/leave.js

@@ -1015,6 +1015,7 @@ async function leaveRoutes(fastify) {
           startIndex: 0,
           ownerId: leave.owner_id,
           logger: fastify.log,
+          blockOnUnresolvedAssignee: true,
         });
         if (!actionable) {
           throw buildValidationError({ workflow: "no_actionable_approver" }, 409);

server/src/routes/purchaseRequests.js

@@ -1524,6 +1524,7 @@ async function purchaseRequestRoutes(fastify) {
         startIndex: 0,
         ownerId: unlockedPurchaseRequest.applicant_id,
         logger: fastify.log,
+        blockOnUnresolvedAssignee: true,
       });
 
       if (!actionable) {

server/src/routes/reimbursements.js

@@ -3179,6 +3179,7 @@ async function reimbursementRoutes(fastify) {
           startIndex: 0,
           ownerId: reimbursement.owner_id,
           logger: fastify.log,
+          blockOnUnresolvedAssignee: true,
         });
 
         if (!actionable) {

server/src/routes/travelRequests.js

@@ -986,6 +986,7 @@ async function createTravelRequestsRoutes(fastify) {
           startIndex: 0,
           ownerId: travelRequest.applicant_employee_id,
           logger: fastify.log,
+          blockOnUnresolvedAssignee: true,
         });
         if (!actionable) {
           throw buildValidationError({ workflow: "no_actionable_approver" }, 409);

server/src/routes/workflow.js

@@ -2,7 +2,7 @@ const { z } = require("zod");
 const { AppError } = require("../utils/AppError");
 const { buildAuditLogData } = require("../utils/audit");
 const { sendData } = require("../utils/reply");
-const { resolvePermissionsForRoles, hasPermission, ROLE_PERMISSIONS, resolveEntityPermission } = require("../constants/permissions");
+const { hasPermission, ROLE_PERMISSIONS, resolveEntityPermission } = require("../constants/permissions");
 const { getWorkflowStepsSnapshot, resolveActionableStep, toMoneyString } = require("../utils/workflow");
 const { consumeReservedLeave, releaseReservedLeave, formatDateOnly } = require("../services/leave");
 const { FEATURE_FLAG_KEYS, evaluateFeatureFlag } = require("../services/featureFlags");
@@ -525,6 +525,7 @@ async function loadWorkflowInstanceForTask(tx, instanceId) {
       id: true,
       entity_type: true,
       entity_id: true,
+      submitter_id: true,
       current_step_id: true,
       context_data: true,
       workflow_definition: {
@@ -674,6 +675,102 @@ async function loadWorkflowNotifyContext(tx, entityType, entityId) {
   };
 }
 
