完善借款、编号、付款与预算并发及验收（09-06-release-gate-integrity）
汇总已落盘的借款本金与还款、兼容历史编号的周期化编号、付款责任与回单核验、报销进度和排序、PWA/采购事务、错误原因与日期校验及ERP退役。 统一共享预算池锁序和锁后判断，恢复差旅原预算选择，补原因码固定夹具及反向完整性检查。 纳入配套迁移、测试、受管QA、分层验收合同、规约及任务记录；原始证据留在ignored artifacts。 关联任务：09-17-company-loan-principal-repayment、09-17-erp-exclusive-retirement、09-18-reimbursement-periodic-numbering、09-08-reimbursement-payment-closeout、09-18-local-concurrency-product-fixes、09-19-budget-pool-concurrency、09-05-error-explainability-payment-readiness。 预算补审由Claude定向验证2文件928项通过，原4446/28及r6结果仍仅对应各自历史输入；本轮未重跑测试。 完整新候选门禁、R1真实入口接入与12项公网义务仍开放。生产编号未启用、差旅仍冻结；不推送、不部署，不宣称发布资格。
这个提交包含在：
@@ -16,10 +16,10 @@ const MINIMAL_PDF = Buffer.from(
|
||||
"ascii",
|
||||
);
|
||||
|
||||
function buildMultipartRequest({ filename, contentType, content }) {
|
||||
function buildMultipartRequest({ filename, contentType, content, field = "file" }) {
|
||||
const boundary = "----codex-employee-attachment-boundary";
|
||||
const head = Buffer.from(
|
||||
`--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="${filename}"\r\nContent-Type: ${contentType}\r\n\r\n`,
|
||||
`--${boundary}\r\nContent-Disposition: form-data; name="${field}"; filename="${filename}"\r\nContent-Type: ${contentType}\r\n\r\n`,
|
||||
);
|
||||
const tail = Buffer.from(`\r\n--${boundary}--\r\n`);
|
||||
const body = Buffer.concat([head, Buffer.isBuffer(content) ? content : Buffer.from(content, "utf8"), tail]);
|
||||
@@ -338,8 +338,10 @@ describe("employee attachment and delete routes", () => {
|
||||
expect(response.statusCode).toBe(409);
|
||||
expect(response.headers["content-disposition"]).toBeUndefined();
|
||||
expect(response.rawPayload.equals(invalidStoredContent)).toBe(false);
|
||||
expect(response.json().error.message).toBe("合同附件未通过安全校验");
|
||||
expect(response.json().error.details).toEqual({
|
||||
attachment: "security_validation_failed",
|
||||
reasonCode: "employee.contract_attachment_download_blocked",
|
||||
});
|
||||
expect(testApp.auditCreate).toHaveBeenCalledWith({
|
||||
data: expect.objectContaining({
|
||||
@@ -418,7 +420,7 @@ describe("employee attachment and delete routes", () => {
|
||||
expect(response.json().error).toEqual(
|
||||
expect.objectContaining({
|
||||
code: "VALID_001",
|
||||
details: { file: "type_mismatch" },
|
||||
details: { file: "type_mismatch", reasonCode: "employee.contract_attachment_content_invalid" },
|
||||
}),
|
||||
);
|
||||
expect(testApp.contractUpdate).not.toHaveBeenCalled();
|
||||
@@ -562,6 +564,9 @@ describe("employee attachment and delete routes", () => {
|
||||
|
||||
expect(activeResponse.statusCode).toBe(409);
|
||||
expect(activeResponse.json().error.code).toBe("VALID_001");
|
||||
expect(activeResponse.json().error.details).toEqual({ contract: "active_contract_must_be_terminated", reasonCode: "employee.active_contract_delete_forbidden" });
|
||||
expect(activeApp.contractDelete).not.toHaveBeenCalled();
|
||||
expect(activeApp.auditCreate).not.toHaveBeenCalled();
|
||||
expect(activeApp.state.contract).not.toBeNull();
|
||||
|
||||
await activeApp.app.close();
|
||||
@@ -617,6 +622,7 @@ describe("employee attachment and delete routes", () => {
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(400);
|
||||
expect(response.json().error.details.reasonCode).toBe("employee.contract_delete_input_invalid");
|
||||
expect(testApp.featureFlagFindUnique).not.toHaveBeenCalled();
|
||||
expect(testApp.transaction).not.toHaveBeenCalled();
|
||||
expect(testApp.contractDelete).not.toHaveBeenCalled();
|
||||
@@ -626,3 +632,43 @@ describe("employee attachment and delete routes", () => {
|
||||
await fs.rm(testApp.tempDir, { recursive: true, force: true });
|
||||
});
|
||||
});
|
||||
|
||||
describe("employee upload error reasons", () => {
|
||||
const actor = { id: EMPLOYEE_ID, department_id: DEPARTMENT_ID, permissionCodes: ["system.users", "employee.contract.manage"] };
|
||||
function uploadUrl(kind) { return kind === "avatar" ? `/api/employees/${EMPLOYEE_ID}/avatar` : `/api/employees/${EMPLOYEE_ID}/contracts/${CONTRACT_ID}/attachment`; }
