wangsli/hyb-oa
1
0
派生 0
代码 工单 合并请求 工作流 8 软件包 项目 发布 百科 活动

feat(server): 完成 P2 后端能力（支付幂等、委派回收、OCR异步、审计）

浏览代码
这个提交包含在：
wangsli
2026-02-07 21:54:29 +08:00
父节点 7ea25e9d72
当前提交 c4df9a419a
共修改 23 个文件，包含 2102 行新增和 70 行删除
下载 Patch 文件 下载 Diff 文件 展开所有文件 折叠所有文件
.gitignore
+2
查看文件
@@ -7,3 +7,5 @@ server/generated/prisma
**/dist
server/generated/storage
server/.env.example
+12
查看文件
@@ -7,3 +7,15 @@ APP_TIMEZONE="Asia/Shanghai"
STORAGE_DIR="generated/storage"
SIGNED_URL_TTL_SECONDS="600"
MAX_UPLOAD_SIZE_BYTES="10485760"
DELEGATION_REVOKE_CRON="0 * * * *"
OCR_PROVIDER="off"
OCR_BATCH_SIZE="10"
OCR_LOCK_TTL_SECONDS="300"
OCR_POLL_CRON="* * * * *"
OCR_MAX_ATTEMPTS="3"
OCR_TIMEOUT_MS="5000"
TENCENT_SECRET_ID=""
TENCENT_SECRET_KEY=""
TENCENT_OCR_REGION="ap-beijing"
server/README.md
+53 -5
查看文件
@@ -90,6 +90,9 @@ cd /home/shunli/Projects/hyb-oa/server
- `pay` 权限：非财务返回 `PERM_001`
- `pay` 状态校验：非 `approved/paid` 返回 `VALID_001`
- `pay` 幂等：重复付款返回 200（`archivedInvoiceCount` 可为 0）
- `pay` 幂等冲突：已付款后提交冲突凭证字段返回 `409 VALID_001`（`already_paid_conflict`）
- `delegation`：有效期内可代办并在 history 写入 delegation 证据
- `delegation` 过期：代理人返回 `PERM_002`，自动回收任务可撤销过期委派
### 4.4 一键全量回归
```bash
@@ -126,19 +129,62 @@ npm run dev
---
## 5. 关键环境变量
## 5. P2 API 摘要
### 5.1 付款标记（pay）
- `POST /api/reimbursements/:id/pay`
- 权限：`expense.finance.pay`
- 可选请求体：`paymentVoucherNo`、`paymentDate(YYYY-MM-DD)`、`paymentChannel(bank/alipay/wechat/cash/other)`
- 语义：
- `approved -> paid`：返回 200，并归档关联 `bound` 发票
- 已 `paid` 重复同值：返回 200（`payment.idempotent=true`）
- 已 `paid` 重复冲突值：返回 `409 VALID_001`，`details.payment=already_paid_conflict`
### 5.2 委派管理
- `POST /api/delegations`：创建委派（scope + validFrom/validTo）
- `GET /api/delegations/mine`：查看我发起/我接收的委派
- `POST /api/delegations/:id/revoke`：撤销委派
- 委派仅作用于 `assignee_id` 任务，不改写 `assignee_role` 语义。
### 5.3 OCR 异步状态查询
- 上传发票在 OCR 开启且 `ocr_type=vat` 时会进入 `pending_ocr`。
- `GET /api/invoice-pool/:id` 可轮询 OCR 处理状态（`pending_ocr/available/ocr_failed`）。
### 5.4 审计日志查询
- `GET /api/audit-logs`
- 权限：`system.audit.view`（finance_mgr/admin）
- 支持分页与筛选（actor/action/targetType/date range）。
### 5.5 定时任务（可手动执行）
```bash
cd /home/shunli/Projects/hyb-oa/server
npm run job:revoke-expired-delegations
npm run job:ocr-once
```
---
## 6. 关键环境变量
- `DATABASE_URL`: PostgreSQL 连接串
- `JWT_SECRET`: JWT & signed-url token 签名密钥
- `APP_TIMEZONE`: 默认 `Asia/Shanghai`
- `STORAGE_DIR`: 默认 `generated/storage`（相对 `server/`）
- `SIGNED_URL_TTL_SECONDS`: 默认 `600`
- `MAX_UPLOAD_SIZE_BYTES`: 默认 `10485760`（10MB）
- `DELEGATION_REVOKE_CRON`: 委派自动回收定时表达式（默认 `0 * * * *`）
- `OCR_PROVIDER`: `off` 或 `tencent`（默认 `off`）
- `OCR_BATCH_SIZE`: 每轮 OCR 认领数量（默认 `10`）
- `OCR_LOCK_TTL_SECONDS`: OCR 锁超时秒数（默认 `300`）
- `OCR_POLL_CRON`: OCR 轮询 cron（默认 `* * * * *`）
- `OCR_MAX_ATTEMPTS`: OCR 最大重试次数（默认 `3`）
- `OCR_TIMEOUT_MS`: 腾讯 OCR SDK 超时（默认 `5000`）
- `TENCENT_SECRET_ID` / `TENCENT_SECRET_KEY` / `TENCENT_OCR_REGION`: 腾讯 OCR 配置
> 生产提示：大表加索引需评估 `CREATE INDEX CONCURRENTLY`，避免锁表影响。
---
## 6. 常见失败排查
## 7. 常见失败排查
| 现象 | 可能原因 | 解决方案 |
|---|---|---|
@@ -147,14 +193,16 @@ npm run dev
| signed-url 接口返回 403 | `JWT_SECRET` 不一致、token 过期、访问人无权限 | 统一服务密钥、确认 URL 在 TTL 内、检查账号角色 |
| 上传返回 `file_too_large` | 文件超 `MAX_UPLOAD_SIZE_BYTES` | 调整环境变量或使用更小文件 |
| 上传失败且报目录/权限错误 | `STORAGE_DIR` 不存在或不可写 | 创建目录并修正权限；Docker 需确认 volume 挂载 |
| OCR 长期停留 `pending_ocr` | `OCR_PROVIDER=off` 或密钥无效 | 检查 OCR 环境变量，手动执行 `npm run job:ocr-once` 验证 |
| 委派过期后仍可操作 | 自动回收任务未运行 | 检查 `DELEGATION_REVOKE_CRON`，手动执行 `npm run job:revoke-expired-delegations` |
---
## 7. 手工故障注入（非阻塞）
## 8. 手工故障注入（非阻塞）
### 7.1 `STORAGE_DIR` 不可写路径
### 8.1 `STORAGE_DIR` 不可写路径
- 临时将 `STORAGE_DIR` 指向只读目录，执行上传接口，确认错误可观测（日志+返回码）。
### 7.2 磁盘空间不足（ENOSPC）
### 8.2 磁盘空间不足（ENOSPC）
- 在受控环境中制造磁盘满条件后重试上传。
- 预期：错误路径可观测（日志中能定位到 I/O 错误），不要求纳入日常 CI 冒烟。
server/package-lock.json
自动生成
+433
查看文件
@@ -19,8 +19,10 @@
"bcryptjs": "^3.0.3",
"fastify": "^5.7.4",
"fastify-plugin": "^5.1.0",
"node-cron": "^4.2.1",
"pg": "^8.18.0",
"prisma": "^7.3.0",
"tencentcloud-sdk-nodejs": "^4.1.14",
"zod": "^4.3.6"
},
"devDependencies": {
@@ -625,6 +627,18 @@
"integrity": "sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==",
"license": "MIT"
},
"node_modules/agent-base": {
"version": "6.0.2",
"resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
"integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
"license": "MIT",
"dependencies": {
"debug": "4"
},
"engines": {
"node": ">= 6.0.0"
}
},
"node_modules/ajv": {
"version": "8.17.1",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-8.17.1.tgz",
@@ -670,6 +684,12 @@
"safer-buffer": "^2.1.0"
}
},
"node_modules/asynckit": {
"version": "0.4.0",
"resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
"integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
"license": "MIT"
},
"node_modules/atomic-sleep": {
"version": "1.0.0",
"resolved": "https://registry.npmjs.org/atomic-sleep/-/atomic-sleep-1.0.0.tgz",
@@ -707,6 +727,15 @@
"bcrypt": "bin/bcrypt"
}
},
"node_modules/bignumber.js": {
"version": "9.3.1",
"resolved": "https://registry.npmjs.org/bignumber.js/-/bignumber.js-9.3.1.tgz",
"integrity": "sha512-Ko0uX15oIUS7wJ3Rb30Fs6SkVbLmPBAKdlm7q9+ak9bbIeFf0MwuBsQV6z7+X768/cHsfg+WlysDWJcmthjsjQ==",
"license": "MIT",
"engines": {
"node": "*"
}
},
"node_modules/bn.js": {
"version": "4.12.2",
"resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.2.tgz",
@@ -741,6 +770,19 @@
}
}
},
"node_modules/call-bind-apply-helpers": {
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
"integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
"license": "MIT",
"dependencies": {
"es-errors": "^1.3.0",
"function-bind": "^1.1.2"
},
"engines": {
"node": ">= 0.4"
}
},
"node_modules/chevrotain": {
"version": "10.5.0",
"resolved": "https://registry.npmjs.org/chevrotain/-/chevrotain-10.5.0.tgz",
@@ -779,6 +821,18 @@
"consola": "^3.2.3"
}
},
"node_modules/combined-stream": {
"version": "1.0.8",
"resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
"integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
"license": "MIT",
"dependencies": {
"delayed-stream": "~1.0.0"
},
"engines": {
"node": ">= 0.8"
}
},
"node_modules/confbox": {
"version": "0.2.2",
"resolved": "https://registry.npmjs.org/confbox/-/confbox-0.2.2.tgz",
@@ -841,6 +895,23 @@
"license": "MIT",
"peer": true
},
"node_modules/debug": {
"version": "4.4.3",
"resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
"integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
"license": "MIT",
"dependencies": {
"ms": "^2.1.3"
},
"engines": {
"node": ">=6.0"
},
"peerDependenciesMeta": {
"supports-color": {
"optional": true
}
}
},
"node_modules/deepmerge-ts": {
"version": "7.1.5",
"resolved": "https://registry.npmjs.org/deepmerge-ts/-/deepmerge-ts-7.1.5.tgz",
@@ -856,6 +927,15 @@
"integrity": "sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==",
"license": "MIT"
},
"node_modules/delayed-stream": {
"version": "1.0.0",
"resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
"integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
"license": "MIT",
"engines": {
"node": ">=0.4.0"
}
},
"node_modules/denque": {
"version": "2.1.0",
"resolved": "https://registry.npmjs.org/denque/-/denque-2.1.0.tgz",
@@ -901,6 +981,20 @@
"url": "https://dotenvx.com"
}
},
"node_modules/dunder-proto": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
"integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
"license": "MIT",
"dependencies": {
"call-bind-apply-helpers": "^1.0.1",
"es-errors": "^1.3.0",
"gopd": "^1.2.0"
},
"engines": {
"node": ">= 0.4"
}
},
"node_modules/ecdsa-sig-formatter": {
"version": "1.0.11",
"resolved": "https://registry.npmjs.org/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.11.tgz",
@@ -929,6 +1023,51 @@
"node": ">=14"
}
},
"node_modules/es-define-property": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
"integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
"license": "MIT",
"engines": {
"node": ">= 0.4"
}
},
"node_modules/es-errors": {
"version": "1.3.0",
"resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
"integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
"license": "MIT",
"engines": {
"node": ">= 0.4"
}
},
"node_modules/es-object-atoms": {
"version": "1.1.1",
"resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
"integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
"license": "MIT",
"dependencies": {
"es-errors": "^1.3.0"
},
"engines": {
"node": ">= 0.4"
}
},
"node_modules/es-set-tostringtag": {
"version": "2.1.0",
"resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
"integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
"license": "MIT",
"dependencies": {
"es-errors": "^1.3.0",
"get-intrinsic": "^1.2.6",
"has-tostringtag": "^1.0.2",
"hasown": "^2.0.2"
},
"engines": {
"node": ">= 0.4"
}
},
"node_modules/escape-html": {
"version": "1.0.3",
"resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
@@ -1159,6 +1298,31 @@
"url": "https://github.com/sponsors/isaacs"
}
},
"node_modules/form-data": {
"version": "3.0.4",
"resolved": "https://registry.npmjs.org/form-data/-/form-data-3.0.4.tgz",
"integrity": "sha512-f0cRzm6dkyVYV3nPoooP8XlccPQukegwhAnpoLcXy+X+A8KfpGOoXwDr9FLZd3wzgLaBGQBE3lY93Zm/i1JvIQ==",
"license": "MIT",
"dependencies": {
"asynckit": "^0.4.0",
"combined-stream": "^1.0.8",
"es-set-tostringtag": "^2.1.0",
"hasown": "^2.0.2",
"mime-types": "^2.1.35"
},
"engines": {
"node": ">= 6"
}
},
"node_modules/function-bind": {
"version": "1.1.2",
"resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
"integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
"license": "MIT",
"funding": {
"url": "https://github.com/sponsors/ljharb"
}
},
"node_modules/generate-function": {
"version": "2.3.1",
"resolved": "https://registry.npmjs.org/generate-function/-/generate-function-2.3.1.tgz",
@@ -1168,12 +1332,61 @@
"is-property": "^1.0.2"
}
},
"node_modules/get-intrinsic": {
"version": "1.3.0",
"resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
"integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
"license": "MIT",
"dependencies": {
"call-bind-apply-helpers": "^1.0.2",
"es-define-property": "^1.0.1",
"es-errors": "^1.3.0",
"es-object-atoms": "^1.1.1",
"function-bind": "^1.1.2",
"get-proto": "^1.0.1",
"gopd": "^1.2.0",
"has-symbols": "^1.1.0",
"hasown": "^2.0.2",
"math-intrinsics": "^1.1.0"
},
"engines": {
"node": ">= 0.4"
},
"funding": {
"url": "https://github.com/sponsors/ljharb"
}
},
"node_modules/get-port-please": {
"version": "3.2.0",
"resolved": "https://registry.npmjs.org/get-port-please/-/get-port-please-3.2.0.tgz",
"integrity": "sha512-I9QVvBw5U/hw3RmWpYKRumUeaDgxTPd401x364rLmWBJcOQ753eov1eTgzDqRG9bqFIfDc7gfzcQEWrUri3o1A==",
"license": "MIT"
},
"node_modules/get-proto": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
"integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
"license": "MIT",
"dependencies": {
"dunder-proto": "^1.0.1",
"es-object-atoms": "^1.0.0"
},
"engines": {
"node": ">= 0.4"
}
},
"node_modules/get-stream": {
"version": "6.0.1",
"resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
"integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
"license": "MIT",
"engines": {
"node": ">=10"
},
"funding": {
"url": "https://github.com/sponsors/sindresorhus"
}
},
"node_modules/giget": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/giget/-/giget-2.0.0.tgz",
@@ -1208,6 +1421,18 @@
"url": "https://github.com/sponsors/isaacs"
}
},
"node_modules/gopd": {
"version": "1.2.0",
"resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
"integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
"license": "MIT",
"engines": {
"node": ">= 0.4"
},
"funding": {
"url": "https://github.com/sponsors/ljharb"
}
},
"node_modules/graceful-fs": {
"version": "4.2.11",
"resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
@@ -1225,6 +1450,45 @@
"resolved": "https://registry.npmjs.org/graphmatch/-/graphmatch-1.1.0.tgz",
"integrity": "sha512-0E62MaTW5rPZVRLyIJZG/YejmdA/Xr1QydHEw3Vt+qOKkMIOE8WDLc9ZX2bmAjtJFZcId4lEdrdmASsEy7D1QA=="
},
"node_modules/has-symbols": {
"version": "1.1.0",
"resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
"integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
"license": "MIT",
"engines": {
"node": ">= 0.4"
},
"funding": {
"url": "https://github.com/sponsors/ljharb"
}
},
"node_modules/has-tostringtag": {
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
"integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
"license": "MIT",
"dependencies": {
"has-symbols": "^1.0.3"
},
"engines": {
"node": ">= 0.4"
},
"funding": {
"url": "https://github.com/sponsors/ljharb"
}
},
"node_modules/hasown": {
"version": "2.0.2",
"resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
"integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
"license": "MIT",
"dependencies": {
"function-bind": "^1.1.2"
},
"engines": {
"node": ">= 0.4"
}
},
"node_modules/hono": {
"version": "4.11.4",
"resolved": "https://registry.npmjs.org/hono/-/hono-4.11.4.tgz",
@@ -1260,6 +1524,19 @@
"integrity": "sha512-RJ8XvFvpPM/Dmc5SV+dC4y5PCeOhT3x1Hq0NU3rjGeg5a/CqlhZ7uudknPwZFz4aeAXDcbAyaeP7GAo9lvngtA==",
"license": "MIT"
},
"node_modules/https-proxy-agent": {
"version": "5.0.1",
"resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
"integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
"license": "MIT",
"dependencies": {
"agent-base": "6",
"debug": "4"
},
"engines": {
"node": ">= 6"
}
},
"node_modules/iconv-lite": {
"version": "0.7.2",
"resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
@@ -1282,6 +1559,15 @@
"integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
"license": "ISC"
},
"node_modules/ini": {
"version": "5.0.0",
"resolved": "https://registry.npmjs.org/ini/-/ini-5.0.0.tgz",
"integrity": "sha512-+N0ngpO3e7cRUWOJAS7qw0IZIVc6XPrW4MlFBdD066F2L4k1L6ker3hLqSq7iXxU5tgS4WGkIUElWn5vogAEnw==",
"license": "ISC",
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/ipaddr.js": {
"version": "2.3.0",
"resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-2.3.0.tgz",
@@ -1297,6 +1583,18 @@
"integrity": "sha512-Ks/IoX00TtClbGQr4TWXemAnktAQvYB7HzcCxDGqEZU6oCmb2INHuOoKxbtR+HFkmYWBKv/dOZtGRiAjDhj92g==",
"license": "MIT"
},
"node_modules/is-stream": {
"version": "2.0.1",
"resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
"integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
"license": "MIT",
"engines": {
"node": ">=8"
},
"funding": {
"url": "https://github.com/sponsors/sindresorhus"
}
},
"node_modules/isexe": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
@@ -1312,6 +1610,15 @@
"jiti": "lib/jiti-cli.mjs"
}
},
"node_modules/json-bigint": {
"version": "1.0.0",
"resolved": "https://registry.npmjs.org/json-bigint/-/json-bigint-1.0.0.tgz",
"integrity": "sha512-SiPv/8VpZuWbvLSMtTDU8hEfrZWg/mH/nV/b4o0CYbSxu1UIQPLdwKOCIyLQX+VIPO5vrLX3i8qtqFyhdPSUSQ==",
"license": "MIT",
"dependencies": {
"bignumber.js": "^9.0.0"
}
},
"node_modules/json-schema-ref-resolver": {
"version": "3.0.0",
"resolved": "https://registry.npmjs.org/json-schema-ref-resolver/-/json-schema-ref-resolver-3.0.0.tgz",
@@ -1419,6 +1726,15 @@
"url": "https://github.com/sponsors/wellwelwel"
}
},
"node_modules/math-intrinsics": {
"version": "1.1.0",
"resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
"integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
"license": "MIT",
"engines": {
"node": ">= 0.4"
}
},
"node_modules/mime": {
"version": "3.0.0",
"resolved": "https://registry.npmjs.org/mime/-/mime-3.0.0.tgz",
@@ -1431,6 +1747,27 @@
"node": ">=10.0.0"
}
},
"node_modules/mime-db": {
"version": "1.52.0",
"resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
"integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
"license": "MIT",
"engines": {
"node": ">= 0.6"
}
},
"node_modules/mime-types": {
"version": "2.1.35",
"resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
"integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
"license": "MIT",
"dependencies": {
"mime-db": "1.52.0"
},
"engines": {
"node": ">= 0.6"
}
},
"node_modules/minimalistic-assert": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz",
@@ -1470,6 +1807,12 @@
"obliterator": "^2.0.4"
}
},
"node_modules/ms": {
"version": "2.1.3",
"resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
"integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
"license": "MIT"
},
"node_modules/mysql2": {
"version": "3.15.3",
"resolved": "https://registry.npmjs.org/mysql2/-/mysql2-3.15.3.tgz",
@@ -1502,6 +1845,35 @@
"node": ">=8.0.0"
}
},
"node_modules/node-cron": {
"version": "4.2.1",
"resolved": "https://registry.npmjs.org/node-cron/-/node-cron-4.2.1.tgz",
"integrity": "sha512-lgimEHPE/QDgFlywTd8yTR61ptugX3Qer29efeyWw2rv259HtGBNn1vZVmp8lB9uo9wC0t/AT4iGqXxia+CJFg==",
"license": "ISC",
"engines": {
"node": ">=6.0.0"
}
},
"node_modules/node-fetch": {
"version": "2.7.0",
"resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
"integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==",
"license": "MIT",
"dependencies": {
"whatwg-url": "^5.0.0"
},
"engines": {
"node": "4.x || >=6.0.0"
},
"peerDependencies": {
"encoding": "^0.1.0"
},
"peerDependenciesMeta": {
"encoding": {
"optional": true
}
}
},
"node_modules/node-fetch-native": {
"version": "1.6.7",
"resolved": "https://registry.npmjs.org/node-fetch-native/-/node-fetch-native-1.6.7.tgz",
@@ -2182,6 +2554,26 @@
"reusify": "^1.0.0"
}
},
"node_modules/tencentcloud-sdk-nodejs": {
"version": "4.1.184",
"resolved": "https://registry.npmjs.org/tencentcloud-sdk-nodejs/-/tencentcloud-sdk-nodejs-4.1.184.tgz",
"integrity": "sha512-OEHfAk4iUuDECw1phx/WxZbigLUZoSdjj+mErzs1+hRWeD2bTy79beMTep5W0Loq4rHIMRu8rXchq0n89mKchA==",
"license": "Apache-2.0",
"dependencies": {
"form-data": "^3.0.4",
"get-stream": "^6.0.0",
"https-proxy-agent": "^5.0.0",
"ini": "^5.0.0",
"is-stream": "^2.0.0",
"json-bigint": "^1.0.0",
"node-fetch": "^2.2.0",
"tslib": "1.13.0",
"uuid": "^9.0.1"
},
"engines": {
"node": ">=10"
}
},
"node_modules/thread-stream": {
"version": "4.0.0",
"resolved": "https://registry.npmjs.org/thread-stream/-/thread-stream-4.0.0.tgz",
@@ -2221,6 +2613,31 @@
"node": ">=0.6"
}
},
"node_modules/tr46": {
"version": "0.0.3",
"resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
"integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
"license": "MIT"
},
"node_modules/tslib": {
"version": "1.13.0",
"resolved": "https://registry.npmjs.org/tslib/-/tslib-1.13.0.tgz",
"integrity": "sha512-i/6DQjL8Xf3be4K/E6Wgpekn5Qasl1usyw++dAA35Ue5orEn65VIxOA+YvNNl9HV3qv70T7CNwjODHZrLwvd1Q==",
"license": "0BSD"
},
"node_modules/uuid": {
"version": "9.0.1",
"resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
"integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
"funding": [
"https://github.com/sponsors/broofa",
"https://github.com/sponsors/ctavan"
],
"license": "MIT",
"bin": {
"uuid": "dist/bin/uuid"
}
},
"node_modules/valibot": {
"version": "1.2.0",
"resolved": "https://registry.npmjs.org/valibot/-/valibot-1.2.0.tgz",
@@ -2235,6 +2652,22 @@
}
}
},
"node_modules/webidl-conversions": {
"version": "3.0.1",
"resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
"integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==",
"license": "BSD-2-Clause"
},
"node_modules/whatwg-url": {
"version": "5.0.0",
"resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
"integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
"license": "MIT",
"dependencies": {
"tr46": "~0.0.3",
"webidl-conversions": "^3.0.0"
}
},
"node_modules/which": {
"version": "2.0.2",
"resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
server/package.json
+6 -2
查看文件
@@ -14,7 +14,9 @@
"prisma:migrate:deploy": "prisma migrate deploy",
"seed:config": "node src/scripts/seed-config.js",
"seed:dev-users": "node src/scripts/seed-dev.js",
"seed:dev": "npm run seed:config && npm run seed:dev-users"
"seed:dev": "npm run seed:config && npm run seed:dev-users",
"job:revoke-expired-delegations": "node src/scripts/revoke-expired-delegations.js",
"job:ocr-once": "node src/scripts/run-ocr-once.js"
},
"keywords": [],
"author": "",
@@ -32,7 +34,9 @@
"fastify-plugin": "^5.1.0",
"pg": "^8.18.0",
"prisma": "^7.3.0",
"zod": "^4.3.6"
"zod": "^4.3.6",
"node-cron": "^4.2.1",
"tencentcloud-sdk-nodejs": "^4.1.14"
},
"devDependencies": {
"dotenv": "^16.4.5"
server/prisma/migrations/20260207180145_p2_phase1/migration.sql
+25
查看文件
@@ -0,0 +1,25 @@
-- reimbursement_forms: payment voucher fields
ALTER TABLE "reimbursement_forms"
ADD COLUMN "payment_voucher_no" VARCHAR(50),
ADD COLUMN "payment_date" DATE,
ADD COLUMN "payment_channel" VARCHAR(20),
ADD COLUMN "paid_at" TIMESTAMP(3),
ADD COLUMN "paid_by" UUID;
ALTER TABLE "reimbursement_forms"
ADD CONSTRAINT "reimbursement_forms_paid_by_fkey"
FOREIGN KEY ("paid_by") REFERENCES "employees"("id") ON DELETE SET NULL ON UPDATE CASCADE;
CREATE INDEX "reimbursement_forms_paid_by_idx" ON "reimbursement_forms"("paid_by");
-- invoice_pool: OCR lock fields
ALTER TABLE "invoice_pool"
ADD COLUMN "ocr_locked_at" TIMESTAMP(3),
ADD COLUMN "ocr_lock_owner" VARCHAR(128);
CREATE INDEX "idx_invoice_pool_ocr_queue"
ON "invoice_pool"("status", "ocr_locked_at", "created_at");
-- audit_logs: query acceleration
CREATE INDEX "idx_audit_logs_query"
ON "audit_logs"("created_at" DESC, "actor_id", "action");
server/prisma/schema.prisma
+15 -3
查看文件
@@ -171,6 +171,7 @@ model Employee {
submitted_reimbursements ReimbursementForm[] @relation("ReimbursementSubmitter")
owned_reimbursements ReimbursementForm[] @relation("ReimbursementOwner")
paid_reimbursements ReimbursementForm[] @relation("ReimbursementPaidBy")
owned_invoices InvoicePool[] @relation("InvoiceOwner")
uploaded_invoices InvoicePool[] @relation("InvoiceUploader")
@@ -276,6 +277,7 @@ model AuditLog {
@@index([request_id])
@@index([actor_id, created_at])
@@index([created_at, actor_id, action], map: "idx_audit_logs_query")
@@map("audit_logs")
}
@@ -327,15 +329,21 @@ model ReimbursementForm {
total_amount Decimal @default(0) @db.Decimal(14, 2)
status ReimbursementStatus @default(draft)
description String?
