468 行
16 KiB
JavaScript
468 行
16 KiB
JavaScript
const fs = require("node:fs/promises");
|
|
const os = require("node:os");
|
|
const path = require("node:path");
|
|
|
|
const Fastify = require("fastify");
|
|
const multipart = require("@fastify/multipart");
|
|
|
|
const { AppError } = require("../../../src/utils/AppError");
|
|
const reimbursementRoutes = require("../../../src/routes/reimbursements");
|
|
|
|
function buildMultipartRequest({ files, fields = {} }) {
|
|
const boundary = "----codex-reimbursement-attachment-boundary";
|
|
const segments = [];
|
|
|
|
for (const [name, value] of Object.entries(fields)) {
|
|
segments.push(
|
|
Buffer.from(
|
|
`--${boundary}\r\nContent-Disposition: form-data; name="${name}"\r\n\r\n${value}\r\n`,
|
|
),
|
|
);
|
|
}
|
|
|
|
for (const file of files) {
|
|
segments.push(
|
|
Buffer.from(
|
|
`--${boundary}\r\nContent-Disposition: form-data; name="files"; filename="${file.filename}"\r\nContent-Type: ${file.contentType}\r\n\r\n`,
|
|
),
|
|
Buffer.isBuffer(file.content) ? file.content : Buffer.from(file.content, "utf8"),
|
|
Buffer.from("\r\n"),
|
|
);
|
|
}
|
|
|
|
segments.push(Buffer.from(`--${boundary}--\r\n`));
|
|
|
|
return {
|
|
payload: Buffer.concat(segments),
|
|
headers: {
|
|
"content-type": `multipart/form-data; boundary=${boundary}`,
|
|
},
|
|
};
|
|
}
|
|
|
|
async function buildApp({ reimbursementStatus = "draft" } = {}) {
|
|
const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "hyb-oa-r111-reimbursement-attachments-"));
|
|
const reimbursementId = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
|
|
const createdAttachments = [];
|
|
|
|
const prisma = {
|
|
reimbursementForm: {
|
|
findUnique: vi.fn().mockResolvedValue({
|
|
id: reimbursementId,
|
|
owner_id: "actor-1",
|
|
submitter_id: "actor-1",
|
|
status: reimbursementStatus,
|
|
}),
|
|
},
|
|
reimbursementAttachment: {
|
|
create: vi.fn().mockImplementation(async ({ data, select }) => {
|
|
const created = {
|
|
id: `bbbbbbbb-bbbb-4bbb-8bbb-${String(createdAttachments.length + 1).padStart(12, "0")}`,
|
|
reimbursement_id: data.reimbursement_id,
|
|
original_name: data.original_name,
|
|
mime_type: data.mime_type,
|
|
file_size: data.file_size,
|
|
file_sha256: data.file_sha256,
|
|
governance_status: data.governance_status,
|
|
sensitivity_level: data.sensitivity_level,
|
|
attachment_type: data.attachment_type,
|
|
reviewed_by: data.reviewed_by ?? null,
|
|
reviewed_at: data.reviewed_at ?? null,
|
|
review_note: data.review_note ?? null,
|
|
archived_by: data.archived_by ?? null,
|
|
archived_at: data.archived_at ?? null,
|
|
archive_note: data.archive_note ?? null,
|
|
download_policy: data.download_policy,
|
|
storage_path: data.storage_path,
|
|
created_at: new Date("2026-05-08T08:00:00.000Z"),
|
|
uploader: {
|
|
id: "actor-1",
|
|
employee_no: "E001",
|
|
name: "测试用户",
|
|
},
|
|
};
|
|
createdAttachments.push(created);
|
|
if (!select) {
|
|
return created;
|
|
}
|
|
return created;
|
|
}),
|
|
deleteMany: vi.fn().mockImplementation(async ({ where }) => {
|
|
const index = createdAttachments.findIndex(
|
|
(item) => item.id === where.id && item.reimbursement_id === where.reimbursement_id,
|
|
);
|
|
if (index < 0) {
|
|
return { count: 0 };
|
|
}
|
|
createdAttachments.splice(index, 1);
|
|
return { count: 1 };
|
|
}),
|
|
findFirst: vi.fn().mockImplementation(async ({ where }) => {
|
|
const item = createdAttachments.find(
|
|
(candidate) => candidate.id === where.id && candidate.reimbursement_id === where.reimbursement_id,
|
|
);
|
|
if (!item) {
|
|
return null;
|
|
}
|
|
return {
|
|
id: item.id,
|
|
storage_path: item.storage_path,
|
|
original_name: item.original_name,
|
|
mime_type: item.mime_type,
|
|
