wangsli/hyb-oa
1
0
派生 0
代码 工单 合并请求 工作流 5 软件包 项目 发布 百科 活动

完善借款、编号、付款与预算并发及验收（09-06-release-gate-integrity）

浏览代码 
汇总已落盘的借款本金与还款、兼容历史编号的周期化编号、付款责任与回单核验、报销进度和排序、PWA/采购事务、错误原因与日期校验及ERP退役。
统一共享预算池锁序和锁后判断，恢复差旅原预算选择，补原因码固定夹具及反向完整性检查。
纳入配套迁移、测试、受管QA、分层验收合同、规约及任务记录；原始证据留在ignored artifacts。

关联任务：09-17-company-loan-principal-repayment、09-17-erp-exclusive-retirement、09-18-reimbursement-periodic-numbering、09-08-reimbursement-payment-closeout、09-18-local-concurrency-product-fixes、09-19-budget-pool-concurrency、09-05-error-explainability-payment-readiness。
预算补审由Claude定向验证2文件928项通过，原4446/28及r6结果仍仅对应各自历史输入；本轮未重跑测试。
完整新候选门禁、R1真实入口接入与12项公网义务仍开放。生产编号未启用、差旅仍冻结；不推送、不部署，不宣称发布资格。
这个提交包含在：
wangsli
2026-09-19 13:11:04 +08:00
父节点 729d90576f
当前提交 1f8d5b658a
共修改 367 个文件，包含 21079 行新增和 12287 行删除
下载 Patch 文件 下载 Diff 文件 展开所有文件 折叠所有文件
server/tests/unit/routes/purchase.attachments.test.js
+46 -7
查看文件
@@ -90,6 +90,7 @@ async function buildApp({
maxUploadSizeBytes = 1024 * 1024,
storageOverrides = {},
auditCreate = null,
multipartLimits = {},
} = {}) {
const effectiveActor = actor ?? {
id: EMPLOYEE_ID,
@@ -207,7 +208,7 @@ async function buildApp({
await app.register(multipart, {
attachFieldsToBody: false,
limits: { files: 1, fileSize: maxUploadSizeBytes },
limits: { files: 1, fileSize: maxUploadSizeBytes, ...multipartLimits },
});
await app.register(purchaseRequestRoutes, {
prefix: "/api",
@@ -361,7 +362,7 @@ describe("purchase attachment upload", () => {
expect(response.statusCode).toBe(400);
expect(response.json().error.code).toBe("VALID_001");
if (expectedDetails) {
expect(response.json().error.details).toEqual(expectedDetails);
expect(response.json().error.details).toEqual({ ...expectedDetails, reasonCode: ({ "non multipart": "purchase_attachment.multipart_required", "wrong file field": "purchase_attachment.field_invalid", "path-shaped filename": "purchase_attachment.dangerous_filename", "empty content": "purchase_attachment.empty_file" })[_label] });
}
expect(storage.writeBuffer).not.toHaveBeenCalled();
expect(attachmentCreate).not.toHaveBeenCalled();
@@ -396,7 +397,7 @@ describe("purchase attachment upload", () => {
});
expect(response.statusCode).toBe(400);
expect(response.json().error.details).toEqual({ file: "only_single_file_supported" });
expect(response.json().error.details).toEqual({ file: "only_single_file_supported", reasonCode: "purchase_attachment.single_file_required" });
expect(storage.writeBuffer).not.toHaveBeenCalled();
expect(attachmentCreate).not.toHaveBeenCalled();
} finally {
@@ -422,7 +423,7 @@ describe("purchase attachment upload", () => {
});
expect(response.statusCode).toBe(400);
expect(response.json().error.details).toEqual({ file: "file_too_large" });
expect(response.json().error.details).toEqual({ file: "file_too_large", reasonCode: "purchase_attachment.too_large" });
expect(storage.writeBuffer).not.toHaveBeenCalled();
expect(attachmentCreate).not.toHaveBeenCalled();
} finally {
@@ -600,7 +601,7 @@ describe("purchase attachment authenticated download", () => {
payload: {},
});
expect(response.statusCode).toBe(400);
expect(response.json().error.details).toEqual({ reason: "required" });
expect(response.json().error.details).toEqual({ reason: "required", reasonCode: "purchase_attachment.download_reason_required" });
expect(storage.openReadStream).not.toHaveBeenCalled();
} finally {
await app.close();
@@ -654,6 +655,7 @@ describe("purchase attachment authenticated download", () => {
payload: {},
});
expect(response.statusCode).toBe(409);
expect(response.json().error).toMatchObject({ message: "附件已隔离，无法下载", details: { reason: "quarantined", attachment: "security_validation_failed", reasonCode: "purchase_attachment.download_blocked" } });
expect(storage.openReadStream).not.toHaveBeenCalled();
expect(downloadAuditCreate).toHaveBeenCalledWith(
expect.objectContaining({
@@ -682,7 +684,7 @@ describe("purchase attachment authenticated download", () => {
payload: {},
});
expect(response.statusCode).toBe(409);
expect(response.json().error.details.reason).toBe("size_limit");
expect(response.json().error).toMatchObject({ message: "附件未通过安全校验", details: { reason: "size_limit", attachment: "security_validation_failed", reasonCode: "purchase_attachment.download_blocked" } });
expect(storage.openReadStream).not.toHaveBeenCalled();
} finally {
await app.close();