payment_voucher_no String? @db.VarChar(50)
payment_date DateTime? @db.Date
payment_channel String? @db.VarChar(20)
paid_at DateTime?
paid_by String? @db.Uuid
created_at DateTime @default(now())
created_by String? @db.Uuid
updated_at DateTime @updatedAt
updated_by String? @db.Uuid
submitter Employee @relation("ReimbursementSubmitter", fields: [submitter_id], references: [id], onDelete: Restrict)
owner Employee @relation("ReimbursementOwner", fields: [owner_id], references: [id], onDelete: Restrict)
department Department @relation(fields: [department_id], references: [id], onDelete: Restrict)
submitter Employee @relation("ReimbursementSubmitter", fields: [submitter_id], references: [id], onDelete: Restrict)
owner Employee @relation("ReimbursementOwner", fields: [owner_id], references: [id], onDelete: Restrict)
paid_by_employee Employee? @relation("ReimbursementPaidBy", fields: [paid_by], references: [id], onDelete: SetNull)
department Department @relation(fields: [department_id], references: [id], onDelete: Restrict)
items ReimbursementItem[]
invoice_pool_items InvoicePool[]
@@ -345,6 +353,7 @@ model ReimbursementForm {
@@index([owner_id])
@@index([submitter_id])
@@index([department_id])
@@index([paid_by])
@@index([status])
@@index([reimbursement_date])
@@map("reimbursement_forms")
@@ -414,6 +423,8 @@ model InvoicePool {
ocr_attempts Int @default(0)
ocr_last_error String?
ocr_completed_at DateTime?
ocr_locked_at DateTime?
ocr_lock_owner String? @db.VarChar(128)
invoice_code String?
invoice_number String?
@@ -447,6 +458,7 @@ model InvoicePool {
@@index([file_sha256])
@@index([invoice_code, invoice_number])
@@index([status])
@@index([status, ocr_locked_at, created_at], map: "idx_invoice_pool_ocr_queue")
@@index([linked_reimbursement_id])
@@map("invoice_pool")
}
server/scripts/regression-workflow-actions.sh
+184 -26
查看文件
@@ -188,8 +188,13 @@ pay_reimbursement() {
local token="$1"
local reimbursement_id="$2"
local out_file="$3"
local body="${4:-}"
api_json_auth POST "$BASE_URL/api/reimbursements/$reimbursement_id/pay" "$token" "$out_file" '{}'
if [[ -z "$body" ]]; then
body='{}'
fi
api_json_auth POST "$BASE_URL/api/reimbursements/$reimbursement_id/pay" "$token" "$out_file" "$body"
}
transfer_task() {
@@ -213,6 +218,25 @@ withdraw_reimbursement() {
assert_status "$status" "200" "withdraw reimbursement $reimbursement_id" "$out_file"
}
create_delegation() {
local token="$1"
local delegate_id="$2"
local scope="$3"
local valid_from="$4"
local valid_to="$5"
local out_file="$6"
api_json_auth POST "$BASE_URL/api/delegations" "$token" "$out_file" "{\"delegateEmployeeId\":\"$delegate_id\",\"scope\":\"$scope\",\"validFrom\":\"$valid_from\",\"validTo\":\"$valid_to\"}"
}
revoke_delegation() {
local token="$1"
local delegation_id="$2"
local out_file="$3"
api_json_auth POST "$BASE_URL/api/delegations/$delegation_id/revoke" "$token" "$out_file" '{}'
}
create_and_bind_invoice() {
local token="$1"
local reimbursement_id="$2"
@@ -761,7 +785,86 @@ const { createPrismaClient } = require('./src/prismaClient');
NODE
}
echo "[1/19] Health check + login baseline users"
assert_delegation_history_evidence() {
local task_id="$1"
local delegation_id="$2"
local principal_id="$3"
local delegate_id="$4"
local scenario="$5"
DATABASE_URL="$DATABASE_URL" node - "$task_id" "$delegation_id" "$principal_id" "$delegate_id" "$scenario" <<'NODE'
const [taskId, delegationId, principalId, delegateId, scenario] = process.argv.slice(2);
const { createPrismaClient } = require('./src/prismaClient');
(async () => {
const { prisma, pool } = createPrismaClient();
await prisma.$connect();
try {
const history = await prisma.workflowHistory.findFirst({
where: { task_id: taskId },
orderBy: { created_at: 'desc' },
select: { payload: true },
});
if (!history) {
console.error(`[ERROR] ${scenario} history not found`);
process.exit(1);
}
const payload = history.payload ?? {};
if (
payload.delegation_id !== delegationId ||
payload.principal_id !== principalId ||
payload.delegate_id !== delegateId
) {
console.error(
`[ERROR] ${scenario} delegation payload mismatch: delegation_id=${payload.delegation_id}, principal_id=${payload.principal_id}, delegate_id=${payload.delegate_id}`,
);
process.exit(1);
}
} finally {
await prisma.$disconnect();
await pool.end();
}
})().catch((error) => {
console.error(error);
process.exit(1);
});
NODE
}
assert_delegation_revoked_db() {
local delegation_id="$1"
local scenario="$2"
DATABASE_URL="$DATABASE_URL" node - "$delegation_id" "$scenario" <<'NODE'
const [delegationId, scenario] = process.argv.slice(2);
const { createPrismaClient } = require('./src/prismaClient');
(async () => {
const { prisma, pool } = createPrismaClient();
await prisma.$connect();
try {
const delegation = await prisma.delegationGrant.findUnique({
where: { id: delegationId },
select: { revoked_at: true },
});
if (!delegation || delegation.revoked_at == null) {
console.error(`[ERROR] ${scenario} expected revoked delegation but got none`);
process.exit(1);
}
} finally {
await prisma.$disconnect();
await pool.end();
}
})().catch((error) => {
console.error(error);
process.exit(1);
});
NODE
}
echo "[1/23] Health check + login baseline users"
health_status="$(curl -sS -o "$TMP_DIR/health.json" -w "%{http_code}" "$BASE_URL/health")"
assert_status "$health_status" "200" "health check" "$TMP_DIR/health.json"
@@ -783,7 +886,7 @@ ceo_me_status="$(api_json_auth GET "$BASE_URL/api/me" "$CEO_TOKEN" "$TMP_DIR/me-
assert_status "$ceo_me_status" "200" "get /api/me ceo" "$TMP_DIR/me-ceo.json"
CEO_ID="$(jq -er '.data.id' "$TMP_DIR/me-ceo.json")"
echo "[2/19] reject: instance=rejected, reimbursement=rejected"
echo "[2/23] reject: instance=rejected, reimbursement=rejected"
RID_REJECT="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/reject-create.json")"
create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_REJECT" "reject" >/dev/null
submit_reimbursement "$EMPLOYEE_TOKEN" "$RID_REJECT" "$TMP_DIR/reject-submit.json"
@@ -796,7 +899,7 @@ assert_jq "$TMP_DIR/reject-action.json" '.data.outcome == "rejected" and .data.r
assert_instance_status "$INSTANCE_REJECT" "rejected" "reject scenario"
assert_reimbursement_status_db "$RID_REJECT" "rejected" "reject scenario"
echo "[3/19] return + resubmit: terminated/draft and new instance"
echo "[3/23] return + resubmit: terminated/draft and new instance"
RID_RETURN="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/return-create.json")"
create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_RETURN" "return" >/dev/null
submit_reimbursement "$EMPLOYEE_TOKEN" "$RID_RETURN" "$TMP_DIR/return-submit-1.json"
@@ -821,7 +924,7 @@ withdraw_reimbursement "$EMPLOYEE_TOKEN" "$RID_RETURN" "cleanup after return-res
assert_instance_status "$INSTANCE_RETURN_2" "cancelled" "return resubmit cleanup"
assert_reimbursement_status_db "$RID_RETURN" "draft" "return resubmit cleanup"
echo "[4/19] withdraw: before approver processing"
echo "[4/23] withdraw: before approver processing"
RID_WITHDRAW="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/withdraw-create.json")"
create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_WITHDRAW" "withdraw" >/dev/null
submit_reimbursement "$EMPLOYEE_TOKEN" "$RID_WITHDRAW" "$TMP_DIR/withdraw-submit.json"
@@ -832,7 +935,7 @@ assert_jq "$TMP_DIR/withdraw-action.json" '.data.outcome == "withdrawn" and .dat
assert_instance_status "$INSTANCE_WITHDRAW" "cancelled" "withdraw scenario"
assert_reimbursement_status_db "$RID_WITHDRAW" "draft" "withdraw scenario"
echo "[5/19] PERM_002: non-assignee cannot operate"
echo "[5/23] PERM_002: non-assignee cannot operate"
RID_PERM="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/perm-create.json")"
create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_PERM" "perm" >/dev/null
submit_reimbursement "$EMPLOYEE_TOKEN" "$RID_PERM" "$TMP_DIR/perm-submit.json"
@@ -847,7 +950,7 @@ withdraw_reimbursement "$EMPLOYEE_TOKEN" "$RID_PERM" "cleanup after PERM_002" "$
assert_instance_status "$INSTANCE_PERM" "cancelled" "PERM_002 cleanup"
assert_reimbursement_status_db "$RID_PERM" "draft" "PERM_002 cleanup"
echo "[6/19] negative_not_allowed: submit blocked when total_amount < 0"
echo "[6/23] negative_not_allowed: submit blocked when total_amount < 0"
RID_NEGATIVE="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/negative-create.json")"
create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_NEGATIVE" "negative" >/dev/null
set_reimbursement_total_amount "$RID_NEGATIVE" "-1.00"
@@ -858,11 +961,11 @@ assert_error_code "$TMP_DIR/negative-submit.json" "VALID_001" "negative_not_allo
assert_error_detail "$TMP_DIR/negative-submit.json" '.error.details.total_amount' "negative_not_allowed" "negative_not_allowed submit"
assert_no_workflow_instance "$RID_NEGATIVE" "negative_not_allowed"
echo "[7/19] Prepare manager-missing context"
echo "[7/23] Prepare manager-missing context"
set_employee_direct_manager "$EMPLOYEE_ID" "__NULL__"
EMPLOYEE_MANAGER_PATCHED=1
echo "[8/19] manager skip: missing manager -> skip with history + finance task"
echo "[8/23] manager skip: missing manager -> skip with history + finance task"
RID_SKIP="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/skip-create.json")"
create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_SKIP" "skip" >/dev/null
submit_reimbursement "$EMPLOYEE_TOKEN" "$RID_SKIP" "$TMP_DIR/skip-submit.json"
@@ -876,7 +979,7 @@ skip_finance_approve_status="$(api_json_auth POST "$BASE_URL/api/workflow/tasks/
assert_status "$skip_finance_approve_status" "200" "manager skip finance approve" "$TMP_DIR/skip-finance-approve.json"
assert_reimbursement_status_db "$RID_SKIP" "approved" "manager skip scenario"
echo "[9/19] no_actionable_approver: full chain non-actionable"
echo "[9/23] no_actionable_approver: full chain non-actionable"
TMP_APPROVAL_RULE_ID="$(create_temp_manager_only_rule "tmp-manager-only-$RUN_SUFFIX" "9000.00" "9001.00" "1")"
