BIZ8-11 增强采购项目关联
这个提交包含在：
@@ -66,11 +66,12 @@ function buildProjectState(overrides = {}) {
|
||||
};
|
||||
}
|
||||
|
||||
function createPrismaState({ communicationLogs = [], closureChecklistItems = [] } = {}) {
|
||||
function createPrismaState({ communicationLogs = [], closureChecklistItems = [], purchaseRequests = [] } = {}) {
|
||||
const state = {
|
||||
project: buildProjectState(),
|
||||
communicationLogs: communicationLogs.map((item) => ({ ...item })),
|
||||
closureChecklistItems: closureChecklistItems.map((item) => ({ ...item })),
|
||||
purchaseRequests: purchaseRequests.map((item) => ({ ...item })),
|
||||
openRiskCount: 0,
|
||||
openReimbursementCount: 0,
|
||||
openTravelCount: 0,
|
||||
@@ -89,6 +90,7 @@ function createPrismaState({ communicationLogs = [], closureChecklistItems = []
|
||||
tasks: (project.tasks ?? []).length,
|
||||
risks: (project.risks ?? []).length,
|
||||
reimbursements: 0,
|
||||
purchase_requests: state.purchaseRequests.filter((item) => item.project_id === project.id).length,
|
||||
travel_requests: 0,
|
||||
todo_items: 0,
|
||||
weekly_reports: 0,
|
||||
@@ -277,6 +279,13 @@ function createPrismaState({ communicationLogs = [], closureChecklistItems = []
|
||||
projectRisk: { count: vi.fn().mockImplementation(async () => state.openRiskCount) },
|
||||
reimbursementForm: { count: vi.fn().mockImplementation(async () => state.openReimbursementCount) },
|
||||
travelRequest: { count: vi.fn().mockImplementation(async () => state.openTravelCount) },
|
||||
purchaseRequest: {
|
||||
findMany: vi.fn().mockImplementation(async ({ where }) => {
|
||||
return state.purchaseRequests
|
||||
.filter((item) => item.project_id === where.project_id)
|
||||
.sort((left, right) => new Date(right.updated_at).getTime() - new Date(left.updated_at).getTime());
|
||||
}),
|
||||
},
|
||||
projectDeliveryRecord: { count: vi.fn().mockImplementation(async () => state.deliveryRecordCount) },
|
||||
contractRegistry: { count: vi.fn().mockImplementation(async () => state.contractCount) },
|
||||
confidentialDocumentRef: { count: vi.fn().mockImplementation(async () => state.confidentialDocRefCount) },
|
||||
@@ -329,6 +338,79 @@ async function buildApp({ employee, prisma }) {
|
||||
}
|
||||
|
||||
describe("project R23 routes", () => {
|
||||
it("returns purchase request summary only to readable project users", async () => {
|
||||
const { prisma } = createPrismaState({
|
||||
purchaseRequests: [
|
||||
{
|
||||
id: "77777777-7777-4777-8777-777777777777",
|
||||
project_id: PROJECT_ID,
|
||||
request_no: "PR-20260513-001",
|
||||
title: "测试设备采购",
|
||||
status: "approved",
|
||||
total_amount: "1200.50",
|
||||
updated_at: new Date("2026-05-13T08:00:00.000Z"),
|
||||
},
|
||||
{
|
||||
id: "88888888-8888-4888-8888-888888888888",
|
||||
project_id: PROJECT_ID,
|
||||
request_no: null,
|
||||
title: "未编号采购草稿",
|
||||
status: "draft",
|
||||
total_amount: "99.50",
|
||||
updated_at: new Date("2026-05-13T09:00:00.000Z"),
|
||||
},
|
||||
],
|
||||
});
|
||||
const memberApp = await buildApp({
|
||||
employee: { id: MEMBER_ID, department_id: null, permissionCodes: ["project.view_own"] },
|
||||
prisma,
|
||||
});
|
||||
|
||||
const response = await memberApp.inject({
|
||||
method: "GET",
|
||||
url: `/api/projects/${PROJECT_ID}/purchase-requests/summary`,
|
||||
headers: { authorization: "Bearer test-token" },
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(200);
|
||||
expect(response.json().data).toEqual({
|
||||
totalAmount: "1300.00",
|
||||
items: [
|
||||
{
|
||||
id: "88888888-8888-4888-8888-888888888888",
|
||||
requestNo: "88888888-8888-4888-8888-888888888888",
|
||||
title: "未编号采购草稿",
|
||||
status: "draft",
|
||||
totalAmount: "99.50",
|
||||
updatedAt: "2026-05-13T09:00:00.000Z",
|
||||
},
|
||||
{
|
||||
id: "77777777-7777-4777-8777-777777777777",
|
||||
requestNo: "PR-20260513-001",
|
||||
title: "测试设备采购",
|
||||
status: "approved",
|
||||
totalAmount: "1200.50",
|
||||
updatedAt: "2026-05-13T08:00:00.000Z",
|
||||
},
|
||||
],
|
||||
});
|
||||
|
||||
const outsiderApp = await buildApp({
|
||||
employee: { id: OUTSIDER_ID, department_id: null, permissionCodes: ["project.view_own"] },
|
||||
prisma,
|
||||
});
|
||||
const forbiddenResponse = await outsiderApp.inject({
|
||||
method: "GET",
|
||||
