feat(P20T2-1,P20T2-2,P20T2-3): 卡授权/交易/支付标记/发票绑定/ERP出站后端

server/src/routes/invoicePool/read.js

@@ -47,10 +47,12 @@ function parseInvoiceListQuery(query) {
 
 function ensureInvoiceReadableByUser(request, invoice) {
   const roleCodes = request.employee.roleCodes;
+  const permissionCodes = request.employee.permissionCodes ?? [];
   if (
     roleCodes.includes("admin") ||
     roleCodes.includes("finance") ||
-    roleCodes.includes("finance_mgr")
+    roleCodes.includes("finance_mgr") ||
+    permissionCodes.includes("travel.payment.manage")
   ) {
     return true;
   }
@@ -110,7 +112,9 @@ function registerInvoicePoolReadRoutes(fastify) {
       const query = parseInvoiceListQuery(request.query);
 
       const canViewOwn = fastify.hasPermission(request.employee, "invoice.view_own");
-      const canManage = fastify.hasPermission(request.employee, "invoice.manage");
+      const canManage =
+        fastify.hasPermission(request.employee, "invoice.manage") ||
+        fastify.hasPermission(request.employee, "travel.payment.manage");
 
       if (!canViewOwn && !canManage) {
         throw new AppError({