391 行
12 KiB
JavaScript
391 行
12 KiB
JavaScript
const Fastify = require("fastify");
|
|
|
|
const { AppError } = require("../../../src/utils/AppError");
|
|
const workflowRoutes = require("../../../src/routes/workflow");
|
|
|
|
const APPLICANT_ID = "55555555-5555-4555-8555-555555555555";
|
|
|
|
function buildTaskRow() {
|
|
return {
|
|
id: "11111111-1111-4111-8111-111111111111",
|
|
instance_id: "22222222-2222-4222-8222-222222222222",
|
|
step_id: "manager_approval",
|
|
step_name: "经理审批",
|
|
assignee_id: "actor-1",
|
|
assignee_role: null,
|
|
status: "pending",
|
|
};
|
|
}
|
|
|
|
function buildWorkflowInstance(entityType) {
|
|
return {
|
|
id: "22222222-2222-4222-8222-222222222222",
|
|
entity_type: entityType,
|
|
entity_id: "33333333-3333-4333-8333-333333333333",
|
|
current_step_id: "manager_approval",
|
|
context_data: {},
|
|
workflow_definition: {
|
|
definition_json: {
|
|
steps: [],
|
|
},
|
|
},
|
|
};
|
|
}
|
|
|
|
function buildTarget(roleCode) {
|
|
return {
|
|
id: "44444444-4444-4444-8444-444444444444",
|
|
status: "active",
|
|
roles: [
|
|
{
|
|
role_code: roleCode,
|
|
},
|
|
],
|
|
};
|
|
}
|
|
|
|
function buildTx({ entityType, targetRoleCode = "manager", transferCount = 0 }) {
|
|
return {
|
|
$queryRaw: vi.fn().mockResolvedValue([buildTaskRow()]),
|
|
workflowInstance: {
|
|
findUnique: vi.fn().mockResolvedValue(buildWorkflowInstance(entityType)),
|
|
},
|
|
employee: {
|
|
findUnique: vi.fn().mockResolvedValue(buildTarget(targetRoleCode)),
|
|
},
|
|
reimbursementForm: {
|
|
findUnique: vi.fn().mockResolvedValue({
|
|
id: "33333333-3333-4333-8333-333333333333",
|
|
owner_id: APPLICANT_ID,
|
|
submitter_id: APPLICANT_ID,
|
|
owner: { id: APPLICANT_ID, name: "申请人" },
|
|
}),
|
|
},
|
|
leaveRequest: {
|
|
findUnique: vi.fn().mockResolvedValue({
|
|
id: "33333333-3333-4333-8333-333333333333",
|
|
owner_id: APPLICANT_ID,
|
|
owner: { id: APPLICANT_ID, name: "申请人" },
|
|
}),
|
|
},
|
|
purchaseRequest: {
|
|
findUnique: vi.fn().mockResolvedValue({
|
|
id: "33333333-3333-4333-8333-333333333333",
|
|
request_no: "CG-TEST",
|
|
applicant_id: APPLICANT_ID,
|
|
submitter_id: APPLICANT_ID,
|
|
applicant: { id: APPLICANT_ID, name: "申请人" },
|
|
}),
|
|
},
|
|
travelRequest: {
|
|
findUnique: vi.fn().mockResolvedValue({
|
|
id: "33333333-3333-4333-8333-333333333333",
|
|
request_no: "CL-TEST",
|
|
applicant_employee_id: APPLICANT_ID,
|
|
submitter_id: APPLICANT_ID,
|
|
applicant: { id: APPLICANT_ID, name: "申请人" },
|
|
}),
|
|
},
|
|
workflowTask: {
|
|
update: vi.fn().mockResolvedValue({ id: "11111111-1111-4111-8111-111111111111" }),
|
|
},
|
|
workflowHistory: {
|
|
count: vi.fn().mockResolvedValue(transferCount),
|
|
create: vi.fn().mockResolvedValue({ id: "history-1" }),
|
|
},
|
|
approvalTransfer: {
|
|
create: vi.fn().mockResolvedValue({ id: "transfer-1" }),
|
|
},
|
|
};
|
|
}
|
|
|
|
function buildPrisma(tx) {
|
|
return {
|
|
$transaction: vi.fn().mockImplementation((callback) => callback(tx)),
|
|
};
|
|
}
|
|
|
|
async function buildApp({ prisma, employee }) {
|
|
const app = Fastify();
|
|
|
|
app.decorate("prisma", prisma);
|
|
app.decorate("config", {});
|
|
app.decorate("authenticate", async (request) => {
|
|
if (!request.headers.authorization) {
|
|
throw new AppError({
|
|
code: "AUTH_001",
|
|
message: "未登录",
|
|
statusCode: 401,
|
|
});
|
|
}
|
|
|
|
request.employee = employee;
|
|
});
|
|
app.decorate("hasPermission", (actor, permissionCode) => {
|
|
return (actor?.permissionCodes ?? []).includes("*") || (actor?.permissionCodes ?? []).includes(permissionCode);
|
|
});
|
|
app.decorate("requirePermission", (permissionCode) => async (request) => {
|
|