@@ -746,7 +748,7 @@ describe("purchase attachment authenticated download", () => {
payload: {},
});
expect(response.statusCode).toBe(409);
expect(response.json().error.details.reason).toBe("size_limit");
expect(response.json().error).toMatchObject({ message: "附件未通过安全校验", details: { reason: "size_limit", attachment: "security_validation_failed", reasonCode: "purchase_attachment.download_blocked" } });
expect(oversizedStream.destroy).toHaveBeenCalledTimes(1);
expect(storage.openReadStream).toHaveBeenCalledTimes(1);
} finally {
@@ -771,6 +773,7 @@ describe("purchase attachment authenticated download", () => {
payload: {},
});
expect(response.statusCode).toBe(409);
expect(response.json().error).toMatchObject({ message: "附件未通过安全校验", details: { attachment: "security_validation_failed", reasonCode: "purchase_attachment.download_blocked" } });
expect(response.headers["content-disposition"]).toBeUndefined();
expect(downloadAuditCreate).toHaveBeenCalledWith(
expect.objectContaining({
@@ -871,3 +874,39 @@ describe("purchase attachment authenticated download", () => {
}
});
});
describe("purchase attachment additional reason boundaries", () => {
it.each([
["field-only upload", {}, [{ type: "field", name: "attachmentType", value: "quote" }], "file_required", "required"],
["route single-file guard", { files: 2 }, Array.from({ length: 2 }, () => ({ type: "file", filename: "合成.pdf", contentType: "application/pdf", content: VALID_PDF })), "single_file_required", "only_single_file_supported"],
["fields limit", { fields: 1 }, [{ type: "field", name: "attachmentType", value: "quote" }, { type: "field", name: "sensitivityLevel", value: "internal" }], "multipart_limit", "multipart_limit_exceeded"],
["parts limit", { parts: 1 }, [{ type: "field", name: "attachmentType", value: "quote" }, { type: "file", filename: "合成.pdf", contentType: "application/pdf", content: VALID_PDF }], "multipart_limit", "multipart_limit_exceeded"],
])("explains %s before storage or mutation", async (_, multipartLimits, parts, reason, file) => {
const { app, storage, attachmentCreate, uploadAuditCreate } = await buildApp({ multipartLimits });
try {
const r = await app.inject({ method: "POST", url: `/api/purchase-requests/${PURCHASE_REQUEST_ID}/attachments`, ...buildMultipartRequest(parts) });
expect(r.statusCode).toBe(400); expect(r.json().error.details).toEqual({ file, reasonCode: `purchase_attachment.${reason}` });
expect(storage.writeBuffer).not.toHaveBeenCalled(); expect(attachmentCreate).not.toHaveBeenCalled(); expect(uploadAuditCreate).not.toHaveBeenCalled();
} finally { await app.close(); }
});
it.each([
["DELETE", {}, "delete_input_invalid"],
["POST", { reason: 123 }, "download_input_invalid"],
])("explains %s attachment body before lookup", async (method, payload, reason) => {
const { app, prisma, storage, attachmentDelete } = await buildApp();
try {
const r = await app.inject({ method, url: `/api/purchase-requests/${PURCHASE_REQUEST_ID}/attachments/${ATTACHMENT_ID}${method === "POST" ? "/download" : ""}`, headers: { authorization: "Bearer unit-test" }, payload });
expect(r.statusCode).toBe(400); expect(r.json().error.details).toMatchObject({ reasonCode: `purchase_attachment.${reason}`, fieldErrors: expect.any(Object) });
expect(prisma.purchaseRequest.findUnique).not.toHaveBeenCalled(); expect(prisma.purchaseAttachment.findFirst).not.toHaveBeenCalled(); expect(storage.openReadStream).not.toHaveBeenCalled(); expect(attachmentDelete).not.toHaveBeenCalled();
} finally { await app.close(); }
});
it("explains non-draft delete before attachment lookup", async () => {
const { app, prisma, attachmentDelete, uploadAuditCreate } = await buildApp({ purchaseRequest: buildPurchaseRequest({ status: "approved" }) });
try {
const r = await app.inject({ method: "DELETE", url: `/api/purchase-requests/${PURCHASE_REQUEST_ID}/attachments/${ATTACHMENT_ID}`, headers: { authorization: "Bearer unit-test" }, payload: { reason: "合成删除" } });
expect(r.statusCode).toBe(409); expect(r.json().error.details).toEqual({ status: "only_draft_editable", reasonCode: "purchase_attachment.not_editable" });
expect(prisma.purchaseAttachment.findFirst).not.toHaveBeenCalled(); expect(attachmentDelete).not.toHaveBeenCalled(); expect(uploadAuditCreate).not.toHaveBeenCalled();
} finally { await app.close(); }
});
});