wangsli
1f8d5b658a
汇总已落盘的借款本金与还款、兼容历史编号的周期化编号、付款责任与回单核验、报销进度和排序、PWA/采购事务、错误原因与日期校验及ERP退役。 统一共享预算池锁序和锁后判断，恢复差旅原预算选择，补原因码固定夹具及反向完整性检查。 纳入配套迁移、测试、受管QA、分层验收合同、规约及任务记录；原始证据留在ignored artifacts。 关联任务：09-17-company-loan-principal-repayment、09-17-erp-exclusive-retirement、09-18-reimbursement-periodic-numbering、09-08-reimbursement-payment-closeout、09-18-local-concurrency-product-fixes、09-19-budget-pool-concurrency、09-05-error-explainability-payment-readiness。 预算补审由Claude定向验证2文件928项通过，原4446/28及r6结果仍仅对应各自历史输入；本轮未重跑测试。 完整新候选门禁、R1真实入口接入与12项公网义务仍开放。生产编号未启用、差旅仍冻结；不推送、不部署，不宣称发布资格。
333 行
12 KiB
JavaScript
333 行
12 KiB
JavaScript
const Fastify = require("fastify");
|
|
|
|
const usersRoutes = require("../../../src/routes/users");
|
|
const { AppError } = require("../../../src/utils/AppError");
|
|
|
|
function buildEmployeeRow(overrides = {}) {
|
|
const now = new Date("2026-03-28T10:00:00.000Z");
|
|
return {
|
|
id: "11111111-1111-4111-8111-111111111111",
|
|
employee_no: "E001",
|
|
name: "Alice",
|
|
phone: "13800000000",
|
|
email: "[email protected]",
|
|
status: "active",
|
|
department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
|
|
title: "员工",
|
|
created_at: now,
|
|
updated_at: now,
|
|
roles: [{ role_code: "employee" }],
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
async function buildApp({ routeOptions = {}, employee } = {}) {
|
|
const app = Fastify();
|
|
const findMany = vi.fn().mockResolvedValue([buildEmployeeRow()]);
|
|
const count = vi.fn().mockResolvedValue(1);
|
|
const actor =
|
|
employee ??
|
|
{
|
|
id: "actor-1",
|
|
department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
|
|
permissionCodes: ["system.accounts.manage"],
|
|
};
|
|
|
|
app.decorate("prisma", {
|
|
employee: {
|
|
findMany,
|
|
count,
|
|
},
|
|
});
|
|
app.decorate("requirePermission", (permissionCode) => async (request) => {
|
|
request.employee = actor;
|
|
const permissionCodes = actor.permissionCodes ?? [];
|
|
if (!permissionCodes.includes("*") && !permissionCodes.includes(permissionCode)) {
|
|
throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
|
|
}
|
|
});
|
|
app.decorate("authenticate", async (request) => {
|
|
request.employee = actor;
|
|
});
|
|
app.decorate("hasPermission", (requestEmployee, permissionCode) => {
|
|
const permissionCodes = requestEmployee.permissionCodes ?? [];
|
|
return permissionCodes.includes("*") || permissionCodes.includes(permissionCode);
|
|
});
|
|
app.decorate("assertPermission", (requestEmployee, permissionCode) => {
|
|
const permissionCodes = requestEmployee.permissionCodes ?? [];
|
|
if (!permissionCodes.includes("*") && !permissionCodes.includes(permissionCode)) {
|
|
throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
|
|
}
|
|
return permissionCode;
|
|
});
|
|
app.decorate("config", {});
|
|
|
|
app.setErrorHandler((error, request, reply) => {
|
|
if (error instanceof AppError) {
|
|
return reply.status(error.statusCode).send({
|
|
error: { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) },
|
|
});
|
|
}
|
|
return reply.status(500).send({ error: { code: "SYS_001" } });
|
|
});
|
|
|
|
await app.register(usersRoutes, { prefix: "/api", ...routeOptions });
|
|
return { app, findMany, count };
|
|
}
|
|
|
|
describe("usersRoutes list query", () => {
|
|
it("supports departmentId filter for /employees when enabled", async () => {
|
|
const departmentId = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
|
|
const { app, findMany, count } = await buildApp({
|
|
routeOptions: {
|
|
basePath: "/employees",
|
|
allowDepartmentFilter: true,
|
|
},
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "GET",
|
|
url: `/api/employees?page=1&pageSize=20&departmentId=${departmentId}`,
|
|
});
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(findMany).toHaveBeenCalledWith(
|
|
expect.objectContaining({
|
|
where: expect.objectContaining({
|
|
department_id: departmentId,
|
|
}),
|
|
}),
|
|
);
|
|
expect(count).toHaveBeenCalledWith({
|
|
where: expect.objectContaining({
|
|
department_id: departmentId,
|
|
}),
|
|
});
|
|
|
|
await app.close();
|
|
});
|
|
|
|
it("combines q + status + departmentId for /employees", async () => {
|
|
const departmentId = "cccccccc-cccc-4ccc-8ccc-cccccccccccc";
|
|
