实现 B-2a 报销审批内容工作台（reimbursement-approval-content-workbench）
这个提交包含在：
@@ -271,6 +271,36 @@ function ensureOwnOrCanViewAll(fastify, request, reimbursement) {
|
||||
}
|
||||
}
|
||||
|
||||
async function ensureOwnCanViewAllOrWorkflowReviewer(fastify, request, reimbursement) {
|
||||
const canViewAll = fastify.hasPermission(request.employee, "expense.view_all");
|
||||
const isOwn = reimbursement.owner_id === request.employee.id || reimbursement.submitter_id === request.employee.id;
|
||||
const canViewOwn = fastify.hasPermission(request.employee, "expense.view_own") && isOwn;
|
||||
if (canViewAll || canViewOwn) return;
|
||||
|
||||
const delegatedPrincipalIds = await listActiveDelegationPrincipals(fastify.prisma, {
|
||||
delegateEmployeeId: request.employee.id,
|
||||
allowedScopes: ["all"],
|
||||
});
|
||||
const assigneeFilters = [
|
||||
{ assignee_id: request.employee.id },
|
||||
...(request.employee.roleCodes?.length ? [{ assignee_role: { in: request.employee.roleCodes } }] : []),
|
||||
...(delegatedPrincipalIds.length ? [{ assignee_id: { in: delegatedPrincipalIds } }] : []),
|
||||
];
|
||||
const reviewerTask = await fastify.prisma.workflowTask.findFirst({
|
||||
where: {
|
||||
OR: assigneeFilters,
|
||||
workflow_instance: {
|
||||
entity_type: "reimbursement",
|
||||
entity_id: reimbursement.id,
|
||||
},
|
||||
},
|
||||
select: { id: true },
|
||||
});
|
||||
if (reviewerTask) return;
|
||||
|
||||
throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
|
||||
}
|
||||
|
||||
function buildWorkflowProgress(workflowInstance, historyItems = []) {
|
||||
if (!workflowInstance?.current_step_id) {
|
||||
return null;
|
||||
@@ -2518,7 +2548,7 @@ async function reimbursementRoutes(fastify) {
|
||||
});
|
||||
}
|
||||
|
||||
ensureOwnOrCanViewAll(fastify, request, reimbursement);
|
||||
await ensureOwnCanViewAllOrWorkflowReviewer(fastify, request, reimbursement);
|
||||
|
||||
const controlMode = normalizeBudgetControlMode(fastify.config);
|
||||
const budgetPool = await resolveApplicableBudgetPool(fastify.prisma, reimbursement);
|
||||
@@ -3323,7 +3353,10 @@ async function reimbursementRoutes(fastify) {
|
||||
actorId = previewGrant.actorId;
|
||||
downloadReason = "企业微信在线预览";
|
||||
} else {
|
||||
ensureOwnOrCanViewAll(fastify, request, attachment.reimbursement_form);
|
||||
await ensureOwnCanViewAllOrWorkflowReviewer(fastify, request, {
|
||||
id: reimbursementId,
|
||||
...attachment.reimbursement_form,
|
||||
});
|
||||
actorId = request.employee.id;
|
||||
downloadReason = sanitizeDownloadReason(request.query?.reason);
|
||||
if (requiresDownloadReason(attachment) && !downloadReason) {
|
||||
@@ -3408,7 +3441,10 @@ async function reimbursementRoutes(fastify) {
|
||||
if (!attachment) {
|
||||
throw new AppError({ code: "SYS_404", message: "Not Found", statusCode: 404 });
|
||||
}
|
||||
ensureOwnOrCanViewAll(fastify, request, attachment.reimbursement_form);
|
||||
await ensureOwnCanViewAllOrWorkflowReviewer(fastify, request, {
|
||||
id: reimbursementId,
|
||||
...attachment.reimbursement_form,
|
||||
});
|
||||
const reason = sanitizeDownloadReason(parsedBody.data.reason);
|
||||
if (requiresDownloadReason(attachment) && !reason) {
|
||||
throw new AppError({
|
||||
@@ -3501,7 +3537,7 @@ async function reimbursementRoutes(fastify) {
|
||||
if (!reimbursement) {
|
||||
throw new AppError({ code: "SYS_404", message: "Not Found", statusCode: 404 });
|
||||
}
|
||||
ensureOwnOrCanViewAll(fastify, request, reimbursement);
|
||||
await ensureOwnCanViewAllOrWorkflowReviewer(fastify, request, reimbursement);