+function resolveBusinessApprovePermission(entityType) {
+  return resolveEntityPermission(normalizeWorkflowEntityType(entityType), "approve");
+}
+
+function roleHasBusinessApprovePermission(roleCode, approvePermission) {
+  if (!roleCode || roleCode === "admin" || !approvePermission) {
+    return false;
+  }
+
+  return (ROLE_PERMISSIONS[roleCode] ?? []).includes(approvePermission);
+}
+
+function employeeHasBusinessApproveRole(employee, entityType) {
+  const approvePermission = resolveBusinessApprovePermission(entityType);
+  return Boolean(
+    approvePermission &&
+      (employee?.roleCodes ?? []).some((roleCode) =>
+        roleHasBusinessApprovePermission(roleCode, approvePermission),
+      ),
+  );
+}
+
+function ensureBusinessApproveRole(employee, entityType) {
+  if (employeeHasBusinessApproveRole(employee, entityType)) {
+    return;
+  }
+
+  throw new AppError({
+    code: "PERM_002",
+    message: "不在审批范围/非当前处理人",
+    statusCode: 403,
+    details: { workflow: "business_approval_role_required" },
+  });
+}
+
+function collectWorkflowApplicantIds(workflowInstance, record) {
+  const entityType = normalizeWorkflowEntityType(workflowInstance.entity_type);
+
+  if (entityType === "reimbursement") {
+    return uniq([record?.owner_id, record?.submitter_id, workflowInstance.submitter_id]);
+  }
+
+  if (entityType === "leave") {
+    return uniq([record?.owner_id, workflowInstance.submitter_id]);
+  }
+
+  if (entityType === "purchase_request") {
+    return uniq([record?.applicant_id, record?.submitter_id, workflowInstance.submitter_id]);
+  }
+
+  if (entityType === "travel_request") {
+    return uniq([record?.applicant_employee_id, record?.submitter_id, workflowInstance.submitter_id]);
+  }
+
+  return uniq([workflowInstance.submitter_id]);
+}
+
+async function loadWorkflowApplicantIds(tx, workflowInstance) {
+  const { record } = await loadWorkflowNotifyContext(
+    tx,
+    workflowInstance.entity_type,
+    workflowInstance.entity_id,
+  );
+
+  if (!record) {
+    throw new AppError({
+      code: "VALID_001",
+      message: "参数校验失败",
+      statusCode: 409,
+      details: { workflow: "entity_not_processable" },
+    });
+  }
+
+  return collectWorkflowApplicantIds(workflowInstance, record);
+}
+
+function ensureNoSelfApproval(actorIds, applicantIds) {
+  if (!actorIds.some((actorId) => applicantIds.includes(actorId))) {
+    return;
+  }
+
+  throw new AppError({
+    code: "VALID_001",
+    message: "参数校验失败",
+    statusCode: 409,
+    details: { workflow: "self_approval_not_allowed" },
+  });
+}
+
+async function ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment) {
+  ensureBusinessApproveRole(request.employee, workflowInstance.entity_type);
+  const applicantIds = await loadWorkflowApplicantIds(tx, workflowInstance);
+  ensureNoSelfApproval(uniq([request.employee.id, assignment?.principalId]), applicantIds);
+  return applicantIds;
+}
+
 function resolveWorkflowOutcomeNotificationType(entityType, outcome) {
   const normalizedEntityType = normalizeWorkflowEntityType(entityType);
 
@@ -877,8 +974,7 @@ async function ensureTransferTargetEligible(tx, toApproverId, approvePermission)
   }
 
   const roleCodes = target.roles.map((item) => item.role_code);
-  const permissionCodes = resolvePermissionsForRoles(roleCodes);
-  if (!approvePermission || !hasPermission(permissionCodes, approvePermission)) {
+  if (!roleCodes.some((roleCode) => roleHasBusinessApprovePermission(roleCode, approvePermission))) {
     throw new AppError({
       code: "VALID_001",
       message: "参数校验失败",
@@ -943,6 +1039,7 @@ async function executeApproveWorkflowTask({
     const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id);
     ensureWorkflowEntityType(workflowInstance, allowedEntityType);
     fastify.assertEntityPermission(request.employee, workflowInstance.entity_type, "approve");
+    await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment);
     const steps = getWorkflowStepsSnapshot(workflowInstance);
     const currentStepIndex = steps.findIndex((step) => step.id === workflowInstance.current_step_id);
     if (currentStepIndex < 0) {
@@ -1238,6 +1335,7 @@ async function executeRejectWorkflowTask({
     const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id);
     ensureWorkflowEntityType(workflowInstance, allowedEntityType);
     fastify.assertEntityPermission(request.employee, workflowInstance.entity_type, "approve");
+    await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment);
     const now = new Date();
 
     await tx.workflowTask.update({
@@ -1406,6 +1504,14 @@ function mapBatchTaskError(taskId, error) {
     };
   }
 
+  if (error instanceof AppError && error.details?.workflow === "self_approval_not_allowed") {
+    return {
+      taskId,
+      outcome: "error",
+      reason: "self_approval_not_allowed",
+    };
+  }
+
   if (error instanceof AppError) {
     return {
       taskId,
@@ -2219,6 +2325,7 @@ async function workflowRoutes(fastify) {
 
         const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id);
         fastify.assertEntityPermission(request.employee, workflowInstance.entity_type, "approve");
+        await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment);
         const now = new Date();
 
         await tx.workflowTask.update({
@@ -2421,8 +2528,10 @@ async function workflowRoutes(fastify) {
             details: { transfer: "unsupported_entity_type" },
           });
         }
+        const applicantIds = await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment);
         const transferCount = await ensureTransferChainNotExceeded(tx, taskId);
         await ensureTransferTargetEligible(tx, toApproverId, approvePermission);
+        ensureNoSelfApproval([toApproverId], applicantIds);
 