|
||||
it.each(["avatar", "contract_attachment"].flatMap((kind) => ["multipart_required", "file_required", "field_invalid", "type_invalid", "file_empty", "file_too_large"].map((reason) => [kind, reason])))("rejects %s %s before storage or mutation", async (kind, suffix) => {
|
||||
const t = await buildApp({ actor });
|
||||
try {
|
||||
const boundary = "synthetic-empty-file";
|
||||
let request;
|
||||
if (suffix === "multipart_required") request = { payload: { file: "synthetic" } };
|
||||
else if (suffix === "file_required") request = { headers: { "content-type": `multipart/form-data; boundary=${boundary}` }, payload: `--${boundary}\r\nContent-Disposition: form-data; name="note"\r\n\r\nsynthetic\r\n--${boundary}--\r\n` };
|
||||
else request = buildMultipartRequest({ filename: kind === "avatar" ? "synthetic.png" : "synthetic.pdf", contentType: suffix === "type_invalid" ? "text/plain" : kind === "avatar" ? "image/png" : "application/pdf", field: suffix === "field_invalid" ? "wrong" : "file", content: suffix === "file_empty" ? Buffer.alloc(0) : suffix === "file_too_large" ? Buffer.alloc((kind === "avatar" ? 2 : 10) * 1024 * 1024 + 1, 65) : Buffer.from("synthetic") });
|
||||
const response = await t.app.inject({ method: "PUT", url: uploadUrl(kind), ...request });
|
||||
expect(response.statusCode).toBe(400);
|
||||
expect(response.json().error.details).toEqual({ file: { multipart_required: "invalid_multipart", file_required: "required", field_invalid: "invalid_field", type_invalid: "invalid_type", file_empty: "empty", file_too_large: "file_too_large" }[suffix], reasonCode: `employee.${kind}_${suffix}` });
|
||||
expect(t.employeeUpdate).not.toHaveBeenCalled(); expect(t.contractUpdate).not.toHaveBeenCalled(); expect(t.auditCreate).not.toHaveBeenCalled(); expect(t.transaction).not.toHaveBeenCalled(); expect(await fs.readdir(t.tempDir)).toEqual([]);
|
||||
} finally { await t.app.close(); await fs.rm(t.tempDir, { recursive: true, force: true }); }
|
||||
});
|
||||
it("rejects invalid avatar image bytes before persistence", async () => {
|
||||
const t = await buildApp({ actor });
|
||||
try {
|
||||
const response = await t.app.inject({ method: "PUT", url: uploadUrl("avatar"), ...buildMultipartRequest({ filename: "synthetic.png", contentType: "image/png", content: "synthetic-invalid-image" }) });
|
||||
expect(response.statusCode).toBe(400); expect(response.json().error.details).toEqual({ file: "invalid_image", reasonCode: "employee.avatar_image_invalid" });
|
||||
expect(t.employeeUpdate).not.toHaveBeenCalled(); expect(await fs.readdir(t.tempDir)).toEqual([]);
|
||||
} finally { await t.app.close(); await fs.rm(t.tempDir, { recursive: true, force: true }); }
|
||||
});
|
||||
it.each(["avatar", "contract_attachment"])("handles request.file size errors for %s and preserves other failures", async (kind) => {
|
||||
for (const code of ["FST_REQ_FILE_TOO_LARGE", "SYNTHETIC_READ_FAILURE"]) {
|
||||
const t = await buildApp({ actor });
|
||||
try {
|
||||
t.app.addHook("preHandler", async (request) => { request.isMultipart = () => true; request.file = async () => { throw Object.assign(new Error("synthetic_file_read"), { code }); }; });
|
||||
const response = await t.app.inject({ method: "PUT", url: uploadUrl(kind), payload: {} });
|
||||
expect(response.statusCode).toBe(code === "FST_REQ_FILE_TOO_LARGE" ? 400 : 500);
|
||||
if (code === "FST_REQ_FILE_TOO_LARGE") expect(response.json().error.details).toEqual({ file: "file_too_large", reasonCode: `employee.${kind}_file_too_large` });
|
||||
else expect(response.json().error.details?.reasonCode).toBeUndefined();
|
||||
expect(t.employeeUpdate).not.toHaveBeenCalled(); expect(t.contractUpdate).not.toHaveBeenCalled(); expect(t.auditCreate).not.toHaveBeenCalled(); expect(await fs.readdir(t.tempDir)).toEqual([]);
|
||||
} finally { await t.app.close(); await fs.rm(t.tempDir, { recursive: true, force: true }); }
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
在新工单中引用
屏蔽一个用户