wangsli
1f8d5b658a
汇总已落盘的借款本金与还款、兼容历史编号的周期化编号、付款责任与回单核验、报销进度和排序、PWA/采购事务、错误原因与日期校验及ERP退役。 统一共享预算池锁序和锁后判断，恢复差旅原预算选择，补原因码固定夹具及反向完整性检查。 纳入配套迁移、测试、受管QA、分层验收合同、规约及任务记录；原始证据留在ignored artifacts。 关联任务：09-17-company-loan-principal-repayment、09-17-erp-exclusive-retirement、09-18-reimbursement-periodic-numbering、09-08-reimbursement-payment-closeout、09-18-local-concurrency-product-fixes、09-19-budget-pool-concurrency、09-05-error-explainability-payment-readiness。 预算补审由Claude定向验证2文件928项通过，原4446/28及r6结果仍仅对应各自历史输入；本轮未重跑测试。 完整新候选门禁、R1真实入口接入与12项公网义务仍开放。生产编号未启用、差旅仍冻结；不推送、不部署，不宣称发布资格。
394 行
12 KiB
JavaScript
394 行
12 KiB
JavaScript
const Fastify = require("fastify");
|
|
|
|
const { AppError } = require("../../../src/utils/AppError");
|
|
const purchaseRequestRoutes = require("../../../src/routes/purchaseRequests");
|
|
|
|
const PURCHASE_REQUEST_ID = "11111111-1111-4111-8111-111111111111";
|
|
const EMPLOYEE_ID = "22222222-2222-4222-8222-222222222222";
|
|
const OTHER_EMPLOYEE_ID = "33333333-3333-4333-8333-333333333333";
|
|
const DEPARTMENT_ID = "44444444-4444-4444-8444-444444444444";
|
|
const PROJECT_ID = "55555555-5555-4555-8555-555555555555";
|
|
const NOW = new Date("2026-05-13T10:00:00.000Z");
|
|
|
|
function buildFeatureFlagRecord(flagKey) {
|
|
return {
|
|
id: `flag-${flagKey}`,
|
|
flag_key: flagKey,
|
|
override_mode: "force_on",
|
|
rollout_type: "global",
|
|
department_ids: [],
|
|
note: "unit-test",
|
|
version: 1,
|
|
created_at: NOW,
|
|
created_by: null,
|
|
updated_at: NOW,
|
|
updated_by: null,
|
|
};
|
|
}
|
|
|
|
function buildProject(overrides = {}) {
|
|
return {
|
|
id: PROJECT_ID,
|
|
project_no: "PRJ-BIZ8",
|
|
name: "BIZ8 测试项目",
|
|
status: "active",
|
|
owner_employee_id: EMPLOYEE_ID,
|
|
manager_employee_id: null,
|
|
members: [],
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
function buildPurchaseRequest(overrides = {}) {
|
|
return {
|
|
id: PURCHASE_REQUEST_ID,
|
|
request_no: null,
|
|
applicant_id: EMPLOYEE_ID,
|
|
submitter_id: null,
|
|
department_id: DEPARTMENT_ID,
|
|
legal_entity_id: null,
|
|
cost_center_id: null,
|
|
supplier_id: null,
|
|
document_category_id: null,
|
|
budget_pool_id: null,
|
|
project_id: null,
|
|
title: "项目关联采购草稿",
|
|
reason: null,
|
|
currency_code: "CNY",
|
|
total_amount: "0.00",
|
|
expected_delivery_date: null,
|
|
status: "draft",
|
|
created_at: NOW,
|
|
updated_at: NOW,
|
|
applicant: { id: EMPLOYEE_ID, employee_no: "E001", name: "申请人" },
|
|
submitter: null,
|
|
department: { id: DEPARTMENT_ID, name: "测试部门" },
|
|
legal_entity: null,
|
|
cost_center: null,
|
|
supplier: null,
|
|
document_category: null,
|
|
budget_pool: null,
|
|
project: null,
|
|
items: [],
|
|
attachments: [],
|
|
order_archive: null,
|
|
workflow_instances: [],
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
async function buildApp({
|
|
project = buildProject(),
|
|
actorId = EMPLOYEE_ID,
|
|
permissionCodes = ["procurement.create", "procurement.view_own", "project.view_own"],
|
|
purchaseRequestOverrides = {},
|
|
purchaseRequests = null,
|
|
} = {}) {
|
|
const app = Fastify();
|
|
const actor = {
|
|
id: actorId,
|
|
department_id: DEPARTMENT_ID,
|
|
roleCodes: [],
|
|
permissionCodes,
|
|
};
|
|
const state = {
|
|