governance_status: item.governance_status,
|
|
sensitivity_level: item.sensitivity_level,
|
|
attachment_type: item.attachment_type,
|
|
download_policy: item.download_policy,
|
|
reimbursement_form: {
|
|
owner_id: "actor-1",
|
|
submitter_id: "actor-1",
|
|
},
|
|
};
|
|
}),
|
|
},
|
|
auditLog: {
|
|
create: vi.fn().mockResolvedValue({ id: "audit-1" }),
|
|
},
|
|
$queryRaw: vi.fn().mockResolvedValue([
|
|
{
|
|
id: reimbursementId,
|
|
owner_id: "actor-1",
|
|
submitter_id: "actor-1",
|
|
status: reimbursementStatus,
|
|
},
|
|
]),
|
|
$transaction: vi.fn().mockImplementation(async (callback) => callback(prisma)),
|
|
};
|
|
|
|
const app = Fastify();
|
|
app.decorate("prisma", prisma);
|
|
app.decorate("config", {
|
|
appTimezone: "Asia/Shanghai",
|
|
storageDir: tempDir,
|
|
maxUploadSizeBytes: 5 * 1024 * 1024,
|
|
});
|
|
app.decorate("authenticate", async (request) => {
|
|
if (!request.headers.authorization) {
|
|
throw new AppError({ code: "AUTH_001", message: "未登录", statusCode: 401 });
|
|
}
|
|
request.employee = {
|
|
id: "actor-1",
|
|
roleCodes: ["employee"],
|
|
permissionCodes: ["expense.edit_own", "expense.view_own"],
|
|
};
|
|
});
|
|
app.decorate("hasPermission", (employee, permissionCode) => {
|
|
return (employee?.permissionCodes ?? []).includes("*") || (employee?.permissionCodes ?? []).includes(permissionCode);
|
|
});
|
|
app.decorate("requirePermission", (permissionCode) => async (request) => {
|
|
await app.authenticate(request);
|
|
if (!app.hasPermission(request.employee, permissionCode)) {
|
|
throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
|
|
}
|
|
});
|
|
app.setErrorHandler((error, request, reply) => {
|
|
if (error instanceof AppError) {
|
|
return reply.status(error.statusCode).send({
|
|
requestId: request.id,
|
|
error: {
|
|
code: error.code,
|
|
message: error.message,
|
|
details: error.details ?? {},
|
|
},
|
|
});
|
|
}
|
|
|
|
return reply.status(500).send({
|
|
requestId: request.id,
|
|
error: { code: "SYS_001", message: "服务器内部错误", details: {} },
|
|
});
|
|
});
|
|
|
|
await app.register(multipart, {
|
|
attachFieldsToBody: false,
|
|
limits: { files: 1, fileSize: 5 * 1024 * 1024 },
|
|
});
|
|
await app.register(reimbursementRoutes, { prefix: "/api" });
|
|
|
|
return { app, prisma, tempDir, reimbursementId, createdAttachments };
|
|
}
|
|
|
|
describe("reimbursement attachment routes", () => {
|
|
it("uploads five attachment materials with the production global one-file baseline", async () => {
|
|
const { app, prisma, tempDir, reimbursementId, createdAttachments } = await buildApp();
|
|
|
|
try {
|
|
const requestPayload = buildMultipartRequest({
|
|
files: [
|
|
{
|
|
filename: "contract.pdf",
|
|
contentType: "application/pdf",
|
|
content: "%PDF contract",
|
|
},
|
|
{
|
|
filename: "payment.png",
|
|
contentType: "image/png",
|
|
content: "png-content",
|
|
},
|
|
{
|
|
filename: "order.jpg",
|
|
contentType: "image/jpeg",
|
|
content: "jpg-content",
|
|
},
|
|
{
|
|
filename: "note.webp",
|
|
contentType: "image/webp",
|
|
content: "webp-content",
|
|
},
|
|
{
|
|
filename: "extra.pdf",
|
|
contentType: "application/pdf",
|
|
content: "%PDF extra",
|
|
},
|
|
],
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "POST",
|
|
url: `/api/reimbursements/${reimbursementId}/attachments`,
|
|
headers: {
|
|
authorization: "Bearer test",
|
|
...requestPayload.headers,
|
|
},
|
|
payload: requestPayload.payload,
|
|
});
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(response.json().data.items).toHaveLength(5);
|
|
expect(response.json().data.items[0]).toEqual(
|
|
expect.objectContaining({
|
|
originalName: "contract.pdf",
|
|
mimeType: "application/pdf",
|
|
governanceStatus: "approved",
|
|