RID_NO_ACTIONABLE="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/no-actionable-create.json")"
@@ -892,11 +995,11 @@ assert_no_workflow_instance "$RID_NO_ACTIONABLE" "no_actionable_approver"
delete_approval_rule "$TMP_APPROVAL_RULE_ID"
TMP_APPROVAL_RULE_ID=""
echo "[10/19] restore manager relation before transfer/pay scenarios"
echo "[10/23] restore manager relation before transfer/pay scenarios"
set_employee_direct_manager "$EMPLOYEE_ID" "$ORIGINAL_EMPLOYEE_MANAGER_ID"
EMPLOYEE_MANAGER_PATCHED=0
echo "[11/19] transfer success: manager -> ceo with 3 evidences"
echo "[11/23] transfer success: manager -> ceo with 3 evidences"
RID_TRANSFER_OK="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/transfer-ok-create.json")"
create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_TRANSFER_OK" "transfer-ok" >/dev/null
submit_reimbursement "$EMPLOYEE_TOKEN" "$RID_TRANSFER_OK" "$TMP_DIR/transfer-ok-submit.json"
@@ -923,7 +1026,7 @@ fi
assert_reimbursement_status_db "$RID_TRANSFER_OK" "approved" "transfer success approval"
echo "[12/19] transfer reason too short => VALID_002"
echo "[12/23] transfer reason too short => VALID_002"
RID_TRANSFER_SHORT="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/transfer-short-create.json")"
create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_TRANSFER_SHORT" "transfer-short" >/dev/null
submit_reimbursement "$EMPLOYEE_TOKEN" "$RID_TRANSFER_SHORT" "$TMP_DIR/transfer-short-submit.json"
@@ -936,7 +1039,7 @@ assert_error_code "$TMP_DIR/transfer-short-action.json" "VALID_002" "transfer re
withdraw_reimbursement "$EMPLOYEE_TOKEN" "$RID_TRANSFER_SHORT" "cleanup transfer short" "$TMP_DIR/transfer-short-withdraw-cleanup.json"
assert_reimbursement_status_db "$RID_TRANSFER_SHORT" "draft" "transfer short cleanup"
echo "[13/19] transfer target not approver => VALID_001"
echo "[13/23] transfer target not approver => VALID_001"
RID_TRANSFER_TARGET="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/transfer-target-create.json")"
create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_TRANSFER_TARGET" "transfer-target" >/dev/null
submit_reimbursement "$EMPLOYEE_TOKEN" "$RID_TRANSFER_TARGET" "$TMP_DIR/transfer-target-submit.json"
@@ -950,7 +1053,7 @@ assert_error_detail "$TMP_DIR/transfer-target-action.json" '.error.details.toApp
withdraw_reimbursement "$EMPLOYEE_TOKEN" "$RID_TRANSFER_TARGET" "cleanup transfer target" "$TMP_DIR/transfer-target-withdraw-cleanup.json"
assert_reimbursement_status_db "$RID_TRANSFER_TARGET" "draft" "transfer target cleanup"
echo "[14/19] transfer same assignee => VALID_001"
echo "[14/23] transfer same assignee => VALID_001"
RID_TRANSFER_SAME="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/transfer-same-create.json")"
create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_TRANSFER_SAME" "transfer-same" >/dev/null
submit_reimbursement "$EMPLOYEE_TOKEN" "$RID_TRANSFER_SAME" "$TMP_DIR/transfer-same-submit.json"
@@ -964,7 +1067,7 @@ assert_error_detail "$TMP_DIR/transfer-same-action.json" '.error.details.transfe
withdraw_reimbursement "$EMPLOYEE_TOKEN" "$RID_TRANSFER_SAME" "cleanup transfer same assignee" "$TMP_DIR/transfer-same-withdraw-cleanup.json"
assert_reimbursement_status_db "$RID_TRANSFER_SAME" "draft" "transfer same cleanup"
echo "[15/19] transfer chain limit: 4th transfer blocked"
echo "[15/23] transfer chain limit: 4th transfer blocked"
RID_TRANSFER_CHAIN="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/transfer-chain-create.json")"
create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_TRANSFER_CHAIN" "transfer-chain" >/dev/null
submit_reimbursement "$EMPLOYEE_TOKEN" "$RID_TRANSFER_CHAIN" "$TMP_DIR/transfer-chain-submit.json"
@@ -998,7 +1101,54 @@ fi
assert_reimbursement_status_db "$RID_TRANSFER_CHAIN" "approved" "transfer chain final approval"
echo "[16/19] pay success: approved -> paid and invoices archived"
echo "[17/23] delegation active window: delegate can approve"
RID_DELEGATION_OK="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/delegation-ok-create.json")"
create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_DELEGATION_OK" "delegation-ok" >/dev/null
submit_reimbursement "$EMPLOYEE_TOKEN" "$RID_DELEGATION_OK" "$TMP_DIR/delegation-ok-submit.json"
TASK_DELEGATION_OK="$(jq -er '.data.currentTaskId' "$TMP_DIR/delegation-ok-submit.json")"
DELEGATION_VALID_FROM="$(date -u -d '-5 minutes' '+%Y-%m-%dT%H:%M:%SZ')"
DELEGATION_VALID_TO="$(date -u -d '+1 hour' '+%Y-%m-%dT%H:%M:%SZ')"
delegation_create_status="$(create_delegation "$MANAGER_TOKEN" "$CEO_ID" "all" "$DELEGATION_VALID_FROM" "$DELEGATION_VALID_TO" "$TMP_DIR/delegation-create-ok.json")"
assert_status "$delegation_create_status" "200" "create delegation active" "$TMP_DIR/delegation-create-ok.json"
DELEGATION_OK_ID="$(jq -er '.data.delegation.id' "$TMP_DIR/delegation-create-ok.json")"
ceo_approve_via_delegation_status="$(api_json_auth POST "$BASE_URL/api/workflow/tasks/$TASK_DELEGATION_OK/approve" "$CEO_TOKEN" "$TMP_DIR/delegation-ok-ceo-approve.json" '{}')"
assert_status "$ceo_approve_via_delegation_status" "200" "delegated approve by ceo" "$TMP_DIR/delegation-ok-ceo-approve.json"
assert_delegation_history_evidence "$TASK_DELEGATION_OK" "$DELEGATION_OK_ID" "$MANAGER_ID" "$CEO_ID" "delegation active approve"
revoke_delegation_status="$(revoke_delegation "$MANAGER_TOKEN" "$DELEGATION_OK_ID" "$TMP_DIR/delegation-revoke-ok.json")"
assert_status "$revoke_delegation_status" "200" "revoke delegation" "$TMP_DIR/delegation-revoke-ok.json"
assert_delegation_revoked_db "$DELEGATION_OK_ID" "delegation revoke"
echo "[18/23] delegation expired: delegate forbidden"
DELEGATION_EXPIRED_FROM="$(date -u -d '-2 hours' '+%Y-%m-%dT%H:%M:%SZ')"
DELEGATION_EXPIRED_TO="$(date -u -d '-1 hour' '+%Y-%m-%dT%H:%M:%SZ')"
delegation_expired_create_status="$(create_delegation "$MANAGER_TOKEN" "$CEO_ID" "all" "$DELEGATION_EXPIRED_FROM" "$DELEGATION_EXPIRED_TO" "$TMP_DIR/delegation-create-expired.json")"
assert_status "$delegation_expired_create_status" "200" "create expired delegation" "$TMP_DIR/delegation-create-expired.json"
DELEGATION_EXPIRED_ID="$(jq -er '.data.delegation.id' "$TMP_DIR/delegation-create-expired.json")"
RID_DELEGATION_EXPIRED="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/delegation-expired-create.json")"
create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_DELEGATION_EXPIRED" "delegation-expired" >/dev/null
submit_reimbursement "$EMPLOYEE_TOKEN" "$RID_DELEGATION_EXPIRED" "$TMP_DIR/delegation-expired-submit.json"
TASK_DELEGATION_EXPIRED="$(jq -er '.data.currentTaskId' "$TMP_DIR/delegation-expired-submit.json")"
ceo_approve_expired_status="$(api_json_auth POST "$BASE_URL/api/workflow/tasks/$TASK_DELEGATION_EXPIRED/approve" "$CEO_TOKEN" "$TMP_DIR/delegation-expired-ceo-approve.json" '{}')"
assert_status "$ceo_approve_expired_status" "403" "expired delegation should be forbidden" "$TMP_DIR/delegation-expired-ceo-approve.json"
assert_error_code "$TMP_DIR/delegation-expired-ceo-approve.json" "PERM_002" "expired delegation should be forbidden"
revoke_job_output="$(npm run --silent job:revoke-expired-delegations)"
revoke_job_status="$(printf '%s\n' "$revoke_job_output" | tail -n 1)"
if [[ "$revoke_job_status" != revoked=* ]]; then
echo "[ERROR] revoke expired delegations script output invalid: $revoke_job_output" >&2
exit 1
fi
assert_delegation_revoked_db "$DELEGATION_EXPIRED_ID" "delegation auto revoke"
manager_approve_after_expired_status="$(api_json_auth POST "$BASE_URL/api/workflow/tasks/$TASK_DELEGATION_EXPIRED/approve" "$MANAGER_TOKEN" "$TMP_DIR/delegation-expired-manager-approve.json" '{}')"
assert_status "$manager_approve_after_expired_status" "200" "manager approve after expired delegation" "$TMP_DIR/delegation-expired-manager-approve.json"
echo "[19/23] pay success: approved -> paid and invoices archived"
RID_PAY_OK="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/pay-ok-create.json")"
IID_PAY_OK="$(create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_PAY_OK" "pay-ok")"
submit_reimbursement "$EMPLOYEE_TOKEN" "$RID_PAY_OK" "$TMP_DIR/pay-ok-submit.json"
@@ -1015,13 +1165,14 @@ fi
assert_reimbursement_status_db "$RID_PAY_OK" "approved" "pay success precondition"
pay_ok_status="$(pay_reimbursement "$FINANCE_TOKEN" "$RID_PAY_OK" "$TMP_DIR/pay-ok-pay.json")"
pay_ok_body="{\"paymentVoucherNo\":\"VOUCHER-$RUN_SUFFIX\",\"paymentDate\":\"2026-02-07\",\"paymentChannel\":\"bank\"}"
pay_ok_status="$(pay_reimbursement "$FINANCE_TOKEN" "$RID_PAY_OK" "$TMP_DIR/pay-ok-pay.json" "$pay_ok_body")"
assert_status "$pay_ok_status" "200" "pay approved reimbursement" "$TMP_DIR/pay-ok-pay.json"
assert_jq "$TMP_DIR/pay-ok-pay.json" '.data.outcome == "paid" and .data.reimbursementStatus == "paid" and (.data.archivedInvoiceCount | type == "number") and .data.archivedInvoiceCount >= 1' "pay success response"
assert_jq "$TMP_DIR/pay-ok-pay.json" '.data.outcome == "paid" and .data.reimbursementStatus == "paid" and (.data.archivedInvoiceCount | type == "number") and .data.archivedInvoiceCount >= 1 and .data.payment.idempotent == false and .data.payment.paymentChannel == "bank"' "pay success response"
assert_reimbursement_status_db "$RID_PAY_OK" "paid" "pay success"
assert_invoices_archived_used_complete "$RID_PAY_OK" "pay success"
echo "[17/19] pay invalid status: draft/reviewing/rejected/cancelled"
echo "[20/23] pay invalid status: draft/reviewing/rejected/cancelled"
pay_invalid_draft_status="$(pay_reimbursement "$FINANCE_TOKEN" "$RID_NEGATIVE" "$TMP_DIR/pay-invalid-draft.json")"
assert_status "$pay_invalid_draft_status" "409" "pay invalid status draft" "$TMP_DIR/pay-invalid-draft.json"
assert_error_code "$TMP_DIR/pay-invalid-draft.json" "VALID_001" "pay invalid status draft"
@@ -1050,20 +1201,27 @@ assert_status "$pay_invalid_cancelled_status" "409" "pay invalid status cancelle
