feat(P15A-1,P15A-5): 解耦请假审批权限

server/src/routes/leave.js

@@ -95,7 +95,8 @@ async function leaveRoutes(fastify) {
   fastify.post(
     "/leave-requests",
     {
-      preHandler: fastify.authenticate,
+      schema: { tags: ["Leave"], summary: "Create Leave Request" },
+      preHandler: fastify.requireEntityPermission("leave", "create"),
     },
     async (request, reply) => {
       const body = parseCreateBody(request.body);
@@ -131,6 +132,7 @@ async function leaveRoutes(fastify) {
   fastify.get(
     "/leave-requests/:id",
     {
+      schema: { tags: ["Leave"], summary: "Get Leave Request" },
       preHandler: fastify.authenticate,
     },
     async (request, reply) => {
@@ -159,7 +161,7 @@ async function leaveRoutes(fastify) {
         });
       }
 
-      const canViewAll = fastify.hasPermission(request.employee, "expense.view_all");
+      const canViewAll = fastify.hasPermission(request.employee, "leave.view_all");
       if (!canViewAll && leave.owner_id !== request.employee.id) {
         throw new AppError({
           code: "PERM_001",
@@ -185,7 +187,8 @@ async function leaveRoutes(fastify) {
   fastify.post(
     "/leave-requests/:id/submit",
     {
-      preHandler: fastify.authenticate,
+      schema: { tags: ["Leave"], summary: "Submit Leave Request" },
+      preHandler: fastify.requireEntityPermission("leave", "submit"),
     },
     async (request, reply) => {
       const leaveId = parseLeaveId(request.params?.id);