359 行
14 KiB
JavaScript
359 行
14 KiB
JavaScript
const Fastify = require("fastify");
|
|
|
|
const wecomApprovalArchiveRoutes = require("../../../src/routes/wecomApprovalArchive");
|
|
const { AppError } = require("../../../src/utils/AppError");
|
|
|
|
const EMPLOYEE_ID = "11111111-1111-4111-8111-111111111111";
|
|
const OTHER_ID = "22222222-2222-4222-8222-222222222222";
|
|
const MANAGER_ID = "33333333-3333-4333-8333-333333333333";
|
|
const REPORT_ID = "44444444-4444-4444-8444-444444444444";
|
|
const PEER_ID = "55555555-5555-4555-8555-555555555555";
|
|
const FINANCE_ID = "66666666-6666-4666-8666-666666666666";
|
|
const HR_ID = "77777777-7777-4777-8777-777777777777";
|
|
|
|
const FULL_SP_NO = "SPWARCH2FULLIDENTIFIERSHOULDNOTLEAK";
|
|
const FULL_TEMPLATE_ID = "TPLWARCH2FULLIDENTIFIERSHOULDNOTLEAK";
|
|
const FULL_USER_ID = "wecom_full_userid_should_not_leak_warch2";
|
|
const FULL_PHONE = "13900001111";
|
|
const FULL_EMAIL = "[email protected]";
|
|
const FULL_FIELD_VALUE = "完整请假原因不应该出现在查询响应中";
|
|
const FULL_COMMENT = "审批评论不应该出现在查询响应中";
|
|
const FULL_SOURCE = "raw payload must not leak";
|
|
const FULL_ERROR = "internal processing error must not leak";
|
|
|
|
function employee(id, name, overrides = {}) {
|
|
return {
|
|
id,
|
|
employee_no: `NO-${id.slice(0, 4)}`,
|
|
name,
|
|
status: "active",
|
|
direct_manager_id: null,
|
|
department_id: "department-a",
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
const EMPLOYEES = [
|
|
employee(EMPLOYEE_ID, "员工本人"),
|
|
employee(OTHER_ID, "其他员工"),
|
|
employee(MANAGER_ID, "直属主管"),
|
|
employee(REPORT_ID, "直属下属", { direct_manager_id: MANAGER_ID }),
|
|
employee(PEER_ID, "同部门非直属"),
|
|
employee(FINANCE_ID, "财务"),
|
|
employee(HR_ID, "HR"),
|
|
];
|
|
|
|
function archiveRow(overrides = {}) {
|
|
const applicantId = overrides.applicant_employee_id === undefined ? EMPLOYEE_ID : overrides.applicant_employee_id;
|
|
const applicant = applicantId ? EMPLOYEES.find((item) => item.id === applicantId) : null;
|
|
return {
|
|
id: overrides.id || `archive-${Math.random().toString(36).slice(2)}`,
|
|
sp_no: overrides.sp_no || FULL_SP_NO,
|
|
template_id: overrides.template_id || FULL_TEMPLATE_ID,
|
|
template_type: overrides.template_type || "leave",
|
|
sp_name: overrides.sp_name || "OA-POC-请假",
|
|
normalized_status: overrides.normalized_status || "approved",
|
|
applicant_employee_id: applicantId,
|
|
applicant_external_user_id: overrides.applicant_external_user_id || FULL_USER_ID,
|
|
applied_at: new Date("2026-05-19T08:00:00.000Z"),
|
|
submitted_at: new Date("2026-05-19T08:00:00.000Z"),
|
|
completed_at: new Date("2026-05-19T09:00:00.000Z"),
|
|
status_observed_at: new Date("2026-05-19T09:00:00.000Z"),
|
|
last_callback_at: null,
|
|
last_compensation_at: new Date("2026-05-19T10:00:00.000Z"),
|
|
last_source: "compensation_pull",
|
|
readability_status: "PASS_READABLE",
|
|
single_tap_approve_risk: true,
|
|
template_adjustment_required: false,
|
|
source_summary: { raw: FULL_SOURCE },
|
|
processing_error_message: FULL_ERROR,
|
|
error_message: FULL_ERROR,
|
|
applicant,
|
|
participants: overrides.participants || [],
|
|
actions: overrides.actions || [],
|
|
field_summaries: overrides.field_summaries || [{
|
|
id: `field-${overrides.id || "1"}`,
|
|
field_key: "reason",
|
|
field_index: 1,
|
|
field_name: "请假原因",
|
|
field_type: "Textarea",
|
|
normalized_value: FULL_FIELD_VALUE,
|
|
value_preview: FULL_FIELD_VALUE.slice(0, 10),
|
|
sensitive_level: "restricted",
|
|
display_allowed: false,
|
|
}],
|
|
attachment_summaries: [{
|
|
id: `attach-${overrides.id || "1"}`,
|
|
external_ref_summary: "attachment raw ref should not leak",
|
|
}],
|
|
reconcile_findings: overrides.reconcile_findings || [],