await app.authenticate(request);
|
|
if (!app.hasPermission(request.employee, permissionCode)) {
|
|
throw new AppError({
|
|
code: "PERM_001",
|
|
message: "无权限",
|
|
statusCode: 403,
|
|
details: { permission: permissionCode },
|
|
});
|
|
}
|
|
});
|
|
|
|
app.setErrorHandler((error, request, reply) => {
|
|
if (error instanceof AppError) {
|
|
return reply.status(error.statusCode).send({
|
|
requestId: request.id,
|
|
error: {
|
|
code: error.code,
|
|
message: error.message,
|
|
details: error.details ?? {},
|
|
},
|
|
});
|
|
}
|
|
|
|
return reply.status(500).send({
|
|
requestId: request.id,
|
|
error: { code: "SYS_001", message: "服务器内部错误", details: {} },
|
|
});
|
|
});
|
|
|
|
await app.register(workflowRoutes, { prefix: "/api" });
|
|
return app;
|
|
}
|
|
|
|
describe("workflow transfer route", () => {
|
|
it.each(["leave", "purchase_request"])(
|
|
"allows transfer for %s when target has matching approve permission",
|
|
async (entityType) => {
|
|
const tx = buildTx({ entityType });
|
|
const app = await buildApp({
|
|
prisma: buildPrisma(tx),
|
|
employee: {
|
|
id: "actor-1",
|
|
roleCodes: ["manager"],
|
|
permissionCodes: ["expense.transfer"],
|
|
},
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "POST",
|
|
url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
|
|
headers: { authorization: "Bearer test" },
|
|
payload: {
|
|
toApproverId: "44444444-4444-4444-8444-444444444444",
|
|
reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
|
|
},
|
|
});
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(response.json().data).toEqual(
|
|
expect.objectContaining({
|
|
outcome: "transferred",
|
|
toApproverId: "44444444-4444-4444-8444-444444444444",
|
|
transferCount: 1,
|
|
transferId: null,
|
|
}),
|
|
);
|
|
expect(tx.workflowTask.update).toHaveBeenCalledWith(
|
|
expect.objectContaining({
|
|
where: { id: buildTaskRow().id },
|
|
data: expect.objectContaining({
|
|
assignee_id: "44444444-4444-4444-8444-444444444444",
|
|
assignee_role: null,
|
|
}),
|
|
}),
|
|
);
|
|
expect(tx.workflowHistory.create).toHaveBeenCalledWith(
|
|
expect.objectContaining({
|
|
data: expect.objectContaining({
|
|
action: "transfer",
|
|
payload: expect.objectContaining({
|
|
to_approver_id: "44444444-4444-4444-8444-444444444444",
|
|
transfer_count: 1,
|
|
}),
|
|
}),
|
|
}),
|
|
);
|
|
expect(tx.approvalTransfer.create).not.toHaveBeenCalled();
|
|
|
|
await app.close();
|
|
},
|
|
);
|
|
|
|
it("rejects transfer for frozen travel_request tasks", async () => {
|
|
const tx = buildTx({ entityType: "travel_request" });
|
|
const app = await buildApp({
|
|
prisma: buildPrisma(tx),
|
|
employee: {
|
|
id: "actor-1",
|
|
roleCodes: ["manager"],
|
|
permissionCodes: ["expense.transfer"],
|
|
},
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "POST",
|
|
url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
|
|
headers: { authorization: "Bearer test" },
|
|
payload: {
|
|
toApproverId: "44444444-4444-4444-8444-444444444444",
|
|
reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
|
|
},
|
|
});
|
|
|
|
expect(response.statusCode).toBe(403);
|
|
expect(tx.workflowTask.update).not.toHaveBeenCalled();
|
|
|
|
await app.close();
|
|
});
|
|
|
|
it("rejects target approver without matching entity approve permission", async () => {
|
|
const tx = buildTx({ entityType: "leave", targetRoleCode: "finance" });
|
|
const app = await buildApp({
|
|
prisma: buildPrisma(tx),
|
|
employee: {
|
|
id: "actor-1",
|
|
roleCodes: ["manager"],
|
|
permissionCodes: ["expense.transfer"],
|
|
},
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "POST",
|
|
url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
|
|