assert_error_code "$TMP_DIR/pay-invalid-cancelled.json" "VALID_001" "pay invalid status cancelled"
assert_error_detail "$TMP_DIR/pay-invalid-cancelled.json" '.error.details.status' "invalid_pay_status" "pay invalid status cancelled"
echo "[18/19] pay permission: non-finance forbidden"
echo "[21/23] pay permission: non-finance forbidden"
pay_perm_status="$(pay_reimbursement "$EMPLOYEE_TOKEN" "$RID_PAY_OK" "$TMP_DIR/pay-perm-employee.json")"
assert_status "$pay_perm_status" "403" "pay forbidden for non-finance" "$TMP_DIR/pay-perm-employee.json"
assert_error_code "$TMP_DIR/pay-perm-employee.json" "PERM_001" "pay forbidden for non-finance"
echo "[19/19] pay idempotent: paid reimbursement can be paid again"
pay_idempotent_status="$(pay_reimbursement "$FINANCE_TOKEN" "$RID_PAY_OK" "$TMP_DIR/pay-idempotent.json")"
echo "[22/23] pay idempotent: paid reimbursement can be paid again"
pay_idempotent_body="{\"paymentVoucherNo\":\"VOUCHER-$RUN_SUFFIX\",\"paymentDate\":\"2026-02-07\",\"paymentChannel\":\"bank\"}"
pay_idempotent_status="$(pay_reimbursement "$FINANCE_TOKEN" "$RID_PAY_OK" "$TMP_DIR/pay-idempotent.json" "$pay_idempotent_body")"
assert_status "$pay_idempotent_status" "200" "pay idempotent" "$TMP_DIR/pay-idempotent.json"
assert_jq "$TMP_DIR/pay-idempotent.json" '.data.outcome == "paid" and .data.reimbursementStatus == "paid" and (.data.archivedInvoiceCount | type == "number") and .data.archivedInvoiceCount >= 0' "pay idempotent response"
assert_jq "$TMP_DIR/pay-idempotent.json" '.data.outcome == "paid" and .data.reimbursementStatus == "paid" and (.data.archivedInvoiceCount | type == "number") and .data.archivedInvoiceCount >= 0 and .data.payment.idempotent == true and .data.payment.paymentVoucherNo != null' "pay idempotent response"
assert_reimbursement_status_db "$RID_PAY_OK" "paid" "pay idempotent"
assert_invoices_archived_used_complete "$RID_PAY_OK" "pay idempotent"
pay_conflict_body="{\"paymentVoucherNo\":\"VOUCHER-CONFLICT-$RUN_SUFFIX\",\"paymentDate\":\"2026-02-06\",\"paymentChannel\":\"alipay\"}"
pay_conflict_status="$(pay_reimbursement "$FINANCE_TOKEN" "$RID_PAY_OK" "$TMP_DIR/pay-conflict.json" "$pay_conflict_body")"
assert_status "$pay_conflict_status" "409" "pay idempotent conflict" "$TMP_DIR/pay-conflict.json"
assert_error_code "$TMP_DIR/pay-conflict.json" "VALID_001" "pay idempotent conflict"
assert_error_detail "$TMP_DIR/pay-conflict.json" '.error.details.payment' "already_paid_conflict" "pay idempotent conflict"
if [[ "$RUN_PAY_CONCURRENCY_CHECK" == "1" ]]; then
echo "[19.1/19] optional pay concurrency check"
echo "[22.1/23] optional pay concurrency check"
RID_PAY_CONCURRENCY="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/pay-concurrency-create.json")"
create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_PAY_CONCURRENCY" "pay-concurrency" >/dev/null
submit_reimbursement "$EMPLOYEE_TOKEN" "$RID_PAY_CONCURRENCY" "$TMP_DIR/pay-concurrency-submit.json"
@@ -1090,7 +1248,7 @@ if [[ "$RUN_PAY_CONCURRENCY_CHECK" == "1" ]]; then
assert_invoices_archived_used_complete "$RID_PAY_CONCURRENCY" "pay concurrency"
fi
echo "[19/19] Final manager relation restore"
echo "[23/23] Final manager relation restore"
set_employee_direct_manager "$EMPLOYEE_ID" "$ORIGINAL_EMPLOYEE_MANAGER_ID"
EMPLOYEE_MANAGER_PATCHED=0
server/src/app.js
+9
查看文件
@@ -16,6 +16,10 @@ const meRoutes = require("./routes/me");
const reimbursementRoutes = require("./routes/reimbursements");
const invoicePoolRoutes = require("./routes/invoicePool");
const workflowRoutes = require("./routes/workflow");
const delegationRoutes = require("./routes/delegations");
const auditRoutes = require("./routes/audit");
const { startDelegationRevokeJob } = require("./jobs/delegationRevokeJob");
const { startOcrJob } = require("./jobs/ocrJob");
const { AppError } = require("./utils/AppError");
async function buildApp() {
@@ -114,6 +118,11 @@ async function buildApp() {
await app.register(reimbursementRoutes, { prefix: "/api" });
await app.register(invoicePoolRoutes, { prefix: "/api" });
await app.register(workflowRoutes, { prefix: "/api" });
await app.register(delegationRoutes, { prefix: "/api" });
await app.register(auditRoutes, { prefix: "/api" });
startDelegationRevokeJob(app);
startOcrJob(app);
return app;
}
server/src/config.js
+13
查看文件
@@ -42,6 +42,19 @@ function getConfig() {
storageDir: path.resolve(serverRoot, storageDir),
signedUrlTtlSeconds: Number(process.env.SIGNED_URL_TTL_SECONDS ?? 600),
maxUploadSizeBytes: Number(process.env.MAX_UPLOAD_SIZE_BYTES ?? 10 * 1024 * 1024),
delegationRevokeCron: process.env.DELEGATION_REVOKE_CRON ?? "0 * * * *",
ocrProvider: process.env.OCR_PROVIDER ?? "off",
ocrBatchSize: Number(process.env.OCR_BATCH_SIZE ?? 10),
ocrLockTtlSeconds: Number(process.env.OCR_LOCK_TTL_SECONDS ?? 300),
ocrPollCron: process.env.OCR_POLL_CRON ?? "* * * * *",
ocrMaxAttempts: Number(process.env.OCR_MAX_ATTEMPTS ?? 3),
ocrTimeoutMs: Number(process.env.OCR_TIMEOUT_MS ?? 5000),
tencentSecretId: process.env.TENCENT_SECRET_ID ?? "",
tencentSecretKey: process.env.TENCENT_SECRET_KEY ?? "",
tencentOcrRegion: process.env.TENCENT_OCR_REGION ?? "ap-beijing",
};
}
server/src/constants/permissions.js
+1
查看文件
@@ -29,6 +29,7 @@ const ROLE_PERMISSIONS = {
"expense.view_all",
"expense.finance.override_duplicate",
"system.settings",
"system.audit.view",
],
administration: ["expense.proxy_submit", "expense.view_own"],
hr: ["system.users", "expense.view_all"],
server/src/jobs/delegationRevokeJob.js
+103
查看文件
@@ -0,0 +1,103 @@
const cron = require("node-cron");
async function revokeExpiredDelegations(prisma, logger, options = {}) {
const batchSize = options.batchSize ?? 200;
let total = 0;
while (true) {
const now = new Date();
const expired = await prisma.delegationGrant.findMany({
where: {
revoked_at: null,
valid_to: {
not: null,
lte: now,
},
},
orderBy: { valid_to: "asc" },
take: batchSize,
select: {
id: true,
principal_employee_id: true,
delegate_employee_id: true,
},
});
if (!expired.length) {
break;
}
await prisma.$transaction(async (tx) => {
const ids = expired.map((item) => item.id);
await tx.delegationGrant.updateMany({
where: {
id: { in: ids },
revoked_at: null,
},
data: {
revoked_at: now,
},
});
await tx.auditLog.createMany({
data: expired.map((item) => ({
request_id: `job:delegation-revoke:${now.getTime()}:${item.id}`,
actor_id: item.principal_employee_id,
action: "DELEGATION_AUTO_REVOKED",
target_type: "delegation_grant",
target_id: item.id,
ip_address: null,
user_agent: "system/node-cron",
extra: {
principalEmployeeId: item.principal_employee_id,
delegateEmployeeId: item.delegate_employee_id,
},
})),
});
});
total += expired.length;
}
if (total > 0) {
logger.info({ revoked: total }, "Expired delegations auto-revoked");
}
return total;
}
function startDelegationRevokeJob(fastify) {
let running = false;
const task = cron.schedule(fastify.config.delegationRevokeCron, async () => {
if (running) {
return;
}
running = true;
try {
await revokeExpiredDelegations(fastify.prisma, fastify.log);
} catch (error) {
fastify.log.error({ err: error }, "Delegation revoke job failed");
} finally {
running = false;
}
});
fastify.addHook("onClose", async () => {
task.stop();
task.destroy();
});
fastify.log.info(
{ cron: fastify.config.delegationRevokeCron },
"Delegation revoke job scheduled",
);
return task;
}
module.exports = {
revokeExpiredDelegations,
startDelegationRevokeJob,
};
server/src/jobs/ocrJob.js
+314
查看文件
@@ -0,0 +1,314 @@
const fs = require("node:fs/promises");
const path = require("node:path");
const cron = require("node-cron");
const { runOcrForInvoice } = require("../services/ocr");
const OCR_DUPLICATE_ERROR = "duplicate_invoice_code_number";
function trimErrorMessage(error) {
const message = error?.message ?? "ocr_failed";
if (message.length > 500) {
return message.slice(0, 500);
}
return message;
}
function toDateOnly(value) {
if (!value) {
return null;
}
return `${value}T00:00:00.000Z`;
}
function toMoney(value) {
if (value == null) {
return null;
}
const num = Number(value);
if (!Number.isFinite(num)) {
return null;
}
return num.toFixed(2);
}
async function claimPendingInvoices(prisma, config, workerId) {
const batchSize = Math.max(1, Number(config.ocrBatchSize || 10));
const lockTtlSeconds = Math.max(60, Number(config.ocrLockTtlSeconds || 300));
return prisma.$queryRaw`
WITH candidates AS (
SELECT id
FROM "invoice_pool"
WHERE status = 'pending_ocr'
AND (ocr_locked_at IS NULL OR ocr_locked_at < NOW() - make_interval(secs => ${lockTtlSeconds}))
ORDER BY created_at ASC
LIMIT ${batchSize}
FOR UPDATE SKIP LOCKED
)
UPDATE "invoice_pool" AS i
SET ocr_locked_at = NOW(),
ocr_lock_owner = ${workerId}
FROM candidates
WHERE i.id = candidates.id
RETURNING i.id, i.file_sha256, i.ocr_type, i.storage_path, i.ocr_attempts
`;
}
async function findDuplicateInvoice(prisma, invoiceId, invoiceCode, invoiceNumber) {
if (!invoiceCode || !invoiceNumber) {
return null;
}
return prisma.invoicePool.findFirst({
where: {
id: { not: invoiceId },
invoice_code: invoiceCode,
invoice_number: invoiceNumber,
is_duplicate_override: false,
OR: [
{ status: "bound" },
{
status: "archived",
archived_reason: "used_complete",
},
],
},
select: {
id: true,
},
});
}
async function getOrCreateOcrResult(prisma, config, claimedInvoice, imageBase64) {
const where = {
file_sha256_ocr_provider_ocr_type: {
file_sha256: claimedInvoice.file_sha256,
ocr_provider: "tencent",
ocr_type: claimedInvoice.ocr_type,
},
};
const cached = await prisma.ocrResult.findUnique({
where,
select: {
id: true,
result_json: true,
},
});
if (cached) {
return {
ocrResultId: cached.id,
normalized: cached.result_json,
};
}
const normalized = await runOcrForInvoice({
config,
ocrType: claimedInvoice.ocr_type,
imageBase64,
});
try {
const created = await prisma.ocrResult.create({
data: {
file_sha256: claimedInvoice.file_sha256,
ocr_provider: "tencent",
ocr_type: claimedInvoice.ocr_type,