purchaseRequest: buildPurchaseRequest(purchaseRequestOverrides),
|
|
purchaseRequests: null,
|
|
auditEntries: [],
|
|
};
|
|
state.purchaseRequests = purchaseRequests?.map((item) => buildPurchaseRequest(item)) ?? [state.purchaseRequest];
|
|
|
|
function attachProjectRelation(item) {
|
|
return {
|
|
...item,
|
|
project: item.project_id === project.id
|
|
? {
|
|
id: project.id,
|
|
project_no: project.project_no,
|
|
name: project.name,
|
|
status: project.status,
|
|
}
|
|
: null,
|
|
};
|
|
}
|
|
|
|
const tx = {
|
|
$queryRaw: vi.fn(async () => [state.purchaseRequest]),
|
|
featureFlag: {
|
|
findUnique: vi.fn(async ({ where }) => buildFeatureFlagRecord(where.flag_key)),
|
|
},
|
|
project: {
|
|
findUnique: vi.fn(async ({ where }) => (where.id === project.id ? project : null)),
|
|
},
|
|
purchaseRequest: {
|
|
update: vi.fn(async ({ data }) => {
|
|
state.purchaseRequest = {
|
|
...state.purchaseRequest,
|
|
...(data.project_id !== undefined ? { project_id: data.project_id } : {}),
|
|
...(data.title !== undefined ? { title: data.title } : {}),
|
|
...(data.reason !== undefined ? { reason: data.reason } : {}),
|
|
...(data.currency_code !== undefined ? { currency_code: data.currency_code } : {}),
|
|
...(data.total_amount !== undefined ? { total_amount: data.total_amount } : {}),
|
|
updated_by: data.updated_by,
|
|
updated_at: NOW,
|
|
};
|
|
return attachProjectRelation(state.purchaseRequest);
|
|
}),
|
|
findUnique: vi.fn(async () => attachProjectRelation(state.purchaseRequest)),
|
|
},
|
|
auditLog: {
|
|
create: vi.fn(async ({ data }) => {
|
|
state.auditEntries.push(data);
|
|
return { id: "audit-1" };
|
|
}),
|
|
},
|
|
};
|
|
|
|
function listMatchesWhere(item, where = {}) {
|
|
if (where.project_id && item.project_id !== where.project_id) {
|
|
return false;
|
|
}
|
|
if (where.status && item.status !== where.status) {
|
|
return false;
|
|
}
|
|
if (where.OR) {
|
|
return where.OR.some((entry) => {
|
|
if (entry.applicant_id) return item.applicant_id === entry.applicant_id;
|
|
if (entry.submitter_id) return item.submitter_id === entry.submitter_id;
|
|
return false;
|
|
});
|
|
}
|
|
return true;
|
|
}
|
|
|
|
const prisma = {
|
|
$transaction: vi.fn(async (callback) => callback(tx)),
|
|
purchaseRequest: {
|
|
findUnique: vi.fn(async () => attachProjectRelation(state.purchaseRequest)),
|
|
findMany: vi.fn(async ({ where }) => state.purchaseRequests.filter((item) => listMatchesWhere(item, where)).map(attachProjectRelation)),
|
|
count: vi.fn(async ({ where }) => state.purchaseRequests.filter((item) => listMatchesWhere(item, where)).length),
|
|
},
|
|
entityRiskFlag: {
|
|
findMany: vi.fn(async () => []),
|
|
},
|
|
};
|
|
|
|
app.decorate("prisma", prisma);
|
|
app.decorate("config", {
|
|
appTimezone: "Asia/Shanghai",
|
|
projectLinkingEnabled: true,
|
|
cutoverConsoleEnabled: false,
|
|
});
|
|
app.decorate("hasPermission", (employee, permissionCode) => {
|
|
const permissionCodes = employee?.permissionCodes ?? [];
|
|
return permissionCodes.includes("*") || permissionCodes.includes(permissionCode);
|
|
});
|
|
app.decorate("requirePermission", (permissionCode) => async (request) => {
|
|
request.employee = actor;
|
|
if (!app.hasPermission(actor, permissionCode)) {
|
|
throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
|
|
}
|
|
});
|
|
app.decorate("authenticate", async (request) => {
|
|
request.employee = actor;
|
|
});
|
|
app.setErrorHandler((error, request, reply) => {
|
|
reply.status(error.statusCode || 500).send({
|
|
requestId: request.id,
|
|
error: {
|
|
code: error.code || "SYS_001",
|
|
message: error.message,
|
|
details: error.details ?? null,
|
|
},
|
|
});
|
|
});
|
|
|
|
await app.register(purchaseRequestRoutes, { prefix: "/api" });
|
|
return { app, tx, state };
|
|
}
|
|
|
|
describe("purchase request project link", () => {
|
|
it("links draft purchase request to a readable active project", async () => {
|
|
const { app, tx, state } = await buildApp();
|
|
|
|
const response = await app.inject({
|
|
method: "PATCH",
|
|
url: `/api/purchase-requests/${PURCHASE_REQUEST_ID}`,
|
|
payload: { projectId: PROJECT_ID },
|
|
});
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(response.json().data.purchaseRequest).toEqual(
|
|
expect.objectContaining({
|
|
id: PURCHASE_REQUEST_ID,
|
|
projectId: PROJECT_ID,
|
|
project: {
|
|
id: PROJECT_ID,
|
|
projectNo: "PRJ-BIZ8",
|
|
name: "BIZ8 测试项目",
|
|
status: "active",
|
|
},
|
|
}),
|
|
);
|
|
expect(state.purchaseRequest.project_id).toBe(PROJECT_ID);
|
|
expect(tx.auditLog.create).toHaveBeenCalledTimes(1);
|
|
|
|
await app.close();
|
|
});
|
|
|
|
it("blocks archived projects from new purchase links", async () => {
|
|
const { app, tx } = await buildApp({
|
|
project: buildProject({ status: "archived" }),
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "PATCH",
|
|
url: `/api/purchase-requests/${PURCHASE_REQUEST_ID}`,
|
|
payload: { projectId: PROJECT_ID },
|
|
});
|
|
|
|
expect(response.statusCode).toBe(409);
|
|
expect(response.json().error.details).toEqual({ projectId: "archived", reasonCode: "purchase_request.project_archived" });
|
|
expect(tx.purchaseRequest.update).not.toHaveBeenCalled();
|
|
|
|
await app.close();
|
|
});
|
|
|
|
it("does not revalidate an unchanged existing project link during draft edits", async () => {
|
|
const { app, tx } = await buildApp({
|
|
project: buildProject({ status: "archived" }),
|
|
purchaseRequestOverrides: {
|
|
project_id: PROJECT_ID,
|
|
},
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "PATCH",
|
|
url: `/api/purchase-requests/${PURCHASE_REQUEST_ID}`,
|
|
payload: { projectId: PROJECT_ID, title: "只修改标题" },
|
|
});
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(response.json().data.purchaseRequest).toEqual(
|
|
expect.objectContaining({
|
|
projectId: PROJECT_ID,
|
|
title: "只修改标题",
|
|
project: expect.objectContaining({ status: "archived" }),
|
|
}),
|
|
);
|
|
expect(tx.project.findUnique).not.toHaveBeenCalled();
|
|
|
|
await app.close();
|
|
});
|
|
|
|
it("does not let unreadable projects be linked to purchase drafts", async () => {
|
|
const { app, tx } = await buildApp({
|
|
project: buildProject({ owner_employee_id: OTHER_EMPLOYEE_ID }),
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "PATCH",
|
|
url: `/api/purchase-requests/${PURCHASE_REQUEST_ID}`,
|
|
payload: { projectId: PROJECT_ID },
|
|
});
|
|
|
|
expect(response.statusCode).toBe(403);
|
|
expect(response.json().error.code).toBe("PERM_001");
|
|