|
||||
|
||||
const reason = sanitizeDownloadReason(parsedBody.data.reason);
|
||||
if (reimbursement.attachments.some((attachment) => requiresDownloadReason(attachment)) && !reason) {
|
||||
@@ -4532,6 +4568,8 @@ async function reimbursementRoutes(fastify) {
|
||||
workflow_steps_snapshot: workflowSteps,
|
||||
approval_rule_id: approvalRule.id,
|
||||
standardViolations,
|
||||
budgetCheck,
|
||||
budgetCheckRecorded: true,
|
||||
},
|
||||
context_department_id: reimbursement.department_id,
|
||||
created_by: request.employee.id,
|
||||
|
||||
@@ -76,6 +76,95 @@ const WORKFLOW_OVERDUE_ACTION = "overdue_remind";
|
||||
const WORKFLOW_REMINDER_COOLDOWN_MS = 24 * 60 * 60 * 1000;
|
||||
const WORKFLOW_DEFAULT_DUE_MS = 24 * 60 * 60 * 1000;
|
||||
|
||||
const REIMBURSEMENT_SNAPSHOT_CONTROL_MODES = new Set(["warn", "block"]);
|
||||
|
||||
function projectReimbursementSubmissionSnapshot(contextData) {
|
||||
const source = contextData && typeof contextData === "object" && !Array.isArray(contextData)
|
||||
? contextData
|
||||
: {};
|
||||
const standardViolationsPresent = Object.prototype.hasOwnProperty.call(source, "standardViolations");
|
||||
const budgetCheckPresent = Object.prototype.hasOwnProperty.call(source, "budgetCheck") && source.budgetCheck != null;
|
||||
const budgetCheckRecordedPresent = Object.prototype.hasOwnProperty.call(source, "budgetCheckRecorded");
|
||||
const standardViolationsValid = Array.isArray(source.standardViolations) && source.standardViolations.every((item) => (
|
||||
item &&
|
||||
typeof item === "object" &&
|
||||
typeof item.itemId === "string" &&
|
||||
typeof item.expenseTypeId === "string" &&
|
||||
typeof item.expenseTypeName === "string" &&
|
||||
typeof item.amount === "string" &&
|
||||
typeof item.standardId === "string" &&
|
||||
typeof item.standardName === "string" &&
|
||||
typeof item.maxAmount === "string" &&
|
||||
["item", "day", "trip"].includes(item.perUnit) &&
|
||||
REIMBURSEMENT_SNAPSHOT_CONTROL_MODES.has(item.controlMode) &&
|
||||
["global", "department"].includes(item.scopeType) &&
|
||||
(item.scopeKey == null || typeof item.scopeKey === "string") &&
|
||||
typeof item.exceeded === "boolean" &&
|
||||
typeof item.exceededAmount === "string"
|
||||
));
|
||||
const standardViolations = standardViolationsValid
|
||||
? source.standardViolations.map((item) => ({
|
||||
itemId: item.itemId,
|
||||
expenseTypeId: item.expenseTypeId,
|
||||
expenseTypeName: item.expenseTypeName,
|
||||
amount: item.amount,
|
||||
standardId: item.standardId,
|
||||
standardName: item.standardName,
|
||||
maxAmount: item.maxAmount,
|
||||
perUnit: item.perUnit,
|
||||
controlMode: item.controlMode,
|
||||
scopeType: item.scopeType,
|
||||
scopeKey: item.scopeKey,
|
||||
exceeded: item.exceeded,
|
||||
exceededAmount: item.exceededAmount,
|
||||
}))
|
||||
: [];
|
||||
|
||||
let budgetCheck = null;
|
||||
if (budgetCheckPresent) {
|
||||
const candidate = source.budgetCheck;
|
||||
const usagePercent = Number(candidate?.usagePercent);
|
||||
if (
|
||||
candidate &&
|
||||
typeof candidate === "object" &&
|
||||
!Array.isArray(candidate) &&
|
||||
typeof candidate.budgetId === "string" &&
|
||||
typeof candidate.budgetCode === "string" &&
|
||||
REIMBURSEMENT_SNAPSHOT_CONTROL_MODES.has(candidate.controlMode) &&
|
||||
Number.isFinite(usagePercent) &&
|
||||
typeof candidate.exceededThreshold === "boolean" &&
|
||||
typeof candidate.exceededBudget === "boolean"
|
||||
) {
|
||||
budgetCheck = {
|
||||