result_json: normalized,
},
select: {
id: true,
},
});
return {
ocrResultId: created.id,
normalized,
};
} catch (error) {
if (error?.code !== "P2002") {
throw error;
}
const raced = await prisma.ocrResult.findUnique({
where,
select: {
id: true,
result_json: true,
},
});
if (!raced) {
throw error;
}
return {
ocrResultId: raced.id,
normalized: raced.result_json,
};
}
}
async function markInvoiceAsDuplicate(prisma, invoiceId, normalized, ocrResultId) {
const now = new Date();
await prisma.invoicePool.update({
where: { id: invoiceId },
data: {
status: "ocr_failed",
ocr_result_id: ocrResultId,
invoice_code: normalized.invoiceCode ?? null,
invoice_number: normalized.invoiceNumber ?? null,
invoice_date: normalized.invoiceDate ? new Date(toDateOnly(normalized.invoiceDate)) : null,
amount: toMoney(normalized.amount),
tax_amount: toMoney(normalized.taxAmount),
total_amount: toMoney(normalized.totalAmount),
seller_name: normalized.sellerName ?? null,
buyer_name: normalized.buyerName ?? null,
ocr_last_error: OCR_DUPLICATE_ERROR,
ocr_completed_at: now,
ocr_attempts: { increment: 1 },
ocr_locked_at: null,
ocr_lock_owner: null,
},
});
}
async function markInvoiceAsAvailable(prisma, invoiceId, normalized, ocrResultId) {
const now = new Date();
await prisma.invoicePool.update({
where: { id: invoiceId },
data: {
status: "available",
ocr_result_id: ocrResultId,
invoice_code: normalized.invoiceCode ?? null,
invoice_number: normalized.invoiceNumber ?? null,
invoice_date: normalized.invoiceDate ? new Date(toDateOnly(normalized.invoiceDate)) : null,
amount: toMoney(normalized.amount),
tax_amount: toMoney(normalized.taxAmount),
total_amount: toMoney(normalized.totalAmount),
seller_name: normalized.sellerName ?? null,
buyer_name: normalized.buyerName ?? null,
ocr_last_error: null,
ocr_completed_at: now,
ocr_attempts: { increment: 1 },
ocr_locked_at: null,
ocr_lock_owner: null,
},
});
}
async function markInvoiceAsFailed(prisma, claimedInvoice, errorMessage, config) {
const now = new Date();
const nextAttempts = Number(claimedInvoice.ocr_attempts || 0) + 1;
const isTerminal = nextAttempts >= config.ocrMaxAttempts;
await prisma.invoicePool.update({
where: { id: claimedInvoice.id },
data: {
status: isTerminal ? "ocr_failed" : "pending_ocr",
ocr_attempts: nextAttempts,
ocr_last_error: errorMessage,
ocr_completed_at: isTerminal ? now : null,
ocr_locked_at: null,
ocr_lock_owner: null,
},
});
}
async function processClaimedInvoice(prisma, config, claimedInvoice, workerId, logger) {
try {
const absolutePath = path.resolve(config.storageDir, claimedInvoice.storage_path);
const fileBuffer = await fs.readFile(absolutePath);
const imageBase64 = fileBuffer.toString("base64");
const { ocrResultId, normalized } = await getOrCreateOcrResult(
prisma,
config,
claimedInvoice,
imageBase64,
);
const duplicate = await findDuplicateInvoice(
prisma,
claimedInvoice.id,
normalized.invoiceCode,
normalized.invoiceNumber,
);
if (duplicate) {
await markInvoiceAsDuplicate(prisma, claimedInvoice.id, normalized, ocrResultId);
logger.warn(
{
invoiceId: claimedInvoice.id,
duplicateInvoiceId: duplicate.id,
},
"OCR invoice marked as duplicate",
);
return;
}
await markInvoiceAsAvailable(prisma, claimedInvoice.id, normalized, ocrResultId);
} catch (error) {
const message = trimErrorMessage(error);
await markInvoiceAsFailed(prisma, claimedInvoice, message, config);
logger.error({ err: error, invoiceId: claimedInvoice.id, workerId }, "OCR processing failed");
}
}
async function runOcrOnce(prisma, config, logger, workerId = `ocr:${process.pid}`) {
const claimed = await claimPendingInvoices(prisma, config, workerId);
if (!claimed.length) {
return { claimed: 0 };
}
for (const item of claimed) {
await processClaimedInvoice(prisma, config, item, workerId, logger);
}
return { claimed: claimed.length };
}
function startOcrJob(fastify) {
if (fastify.config.ocrProvider !== "tencent") {
fastify.log.info({ provider: fastify.config.ocrProvider }, "OCR job disabled");
return null;
}
let running = false;
const workerId = `ocr-worker:${process.pid}`;
const task = cron.schedule(fastify.config.ocrPollCron, async () => {
if (running) {
return;
}
running = true;
try {
await runOcrOnce(fastify.prisma, fastify.config, fastify.log, workerId);
} catch (error) {
fastify.log.error({ err: error }, "OCR job tick failed");
} finally {
running = false;
}
});
fastify.addHook("onClose", async () => {
task.stop();
task.destroy();
});
fastify.log.info({ cron: fastify.config.ocrPollCron }, "OCR job scheduled");
return task;
}
module.exports = {
OCR_DUPLICATE_ERROR,
claimPendingInvoices,
runOcrOnce,
startOcrJob,
};
server/src/routes/audit.js
+127
查看文件
@@ -0,0 +1,127 @@
const { z } = require("zod");
const { AppError } = require("../utils/AppError");
const { sendData } = require("../utils/reply");
const QUERY_SCHEMA = z.object({
page: z.coerce.number().int().min(1).optional(),
pageSize: z.coerce.number().int().min(1).max(100).optional(),
actorId: z.string().uuid().optional(),
action: z.string().min(1).max(100).optional(),
targetType: z.string().min(1).max(100).optional(),
dateFrom: z.string().datetime().optional(),
dateTo: z.string().datetime().optional(),
});
function parseQuery(query) {
const parsed = QUERY_SCHEMA.safeParse(query ?? {});
if (!parsed.success) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: parsed.error.flatten(),
});
}
const page = parsed.data.page ?? 1;
const pageSize = parsed.data.pageSize ?? 20;
const dateFrom = parsed.data.dateFrom ? new Date(parsed.data.dateFrom) : null;
const dateTo = parsed.data.dateTo ? new Date(parsed.data.dateTo) : null;
if (dateFrom && dateTo && dateFrom > dateTo) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: { dateTo: "must_be_after_dateFrom" },
});
}
return {
page,
pageSize,
actorId: parsed.data.actorId,
action: parsed.data.action,
targetType: parsed.data.targetType,
dateFrom,
dateTo,
};
}
async function auditRoutes(fastify) {
fastify.get(
"/audit-logs",
{
preHandler: fastify.requirePermission("system.audit.view"),
},
async (request, reply) => {
const query = parseQuery(request.query);
const skip = (query.page - 1) * query.pageSize;
const where = {
...(query.actorId ? { actor_id: query.actorId } : {}),
...(query.action ? { action: query.action } : {}),
...(query.targetType ? { target_type: query.targetType } : {}),
...(query.dateFrom || query.dateTo
? {
created_at: {
...(query.dateFrom ? { gte: query.dateFrom } : {}),
...(query.dateTo ? { lte: query.dateTo } : {}),
},
}
: {}),
};
const [items, total] = await Promise.all([
fastify.prisma.auditLog.findMany({
where,
orderBy: { created_at: "desc" },
skip,
take: query.pageSize,
select: {
id: true,
request_id: true,
actor_id: true,
action: true,
target_type: true,
target_id: true,
ip_address: true,
user_agent: true,
extra: true,
created_at: true,
actor: {
select: {
id: true,
name: true,
email: true,
},
},
},
}),
fastify.prisma.auditLog.count({ where }),
]);
return sendData(reply, request, {
page: query.page,
pageSize: query.pageSize,
total,
items: items.map((item) => ({
id: item.id,
requestId: item.request_id,
actorId: item.actor_id,
actorName: item.actor?.name ?? "",
actorEmail: item.actor?.email ?? "",
action: item.action,
targetType: item.target_type,
targetId: item.target_id,
ipAddress: item.ip_address,
userAgent: item.user_agent,
extra: item.extra,
createdAt: item.created_at.toISOString(),
})),
});
},
);
}
module.exports = auditRoutes;
server/src/routes/delegations.js
+297
查看文件
@@ -0,0 +1,297 @@
const { z } = require("zod");
const { AppError } = require("../utils/AppError");
const { sendData } = require("../utils/reply");
const { buildAuditLogData } = require("../utils/audit");
const { computeDelegationStatus } = require("../utils/delegation");
const UUID_SCHEMA = z.string().uuid();
const CREATE_DELEGATION_SCHEMA = z.object({
delegateEmployeeId: z.string().uuid(),
scope: z.enum(["reimbursement_submit", "all"]).optional(),
validFrom: z.string().datetime().optional(),
validTo: z.string().datetime().optional(),
});
const QUERY_STATUS_SCHEMA = z.object({
status: z.enum(["active", "scheduled", "expired", "revoked", "all"]).optional(),
});
function parseDelegationId(id) {
const parsed = UUID_SCHEMA.safeParse(id);
if (!parsed.success) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: { id: "invalid_uuid" },
});
}
return parsed.data;
}
function parseCreateBody(body) {
const parsed = CREATE_DELEGATION_SCHEMA.safeParse(body ?? {});
if (!parsed.success) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: parsed.error.flatten(),
});
}
const validFrom = parsed.data.validFrom ? new Date(parsed.data.validFrom) : new Date();
const validTo = parsed.data.validTo ? new Date(parsed.data.validTo) : null;
if (Number.isNaN(validFrom.getTime())) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: { validFrom: "invalid_datetime" },
});
}
if (validTo && Number.isNaN(validTo.getTime())) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: { validTo: "invalid_datetime" },
});
}
if (validTo && validTo <= validFrom) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: { validTo: "must_be_after_validFrom" },
});
}
return {
delegateEmployeeId: parsed.data.delegateEmployeeId,
scope: parsed.data.scope ?? "all",
validFrom,
validTo,
};
}
function parseStatusQuery(query) {
const parsed = QUERY_STATUS_SCHEMA.safeParse(query ?? {});
if (!parsed.success) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: parsed.error.flatten(),
});
}
return parsed.data.status ?? "active";
}
function matchesStatusFilter(record, status, now) {
if (status === "all") {
return true;
}
return computeDelegationStatus(record, now) === status;
}
function toResponseItem(record, now) {
return {
id: record.id,
principalEmployeeId: record.principal_employee_id,
delegateEmployeeId: record.delegate_employee_id,
scope: record.scope,
validFrom: record.valid_from.toISOString(),
validTo: record.valid_to ? record.valid_to.toISOString() : null,