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
function participant(employeeId, overrides = {}) {
|
|
const linked = employeeId ? EMPLOYEES.find((item) => item.id === employeeId) : null;
|
|
return {
|
|
id: `participant-${employeeId || "external"}`,
|
|
role: overrides.role || "approver",
|
|
node_index: overrides.node_index ?? 1,
|
|
external_user_id: overrides.external_user_id || FULL_USER_ID,
|
|
employee_id: employeeId,
|
|
is_current: false,
|
|
mapping_status: employeeId ? "mapped_or_external" : "external_only",
|
|
display_summary: FULL_USER_ID,
|
|
employee: linked,
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
function action(employeeId, overrides = {}) {
|
|
const linked = employeeId ? EMPLOYEES.find((item) => item.id === employeeId) : null;
|
|
return {
|
|
id: `action-${employeeId || "external"}`,
|
|
action_type: overrides.action_type || "approve",
|
|
operator_external_user_id: FULL_USER_ID,
|
|
operator_employee_id: employeeId,
|
|
action_time: new Date("2026-05-19T09:00:00.000Z"),
|
|
node_index: 1,
|
|
comment_summary: FULL_COMMENT,
|
|
source: "compensation_pull",
|
|
operator: linked,
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
function matchesScalar(actual, condition) {
|
|
if (condition && typeof condition === "object" && !Array.isArray(condition)) {
|
|
if (condition.in) return condition.in.includes(actual);
|
|
if (Object.prototype.hasOwnProperty.call(condition, "not") && actual === condition.not) return false;
|
|
if (condition.gte && actual < condition.gte) return false;
|
|
if (condition.lte && actual > condition.lte) return false;
|
|
return true;
|
|
}
|
|
return actual === condition;
|
|
}
|
|
|
|
function matchesWhere(row, where) {
|
|
if (!where || !Object.keys(where).length) return true;
|
|
if (where.AND) return where.AND.every((item) => matchesWhere(row, item));
|
|
if (where.OR) return where.OR.some((item) => matchesWhere(row, item));
|
|
return Object.entries(where).every(([key, condition]) => {
|
|
if (key === "participants") {
|
|
return row.participants.some((item) => matchesWhere(item, condition.some || {}));
|
|
}
|
|
if (key === "actions") {
|
|
return row.actions.some((item) => matchesWhere(item, condition.some || {}));
|
|
}
|
|
if (key === "reconcile_findings") {
|
|
return row.reconcile_findings.some((item) => matchesWhere(item, condition.some || {}));
|
|
}
|
|
return matchesScalar(row[key], condition);
|
|
});
|
|
}
|
|
|
|
function buildPrisma(rows) {
|
|
return {
|
|
employee: {
|
|
findMany: vi.fn(async ({ where }) => EMPLOYEES.filter((item) => {
|
|
if (where?.status && item.status !== where.status) return false;
|
|
if (where?.direct_manager_id && item.direct_manager_id !== where.direct_manager_id) return false;
|
|
return true;
|
|
}).map((item) => ({ id: item.id }))),
|
|
},
|
|
wecomApprovalArchive: {
|
|
count: vi.fn(async ({ where }) => rows.filter((row) => matchesWhere(row, where)).length),
|
|
findMany: vi.fn(async ({ where, skip = 0, take = 20 }) => rows.filter((row) => matchesWhere(row, where)).slice(skip, skip + take)),
|
|
findFirst: vi.fn(async ({ where }) => rows.find((row) => matchesWhere(row, where)) || null),
|
|
},
|
|
};
|
|
}
|
|
|
|
async function buildApp({ actor, rows }) {
|
|
const app = Fastify();
|
|
app.decorate("prisma", buildPrisma(rows));
|
|
app.decorate("authenticate", async (request) => {
|
|
request.employee = actor;
|
|
});
|
|
app.setErrorHandler((error, request, reply) => {
|
|
if (error instanceof AppError) {
|
|
return reply.status(error.statusCode).send({
|
|
requestId: request.id,
|
|
error: { code: error.code, message: error.message, details: error.details ?? {} },
|
|
});
|
|
}
|
|
return reply.status(500).send({
|
|
requestId: request.id,
|
|
