R44 A2-A8 完成员工高级筛选批量操作与统计页

server/tests/unit/routes/employees.stats.test.js

@@ -0,0 +1,115 @@
+const Fastify = require("fastify");
+
+const employeesRoutes = require("../../../src/routes/employees");
+const { AppError } = require("../../../src/utils/AppError");
+
+async function buildApp({ permissionCodes = ["system.users"], stats } = {}) {
+  const app = Fastify();
+  const employeeGroupBy = vi
+    .fn()
+    .mockResolvedValueOnce([
+      { employment_status: "active", _count: { _all: 8 } },
+      { employment_status: "probation", _count: { _all: 2 } },
+    ])
+    .mockResolvedValueOnce([
+      { department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa", _count: { _all: 6 } },
+      { department_id: "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb", _count: { _all: 4 } },
+    ]);
+  const employeeCount = vi.fn().mockResolvedValueOnce(3).mockResolvedValueOnce(1);
+  const departmentFindMany = vi.fn().mockResolvedValue([
+    { id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa", name: "行政部" },
+    { id: "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb", name: "研发部" },
+  ]);
+  const contractCount = vi.fn().mockResolvedValue(2);
+
+  app.decorate("prisma", {
+    employee: {
+      groupBy: stats?.employeeGroupBy ?? employeeGroupBy,
+      count: stats?.employeeCount ?? employeeCount,
+      findMany: vi.fn().mockResolvedValue([]),
+      findUnique: vi.fn().mockResolvedValue(null),
+    },
+    department: {
+      findMany: stats?.departmentFindMany ?? departmentFindMany,
+    },
+    employeeContract: {
+      count: stats?.employeeContractCount ?? contractCount,
+      findMany: vi.fn().mockResolvedValue([]),
+    },
+  });
+  app.decorate("authenticate", async (request) => {
+    request.employee = {
+      id: "actor-1",
+      department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+      permissionCodes,
+      roleCodes: [],
+    };
+  });
+  app.decorate("requirePermission", (permissionCode) => async (request) => {
+    request.employee = {
+      id: "actor-1",
+      department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+      permissionCodes,
+      roleCodes: [],
+    };
+    if (!permissionCodes.includes("*") && !permissionCodes.includes(permissionCode)) {
+      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
+    }
+  });
+  app.decorate("hasPermission", (employee, permissionCode) => {
+    const codes = employee.permissionCodes ?? [];
+    return codes.includes("*") || codes.includes(permissionCode);
+  });
+  app.decorate("config", { appTimezone: "Asia/Shanghai" });
+  app.setErrorHandler((error, request, reply) => {
+    reply
+      .status(error.statusCode || 500)
+      .send({ code: error.code || "ERR", message: error.message, details: error.details ?? null });
+  });
+
+  await app.register(employeesRoutes, { prefix: "/api" });
+  return { app, employeeGroupBy, employeeCount, departmentFindMany, contractCount };
+}
+
+describe("employees stats route", () => {
+  it("returns aggregated employee stats for read-only viewers", async () => {
+    const { app, employeeGroupBy, employeeCount, departmentFindMany, contractCount } = await buildApp({
+      permissionCodes: ["report.dashboard.view"],
+    });
+
+    const response = await app.inject({
+      method: "GET",
+      url: "/api/employees/stats",
+    });
+
+    expect(response.statusCode).toBe(200);
+    const payload = response.json();
+    expect(payload.data.employmentStatusSummary.total).toBe(10);
+    expect(payload.data.departmentHeadcount).toEqual([
+      { departmentId: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa", departmentName: "行政部", count: 6 },
+      { departmentId: "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb", departmentName: "研发部", count: 4 },
+    ]);
+    expect(payload.data.recentMovements.hires).toBe(3);
+    expect(payload.data.recentMovements.departures).toBe(1);
+    expect(payload.data.expiringContracts.count).toBe(2);
+    expect(employeeGroupBy).toHaveBeenCalledTimes(2);
+    expect(employeeCount).toHaveBeenCalledTimes(2);
+    expect(departmentFindMany).toHaveBeenCalledTimes(1);
+    expect(contractCount).toHaveBeenCalledTimes(1);
+
+    await app.close();
+  });
+
+  it("rejects requests without people directory permission", async () => {
+    const { app } = await buildApp({ permissionCodes: ["employee"] });
+
+    const response = await app.inject({
+      method: "GET",
+      url: "/api/employees/stats",
+    });
+
+    expect(response.statusCode).toBe(403);
+
+    await app.close();
+  });
+});