revokedAt: record.revoked_at ? record.revoked_at.toISOString() : null,
createdAt: record.created_at.toISOString(),
status: computeDelegationStatus(record, now),
};
}
async function delegationRoutes(fastify) {
fastify.post(
"/delegations",
{
preHandler: fastify.requirePermission("expense.proxy_manage"),
},
async (request, reply) => {
const input = parseCreateBody(request.body);
if (input.delegateEmployeeId === request.employee.id) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 409,
details: { delegateEmployeeId: "self_not_allowed" },
});
}
const delegateEmployee = await fastify.prisma.employee.findUnique({
where: { id: input.delegateEmployeeId },
select: {
id: true,
status: true,
},
});
if (!delegateEmployee || delegateEmployee.status !== "active") {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 409,
details: { delegateEmployeeId: "invalid_delegate" },
});
}
const delegation = await fastify.prisma.$transaction(async (tx) => {
const created = await tx.delegationGrant.create({
data: {
principal_employee_id: request.employee.id,
delegate_employee_id: input.delegateEmployeeId,
scope: input.scope,
valid_from: input.validFrom,
valid_to: input.validTo,
created_by: request.employee.id,
},
});
await tx.auditLog.create({
data: buildAuditLogData(request, {
actorId: request.employee.id,
action: "DELEGATION_CREATE",
targetType: "delegation_grant",
targetId: created.id,
extra: {
principalEmployeeId: request.employee.id,
delegateEmployeeId: input.delegateEmployeeId,
scope: input.scope,
},
}),
});
return created;
});
return sendData(reply, request, {
delegation: toResponseItem(delegation, new Date()),
});
},
);
fastify.get(
"/delegations/mine",
{
preHandler: fastify.requirePermission("expense.proxy_manage"),
},
async (request, reply) => {
const status = parseStatusQuery(request.query);
const now = new Date();
const [initiatedRaw, receivedRaw] = await Promise.all([
fastify.prisma.delegationGrant.findMany({
where: {
principal_employee_id: request.employee.id,
},
orderBy: { created_at: "desc" },
}),
fastify.prisma.delegationGrant.findMany({
where: {
delegate_employee_id: request.employee.id,
},
orderBy: { created_at: "desc" },
}),
]);
const initiated = initiatedRaw
.filter((item) => matchesStatusFilter(item, status, now))
.map((item) => toResponseItem(item, now));
const received = receivedRaw
.filter((item) => matchesStatusFilter(item, status, now))
.map((item) => toResponseItem(item, now));
return sendData(reply, request, {
status,
initiated,
received,
});
},
);
fastify.post(
"/delegations/:id/revoke",
{
preHandler: fastify.requirePermission("expense.proxy_manage"),
},
async (request, reply) => {
const delegationId = parseDelegationId(request.params?.id);
const now = new Date();
const delegation = await fastify.prisma.delegationGrant.findUnique({
where: { id: delegationId },
});
if (!delegation) {
throw new AppError({
code: "SYS_404",
message: "Not Found",
statusCode: 404,
});
}
const canRevoke =
delegation.principal_employee_id === request.employee.id ||
fastify.hasPermission(request.employee, "system.settings");
if (!canRevoke) {
throw new AppError({
code: "PERM_001",
message: "无权限",
statusCode: 403,
});
}
if (delegation.revoked_at) {
return sendData(reply, request, {
delegation: toResponseItem(delegation, now),
outcome: "already_revoked",
});
}
const revoked = await fastify.prisma.$transaction(async (tx) => {
const updated = await tx.delegationGrant.update({
where: { id: delegationId },
data: {
revoked_at: now,
},
});
await tx.auditLog.create({
data: buildAuditLogData(request, {
actorId: request.employee.id,
action: "DELEGATION_REVOKE",
targetType: "delegation_grant",
targetId: delegationId,
extra: {
principalEmployeeId: delegation.principal_employee_id,
delegateEmployeeId: delegation.delegate_employee_id,
},
}),
});
return updated;
});
return sendData(reply, request, {
delegation: toResponseItem(revoked, now),
outcome: "revoked",
});
},
);
}
module.exports = delegationRoutes;
server/src/routes/invoicePool.js
+92 -1
查看文件
@@ -10,6 +10,7 @@ const { compactDateString } = require("../utils/date");
const { sha256Hex } = require("../utils/crypto");
const { signPayload, verifyToken } = require("../utils/signedUrl");
const { toMoneyString } = require("../utils/workflow");
const { isOcrEnabledForType } = require("../services/ocr");
const MIME_ALLOWLIST = new Set([
"application/pdf",
@@ -258,6 +259,8 @@ async function invoicePoolRoutes(fastify) {
await fs.mkdir(path.dirname(absoluteStoragePath), { recursive: true });
await fs.writeFile(absoluteStoragePath, fileBuffer);
const status = isOcrEnabledForType(fastify.config, ocrType) ? "pending_ocr" : "available";
const invoice = await fastify.prisma.invoicePool.create({
data: {
owner_employee_id: ownerEmployeeId,
@@ -268,7 +271,7 @@ async function invoicePoolRoutes(fastify) {
file_size: fileSize,
file_sha256: fileSha256,
ocr_type: ocrType,
status: "available",
status,
created_by: request.employee.id,
updated_by: request.employee.id,
},
@@ -287,6 +290,94 @@ async function invoicePoolRoutes(fastify) {
},
);
fastify.get(
"/invoice-pool/:id",
{
preHandler: fastify.authenticate,
},
async (request, reply) => {
const parsedInvoiceId = z.string().uuid().safeParse(request.params?.id);
if (!parsedInvoiceId.success) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: { id: "invalid_uuid" },
});
}
const invoice = await fastify.prisma.invoicePool.findUnique({
where: { id: parsedInvoiceId.data },
select: {
id: true,
status: true,
owner_employee_id: true,
uploaded_by_employee_id: true,
ocr_type: true,
ocr_provider: true,
ocr_attempts: true,
ocr_last_error: true,
ocr_completed_at: true,
invoice_code: true,
invoice_number: true,
invoice_date: true,
amount: true,
tax_amount: true,
total_amount: true,
linked_reimbursement_id: true,
linked_item_id: true,
created_at: true,
updated_at: true,
linked_reimbursement: {
select: {
owner_id: true,
submitter_id: true,
},
},
},
});
if (!invoice) {
throw new AppError({
code: "SYS_404",
message: "Not Found",
statusCode: 404,
});
}
let canAccess = ensureInvoiceReadableByUser(request, invoice);
if (!canAccess && invoice.linked_reimbursement_id) {
const pendingTask = await fastify.prisma.workflowTask.findFirst({
where: {
status: "pending",
workflow_instance: {
entity_type: "reimbursement",
entity_id: invoice.linked_reimbursement_id,
current_status: "pending",
},
OR: [
{ assignee_id: request.employee.id },
{ assignee_role: { in: request.employee.roleCodes } },
],
},
select: { id: true },
});
canAccess = Boolean(pendingTask);
}
if (!canAccess) {
throw new AppError({
code: "PERM_001",
message: "无权限",
statusCode: 403,
});
}
return sendData(reply, request, normalizeInvoiceResponse(invoice));
},
);
fastify.post(
"/invoice-pool/:id/signed-url",
{
server/src/routes/reimbursements.js
+82 -1
查看文件
@@ -9,6 +9,11 @@ const {
} = require("../utils/workflow");
const UUID_SCHEMA = z.string().uuid();
const PAY_BODY_SCHEMA = z.object({
paymentVoucherNo: z.string().trim().min(1).max(50).optional(),
paymentDate: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(),
paymentChannel: z.enum(["bank", "alipay", "wechat", "cash", "other"]).optional(),
});
function ensureOwnOrCanViewAll(fastify, request, reimbursement) {
const canViewAll = fastify.hasPermission(request.employee, "expense.view_all");
@@ -74,6 +79,32 @@ function parseReimbursementId(id) {
return parsed.data;
}
function parsePayBody(body) {
const parsed = PAY_BODY_SCHEMA.safeParse(body ?? {});
if (!parsed.success) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 400,
details: parsed.error.flatten(),
});
}
return parsed.data;
}
function toDateOnlyString(dateValue) {
if (!dateValue) {
return null;
}
if (typeof dateValue === "string") {
return dateValue.slice(0, 10);
}
return new Date(dateValue).toISOString().slice(0, 10);
}
function ensureNonNegativeAmount(totalAmount) {
const asNumber = Number(totalAmount);
if (!Number.isFinite(asNumber)) {
@@ -655,11 +686,12 @@ async function reimbursementRoutes(fastify) {
},
async (request, reply) => {
const reimbursementId = parseReimbursementId(request.params?.id);
const payInput = parsePayBody(request.body);
let response = null;
await fastify.prisma.$transaction(async (tx) => {
const reimbursementRows = await tx.$queryRaw`
SELECT id, status
SELECT id, status, payment_voucher_no, payment_date, payment_channel, paid_at, paid_by
FROM "reimbursement_forms"
WHERE id = ${reimbursementId}::uuid
FOR UPDATE
@@ -683,6 +715,27 @@ async function reimbursementRoutes(fastify) {
});
}
const existingPaymentDate = toDateOnlyString(reimbursement.payment_date);
if (reimbursement.status === "paid") {
const hasVoucherConflict =
payInput.paymentVoucherNo != null &&
payInput.paymentVoucherNo !== (reimbursement.payment_voucher_no ?? null);
const hasPaymentDateConflict =
payInput.paymentDate != null && payInput.paymentDate !== existingPaymentDate;
const hasChannelConflict =
payInput.paymentChannel != null &&
payInput.paymentChannel !== (reimbursement.payment_channel ?? null);
if (hasVoucherConflict || hasPaymentDateConflict || hasChannelConflict) {
throw new AppError({
code: "VALID_001",
message: "参数校验失败",
statusCode: 409,
details: { payment: "already_paid_conflict" },
});
}
}
const now = new Date();
const archivedResult = await tx.invoicePool.updateMany({
where: {
@@ -702,6 +755,11 @@ async function reimbursementRoutes(fastify) {
where: { id: reimbursementId },
data: {
status: "paid",
payment_voucher_no: payInput.paymentVoucherNo ?? null,
payment_date: payInput.paymentDate ? parseDateOnlyString(payInput.paymentDate) : null,
payment_channel: payInput.paymentChannel ?? null,
paid_at: now,
paid_by: request.employee.id,
updated_by: request.employee.id,
},
});
@@ -713,6 +771,29 @@ async function reimbursementRoutes(fastify) {
reimbursementStatus: "paid",
// archivedInvoiceCount=0 is valid for idempotent pay or when no bound invoices remain.