error: { code: "SYS_001", message: error.message || "服务器内部错误", details: {} },
|
|
});
|
|
});
|
|
await app.register(wecomApprovalArchiveRoutes, { prefix: "/api" });
|
|
return app;
|
|
}
|
|
|
|
function actor(id, roleCodes = ["employee"], permissionCodes = ["leave.view_own", "attendance.view_own"]) {
|
|
return {
|
|
id,
|
|
roleCodes,
|
|
permissionCodes,
|
|
department_id: "department-a",
|
|
};
|
|
}
|
|
|
|
function responseText(response) {
|
|
return JSON.stringify(response.json());
|
|
}
|
|
|
|
describe("wecomApprovalArchive routes", () => {
|
|
beforeEach(() => {
|
|
global.fetch = vi.fn(async () => {
|
|
throw new Error("WeCom API must not be called by archive query");
|
|
});
|
|
});
|
|
|
|
afterEach(() => {
|
|
vi.restoreAllMocks();
|
|
});
|
|
|
|
it("lets normal employees see only self applicant, participant or action histories", async () => {
|
|
const rows = [
|
|
archiveRow({ id: "self-applicant", applicant_employee_id: EMPLOYEE_ID }),
|
|
archiveRow({ id: "participant-related", applicant_employee_id: OTHER_ID, participants: [participant(EMPLOYEE_ID)] }),
|
|
archiveRow({ id: "action-related", applicant_employee_id: OTHER_ID, actions: [action(EMPLOYEE_ID)] }),
|
|
archiveRow({ id: "other-applicant", applicant_employee_id: OTHER_ID }),
|
|
archiveRow({ id: "callback-only", applicant_employee_id: null, participants: [participant(null)], actions: [] }),
|
|
archiveRow({ id: "unmapped-applicant-participant", applicant_employee_id: null, participants: [participant(EMPLOYEE_ID)] }),
|
|
archiveRow({ id: "unmapped-applicant-action", applicant_employee_id: null, actions: [action(EMPLOYEE_ID)] }),
|
|
];
|
|
const app = await buildApp({ actor: actor(EMPLOYEE_ID), rows });
|
|
|
|
const response = await app.inject({ method: "GET", url: "/api/wecom/approval-archive" });
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
const ids = response.json().data.items.map((item) => item.id);
|
|
expect(ids).toEqual(["self-applicant", "participant-related", "action-related"]);
|
|
expect(global.fetch).not.toHaveBeenCalled();
|
|
await app.close();
|
|
});
|
|
|
|
it("requires an archive view permission even for self-related histories", async () => {
|
|
const rows = [archiveRow({ id: "self-applicant", applicant_employee_id: EMPLOYEE_ID })];
|
|
const app = await buildApp({ actor: actor(EMPLOYEE_ID, ["employee"], []), rows });
|
|
|
|
const listResponse = await app.inject({ method: "GET", url: "/api/wecom/approval-archive" });
|
|
const detailResponse = await app.inject({ method: "GET", url: "/api/wecom/approval-archive/self-applicant" });
|
|
|
|
expect(listResponse.statusCode).toBe(403);
|
|
expect(detailResponse.statusCode).toBe(403);
|
|
await app.close();
|
|
});
|
|
|
|
it("limits managers to direct-report applicant histories plus own related histories", async () => {
|
|
const rows = [
|
|
archiveRow({ id: "direct-report", applicant_employee_id: REPORT_ID }),
|
|
archiveRow({ id: "manager-related", applicant_employee_id: OTHER_ID, participants: [participant(MANAGER_ID)] }),
|
|
archiveRow({ id: "same-department-peer", applicant_employee_id: PEER_ID }),
|
|
archiveRow({ id: "unrelated", applicant_employee_id: OTHER_ID }),
|
|
];
|
|
const app = await buildApp({ actor: actor(MANAGER_ID, ["manager"], ["leave.view_all", "attendance.view_all"]), rows });
|
|
|
|
const response = await app.inject({ method: "GET", url: "/api/wecom/approval-archive?scope=team" });
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(response.json().data.items.map((item) => item.id)).toEqual(["direct-report", "manager-related"]);
|
|
await app.close();
|
|
});
|
|
|
|
it("does not treat finance leave or attendance view_all as global WeCom archive access", async () => {
|
|
const rows = [
|
|