         if (toApproverId === request.employee.id) {
           throw new AppError({

server/src/services/feeControl.js

@@ -597,14 +597,14 @@ async function buildReimbursementPrecheck(tx, { reimbursementId, config, logger
     blocking.push(buildRiskFlagPreview("missing_approval_rule", RISK_LEVELS.high, "缺少审批规则", "当前金额范围未匹配到有效报销审批规则。"));
   } else {
     const workflowSteps = buildWorkflowStepsFromApprovalRule(approvalRule);
-    const { actionable } = await resolveActionableStep({
+    const { actionable, skipped } = await resolveActionableStep({
       tx,
       steps: workflowSteps,
       startIndex: 0,
       ownerId: reimbursement.owner_id,
       logger,
     });
-    if (!actionable) {
+    if (!actionable || skipped.length) {
       blocking.push(buildRiskFlagPreview("no_actionable_approver", RISK_LEVELS.high, "缺少可执行审批人", "当前审批链未解析出有效审批人。"));
     }
   }
@@ -718,14 +718,14 @@ async function buildPurchaseRequestPrecheck(tx, { purchaseRequestId, config, log
     blocking.push(buildRiskFlagPreview("workflow_definition_missing", RISK_LEVELS.high, "缺少流程定义", "采购申请缺少有效流程定义。"));
   } else {
     const workflowSteps = parseWorkflowSteps(workflowDefinition.definition_json);
-    const { actionable } = await resolveActionableStep({
+    const { actionable, skipped } = await resolveActionableStep({
       tx,
       steps: workflowSteps,
       startIndex: 0,
       ownerId: purchaseRequest.applicant_id,
       logger,
     });
-    if (!actionable) {
+    if (!actionable || skipped.length) {
       blocking.push(buildRiskFlagPreview("no_actionable_approver", RISK_LEVELS.high, "缺少可执行审批人", "当前采购流程未解析出有效审批人。"));
     }
   }
@@ -850,14 +850,14 @@ async function buildTravelRequestPrecheck(tx, { travelRequestId, config, logger
     blocking.push(buildRiskFlagPreview("workflow_definition_missing", RISK_LEVELS.high, "缺少流程定义", "差旅申请缺少有效流程定义。"));
   } else {
     const workflowSteps = parseWorkflowSteps(workflowDefinition.definition_json);
-    const { actionable } = await resolveActionableStep({
+    const { actionable, skipped } = await resolveActionableStep({
       tx,
       steps: workflowSteps,
       startIndex: 0,
       ownerId: travelRequest.applicant_employee_id,
       logger,
     });
-    if (!actionable) {
+    if (!actionable || skipped.length) {
       blocking.push(buildRiskFlagPreview("no_actionable_approver", RISK_LEVELS.high, "缺少可执行审批人", "当前差旅流程未解析出有效审批人。"));
     }
   }

server/src/utils/workflow.js

@@ -2,6 +2,13 @@ const { AppError } = require("./AppError");
 
 const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const MAX_MANAGER_DEPTH = 10;
+const BLOCKING_ASSIGNEE_SKIP_REASONS = new Set([
+  "no_manager_found",
+  "chain_broken",
+  "self_loop",
+  "cycle_detected",
+  "max_depth_exceeded",
+]);
 
 function parseWorkflowSteps(definitionJson) {
   const steps = definitionJson?.steps;
@@ -233,7 +240,14 @@ async function resolveAssigneeFromRule(rule, options = {}) {
   });
 }
 
-async function resolveActionableStep({ tx, steps, startIndex, ownerId, logger }) {
+async function resolveActionableStep({
+  tx,
+  steps,
+  startIndex,
+  ownerId,
+  logger,
+  blockOnUnresolvedAssignee = false,
+}) {
   const skipped = [];
 
   for (let index = startIndex; index < steps.length; index += 1) {
@@ -257,6 +271,19 @@ async function resolveActionableStep({ tx, steps, startIndex, ownerId, logger })
     }
 
     if (resolved.skipReason) {
+      if (blockOnUnresolvedAssignee && BLOCKING_ASSIGNEE_SKIP_REASONS.has(resolved.skipReason)) {
+        throw new AppError({
+          code: "VALID_001",
+          message: "参数校验失败",
+          statusCode: 409,
+          details: {
+            workflow: "no_actionable_approver",
+            reason: resolved.skipReason,
+            stepId: step.id,
+          },
+        });
+      }
+
       skipped.push({
         index,
         step,