feat(P15A-1,P15A-5): 解耦请假审批权限

server/src/constants/permissions.js

@@ -1,4 +1,4 @@
-const EMPLOYEE_BASE_PERMISSIONS = [
+const EXPENSE_SELF_SERVICE_PERMISSIONS = [
   "expense.create",
   "expense.view_own",
   "expense.edit_own",
@@ -10,6 +10,50 @@ const EMPLOYEE_BASE_PERMISSIONS = [
   "expense.proxy_manage",
 ];
 
+const LEAVE_SELF_SERVICE_PERMISSIONS = [
+  "leave.create",
+  "leave.view_own",
+  "leave.submit",
+];
+
+const EMPLOYEE_BASE_PERMISSIONS = [
+  ...EXPENSE_SELF_SERVICE_PERMISSIONS,
+  ...LEAVE_SELF_SERVICE_PERMISSIONS,
+];
+
+const ENTITY_PERMISSION_MAP = {
+  reimbursement: {
+    create: "expense.create",
+    view_own: "expense.view_own",
+    view_all: "expense.view_all",
+    edit_own: "expense.edit_own",
+    delete_own: "expense.delete_own",
+    submit: "expense.submit",
+    withdraw: "expense.withdraw",
+    approve: "expense.approve",
+    transfer: "expense.transfer",
+  },
+  expense: {
+    create: "expense.create",
+    view_own: "expense.view_own",
+    view_all: "expense.view_all",
+    edit_own: "expense.edit_own",
+    delete_own: "expense.delete_own",
+    submit: "expense.submit",
+    withdraw: "expense.withdraw",
+    approve: "expense.approve",
+    transfer: "expense.transfer",
+  },
+  leave: {
+    create: "leave.create",
+    view_own: "leave.view_own",
+    view_all: "leave.view_all",
+    submit: "leave.submit",
+    approve: "leave.approve",
+    manage: "leave.manage",
+  },
+};
+
 const ROLE_PERMISSIONS = {
   employee: EMPLOYEE_BASE_PERMISSIONS,
   manager: [
@@ -17,6 +61,7 @@ const ROLE_PERMISSIONS = {
     "expense.approve",
     "expense.transfer",
     "expense.view_all",
+    "leave.approve",
     "report.dashboard.view",
     "budget.view",
     "budget.manage",
@@ -26,6 +71,8 @@ const ROLE_PERMISSIONS = {
     "expense.approve",
     "expense.transfer",
     "expense.view_all",
+    "leave.approve",
+    "leave.view_all",
     "report.dashboard.view",
     "budget.view",
   ],
@@ -57,16 +104,17 @@ const ROLE_PERMISSIONS = {
   ],
   administration: [
     "expense.proxy_submit",
-    "expense.create",
-    "expense.view_own",
-    "expense.edit_own",
-    "expense.delete_own",
-    "expense.submit",
-    "expense.withdraw",
-    "invoice.upload",
-    "invoice.view_own",
+    ...EMPLOYEE_BASE_PERMISSIONS,
+  ],
+  hr: [
+    ...LEAVE_SELF_SERVICE_PERMISSIONS,
+    "leave.view_all",
+    "leave.manage",
+    "system.users",
+    "system.users_sensitive",
+    "expense.view_all",
+    "report.dashboard.view",
   ],
-  hr: ["system.users", "system.users_sensitive", "expense.view_all", "report.dashboard.view"],
   admin: ["*"],
 };
 
@@ -90,8 +138,13 @@ function hasPermission(permissionCodes, permission) {
   return permissionCodes.includes("*") || permissionCodes.includes(permission);
 }
 
+function resolveEntityPermission(entityType, action) {
+  return ENTITY_PERMISSION_MAP[entityType]?.[action] ?? null;
+}
+
 module.exports = {
   ROLE_PERMISSIONS,
   resolvePermissionsForRoles,
   hasPermission,
+  resolveEntityPermission,
 };