budgetId: candidate.budgetId,
|
||||
budgetCode: candidate.budgetCode,
|
||||
controlMode: candidate.controlMode,
|
||||
usagePercent,
|
||||
exceededThreshold: candidate.exceededThreshold,
|
||||
exceededBudget: candidate.exceededBudget,
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
const parseStatus =
|
||||
(standardViolationsPresent && !standardViolationsValid) ||
|
||||
(budgetCheckPresent && !budgetCheck) ||
|
||||
(budgetCheckRecordedPresent && source.budgetCheckRecorded !== true)
|
||||
? "invalid"
|
||||
: "ready";
|
||||
|
||||
return {
|
||||
standardViolations,
|
||||
budgetCheck,
|
||||
budgetCheckStatus: budgetCheck
|
||||
? "available"
|
||||
: source.budgetCheckRecorded === true
|
||||
? "not_applicable"
|
||||
: "missing",
|
||||
parseStatus,
|
||||
};
|
||||
}
|
||||
|
||||
const APPROVER_LIST_QUERY_SCHEMA = z.object({
|
||||
keyword: z.string().trim().max(100).optional(),
|
||||
page: z.coerce.number().int().min(1).optional(),
|
||||
@@ -2429,6 +2518,9 @@ async function workflowRoutes(fastify) {
|
||||
},
|
||||
},
|
||||
});
|
||||
const reimbursementSubmissionSnapshot = task.workflow_instance?.entity_type === "reimbursement"
|
||||
? projectReimbursementSubmissionSnapshot(task.workflow_instance.context_data)
|
||||
: null;
|
||||
|
||||
return sendData(reply, request, {
|
||||
task: {
|
||||
@@ -2451,9 +2543,10 @@ async function workflowRoutes(fastify) {
|
||||
currentStatus: task.workflow_instance.current_status,
|
||||
currentStepId: task.workflow_instance.current_step_id,
|
||||
contextData: {
|
||||
standardViolations: Array.isArray(task.workflow_instance.context_data?.standardViolations)
|
||||
? task.workflow_instance.context_data.standardViolations
|
||||
: [],
|
||||
standardViolations: reimbursementSubmissionSnapshot?.standardViolations ?? [],
|
||||
budgetCheck: reimbursementSubmissionSnapshot?.budgetCheck ?? null,
|
||||
budgetCheckStatus: reimbursementSubmissionSnapshot?.budgetCheckStatus ?? "missing",
|
||||
parseStatus: reimbursementSubmissionSnapshot?.parseStatus ?? "ready",
|
||||
},
|
||||
startedAt: isoOrNull(task.workflow_instance.started_at),
|
||||
completedAt: isoOrNull(task.workflow_instance.completed_at),
|
||||
|
||||
@@ -99,6 +99,8 @@ function buildReimbursementRecord(overrides = {}) {
|
||||
async function buildApp({
|
||||
employeeId = OWNER_ID,
|
||||
permissionCodes = ["expense.view_own"],
|
||||
roleCodes = [],
|
||||
reviewerTask = null,
|
||||
reimbursement = buildReimbursementRecord(),
|
||||
latestWorkflowInstance = {
|
||||
id: PENDING_INSTANCE_ID,
|
||||
@@ -273,6 +275,12 @@ async function buildApp({
|
||||
budgetPool: {
|
||||
findMany: vi.fn(async () => []),
|
||||
},
|
||||
delegationGrant: {
|
||||
findMany: vi.fn(async () => []),
|
||||
},
|
||||
workflowTask: {
|
||||
findFirst: vi.fn(async () => reviewerTask),
|
||||
},
|
||||
};
|
||||
|
||||
app.decorate("prisma", prisma);
|
||||
@@ -289,7 +297,7 @@ async function buildApp({
|
||||
request.employee = {
|
||||
id: employeeId,
|
||||
permissionCodes,
|
||||
roleCodes: [],
|
||||
roleCodes,
|
||||
department_id: DEPARTMENT_ID,
|
||||
};
|
||||
});
|
||||
@@ -329,6 +337,48 @@ async function buildApp({
|
||||
}
|
||||
|
||||
describe("GET /api/reimbursements/:id detail enhancements", () => {
|
||||
it("allows an assigned workflow reviewer to read evidence without expense view permissions", async () => {
|
||||
const { app, prisma } = await buildApp({
|
||||
employeeId: "99999999-9999-4999-8999-999999999999",
|
||||
permissionCodes: ["expense.approve"],
|
||||
roleCodes: ["finance"],