sensitivityLevel: "internal",
|
|
attachmentType: "supporting_material",
|
|
downloadPolicy: "standard",
|
|
uploadedBy: expect.objectContaining({ name: "测试用户" }),
|
|
}),
|
|
);
|
|
expect(prisma.reimbursementAttachment.create).toHaveBeenCalledTimes(5);
|
|
expect(prisma.auditLog.create).toHaveBeenCalledWith(
|
|
expect.objectContaining({
|
|
data: expect.objectContaining({
|
|
action: "REIMBURSEMENT_ATTACHMENTS_UPLOADED",
|
|
target_id: reimbursementId,
|
|
extra: expect.objectContaining({
|
|
attachmentType: "supporting_material",
|
|
sensitivityLevel: "internal",
|
|
}),
|
|
}),
|
|
}),
|
|
);
|
|
|
|
for (const attachment of createdAttachments) {
|
|
const storedBuffer = await fs.readFile(path.join(tempDir, attachment.storage_path));
|
|
expect(storedBuffer.length).toBeGreaterThan(0);
|
|
}
|
|
} finally {
|
|
await app.close();
|
|
await fs.rm(tempDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("returns a stable validation error when a request contains six files", async () => {
|
|
const { app, prisma, tempDir, reimbursementId } = await buildApp();
|
|
|
|
try {
|
|
const requestPayload = buildMultipartRequest({
|
|
files: Array.from({ length: 6 }, (_, index) => ({
|
|
filename: `attachment-${index + 1}.pdf`,
|
|
contentType: "application/pdf",
|
|
content: `%PDF attachment ${index + 1}`,
|
|
})),
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "POST",
|
|
url: `/api/reimbursements/${reimbursementId}/attachments`,
|
|
headers: {
|
|
authorization: "Bearer test",
|
|
...requestPayload.headers,
|
|
},
|
|
payload: requestPayload.payload,
|
|
});
|
|
|
|
expect(response.statusCode).toBe(400);
|
|
expect(response.json().error).toMatchObject({
|
|
code: "VALID_001",
|
|
details: { file: "too_many_files", maxFiles: 5 },
|
|
});
|
|
expect(prisma.reimbursementAttachment.create).not.toHaveBeenCalled();
|
|
expect(prisma.auditLog.create).not.toHaveBeenCalled();
|
|
} finally {
|
|
await app.close();
|
|
await fs.rm(tempDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("rejects attachment upload after reimbursement leaves editable status", async () => {
|
|
const { app, prisma, tempDir, reimbursementId } = await buildApp({ reimbursementStatus: "reviewing" });
|
|
|
|
try {
|
|
const requestPayload = buildMultipartRequest({
|
|
files: [
|
|
{
|
|
filename: "contract.pdf",
|
|
contentType: "application/pdf",
|
|
content: "%PDF contract",
|
|
},
|
|
],
|
|
});
|
|
|
|
const response = await app.inject({
|
|
method: "POST",
|
|
url: `/api/reimbursements/${reimbursementId}/attachments`,
|
|
headers: {
|
|
authorization: "Bearer test",
|
|
...requestPayload.headers,
|
|
},
|
|
payload: requestPayload.payload,
|
|
});
|
|
|
|
expect(response.statusCode).toBe(409);
|
|
expect(response.json().error.details).toEqual({ status: "invalid_attachment_edit_status" });
|
|
expect(prisma.reimbursementAttachment.create).not.toHaveBeenCalled();
|
|
} finally {
|
|
await app.close();
|
|
await fs.rm(tempDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("downloads and deletes draft attachment materials", async () => {
|
|
const { app, prisma, tempDir, reimbursementId, createdAttachments } = await buildApp();
|
|
|
|
try {
|
|
const requestPayload = buildMultipartRequest({
|
|
files: [
|
|
{
|
|
filename: "payment.png",
|
|
contentType: "image/png",
|
|
content: "png-content",
|
|
},
|
|
],
|
|
});
|
|
|
|
const uploadResponse = await app.inject({
|
|
method: "POST",
|
|
url: `/api/reimbursements/${reimbursementId}/attachments`,
|
|
headers: {
|
|
authorization: "Bearer test",
|
|
...requestPayload.headers,
|
|
},
|
|
payload: requestPayload.payload,
|
|
});
|
|
|
|
expect(uploadResponse.statusCode).toBe(200);
|
|
const attachmentId = uploadResponse.json().data.items[0].id;
|
