R40: 完成档案编辑扩展与员工导出

2026-03-28 17:42:09 +08:00
@@ -0,0 +1,173 @@
+const Fastify = require("fastify");
+
+const employeesRoutes = require("../../../src/routes/employees");
+const { AppError } = require("../../../src/utils/AppError");
+
+const TARGET_EMPLOYEE_ID = "11111111-1111-4111-8111-111111111111";
+const DEPARTMENT_ID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
+
+function buildProfileRow(overrides = {}) {
+  return {
+    id: TARGET_EMPLOYEE_ID,
+    employee_no: "E001",
+    name: "Alice",
+    phone: "13800000000",
+    email: "[email protected]",
+    status: "active",
+    employment_status: "active",
+    department_id: DEPARTMENT_ID,
+    title: "员工",
+    direct_manager_id: null,
+    hire_date: new Date("2026-01-10T00:00:00.000Z"),
+    probation_end_date: new Date("2026-04-10T00:00:00.000Z"),
+    last_working_date: null,
+    work_location: "上海",
+    emergency_contact_name: "联系人",
+    emergency_contact_phone: "13900000000",
+    notes: "none",
+    archived_at: null,
+    roles: [{ role_code: "employee" }],
+    department: { id: DEPARTMENT_ID, name: "行政部" },
+    direct_manager: null,
+    ...overrides,
+  };
+}
+
+async function buildApp(actor) {
+  const app = Fastify();
+  let storedEmployee = buildProfileRow();
+
+  const employeeFindUnique = vi.fn(async ({ where }) => {
+    if (where.id === TARGET_EMPLOYEE_ID) {
+      return storedEmployee;
+    }
+    return null;
+  });
+
+  const employeeUpdate = vi.fn(async ({ data }) => {
+    storedEmployee = {
+      ...storedEmployee,
+      ...(data.title !== undefined ? { title: data.title } : {}),
+      ...(data.hire_date !== undefined ? { hire_date: data.hire_date } : {}),
+      ...(data.probation_end_date !== undefined ? { probation_end_date: data.probation_end_date } : {}),
+      ...(data.last_working_date !== undefined ? { last_working_date: data.last_working_date } : {}),
+      ...(data.work_location !== undefined ? { work_location: data.work_location } : {}),
+      ...(data.emergency_contact_name !== undefined ? { emergency_contact_name: data.emergency_contact_name } : {}),
+      ...(data.emergency_contact_phone !== undefined ? { emergency_contact_phone: data.emergency_contact_phone } : {}),
+      ...(data.notes !== undefined ? { notes: data.notes } : {}),
+    };
+    return storedEmployee;
+  });
+
+  app.decorate("config", { employeeLifecycleEnabled: true });
+  app.decorate("authenticate", async (request) => {
+    request.employee = actor;
+  });
+  app.decorate("requirePermission", (permissionCode) => async (request) => {
+    request.employee = actor;
+    const permissionCodes = actor.permissionCodes ?? [];
+    if (!permissionCodes.includes("*") && !permissionCodes.includes(permissionCode)) {
+      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
+    }
+  });
+  app.decorate("hasPermission", (employee, permissionCode) => {
+    const permissionCodes = employee.permissionCodes ?? [];
+    return permissionCodes.includes("*") || permissionCodes.includes(permissionCode);
+  });
+  app.decorate("prisma", {
+    featureFlag: {
+      findUnique: vi.fn().mockResolvedValue({
+        id: "flag-1",
+        flag_key: "employee_lifecycle_v1",
+        override_mode: "force_on",
+        rollout_type: "global",
+        department_ids: [],
+        note: "",
+        version: 1,
+        created_at: new Date("2026-03-28T00:00:00.000Z"),
+        created_by: null,
+        updated_at: new Date("2026-03-28T00:00:00.000Z"),
+        updated_by: null,
+      }),
+    },
+    employee: {
+      findUnique: employeeFindUnique,
+      update: employeeUpdate,
+      findMany: vi.fn().mockResolvedValue([]),
+      count: vi.fn().mockResolvedValue(0),
+    },
+    employeeChecklistTask: {
+      findMany: vi.fn().mockResolvedValue([]),
+    },
+    employeeLifecycleEvent: {
+      findMany: vi.fn().mockResolvedValue([]),
+    },
+    assetCard: {
+      findMany: vi.fn().mockResolvedValue([]),
+      count: vi.fn().mockResolvedValue(0),
+    },
+    workflowTask: {
+      count: vi.fn().mockResolvedValue(0),
+    },
+    auditLog: {
+      create: vi.fn().mockResolvedValue({}),
+    },
+  });
+
+  await app.register(employeesRoutes, { prefix: "/api" });
+  return { app, employeeUpdate };
+}
+
+describe("employees profile patch", () => {
+  it("allows system.users to patch hireDate and other extended profile fields", async () => {
+    const { app, employeeUpdate } = await buildApp({
+      id: "actor-1",
+      department_id: DEPARTMENT_ID,
+      permissionCodes: ["system.users"],
+    });
+
+    const response = await app.inject({
+      method: "PATCH",
+      url: `/api/employees/${TARGET_EMPLOYEE_ID}/profile`,