|
||||
reviewerTask: { id: "review-task" },
|
||||
});
|
||||
|
||||
const response = await app.inject({
|
||||
method: "GET",
|
||||
url: `/api/reimbursements/${REIMBURSEMENT_ID}`,
|
||||
headers: { authorization: "Bearer test" },
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(200);
|
||||
expect(prisma.workflowTask.findFirst).toHaveBeenCalledWith(expect.objectContaining({
|
||||
where: expect.objectContaining({
|
||||
workflow_instance: { entity_type: "reimbursement", entity_id: REIMBURSEMENT_ID },
|
||||
}),
|
||||
select: { id: true },
|
||||
}));
|
||||
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("keeps an unrelated employee outside the reimbursement evidence projection", async () => {
|
||||
const { app } = await buildApp({
|
||||
employeeId: "99999999-9999-4999-8999-999999999999",
|
||||
permissionCodes: ["expense.approve"],
|
||||
reviewerTask: null,
|
||||
});
|
||||
|
||||
const response = await app.inject({
|
||||
method: "GET",
|
||||
url: `/api/reimbursements/${REIMBURSEMENT_ID}`,
|
||||
headers: { authorization: "Bearer test" },
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(403);
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("returns department, submittedAt, expanded invoices and printable approvalHistory", async () => {
|
||||
const { app } = await buildApp();
|
||||
|
||||
|
||||
@@ -854,6 +854,40 @@ describe("reimbursements routes expense standard integration", () => {
|
||||
exceededAmount: "60.00",
|
||||
}),
|
||||
]);
|
||||
expect(state.workflowInstanceCreatePayload?.context_data).toEqual(expect.objectContaining({
|
||||
budgetCheck: null,
|
||||
budgetCheckRecorded: true,
|
||||
}));
|
||||
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("persists the calculated budget check in the workflow submission snapshot", async () => {
|
||||
resolveEntityPrecheckMock.mockResolvedValue(buildPrecheck());
|
||||
resolveApplicableBudgetPoolByContextMock.mockResolvedValue({
|
||||
id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
|
||||
code: "BUDGET-2026",
|
||||
allocated_amount: "1000.00",
|
||||
used_amount: "700.00",
|
||||
warning_threshold_percent: 80,
|
||||
});
|
||||
|
||||
const { app, state } = await buildApp();
|
||||
const response = await app.inject({
|
||||
method: "POST",
|
||||
url: `/api/reimbursements/${REIMBURSEMENT_ID}/submit`,
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(200);
|
||||
expect(state.workflowInstanceCreatePayload?.context_data?.budgetCheck).toEqual({
|
||||
budgetId: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
|
||||
budgetCode: "BUDGET-2026",
|
||||
controlMode: "warn",
|
||||
usagePercent: 88,
|
||||
exceededThreshold: true,
|
||||
exceededBudget: false,
|
||||
});
|
||||
expect(state.workflowInstanceCreatePayload?.context_data?.budgetCheckRecorded).toBe(true);
|
||||
|
||||
await app.close();
|
||||
});
|
||||
|
||||
@@ -36,18 +36,33 @@ async function buildApp(options = {}) {
|
||||
entity_id: "44444444-4444-4444-8444-444444444444",
|
||||
current_status: "pending",
|
||||
current_step_id: "approval_1_finance",
|
||||
context_data: {
|
||||
context_data: options.contextData ?? {
|
||||
standardViolations: [
|
||||
{
|
||||
itemId: "item-1",
|
||||
expenseTypeId: "66666666-6666-4666-8666-666666666666",
|
||||
expenseTypeName: "交通费",
|
||||
amount: "180.00",
|
||||
standardId: "77777777-7777-4777-8777-777777777777",
|
||||
standardName: "交通费上限",
|
||||
maxAmount: "120.00",
|
||||
perUnit: "item",
|
||||
exceededAmount: "60.00",
|
||||
controlMode: "warn",
|
||||