archivedInvoiceCount: archivedResult.count,
payment: {
paymentVoucherNo:
reimbursement.status === "paid"
? reimbursement.payment_voucher_no ?? null
: payInput.paymentVoucherNo ?? null,
paymentDate:
reimbursement.status === "paid"
? existingPaymentDate
: payInput.paymentDate ?? null,
paymentChannel:
reimbursement.status === "paid"
? reimbursement.payment_channel ?? null
: payInput.paymentChannel ?? null,
paidAt:
reimbursement.status === "paid"
? reimbursement.paid_at?.toISOString?.() ?? null
: now.toISOString(),
paidBy:
reimbursement.status === "paid"
? reimbursement.paid_by ?? null
: request.employee.id,
idempotent: reimbursement.status === "paid",
},
};
});
server/src/routes/workflow.js
+98 -32
查看文件
@@ -3,6 +3,10 @@ const { AppError } = require("../utils/AppError");
const { sendData } = require("../utils/reply");
const { resolvePermissionsForRoles, hasPermission } = require("../constants/permissions");
const { getWorkflowStepsSnapshot, resolveActionableStep } = require("../utils/workflow");
const {
findActiveDelegationForDelegate,
listActiveDelegationPrincipals,
} = require("../utils/delegation");
const TASK_ID_SCHEMA = z.string().uuid();
const REQUIRED_COMMENT_SCHEMA = z.object({
@@ -98,20 +102,54 @@ function ensurePendingTask(task) {
}
}
function ensureTaskAssignableToCurrentEmployee(task, request) {
async function ensureTaskAssignableToCurrentEmployee(tx, task, request) {
const matchesAssigneeId = Boolean(task.assignee_id && task.assignee_id === request.employee.id);
const matchesAssigneeRole = Boolean(
task.assignee_role && request.employee.roleCodes.includes(task.assignee_role),
);
const isUnassigned = !task.assignee_id && !task.assignee_role;
if (!(matchesAssigneeId || matchesAssigneeRole || isUnassigned)) {
throw new AppError({
code: "PERM_002",
message: "不在审批范围/非当前处理人",
statusCode: 403,
});
if (matchesAssigneeId || matchesAssigneeRole || isUnassigned) {
return {
delegated: false,
delegationId: null,
principalId: null,
};
}
if (task.assignee_id) {
const delegation = await findActiveDelegationForDelegate(tx, {
principalEmployeeId: task.assignee_id,
delegateEmployeeId: request.employee.id,
allowedScopes: ["all"],
});
if (delegation) {
return {
delegated: true,
delegationId: delegation.id,
principalId: delegation.principal_employee_id,
};
}
}
throw new AppError({
code: "PERM_002",
message: "不在审批范围/非当前处理人",
statusCode: 403,
});
}
function withDelegationPayload(payload, assignment, delegateId) {
const nextPayload = payload ? { ...payload } : {};
if (assignment?.delegated) {
nextPayload.delegation_id = assignment.delegationId;
nextPayload.principal_id = assignment.principalId;
nextPayload.delegate_id = delegateId;
}
return nextPayload;
}
async function loadWorkflowInstanceForTask(tx, instanceId) {
@@ -253,11 +291,19 @@ async function workflowRoutes(fastify) {
const roleFilters = request.employee.roleCodes.length
? [{ assignee_role: { in: request.employee.roleCodes } }]
: [];
const delegatedPrincipalIds = await listActiveDelegationPrincipals(fastify.prisma, {
delegateEmployeeId: request.employee.id,
allowedScopes: ["all"],
});
const assigneeFilters = [{ assignee_id: request.employee.id }, ...roleFilters];
if (delegatedPrincipalIds.length) {
assigneeFilters.push({ assignee_id: { in: delegatedPrincipalIds } });
}
const tasks = await fastify.prisma.workflowTask.findMany({
where: {
status,
OR: [{ assignee_id: request.employee.id }, ...roleFilters],
OR: assigneeFilters,
},
orderBy: { created_at: "desc" },
select: {
@@ -299,7 +345,7 @@ async function workflowRoutes(fastify) {
await fastify.prisma.$transaction(async (tx) => {
const task = await lockWorkflowTask(tx, taskId);
ensurePendingTask(task);
ensureTaskAssignableToCurrentEmployee(task, request);
const assignment = await ensureTaskAssignableToCurrentEmployee(tx, task, request);
const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id);
const steps = getWorkflowStepsSnapshot(workflowInstance);
@@ -367,10 +413,14 @@ async function workflowRoutes(fastify) {
task_id: taskId,
actor_id: request.employee.id,
action: "approve",
payload: {
from_step_id: task.step_id,
to_step_id: actionable.step.id,
},
payload: withDelegationPayload(
{
from_step_id: task.step_id,
to_step_id: actionable.step.id,
},
assignment,
request.employee.id,
),
},
});
@@ -407,10 +457,14 @@ async function workflowRoutes(fastify) {
task_id: taskId,
actor_id: request.employee.id,
action: "approve",
payload: {
from_step_id: task.step_id,
terminal: true,
},
payload: withDelegationPayload(
{
from_step_id: task.step_id,
terminal: true,
},
assignment,
request.employee.id,
),
},
});
@@ -440,7 +494,7 @@ async function workflowRoutes(fastify) {
await fastify.prisma.$transaction(async (tx) => {
const task = await lockWorkflowTask(tx, taskId);
ensurePendingTask(task);
ensureTaskAssignableToCurrentEmployee(task, request);
const assignment = await ensureTaskAssignableToCurrentEmployee(tx, task, request);
const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id);
const now = new Date();
@@ -482,9 +536,13 @@ async function workflowRoutes(fastify) {
actor_id: request.employee.id,
action: "reject",
comment,
payload: {
from_step_id: task.step_id,
},
payload: withDelegationPayload(
{
from_step_id: task.step_id,
},
assignment,
request.employee.id,
),
},
});
@@ -513,7 +571,7 @@ async function workflowRoutes(fastify) {
await fastify.prisma.$transaction(async (tx) => {
const task = await lockWorkflowTask(tx, taskId);
ensurePendingTask(task);
ensureTaskAssignableToCurrentEmployee(task, request);
const assignment = await ensureTaskAssignableToCurrentEmployee(tx, task, request);
const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id);
const now = new Date();
@@ -555,9 +613,13 @@ async function workflowRoutes(fastify) {
actor_id: request.employee.id,
action: "return",
comment,
payload: {
from_step_id: task.step_id,
},
payload: withDelegationPayload(
{
from_step_id: task.step_id,
},
assignment,
request.employee.id,
),
},
});
@@ -586,7 +648,7 @@ async function workflowRoutes(fastify) {
await fastify.prisma.$transaction(async (tx) => {
const task = await lockWorkflowTask(tx, taskId);
ensurePendingTask(task);
ensureTaskAssignableToCurrentEmployee(task, request);
const assignment = await ensureTaskAssignableToCurrentEmployee(tx, task, request);
const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id);
const transferCount = await ensureTransferChainNotExceeded(tx, taskId);
@@ -630,12 +692,16 @@ async function workflowRoutes(fastify) {
actor_id: request.employee.id,
action: "transfer",
comment: reason,
payload: {
from_approver_id: request.employee.id,
to_approver_id: toApproverId,
reason,
transfer_count: transferCount + 1,
},
payload: withDelegationPayload(
{
from_approver_id: request.employee.id,
to_approver_id: toApproverId,
reason,
transfer_count: transferCount + 1,
},
assignment,
request.employee.id,
),
},
});
server/src/scripts/revoke-expired-delegations.js
+19
查看文件
@@ -0,0 +1,19 @@
require("dotenv/config");
const { createPrismaClient } = require("../prismaClient");
const { revokeExpiredDelegations } = require("../jobs/delegationRevokeJob");
(async () => {
const { prisma, pool } = createPrismaClient();
await prisma.$connect();
try {
const count = await revokeExpiredDelegations(prisma, console);
process.stdout.write(`revoked=${count}\n`);
} finally {
await prisma.$disconnect();
await pool.end();
}
})().catch((error) => {
console.error(error);
process.exit(1);
});
server/src/scripts/run-ocr-once.js
+26
查看文件
@@ -0,0 +1,26 @@
require("dotenv/config");
const { createPrismaClient } = require("../prismaClient");
const { getConfig } = require("../config");
const { runOcrOnce } = require("../jobs/ocrJob");
(async () => {
const config = getConfig();
const { prisma, pool } = createPrismaClient();
await prisma.$connect();
try {
if (config.ocrProvider !== "tencent") {
process.stdout.write("ocr_provider_disabled\n");
return;
}
const result = await runOcrOnce(prisma, config, console, `ocr-script:${process.pid}`);
process.stdout.write(`claimed=${result.claimed}\n`);
} finally {
await prisma.$disconnect();
await pool.end();
}
})().catch((error) => {
console.error(error);
process.exit(1);
});
server/src/services/ocr/index.js
+22
查看文件
@@ -0,0 +1,22 @@
const { runTencentVatOcr } = require("./tencent");
function isOcrEnabledForType(config, ocrType) {
return config.ocrProvider === "tencent" && ocrType === "vat";
}
async function runOcrForInvoice({ config, ocrType, imageBase64 }) {
if (config.ocrProvider !== "tencent") {
throw new Error(`Unsupported OCR provider: ${config.ocrProvider}`);
}
if (ocrType !== "vat") {
throw new Error(`Unsupported OCR type: ${ocrType}`);
}
return runTencentVatOcr(config, imageBase64);
}
module.exports = {
isOcrEnabledForType,
runOcrForInvoice,
};
server/src/services/ocr/tencent.js
+103
查看文件
@@ -0,0 +1,103 @@
const tencentcloud = require("tencentcloud-sdk-nodejs");
function normalizeDate(value) {
if (!value || typeof value !== "string") {
return null;
}
const compact = value.trim();
if (!compact) {
return null;
}
const replaced = compact.replace(/年|\//g, "-").replace(/月/g, "-").replace(/日/g, "");
const matched = replaced.match(/^(\d{4})-(\d{1,2})-(\d{1,2})$/);
if (!matched) {
return null;
}
const [, year, month, day] = matched;
return `${year}-${month.padStart(2, "0")}-${day.padStart(2, "0")}`;
}
function toNumberString(value) {
if (value == null) {
return null;
}
if (typeof value === "number" && Number.isFinite(value)) {
return value.toFixed(2);
}
if (typeof value !== "string") {
return null;
}
const stripped = value.replace(/[,￥\s]/g, "").trim();
if (!stripped) {
return null;
}
const num = Number(stripped);
if (!Number.isFinite(num)) {
return null;
}
return num.toFixed(2);
}
function normalizeString(value) {
if (typeof value !== "string") {
return null;
}
const normalized = value.trim();
return normalized || null;
}
function createTencentOcrClient(config) {
if (!config.tencentSecretId || !config.tencentSecretKey) {
throw new Error("Tencent OCR credentials are missing");
}
const OcrClient = tencentcloud.ocr.v20181119.Client;
return new OcrClient({
credential: {
secretId: config.tencentSecretId,
secretKey: config.tencentSecretKey,
},
region: config.tencentOcrRegion,
profile: {
httpProfile: {
timeout: config.ocrTimeoutMs,
},
},
});
}
function normalizeVatInvoiceResult(result) {
return {
invoiceCode: normalizeString(result?.InvoiceCode),
invoiceNumber: normalizeString(result?.InvoiceNum),
invoiceDate: normalizeDate(result?.InvoiceDate),
amount: toNumberString(result?.AmountWithoutTax),
taxAmount: toNumberString(result?.TaxAmount),
totalAmount: toNumberString(result?.TotalAmount ?? result?.AmountInFiguers),
sellerName: normalizeString(result?.SellerName),
buyerName: normalizeString(result?.BuyerName),
raw: result ?? {},
};
}
async function runTencentVatOcr(config, imageBase64) {
const client = createTencentOcrClient(config);
const result = await client.VatInvoiceOCR({
ImageBase64: imageBase64,
});
return normalizeVatInvoiceResult(result);
}
module.exports = {
runTencentVatOcr,
};
server/src/utils/delegation.js
+66
查看文件
@@ -0,0 +1,66 @@
function buildActiveDelegationWhere(now, delegateEmployeeId, allowedScopes) {
return {
delegate_employee_id: delegateEmployeeId,
scope: { in: allowedScopes },
revoked_at: null,
valid_from: { lte: now },
OR: [{ valid_to: null }, { valid_to: { gt: now } }],
};
}
async function findActiveDelegationForDelegate(
tx,
{ principalEmployeeId, delegateEmployeeId, allowedScopes = ["all"], now = new Date() },
) {
return tx.delegationGrant.findFirst({
where: {
principal_employee_id: principalEmployeeId,
...buildActiveDelegationWhere(now, delegateEmployeeId, allowedScopes),
},
orderBy: { valid_from: "desc" },
select: {
id: true,
principal_employee_id: true,
delegate_employee_id: true,
scope: true,
valid_from: true,
valid_to: true,
},
});
}
async function listActiveDelegationPrincipals(
tx,
{ delegateEmployeeId, allowedScopes = ["all"], now = new Date() },
) {
const delegations = await tx.delegationGrant.findMany({
where: buildActiveDelegationWhere(now, delegateEmployeeId, allowedScopes),
select: {
principal_employee_id: true,
},
});
return Array.from(new Set(delegations.map((item) => item.principal_employee_id)));
}
function computeDelegationStatus(delegation, now = new Date()) {
if (delegation.revoked_at) {
return "revoked";
}
if (delegation.valid_to && delegation.valid_to <= now) {
return "expired";
}
if (delegation.valid_from > now) {
return "scheduled";
}
return "active";
}
module.exports = {
findActiveDelegationForDelegate,
listActiveDelegationPrincipals,
computeDelegationStatus,
};