wangsli
1f8d5b658a
汇总已落盘的借款本金与还款、兼容历史编号的周期化编号、付款责任与回单核验、报销进度和排序、PWA/采购事务、错误原因与日期校验及ERP退役。 统一共享预算池锁序和锁后判断，恢复差旅原预算选择，补原因码固定夹具及反向完整性检查。 纳入配套迁移、测试、受管QA、分层验收合同、规约及任务记录；原始证据留在ignored artifacts。 关联任务：09-17-company-loan-principal-repayment、09-17-erp-exclusive-retirement、09-18-reimbursement-periodic-numbering、09-08-reimbursement-payment-closeout、09-18-local-concurrency-product-fixes、09-19-budget-pool-concurrency、09-05-error-explainability-payment-readiness。 预算补审由Claude定向验证2文件928项通过，原4446/28及r6结果仍仅对应各自历史输入；本轮未重跑测试。 完整新候选门禁、R1真实入口接入与12项公网义务仍开放。生产编号未启用、差旅仍冻结；不推送、不部署，不宣称发布资格。
71 行
4.3 KiB
JavaScript
71 行
4.3 KiB
JavaScript
const Fastify = require("fastify");
|
|
const exportsRoutes = require("../../../src/routes/exports");
|
|
const { AppError } = require("../../../src/utils/AppError");
|
|
|
|
async function buildApp({ allowed = true } = {}) {
|
|
const app = Fastify();
|
|
const actor = { id: "synthetic-viewer", roleCodes: ["finance"], permissionCodes: allowed ? ["report.dashboard.view"] : [] };
|
|
const prisma = {
|
|
reimbursementForm: { count: vi.fn().mockResolvedValue(0), findMany: vi.fn().mockResolvedValue([]) },
|
|
auditLog: { create: vi.fn() },
|
|
};
|
|
app.decorate("prisma", prisma);
|
|
app.decorate("authenticate", async (request) => { request.employee = actor; });
|
|
app.decorate("hasPermission", (employee, permission) => employee.permissionCodes.includes(permission));
|
|
app.decorate("requirePermission", (permission) => async (request) => {
|
|
request.employee = actor;
|
|
if (!actor.permissionCodes.includes(permission)) throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
|
|
});
|
|
app.setErrorHandler((error, request, reply) => reply.status(error.statusCode || 500).send({ error: { code: error.code, details: error.details } }));
|
|
await app.register(exportsRoutes, { prefix: "/api" });
|
|
return { app, prisma };
|
|
}
|
|
|
|
describe("dashboard export calendar contract", () => {
|
|
it.each(["csv", "xlsx"].flatMap((format) => ["dateFrom", "dateTo"].flatMap((field) => ["2026-02-29", "2026-04-31", "2026-13-01", ""].map((date) => [format, field, date]))))("rejects %s %s=%s before reads or export audit", async (format, field, date) => {
|
|
const { app, prisma } = await buildApp();
|
|
try {
|
|
const response = await app.inject({ method: "GET", url: `/api/exports/dashboard/reimbursements?format=${format}&${field}=${date}` });
|
|
expect(response.statusCode).toBe(400);
|
|
expect(response.json().error.details.fieldErrors[field].length).toBeGreaterThan(0);
|
|
expect(prisma.reimbursementForm.count).not.toHaveBeenCalled();
|
|
expect(prisma.reimbursementForm.findMany).not.toHaveBeenCalled();
|
|
expect(prisma.auditLog.create).not.toHaveBeenCalled();
|
|
expect(response.headers["content-disposition"]).toBeUndefined();
|
|
} finally { await app.close(); }
|
|
});
|
|
|
|
it.each(["csv", "xlsx"])("preserves %s leap-day/month-end UTC bounds", async (format) => {
|
|
const { app, prisma } = await buildApp();
|
|
try {
|
|
const response = await app.inject({ method: "GET", url: `/api/exports/dashboard/reimbursements?format=${format}&dateFrom=2024-02-29&dateTo=2024-04-30` });
|
|
expect(response.statusCode).toBe(200);
|
|
expect(prisma.reimbursementForm.count.mock.calls[0][0].where.AND).toContainEqual({ reimbursement_date: { gte: new Date("2024-02-29T00:00:00.000Z"), lte: new Date("2024-04-30T23:59:59.999Z") } });
|
|
expect(prisma.auditLog.create).toHaveBeenCalledTimes(1);
|
|
} finally { await app.close(); }
|
|
});
|
|
|
|
it("preserves omitted dates and reversed-range status/details", async () => {
|
|
const { app, prisma } = await buildApp();
|
|
try {
|
|
const omitted = await app.inject({ method: "GET", url: "/api/exports/dashboard/reimbursements" });
|
|
expect(omitted.statusCode).toBe(200);
|
|
expect(prisma.reimbursementForm.count.mock.calls[0][0].where.AND.some((clause) => Object.hasOwn(clause, "reimbursement_date"))).toBe(false);
|
|
for (const fn of [...Object.values(prisma.reimbursementForm), prisma.auditLog.create]) fn.mockClear();
|
|
const reversed = await app.inject({ method: "GET", url: "/api/exports/dashboard/reimbursements?dateFrom=2024-05-01&dateTo=2024-04-30" });
|
|
expect(reversed.statusCode).toBe(400);
|
|
expect(reversed.json().error.details).toEqual({ dateTo: "must_be_after_dateFrom", reasonCode: "export.dashboard_date_range_invalid" });
|
|
for (const fn of [...Object.values(prisma.reimbursementForm), prisma.auditLog.create]) expect(fn).not.toHaveBeenCalled();
|
|
} finally { await app.close(); }
|
|
});
|
|
|
|
it("preserves permission rejection without export reads", async () => {
|
|
const { app, prisma } = await buildApp({ allowed: false });
|
|
try {
|
|
const response = await app.inject({ method: "GET", url: "/api/exports/dashboard/reimbursements?dateFrom=2024-02-29" });
|
|
expect(response.statusCode).toBe(403);
|
|
for (const fn of [...Object.values(prisma.reimbursementForm), prisma.auditLog.create]) expect(fn).not.toHaveBeenCalled();
|
|
} finally { await app.close(); }
|
|
});
|
|
});
|