expect(tx.purchaseRequest.update).not.toHaveBeenCalled();
|
|
|
|
await app.close();
|
|
});
|
|
|
|
it("filters purchase request list by project id", async () => {
|
|
const otherProjectId = "66666666-6666-4666-8666-666666666666";
|
|
const { app } = await buildApp({
|
|
permissionCodes: ["procurement.view_all"],
|
|
purchaseRequests: [
|
|
{
|
|
id: PURCHASE_REQUEST_ID,
|
|
project_id: PROJECT_ID,
|
|
request_no: "PR-001",
|
|
title: "关联项目采购",
|
|
status: "draft",
|
|
},
|
|
{
|
|
id: "77777777-7777-4777-8777-777777777777",
|
|
project_id: otherProjectId,
|
|
request_no: "PR-002",
|
|
title: "其他项目采购",
|
|
status: "draft",
|
|
},
|
|
],
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "GET",
|
|
url: `/api/purchase-requests?projectId=${PROJECT_ID}&mine=0`,
|
|
});
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(response.json().data).toEqual(
|
|
expect.objectContaining({
|
|
total: 1,
|
|
items: [
|
|
expect.objectContaining({
|
|
id: PURCHASE_REQUEST_ID,
|
|
projectId: PROJECT_ID,
|
|
project: expect.objectContaining({
|
|
projectNo: "PRJ-BIZ8",
|
|
name: "BIZ8 测试项目",
|
|
}),
|
|
}),
|
|
],
|
|
}),
|
|
);
|
|
|
|
await app.close();
|
|
});
|
|
|
|
it("does not let project membership bypass purchase detail permission", async () => {
|
|
const { app } = await buildApp({
|
|
actorId: OTHER_EMPLOYEE_ID,
|
|
project: buildProject({ owner_employee_id: OTHER_EMPLOYEE_ID }),
|
|
permissionCodes: ["procurement.view_own", "project.view_own"],
|
|
purchaseRequestOverrides: {
|
|
applicant_id: EMPLOYEE_ID,
|
|
project_id: PROJECT_ID,
|
|
},
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "GET",
|
|
url: `/api/purchase-requests/${PURCHASE_REQUEST_ID}`,
|
|
});
|
|
|
|
expect(response.statusCode).toBe(403);
|
|
expect(response.json().error.code).toBe("PERM_001");
|
|
|
|
await app.close();
|
|
});
|
|
});
|
|
|
|
|
|
describe("purchase delivery calendar input", () => {
|
|
it.each(["2026-02-29", "2026-04-31", "2026-13-01", ""])("rejects %s before the transaction", async (date) => {
|
|
const { app, tx, state } = await buildApp();
|
|
try {
|
|
const response = await app.inject({ method: "PATCH", url: `/api/purchase-requests/${PURCHASE_REQUEST_ID}`, payload: { expectedDeliveryDate: date } });
|
|
expect(response.statusCode).toBe(400);
|
|
expect(response.json().error.details.fieldErrors.expectedDeliveryDate.length).toBeGreaterThan(0);
|
|
expect(app.prisma.$transaction).not.toHaveBeenCalled();
|
|
expect(tx.purchaseRequest.update).not.toHaveBeenCalled();
|
|
expect(state.auditEntries).toEqual([]);
|
|
} finally { await app.close(); }
|
|
});
|
|
it.each(["2024-02-29", "2026-04-30", null, undefined])("keeps valid or nullable/optional delivery date %s", async (date) => {
|
|
const { app, tx } = await buildApp();
|
|
try {
|
|
const response = await app.inject({ method: "PATCH", url: `/api/purchase-requests/${PURCHASE_REQUEST_ID}`, payload: { title: "合成修改", ...(date === undefined ? {} : { expectedDeliveryDate: date }) } });
|
|
expect(response.statusCode).toBe(200);
|
|
expect(tx.purchaseRequest.update.mock.calls[0][0].data.expected_delivery_date).toEqual(date === undefined ? undefined : date === null ? null : new Date(`${date}T00:00:00.000Z`));
|
|
} finally { await app.close(); }
|
|
});
|
|
});
|