const { app, findMany } = await buildApp({
|
|
routeOptions: {
|
|
basePath: "/employees",
|
|
allowDepartmentFilter: true,
|
|
},
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "GET",
|
|
url: `/api/employees?status=active&q=alice&departmentId=${departmentId}`,
|
|
});
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(findMany).toHaveBeenCalledWith(
|
|
expect.objectContaining({
|
|
where: expect.objectContaining({
|
|
status: "active",
|
|
department_id: departmentId,
|
|
AND: expect.arrayContaining([
|
|
expect.objectContaining({
|
|
OR: expect.arrayContaining([
|
|
expect.objectContaining({ name: expect.any(Object) }),
|
|
expect.objectContaining({ employee_no: expect.any(Object) }),
|
|
]),
|
|
}),
|
|
]),
|
|
}),
|
|
}),
|
|
);
|
|
|
|
await app.close();
|
|
});
|
|
|
|
it("supports advanced filters and report.dashboard.view for /employees", async () => {
|
|
const departmentId = "eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee";
|
|
const managerId = "ffffffff-ffff-4fff-8fff-ffffffffffff";
|
|
const { app, findMany, count } = await buildApp({
|
|
routeOptions: {
|
|
basePath: "/employees",
|
|
allowDepartmentFilter: true,
|
|
listPermissionCodes: ["system.users", "report.dashboard.view"],
|
|
},
|
|
employee: {
|
|
id: "viewer-1",
|
|
department_id: departmentId,
|
|
permissionCodes: ["report.dashboard.view"],
|
|
},
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "GET",
|
|
url: `/api/employees?page=1&pageSize=20&departmentId=${departmentId}&title=%E7%BB%8F%E7%90%86&managerId=${managerId}&hireDateFrom=2026-01-01&hireDateTo=2026-01-31&employmentStatus=probation`,
|
|
});
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(findMany).toHaveBeenCalledWith(
|
|
expect.objectContaining({
|
|
where: expect.objectContaining({
|
|
department_id: departmentId,
|
|
direct_manager_id: managerId,
|
|
employment_status: "probation",
|
|
hire_date: expect.objectContaining({
|
|
gte: new Date("2026-01-01T00:00:00.000Z"),
|
|
lte: new Date("2026-01-31T23:59:59.999Z"),
|
|
}),
|
|
AND: expect.arrayContaining([
|
|
expect.objectContaining({
|
|
title: expect.objectContaining({
|
|
contains: "经理",
|
|
}),
|
|
}),
|
|
]),
|
|
}),
|
|
}),
|
|
);
|
|
expect(count).toHaveBeenCalledWith({
|
|
where: expect.objectContaining({
|
|
department_id: departmentId,
|
|
direct_manager_id: managerId,
|
|
}),
|
|
});
|
|
|
|
await app.close();
|
|
});
|
|
|
|
it("does not apply departmentId filter for /users", async () => {
|
|
const departmentId = "dddddddd-dddd-4ddd-8ddd-dddddddddddd";
|
|
const { app, findMany } = await buildApp();
|
|
|
|
const response = await app.inject({
|
|
method: "GET",
|
|
url: `/api/users?departmentId=${departmentId}`,
|
|
});
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
const where = findMany.mock.calls[0][0].where;
|
|
expect(where.department_id).toBeUndefined();
|
|
|
|
await app.close();
|
|
});
|
|
|
|
it("returns a minimal directory DTO and does not select or search contact fields", async () => {
|
|
const { app, findMany } = await buildApp({
|
|
routeOptions: {
|
|
basePath: "/employees",
|
|
allowDepartmentFilter: true,
|
|
directoryOnly: true,
|
|
managementPermissionCode: "system.users",
|
|
listPermissionCodes: ["expense.view_own"],
|
|
},
|
|
employee: {
|
|
id: "viewer-1",
|
|
department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
|
|
permissionCodes: ["expense.view_own"],
|
|
},
|
|
});
|
|
|
|
const response = await app.inject({ method: "GET", url: "/api/employees?q=alice" });
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(response.json().data.items[0]).toEqual({
|
|
id: "11111111-1111-4111-8111-111111111111",
|
|
employeeNo: "E001",
|
|
name: "Alice",
|
|
title: "员工",
|
|
status: "active",
|
|
department: null,
|
|
avatarUrl: null,
|
|
});
|
|
const query = findMany.mock.calls[0][0];
|
|
expect(query.select).toEqual({
|
|
id: true,
|
|
employee_no: true,
|
|
name: true,
|
|
title: true,
|
|
status: true,
|
|
avatar_path: true,
|
|
department: { select: { id: true, name: true } },
|
|
});
|
|
const searchFields = query.where.AND[0].OR.map((item) => Object.keys(item)[0]);
|
|
expect(searchFields).toEqual(["employee_no", "name"]);
|
|
|
|
await app.close();
|
|
});
|
|
|
|