+      payload: {
+        title: "经理",
+        hireDate: "2026-02-01",
+        probationEndDate: "2026-05-01",
+        lastWorkingDate: null,
+      },
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(employeeUpdate).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { id: TARGET_EMPLOYEE_ID },
+        data: expect.objectContaining({
+          title: "经理",
+          hire_date: new Date("2026-02-01T00:00:00.000Z"),
+          probation_end_date: new Date("2026-05-01T00:00:00.000Z"),
+          last_working_date: null,
+        }),
+      }),
+    );
+
+    await app.close();
+  });
+
+  it("rejects report.dashboard.view users patching other employee profiles", async () => {
+    const { app } = await buildApp({
+      id: "actor-2",
+      department_id: DEPARTMENT_ID,
+      permissionCodes: ["report.dashboard.view"],
+    });
+
+    const response = await app.inject({
+      method: "PATCH",
+      url: `/api/employees/${TARGET_EMPLOYEE_ID}/profile`,
+      payload: { notes: "should fail" },
+    });
+
+    expect(response.statusCode).toBe(403);
+
+    await app.close();
+  });
+});
@@ -0,0 +1,116 @@
+const Fastify = require("fastify");
+
+const exportsRoutes = require("../../../src/routes/exports");
+const { AppError } = require("../../../src/utils/AppError");
+
+const DEPARTMENT_ID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
+
+async function buildApp(actor) {
+  const app = Fastify();
+  const findMany = vi.fn().mockResolvedValue([
+    {
+      id: "11111111-1111-4111-8111-111111111111",
+      employee_no: "E001",
+      name: "Alice",
+      phone: "13800000000",
+      email: "[email protected]",
+      status: "active",
+      title: "经理",
+      hire_date: new Date("2026-01-10T00:00:00.000Z"),
+      created_at: new Date("2026-03-28T10:00:00.000Z"),
+      department: { name: "行政部" },
+    },
+  ]);
+  const count = vi.fn().mockResolvedValue(1);
+  const auditCreate = vi.fn().mockResolvedValue({});
+
+  app.decorate("authenticate", async (request) => {
+    request.employee = actor;
+  });
+  app.decorate("requirePermission", (permissionCode) => async (request) => {
+    request.employee = actor;
+    const permissionCodes = actor.permissionCodes ?? [];
+    if (!permissionCodes.includes("*") && !permissionCodes.includes(permissionCode)) {
+      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
+    }
+  });
+  app.decorate("hasPermission", (employee, permissionCode) => {
+    const permissionCodes = employee.permissionCodes ?? [];
+    return permissionCodes.includes("*") || permissionCodes.includes(permissionCode);
+  });
+  app.decorate("prisma", {
+    employee: {
+      findMany,
+      count,
+    },
+    auditLog: {
+      create: auditCreate,
+    },
+  });
+
+  await app.register(exportsRoutes, { prefix: "/api" });
+  return { app, findMany, count, auditCreate };
+}
+
+describe("employee exports route", () => {
+  it("exports filtered employees for system.users", async () => {
+    const { app, findMany, count, auditCreate } = await buildApp({
+      id: "actor-1",
+      roleCodes: ["administration"],
+      permissionCodes: ["system.users"],
+    });
+
+    const response = await app.inject({
+      method: "GET",
+      url: `/api/exports/employees?format=csv&status=active&departmentId=${DEPARTMENT_ID}&q=alice`,
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.headers["content-type"]).toContain("text/csv");
+    expect(response.headers["content-disposition"]).toContain("employees-");
+    expect(findMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: expect.objectContaining({
+          status: "active",
+          department_id: DEPARTMENT_ID,
+          OR: expect.arrayContaining([
+            expect.objectContaining({ name: expect.any(Object) }),
+            expect.objectContaining({ employee_no: expect.any(Object) }),
+          ]),
+        }),
+      }),
+    );
+    expect(count).toHaveBeenCalledWith({
+      where: expect.objectContaining({
+        status: "active",
+        department_id: DEPARTMENT_ID,
+      }),
+    });
+    expect(auditCreate).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          action: "EXPORT_EMPLOYEES",
+        }),
+      }),
+    );
+
+    await app.close();
+  });
+
+  it("rejects non system.users access", async () => {
+    const { app } = await buildApp({
+      id: "actor-2",
+      roleCodes: ["manager"],
+      permissionCodes: ["report.dashboard.view"],
+    });
+
+    const response = await app.inject({
+      method: "GET",
+      url: "/api/exports/employees?format=csv",
+    });
+
+    expect(response.statusCode).toBe(403);
+
+    await app.close();
+  });
+});