archiveRow({ id: "finance-self", applicant_employee_id: FINANCE_ID }),
|
|
archiveRow({ id: "other-applicant", applicant_employee_id: OTHER_ID }),
|
|
];
|
|
const app = await buildApp({
|
|
actor: actor(FINANCE_ID, ["finance"], ["leave.view_all", "attendance.view_all"]),
|
|
rows,
|
|
});
|
|
|
|
const response = await app.inject({ method: "GET", url: "/api/wecom/approval-archive?scope=all" });
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(response.json().data.scope).toBe("self");
|
|
expect(response.json().data.items.map((item) => item.id)).toEqual(["finance-self"]);
|
|
await app.close();
|
|
});
|
|
|
|
it("allows HR/admin all-scope access including callback-only or unmapped records", async () => {
|
|
const rows = [
|
|
archiveRow({ id: "normal", applicant_employee_id: OTHER_ID }),
|
|
archiveRow({ id: "callback-only", applicant_employee_id: null, participants: [participant(null)], actions: [] }),
|
|
];
|
|
const app = await buildApp({ actor: actor(HR_ID, ["hr"], ["leave.view_all"]), rows });
|
|
|
|
const response = await app.inject({ method: "GET", url: "/api/wecom/approval-archive?scope=all" });
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(response.json().data.items.map((item) => item.id)).toEqual(["normal", "callback-only"]);
|
|
await app.close();
|
|
});
|
|
|
|
it("prevents employeeId filters and detail id guessing from bypassing authorization", async () => {
|
|
const rows = [
|
|
archiveRow({ id: "self-applicant", applicant_employee_id: EMPLOYEE_ID }),
|
|
archiveRow({ id: "other-applicant", applicant_employee_id: OTHER_ID }),
|
|
];
|
|
const app = await buildApp({ actor: actor(EMPLOYEE_ID), rows });
|
|
|
|
const listResponse = await app.inject({ method: "GET", url: `/api/wecom/approval-archive?employeeId=${OTHER_ID}` });
|
|
const detailResponse = await app.inject({ method: "GET", url: "/api/wecom/approval-archive/other-applicant" });
|
|
|
|
expect(listResponse.statusCode).toBe(200);
|
|
expect(listResponse.json().data.items).toEqual([]);
|
|
expect(detailResponse.statusCode).toBe(404);
|
|
await app.close();
|
|
});
|
|
|
|
it("returns whitelist-only redacted detail responses", async () => {
|
|
const rows = [
|
|
archiveRow({
|
|
id: "sensitive-detail",
|
|
applicant_employee_id: EMPLOYEE_ID,
|
|
participants: [participant(EMPLOYEE_ID)],
|
|
actions: [action(EMPLOYEE_ID)],
|
|
reconcile_findings: [{
|
|
id: "finding-1",
|
|
finding_type: "callback_missing_for_pulled_detail",
|
|
status: "open",
|
|
severity: "info",
|
|
source: "compensation_compare",
|
|
description: FULL_FIELD_VALUE,
|
|
detected_at: new Date("2026-05-19T11:00:00.000Z"),
|
|
resolved_at: null,
|
|
}],
|
|
}),
|
|
];
|
|
const app = await buildApp({ actor: actor(EMPLOYEE_ID), rows });
|
|
|
|
const response = await app.inject({ method: "GET", url: "/api/wecom/approval-archive/sensitive-detail" });
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
const text = responseText(response);
|
|
expect(text).not.toContain(FULL_SP_NO);
|
|
expect(text).not.toContain(FULL_TEMPLATE_ID);
|
|
expect(text).not.toContain(FULL_USER_ID);
|
|
expect(text).not.toContain(FULL_PHONE);
|
|
expect(text).not.toContain(FULL_EMAIL);
|
|
expect(text).not.toContain(FULL_FIELD_VALUE);
|
|
expect(text).not.toContain(FULL_COMMENT);
|
|
expect(text).not.toContain(FULL_SOURCE);
|
|
expect(text).not.toContain(FULL_ERROR);
|
|
expect(text).not.toContain("normalized_value");
|
|
expect(text).not.toContain("value_preview");
|
|
expect(text).not.toContain("comment_summary");
|
|
expect(text).not.toContain("source_summary");
|
|
expect(text).not.toContain("external_ref_summary");
|
|
expect(text).not.toContain("processing_error_message");
|
|
expect(text).not.toContain("error_message");
|
|
await app.close();
|
|
});
|
|
});
|