scopeType: "global",
|
||||
scopeKey: null,
|
||||
exceeded: true,
|
||||
secretNestedField: "must-not-be-projected",
|
||||
},
|
||||
],
|
||||
budgetCheck: {
|
||||
budgetId: "55555555-5555-4555-8555-555555555555",
|
||||
budgetCode: "BUDGET-2026",
|
||||
controlMode: "warn",
|
||||
usagePercent: 82.5,
|
||||
exceededThreshold: true,
|
||||
exceededBudget: false,
|
||||
},
|
||||
},
|
||||
started_at: new Date("2026-04-08T08:00:00.000Z"),
|
||||
completed_at: null,
|
||||
@@ -128,6 +143,82 @@ describe("workflow task detail route", () => {
|
||||
exceededAmount: "60.00",
|
||||
}),
|
||||
]);
|
||||
expect(response.json().data.workflowInstance.contextData.standardViolations[0]).not.toHaveProperty("secretNestedField");
|
||||
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("projects the allowed budget snapshot fields", async () => {
|
||||
const { app } = await buildApp();
|
||||
|
||||
const response = await app.inject({ method: "GET", url: `/api/workflow/tasks/${TASK_ID}` });
|
||||
|
||||
expect(response.statusCode).toBe(200);
|
||||
expect(response.json().data.workflowInstance.contextData).toEqual(expect.objectContaining({
|
||||
budgetCheck: {
|
||||
budgetId: "55555555-5555-4555-8555-555555555555",
|
||||
budgetCode: "BUDGET-2026",
|
||||
controlMode: "warn",
|
||||
usagePercent: 82.5,
|
||||
exceededThreshold: true,
|
||||
exceededBudget: false,
|
||||
},
|
||||
budgetCheckStatus: "available",
|
||||
parseStatus: "ready",
|
||||
}));
|
||||
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("marks a historical missing budget snapshot without failing parsing", async () => {
|
||||
const { app } = await buildApp({ contextData: { standardViolations: [] } });
|
||||
|
||||
const response = await app.inject({ method: "GET", url: `/api/workflow/tasks/${TASK_ID}` });
|
||||
|
||||
expect(response.json().data.workflowInstance.contextData).toEqual({
|
||||
standardViolations: [],
|
||||
budgetCheck: null,
|
||||
budgetCheckStatus: "missing",
|
||||
parseStatus: "ready",
|
||||
});
|
||||
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("distinguishes a recorded submission with no applicable budget from historical missing data", async () => {
|
||||
const { app } = await buildApp({ contextData: { standardViolations: [], budgetCheck: null, budgetCheckRecorded: true } });
|
||||
|
||||
const response = await app.inject({ method: "GET", url: `/api/workflow/tasks/${TASK_ID}` });
|
||||
|
||||
expect(response.json().data.workflowInstance.contextData).toEqual({
|
||||
standardViolations: [],
|
||||
budgetCheck: null,
|
||||
budgetCheckStatus: "not_applicable",
|
||||
parseStatus: "ready",
|
||||
});
|
||||
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("fails the snapshot projection closed when stored fields are malformed", async () => {
|
||||
const { app } = await buildApp({
|
||||
contextData: {
|
||||
standardViolations: { itemId: "not-an-array" },
|
||||
budgetCheck: { budgetCode: "BUDGET-2026", usagePercent: "unknown" },
|
||||
secretField: "must-not-be-projected",
|
||||
},
|
||||
});
|
||||
|
||||
const response = await app.inject({ method: "GET", url: `/api/workflow/tasks/${TASK_ID}` });
|
||||
const contextData = response.json().data.workflowInstance.contextData;
|
||||
|
||||
expect(contextData).toEqual({
|
||||
standardViolations: [],
|
||||
budgetCheck: null,
|
||||
budgetCheckStatus: "missing",
|
||||
parseStatus: "invalid",
|
||||
});
|
||||
expect(contextData).not.toHaveProperty("secretField");
|
||||
|
||||
await app.close();
|
||||
});
|
||||
|
||||
在新工单中引用
屏蔽一个用户