headers: { authorization: "Bearer test" },
|
|
payload: {
|
|
toApproverId: "44444444-4444-4444-8444-444444444444",
|
|
reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
|
|
},
|
|
});
|
|
|
|
expect(response.statusCode).toBe(409);
|
|
expect(response.json().error).toEqual(
|
|
expect.objectContaining({
|
|
code: "VALID_001",
|
|
details: expect.objectContaining({
|
|
toApproverId: "target_not_approver",
|
|
reasonCode: "workflow.transfer_target_ineligible",
|
|
}),
|
|
}),
|
|
);
|
|
expect(tx.workflowTask.update).not.toHaveBeenCalled();
|
|
|
|
await app.close();
|
|
});
|
|
|
|
it.each(["admin", "system_admin"])(
|
|
"does not treat %s-only target as a business approver",
|
|
async (targetRoleCode) => {
|
|
const tx = buildTx({ entityType: "reimbursement", targetRoleCode });
|
|
const app = await buildApp({
|
|
prisma: buildPrisma(tx),
|
|
employee: {
|
|
id: "actor-1",
|
|
roleCodes: ["manager"],
|
|
permissionCodes: ["expense.transfer"],
|
|
},
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "POST",
|
|
url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
|
|
headers: { authorization: "Bearer test" },
|
|
payload: {
|
|
toApproverId: "44444444-4444-4444-8444-444444444444",
|
|
reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
|
|
},
|
|
});
|
|
|
|
expect(response.statusCode).toBe(409);
|
|
expect(response.json().error.details).toEqual(
|
|
expect.objectContaining({
|
|
toApproverId: "target_not_approver",
|
|
reasonCode: "workflow.transfer_target_ineligible",
|
|
}),
|
|
);
|
|
expect(tx.workflowTask.update).not.toHaveBeenCalled();
|
|
|
|
await app.close();
|
|
},
|
|
);
|
|
|
|
it("rejects transfer to the applicant", async () => {
|
|
const tx = buildTx({ entityType: "leave", targetRoleCode: "manager" });
|
|
const app = await buildApp({
|
|
prisma: buildPrisma(tx),
|
|
employee: {
|
|
id: "actor-1",
|
|
roleCodes: ["manager"],
|
|
permissionCodes: ["expense.transfer"],
|
|
},
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "POST",
|
|
url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
|
|
headers: { authorization: "Bearer test" },
|
|
payload: {
|
|
toApproverId: APPLICANT_ID,
|
|
reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
|
|
},
|
|
});
|
|
|
|
expect(response.statusCode).toBe(409);
|
|
expect(response.json().error).toEqual(
|
|
expect.objectContaining({
|
|
code: "VALID_001",
|
|
details: expect.objectContaining({
|
|
workflow: "self_approval_not_allowed",
|
|
reasonCode: "workflow.self_approval_forbidden",
|
|
}),
|
|
}),
|
|
);
|
|
expect(tx.workflowTask.update).not.toHaveBeenCalled();
|
|
|
|
await app.close();
|
|
});
|
|
|
|
it("returns WORKFLOW_003 when transfer chain exceeds limit", async () => {
|
|
const tx = buildTx({ entityType: "leave", transferCount: 3 });
|
|
const app = await buildApp({
|
|
prisma: buildPrisma(tx),
|
|
employee: {
|
|
id: "actor-1",
|
|
roleCodes: ["manager"],
|
|
permissionCodes: ["expense.transfer"],
|
|
},
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "POST",
|
|
url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
|
|
headers: { authorization: "Bearer test" },
|
|
payload: {
|
|
toApproverId: "44444444-4444-4444-8444-444444444444",
|
|
reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
|
|
},
|
|
});
|
|
|
|
expect(response.statusCode).toBe(409);
|
|
expect(response.json().error).toEqual(
|
|
expect.objectContaining({
|
|
code: "WORKFLOW_003",
|
|
details: expect.objectContaining({
|
|
transfer: "chain_limit_exceeded",
|
|
}),
|
|
}),
|
|
);
|
|
expect(tx.workflowTask.update).not.toHaveBeenCalled();
|
|
expect(tx.workflowHistory.create).not.toHaveBeenCalled();
|
|
|
|
await app.close();
|
|
});
|
|
});
|