|
|
|
const downloadResponse = await app.inject({
|
|
method: "GET",
|
|
url: `/api/reimbursements/${reimbursementId}/attachments/${attachmentId}/file`,
|
|
headers: { authorization: "Bearer test" },
|
|
});
|
|
|
|
expect(downloadResponse.statusCode).toBe(200);
|
|
expect(downloadResponse.headers["content-type"]).toContain("image/png");
|
|
expect(downloadResponse.headers["content-disposition"]).toBe(
|
|
"inline; filename=\"payment.png\"; filename*=UTF-8''payment.png",
|
|
);
|
|
expect(downloadResponse.body).toBe("png-content");
|
|
|
|
const deleteResponse = await app.inject({
|
|
method: "DELETE",
|
|
url: `/api/reimbursements/${reimbursementId}/attachments/${attachmentId}`,
|
|
headers: { authorization: "Bearer test", "content-type": "application/json" },
|
|
payload: { reason: "重复上传" },
|
|
});
|
|
|
|
expect(deleteResponse.statusCode).toBe(200);
|
|
expect(deleteResponse.json().data).toEqual({
|
|
attachmentId,
|
|
outcome: "deleted",
|
|
});
|
|
expect(prisma.reimbursementAttachment.deleteMany).toHaveBeenCalledWith({
|
|
where: {
|
|
id: attachmentId,
|
|
reimbursement_id: reimbursementId,
|
|
},
|
|
});
|
|
expect(prisma.auditLog.create).toHaveBeenLastCalledWith(
|
|
expect.objectContaining({
|
|
data: expect.objectContaining({
|
|
action: "REIMBURSEMENT_ATTACHMENT_DELETED",
|
|
target_id: attachmentId,
|
|
extra: expect.objectContaining({ reimbursementId, reason: "重复上传" }),
|
|
}),
|
|
}),
|
|
);
|
|
expect(createdAttachments).toHaveLength(0);
|
|
} finally {
|
|
await app.close();
|
|
await fs.rm(tempDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("returns Chinese attachment names through a safe inline Content-Disposition", async () => {
|
|
const { app, tempDir, reimbursementId, createdAttachments } = await buildApp();
|
|
|
|
try {
|
|
const requestPayload = buildMultipartRequest({
|
|
files: [{ filename: "payment.pdf", contentType: "application/pdf", content: "%PDF payment" }],
|
|
});
|
|
const uploadResponse = await app.inject({
|
|
method: "POST",
|
|
url: `/api/reimbursements/${reimbursementId}/attachments`,
|
|
headers: { authorization: "Bearer test", ...requestPayload.headers },
|
|
payload: requestPayload.payload,
|
|
});
|
|
const attachmentId = uploadResponse.json().data.items[0].id;
|
|
createdAttachments[0].original_name = "支付截图.pdf";
|
|
|
|
const response = await app.inject({
|
|
method: "GET",
|
|
url: `/api/reimbursements/${reimbursementId}/attachments/${attachmentId}/file`,
|
|
headers: { authorization: "Bearer test" },
|
|
});
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(response.headers["content-disposition"]).toBe(
|
|
"inline; filename=\"attachment.pdf\"; filename*=UTF-8''%E6%94%AF%E4%BB%98%E6%88%AA%E5%9B%BE.pdf",
|
|
);
|
|
expect(response.headers["content-disposition"]).not.toContain("支付截图");
|
|
} finally {
|
|
await app.close();
|
|
await fs.rm(tempDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("rejects attachment deletion without a meaningful reason before mutation", async () => {
|
|
const { app, prisma, tempDir, reimbursementId } = await buildApp();
|
|
|
|
try {
|
|
const response = await app.inject({
|
|
method: "DELETE",
|
|
url: `/api/reimbursements/${reimbursementId}/attachments/bbbbbbbb-bbbb-4bbb-8bbb-000000000001`,
|
|
headers: { authorization: "Bearer test", "content-type": "application/json" },
|
|
payload: { reason: " " },
|
|
});
|
|
|
|
expect(response.statusCode).toBe(400);
|
|
expect(response.json().error.code).toBe("VALID_001");
|
|
expect(prisma.reimbursementAttachment.deleteMany).not.toHaveBeenCalled();
|
|
expect(prisma.auditLog.create).not.toHaveBeenCalled();
|
|
} finally {
|
|
await app.close();
|
|
await fs.rm(tempDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
});
|