BIZ8-11 增强采购项目关联

server/src/routes/purchaseRequests.js

@@ -48,6 +48,7 @@ const PURCHASE_LIST_QUERY_SCHEMA = z.object({
   supplierId: UUID_SCHEMA.optional(),
   legalEntityId: UUID_SCHEMA.optional(),
   costCenterId: UUID_SCHEMA.optional(),
+  projectId: UUID_SCHEMA.optional(),
 });
 
 const PURCHASE_PATCH_SCHEMA = z
@@ -60,6 +61,7 @@ const PURCHASE_PATCH_SCHEMA = z
     supplierId: UUID_SCHEMA.nullable().optional(),
     documentCategoryId: UUID_SCHEMA.nullable().optional(),
     budgetPoolId: UUID_SCHEMA.nullable().optional(),
+    projectId: UUID_SCHEMA.nullable().optional(),
     expectedDeliveryDate: DATE_ONLY_SCHEMA.nullable().optional(),
     items: z
       .array(
@@ -106,6 +108,7 @@ const PURCHASE_SUMMARY_SELECT = {
   supplier_id: true,
   document_category_id: true,
   budget_pool_id: true,
+  project_id: true,
   title: true,
   reason: true,
   currency_code: true,
@@ -171,6 +174,14 @@ const PURCHASE_SUMMARY_SELECT = {
       name: true,
     },
   },
+  project: {
+    select: {
+      id: true,
+      project_no: true,
+      name: true,
+      status: true,
+    },
+  },
 };
 
 const PURCHASE_DETAIL_SELECT = {
@@ -334,6 +345,7 @@ function parseListQuery(query) {
     supplierId: parsed.data.supplierId,
     legalEntityId: parsed.data.legalEntityId,
     costCenterId: parsed.data.costCenterId,
+    projectId: parsed.data.projectId,
   };
 }
 
@@ -472,6 +484,7 @@ function mapPurchaseRequestSummary(item) {
     supplierId: item.supplier_id ?? null,
     documentCategoryId: item.document_category_id ?? null,
     budgetPoolId: item.budget_pool_id ?? null,
+    projectId: item.project_id ?? null,
     title: item.title,
     reason: item.reason ?? null,
     currencyCode: item.currency_code,
@@ -525,6 +538,14 @@ function mapPurchaseRequestSummary(item) {
           name: item.budget_pool.name,
         }
       : null,
+    project: item.project
+      ? {
+          id: item.project.id,
+          projectNo: item.project.project_no,
+          name: item.project.name,
+          status: item.project.status,
+        }
+      : null,
   };
 }
 
@@ -769,10 +790,90 @@ async function ensureBudgetPoolAvailable(tx, budgetPoolId) {
   return item;
 }
 
+async function ensureProjectLinkingEnabled(fastify, tx, request) {
+  const gate = await evaluateFeatureFlag({
+    prisma: tx,
+    config: fastify.config,
+    flagKey: FEATURE_FLAG_KEYS.projectLinking,
+    departmentId: request.employee.department_id ?? null,
+    strictDepartment: false,
+  });
+
+  if (!gate.enabled) {
+    throw buildValidationError({ featureFlag: `${FEATURE_FLAG_KEYS.projectLinking}_disabled`, reason: gate.reason }, 409);
+  }
+}
+
+function canReadProjectForLink(fastify, request, project) {
+  if (!project) {
+    return false;
+  }
+  if (
+    fastify.hasPermission(request.employee, "project.view_all") ||
+    fastify.hasPermission(request.employee, "project.manage") ||
+    fastify.hasPermission(request.employee, "system.settings")
+  ) {
+    return true;
+  }
+
+  return (
+    project.owner_employee_id === request.employee.id ||
+    project.manager_employee_id === request.employee.id ||
+    (project.members ?? []).some((item) => item.employee_id === request.employee.id && item.left_at == null)
+  );
+}
+
+async function ensureProjectLinkable(fastify, tx, request, projectId) {
+  if (!projectId) {
+    return null;
+  }
+
+  await ensureProjectLinkingEnabled(fastify, tx, request);
+
+  const project = await tx.project.findUnique({
+    where: { id: projectId },
+    select: {
+      id: true,
+      project_no: true,
+      name: true,
+      status: true,
+      owner_employee_id: true,
+      manager_employee_id: true,
+      members: {
+        where: { left_at: null },
+        select: { employee_id: true, left_at: true },
+      },
+    },
+  });
+
+  if (!project) {
+    throw new AppError({
+      code: "SYS_404",
+      message: "Not Found",
+      statusCode: 404,
+    });
+  }
+
+  if (!canReadProjectForLink(fastify, request, project)) {
+    throw new AppError({
+      code: "PERM_001",
+      message: "无权限",
+      statusCode: 403,
+      details: { permission: "project.view_own" },
+    });
+  }
+
+  if (project.status === "archived") {
+    throw buildValidationError({ projectId: "archived" }, 409);
+  }
+
+  return project;
+}
+
 async function loadPurchaseRequestForUpdate(tx, purchaseRequestId) {
   const rows = await tx.$queryRaw`
     SELECT id, applicant_id, submitter_id, department_id, legal_entity_id, cost_center_id, supplier_id,
-           document_category_id, budget_pool_id, request_no, currency_code, status
+           document_category_id, budget_pool_id, project_id, request_no, currency_code, status
     FROM "purchase_requests"
     WHERE id = ${purchaseRequestId}::uuid
     FOR UPDATE
@@ -1249,6 +1350,7 @@ async function purchaseRequestRoutes(fastify) {
         ...(query.supplierId ? { supplier_id: query.supplierId } : {}),
         ...(query.legalEntityId ? { legal_entity_id: query.legalEntityId } : {}),
         ...(query.costCenterId ? { cost_center_id: query.costCenterId } : {}),
+        ...(query.projectId ? { project_id: query.projectId } : {}),
         ...(mineOnly
           ? {
               OR: [
@@ -1411,6 +1513,9 @@ async function purchaseRequestRoutes(fastify) {
         if (payload.budgetPoolId) {
           await ensureBudgetPoolAvailable(tx, payload.budgetPoolId);
         }
+        if (payload.projectId && payload.projectId !== (locked.project_id ?? null)) {
+          await ensureProjectLinkable(fastify, tx, request, payload.projectId);
+        }
 
         const updateData = {
           ...(payload.title !== undefined ? { title: payload.title.trim() } : {}),
@@ -1421,6 +1526,7 @@ async function purchaseRequestRoutes(fastify) {
           ...(payload.supplierId !== undefined ? { supplier_id: payload.supplierId || null } : {}),
           ...(payload.documentCategoryId !== undefined ? { document_category_id: payload.documentCategoryId || null } : {}),
           ...(payload.budgetPoolId !== undefined ? { budget_pool_id: payload.budgetPoolId || null } : {}),
+          ...(payload.projectId !== undefined ? { project_id: payload.projectId || null } : {}),
           ...(payload.expectedDeliveryDate !== undefined
             ? {
                 expected_delivery_date: payload.expectedDeliveryDate