wangsli
1f8d5b658a
汇总已落盘的借款本金与还款、兼容历史编号的周期化编号、付款责任与回单核验、报销进度和排序、PWA/采购事务、错误原因与日期校验及ERP退役。 统一共享预算池锁序和锁后判断，恢复差旅原预算选择，补原因码固定夹具及反向完整性检查。 纳入配套迁移、测试、受管QA、分层验收合同、规约及任务记录；原始证据留在ignored artifacts。 关联任务：09-17-company-loan-principal-repayment、09-17-erp-exclusive-retirement、09-18-reimbursement-periodic-numbering、09-08-reimbursement-payment-closeout、09-18-local-concurrency-product-fixes、09-19-budget-pool-concurrency、09-05-error-explainability-payment-readiness。 预算补审由Claude定向验证2文件928项通过，原4446/28及r6结果仍仅对应各自历史输入；本轮未重跑测试。 完整新候选门禁、R1真实入口接入与12项公网义务仍开放。生产编号未启用、差旅仍冻结；不推送、不部署，不宣称发布资格。
62 行
3.8 KiB
JavaScript
62 行
3.8 KiB
JavaScript
const Fastify = require("fastify");
|
|
const dashboardRoutes = require("../../../src/routes/dashboard");
|
|
const { AppError } = require("../../../src/utils/AppError");
|
|
const paths = ["expense-overview", "trends", "top-categories", "approval-efficiency"];
|
|
|
|
async function buildApp(allowed = true) {
|
|
const app = Fastify();
|
|
const prisma = {
|
|
reimbursementForm: { count: vi.fn().mockResolvedValue(0), aggregate: vi.fn().mockResolvedValue({ _sum: { total_amount: null } }), groupBy: vi.fn().mockResolvedValue([]), findMany: vi.fn().mockResolvedValue([]) },
|
|
reimbursementItem: { groupBy: vi.fn().mockResolvedValue([]) },
|
|
expenseType: { findMany: vi.fn().mockResolvedValue([]) },
|
|
};
|
|
app.decorate("prisma", prisma);
|
|
app.decorate("requirePermission", () => async (request) => {
|
|
request.employee = { id: "synthetic", roleCodes: ["finance"], permissionCodes: ["finance.ledger.view"] };
|
|
if (!allowed) throw new AppError({ code: "PERM_001", statusCode: 403, message: "无权限" });
|
|
});
|
|
app.setErrorHandler((error, request, reply) => reply.code(error.statusCode ?? 500).send({ error: { code: error.code, details: error.details } }));
|
|
await app.register(dashboardRoutes, { prefix: "/api" });
|
|
return { app, queries: Object.values(prisma).flatMap(Object.values) };
|
|
}
|
|
|
|
describe("dashboard calendar and explanatory read errors", () => {
|
|
it.each(paths)("%s rejects bad dates and reversed bounds before reads", async (path) => {
|
|
const { app, queries } = await buildApp();
|
|
try {
|
|
for (const field of ["dateFrom", "dateTo"]) for (const value of ["2026-02-29", "2026-04-31", "2026-13-01"]) {
|
|
const response = await app.inject({ method: "GET", url: `/api/dashboard/${path}?${field}=${value}` });
|
|
expect(response.statusCode).toBe(400);
|
|
expect(response.json().error).toEqual({ code: "VALID_001", details: { formErrors: [], fieldErrors: { [field]: ["invalid_calendar_date"] }, reasonCode: "dashboard.query_invalid" } });
|
|
}
|
|
const reversed = await app.inject({ method: "GET", url: `/api/dashboard/${path}?dateFrom=2026-05-01&dateTo=2026-04-30` });
|
|
expect(reversed.statusCode).toBe(400);
|
|
expect(reversed.json().error.details).toEqual({ dateTo: "must_be_after_dateFrom", reasonCode: "dashboard.date_range_invalid" });
|
|
for (const query of queries) expect(query).not.toHaveBeenCalled();
|
|
} finally { await app.close(); }
|
|
});
|
|
|
|
it.each(paths)("%s preserves valid UTC bounds and omitted range", async (path) => {
|
|
const { app, queries } = await buildApp();
|
|
try {
|
|
const response = await app.inject({ method: "GET", url: `/api/dashboard/${path}?dateFrom=2024-02-29&dateTo=2026-04-30` });
|
|
expect(response.statusCode).toBe(200);
|
|
const clauses = queries.flatMap((query) => query.mock.calls).map(([arg]) => arg.where.reimbursement_form ?? arg.where);
|
|
expect(clauses.some((where) => where.AND.some((clause) => clause.reimbursement_date?.gte?.toISOString() === "2024-02-29T00:00:00.000Z" && clause.reimbursement_date?.lte?.toISOString() === "2026-04-30T23:59:59.999Z"))).toBe(true);
|
|
for (const query of queries) query.mockClear();
|
|
expect((await app.inject({ method: "GET", url: `/api/dashboard/${path}` })).statusCode).toBe(200);
|
|
const calls = queries.flatMap((query) => query.mock.calls);
|
|
expect(calls.length).toBeGreaterThan(0);
|
|
for (const [arg] of calls) expect((arg.where.reimbursement_form ?? arg.where).AND.some((clause) => clause.reimbursement_date)).toBe(false);
|
|
} finally { await app.close(); }
|
|
});
|
|
|
|
it.each(paths)("%s retains permission rejection before reads", async (path) => {
|
|
const { app, queries } = await buildApp(false);
|
|
try {
|
|
expect((await app.inject({ method: "GET", url: `/api/dashboard/${path}` })).statusCode).toBe(403);
|
|
for (const query of queries) expect(query).not.toHaveBeenCalled();
|
|
} finally { await app.close(); }
|
|
});
|
|
});
|