R36-1/R36-2/R36-3/R36-5 收口请假编辑与团队日历

server/src/routes/leave.js

@@ -44,6 +44,7 @@ const leaveListQuerySchema = z.object({
   pageSize: z.coerce.number().int().min(1).max(100).optional(),
   dateFrom: DATE_ONLY_SCHEMA.optional(),
   dateTo: DATE_ONLY_SCHEMA.optional(),
+  departmentId: z.string().uuid().optional(),
 });
 
 const leaveBalanceQuerySchema = z.object({
@@ -120,6 +121,9 @@ function parseLeaveListQuery(query) {
   if (dateFrom && dateTo && dateFrom > dateTo) {
     throw buildValidationError({ dateTo: "must_be_after_dateFrom" });
   }
+  if (parsed.data.departmentId && parsed.data.scope !== "all") {
+    throw buildValidationError({ departmentId: "scope_all_only" });
+  }
 
   return {
     status: parsed.data.status,
@@ -128,6 +132,7 @@ function parseLeaveListQuery(query) {
     pageSize: parsed.data.pageSize ?? 20,
     dateFrom,
     dateTo,
+    departmentId: parsed.data.departmentId ?? null,
   };
 }
 
@@ -347,12 +352,18 @@ async function loadLeaveTypeOrThrow(prisma, leaveTypeId) {
   return leaveType;
 }
 
-async function assertLeaveTypeAttachment(fastify, leaveType, filePart, employeeId) {
+async function resolveLeaveTypeAttachment(
+  fastify,
+  leaveType,
+  filePart,
+  employeeId,
+  { requireWhenMissing = true } = {},
+) {
   const requiresAttachment = Boolean(leaveType.requires_attachment);
   const allowedMimeTypes = normalizeAttachmentMimeTypes(leaveType.attachment_mime_types);
 
   if (!filePart) {
-    if (requiresAttachment) {
+    if (requireWhenMissing && requiresAttachment) {
       throw buildValidationError({ file: "required" }, 422);
     }
     return null;
@@ -417,6 +428,7 @@ async function leaveRoutes(fastify) {
     async (request, reply) => {
       const query = parseLeaveListQuery(request.query);
       const canViewAll = fastify.hasPermission(request.employee, "leave.view_all");
+      const canManageAll = fastify.hasPermission(request.employee, "leave.manage");
       if (query.scope === "all" && !canViewAll) {
         throw new AppError({
           code: "PERM_001",
@@ -424,6 +436,18 @@ async function leaveRoutes(fastify) {
           statusCode: 403,
         });
       }
+      if (
+        query.departmentId &&
+        !canManageAll &&
+        query.departmentId !== (request.employee.department_id ?? null)
+      ) {
+        throw new AppError({
+          code: "PERM_001",
+          message: "无权限",
+          statusCode: 403,
+          details: { departmentId: "forbidden" },
+        });
+      }
 
       const page = query.page;
       const pageSize = query.pageSize;
@@ -431,6 +455,7 @@ async function leaveRoutes(fastify) {
       const where = {
         ...(query.status ? { status: query.status } : {}),
         ...(query.scope === "all" && canViewAll ? {} : { owner_id: request.employee.id }),
+        ...(query.scope === "all" && query.departmentId ? { department_id: query.departmentId } : {}),
         ...(query.dateFrom || query.dateTo
           ? {
               AND: [
@@ -510,7 +535,7 @@ async function leaveRoutes(fastify) {
       });
       const { body, filePart } = await collectCreatePayload(request);
       const leaveType = await loadLeaveTypeOrThrow(fastify.prisma, body.leaveTypeId);
-      const attachment = await assertLeaveTypeAttachment(
+      const attachment = await resolveLeaveTypeAttachment(
         fastify,
         leaveType,
         filePart,
@@ -576,6 +601,137 @@ async function leaveRoutes(fastify) {
     },
   );
 
+  fastify.patch(
+    "/leave-requests/:id",
+    {
+      schema: { tags: ["Leave"], summary: "Update Leave Request" },
+      preHandler: fastify.requireEntityPermission("leave", "submit"),
+    },
+    async (request, reply) => {
+      const leaveId = parseLeaveId(request.params?.id);
+      const { body, filePart } = await collectCreatePayload(request);
+      let response = null;
+
+      await fastify.prisma.$transaction(async (tx) => {
+        const leaveRows = await tx.$queryRaw`
+          SELECT
+            id,
+            owner_id,
+            department_id,
+            attachment_storage_path,
+            attachment_original_name,
+            attachment_mime_type,
+            status
+          FROM "leave_requests"
+          WHERE id = ${leaveId}::uuid
+          FOR UPDATE
+        `;
+
+        if (!Array.isArray(leaveRows) || leaveRows.length === 0) {
+          throw new AppError({
+            code: "SYS_404",
+            message: "Not Found",
+            statusCode: 404,
+          });
+        }
+
+        const leave = leaveRows[0];
+        await ensureCutoverAllowed({
+          prisma: tx,
+          config: fastify.config,
+          request,
+          domain: "leave",
+          departmentId: leave.department_id ?? request.employee.department_id ?? null,
+        });
+
+        if (leave.owner_id !== request.employee.id) {
+          throw new AppError({
+            code: "PERM_001",
+            message: "无权限",
+            statusCode: 403,
+          });
+        }
+
+        if (!["draft", "rejected"].includes(leave.status)) {
+          throw buildValidationError({ status: "invalid_edit_status" }, 409);
+        }
+
+        const leaveType = await loadLeaveTypeOrThrow(tx, body.leaveTypeId);
+        const attachment = await resolveLeaveTypeAttachment(
+          fastify,
+          leaveType,
+          filePart,
+          request.employee.id,
+          { requireWhenMissing: false },
+        );
+        const requestedDays = await resolveRequestedDaysForCreate(
+          fastify,
+          request.employee,
+          body,
+        );
+
+        const updatedLeave = await tx.leaveRequest.update({
+          where: { id: leaveId },
+          data: {
+            department_id: request.employee.department_id ?? leave.department_id ?? null,
+            leave_type_id: body.leaveTypeId,
+            start_date: body.startDate,
+            end_date: body.endDate,
+            start_session: body.startSession,
+            end_session: body.endSession,
+            requested_days: requestedDays,
+            reason: body.reason,
+            attachment_storage_path: attachment?.storagePath ?? leave.attachment_storage_path ?? null,
+            attachment_original_name: attachment
+              ? attachment.originalName ?? null
+              : leave.attachment_original_name ?? null,
+            attachment_mime_type: attachment
+              ? attachment.mimeType ?? null
+              : leave.attachment_mime_type ?? null,
+            updated_by: request.employee.id,
+          },
+          select: {
+            id: true,
+            owner_id: true,
+            department_id: true,
+            leave_type_id: true,
+            start_date: true,
+            end_date: true,
+            start_session: true,
+            end_session: true,
+            requested_days: true,
+            reason: true,
+            attachment_original_name: true,
+            attachment_mime_type: true,
+            status: true,
+            created_at: true,
+            updated_at: true,
+            leave_type: {
+              select: {
+                id: true,
+                code: true,
+                name: true,
+                requires_attachment: true,
+                attachment_mime_types: true,
+              },
+            },
+            owner: {
+              select: {
+                id: true,
+                employee_no: true,
+                name: true,
+              },
+            },
+          },
+        });
+
+        response = mapLeaveRequestResponse(updatedLeave);
+      });
+
+      return sendData(reply, request, response);
+    },
+  );
+
   fastify.get(
     "/leave-requests/:id",
     {