it("rejects management scope before directory queries without the personnel permission", async () => {
|
|
const { app, findMany, count } = await buildApp({
|
|
routeOptions: {
|
|
basePath: "/employees",
|
|
allowDepartmentFilter: true,
|
|
directoryOnly: true,
|
|
managementPermissionCode: "system.users",
|
|
listPermissionCodes: ["expense.view_own"],
|
|
},
|
|
employee: {
|
|
id: "system-admin-1",
|
|
department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
|
|
permissionCodes: ["expense.view_own", "system.accounts.manage"],
|
|
},
|
|
});
|
|
|
|
const response = await app.inject({ method: "GET", url: "/api/employees?scope=management" });
|
|
|
|
expect(response.statusCode).toBe(403);
|
|
expect(findMany).not.toHaveBeenCalled();
|
|
expect(count).not.toHaveBeenCalled();
|
|
await app.close();
|
|
});
|
|
});
|
|
|
|
|
|
describe("employee directory calendar filters", () => {
|
|
const routes = ["/users", "/employees"];
|
|
it.each(routes.flatMap((route) => ["hireDateFrom", "hireDateTo"].flatMap((field) => ["2026-02-29", "2026-04-31", "2026-13-01", ""].map((date) => [route, field, date]))))("rejects %s %s=%s before employee queries", async (route, field, date) => {
|
|
const { app, findMany, count } = await buildApp({ routeOptions: { basePath: route, allowDepartmentFilter: route === "/employees" } });
|
|
try {
|
|
const response = await app.inject({ method: "GET", url: `/api${route}?${field}=${date}` });
|
|
expect(response.statusCode).toBe(400);
|
|
expect(response.json().error).toMatchObject({ code: "VALID_001", details: { reasonCode: "employee_directory.query_invalid", formErrors: [], fieldErrors: { [field]: expect.arrayContaining(["invalid_calendar_date"]) } } });
|
|
expect(findMany).not.toHaveBeenCalled();
|
|
expect(count).not.toHaveBeenCalled();
|
|
} finally { await app.close(); }
|
|
});
|
|
it.each(routes)("preserves leap-day/month-end UTC range on %s", async (route) => {
|
|
const { app, findMany } = await buildApp({ routeOptions: { basePath: route } });
|
|
try {
|
|
const response = await app.inject({ method: "GET", url: `/api${route}?hireDateFrom=2024-02-29&hireDateTo=2024-04-30` });
|
|
expect(response.statusCode).toBe(200);
|
|
expect(findMany.mock.calls[0][0].where.hire_date).toEqual({ gte: new Date("2024-02-29T00:00:00.000Z"), lte: new Date("2024-04-30T23:59:59.999Z") });
|
|
} finally { await app.close(); }
|
|
});
|
|
it.each(routes)("keeps reversed-range rejection on %s", async (route) => {
|
|
const { app, findMany, count } = await buildApp({ routeOptions: { basePath: route } });
|
|
try {
|
|
const response = await app.inject({ method: "GET", url: `/api${route}?hireDateFrom=2024-05-01&hireDateTo=2024-04-30` });
|
|
expect(response.statusCode).toBe(400);
|
|
expect(response.json().error.details).toEqual({ reasonCode: "employee_directory.hire_date_range_invalid", hireDateTo: "must_be_after_or_equal_hireDateFrom" });
|
|
expect(findMany).not.toHaveBeenCalled();
|
|
expect(count).not.toHaveBeenCalled();
|
|
} finally { await app.close(); }
|
|
});
|
|
it.each(routes)("does not grant access with valid dates on %s", async (route) => {
|
|
const { app, findMany, count } = await buildApp({ routeOptions: { basePath: route }, employee: { id: "synthetic-denied", permissionCodes: [] } });
|
|
try {
|
|
const response = await app.inject({ method: "GET", url: `/api${route}?hireDateFrom=2024-02-29` });
|
|
expect(response.statusCode).toBe(403);
|
|
expect(findMany).not.toHaveBeenCalled();
|
|
expect(count).not.toHaveBeenCalled();
|
|
} finally { await app.close(); }
|
|
});
|
|
});
|
|
|
|
it.each(["/users", "/employees"])("explains invalid pagination for %s before queries", async (basePath) => {
|
|
const { app, findMany, count } = await buildApp({ routeOptions: { basePath, allowDepartmentFilter: true } });
|
|
try {
|
|
const response = await app.inject({ method: "GET", url: `/api${basePath}?page=0` });
|
|
expect(response.statusCode).toBe(400);
|
|
expect(response.json().error).toMatchObject({ code: "VALID_001", details: { reasonCode: "user.list_query_invalid", formErrors: [], fieldErrors: { page: expect.any(Array) } } });
|
|
expect(findMany).not.toHaveBeenCalled(); expect(count).not.toHaveBeenCalled();
|
|
} finally { await app.close(); }
|
|
});
|