url: `/api/projects/${PROJECT_ID}/purchase-requests/summary`,
|
||||
headers: { authorization: "Bearer test-token" },
|
||||
});
|
||||
|
||||
expect(forbiddenResponse.statusCode).toBe(403);
|
||||
expect(forbiddenResponse.json().error.code).toBe("PERM_001");
|
||||
|
||||
await Promise.all([memberApp.close(), outsiderApp.close()]);
|
||||
});
|
||||
|
||||
it("allows project member to create communication logs and blocks outsiders", async () => {
|
||||
const { prisma } = createPrismaState();
|
||||
const memberApp = await buildApp({
|
||||
|
||||
@@ -0,0 +1,370 @@
|
||||
const Fastify = require("fastify");
|
||||
|
||||
const { AppError } = require("../../../src/utils/AppError");
|
||||
const purchaseRequestRoutes = require("../../../src/routes/purchaseRequests");
|
||||
|
||||
const PURCHASE_REQUEST_ID = "11111111-1111-4111-8111-111111111111";
|
||||
const EMPLOYEE_ID = "22222222-2222-4222-8222-222222222222";
|
||||
const OTHER_EMPLOYEE_ID = "33333333-3333-4333-8333-333333333333";
|
||||
const DEPARTMENT_ID = "44444444-4444-4444-8444-444444444444";
|
||||
const PROJECT_ID = "55555555-5555-4555-8555-555555555555";
|
||||
const NOW = new Date("2026-05-13T10:00:00.000Z");
|
||||
|
||||
function buildFeatureFlagRecord(flagKey) {
|
||||
return {
|
||||
id: `flag-${flagKey}`,
|
||||
flag_key: flagKey,
|
||||
override_mode: "force_on",
|
||||
rollout_type: "global",
|
||||
department_ids: [],
|
||||
note: "unit-test",
|
||||
version: 1,
|
||||
created_at: NOW,
|
||||
created_by: null,
|
||||
updated_at: NOW,
|
||||
updated_by: null,
|
||||
};
|
||||
}
|
||||
|
||||
function buildProject(overrides = {}) {
|
||||
return {
|
||||
id: PROJECT_ID,
|
||||
project_no: "PRJ-BIZ8",
|
||||
name: "BIZ8 测试项目",
|
||||
status: "active",
|
||||
owner_employee_id: EMPLOYEE_ID,
|
||||
manager_employee_id: null,
|
||||
members: [],
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
function buildPurchaseRequest(overrides = {}) {
|
||||
return {
|
||||
id: PURCHASE_REQUEST_ID,
|
||||
request_no: null,
|
||||
applicant_id: EMPLOYEE_ID,
|
||||
submitter_id: null,
|
||||
department_id: DEPARTMENT_ID,
|
||||
legal_entity_id: null,
|
||||
cost_center_id: null,
|
||||
supplier_id: null,
|
||||
document_category_id: null,
|
||||
budget_pool_id: null,
|
||||
project_id: null,
|
||||
title: "项目关联采购草稿",
|
||||
reason: null,
|
||||
currency_code: "CNY",
|
||||
total_amount: "0.00",
|
||||
expected_delivery_date: null,
|
||||
status: "draft",
|
||||
created_at: NOW,
|
||||
updated_at: NOW,
|
||||
applicant: { id: EMPLOYEE_ID, employee_no: "E001", name: "申请人" },
|
||||
submitter: null,
|
||||
department: { id: DEPARTMENT_ID, name: "测试部门" },
|
||||
legal_entity: null,
|
||||
cost_center: null,
|
||||
supplier: null,
|
||||
document_category: null,
|
||||
budget_pool: null,
|
||||
project: null,
|
||||
items: [],
|
||||
attachments: [],
|
||||
order_archive: null,
|
||||
workflow_instances: [],
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
async function buildApp({
|
||||
project = buildProject(),
|
||||
actorId = EMPLOYEE_ID,
|
||||
permissionCodes = ["procurement.create", "procurement.view_own", "project.view_own"],
|
||||
purchaseRequestOverrides = {},
|
||||
purchaseRequests = null,
|
||||
} = {}) {
|
||||
const app = Fastify();
|
||||
const actor = {
|
||||
id: actorId,
|
||||
department_id: DEPARTMENT_ID,
|
||||
roleCodes: [],
|
||||
permissionCodes,
|
||||
};
|
||||
const state = {
|
||||
purchaseRequest: buildPurchaseRequest(purchaseRequestOverrides),
|
||||
purchaseRequests: null,
|
||||
auditEntries: [],
|
||||
};
|
||||
state.purchaseRequests = purchaseRequests?.map((item) => buildPurchaseRequest(item)) ?? [state.purchaseRequest];
|
||||
|
||||
function attachProjectRelation(item) {
|
||||
return {
|
||||
...item,
|
||||
project: item.project_id === project.id
|
||||
? {
|
||||
id: project.id,
|
||||
project_no: project.project_no,
|
||||
name: project.name,
|
||||
status: project.status,
|
||||
}
|
||||
: null,
|
||||
};
|
||||
}
|
||||
|
||||
const tx = {
|
||||
$queryRaw: vi.fn(async () => [state.purchaseRequest]),
|
||||
featureFlag: {
|
||||
findUnique: vi.fn(async ({ where }) => buildFeatureFlagRecord(where.flag_key)),
|
||||
},
|
||||
project: {
|
||||
findUnique: vi.fn(async ({ where }) => (where.id === project.id ? project : null)),
|
||||
},
|
||||
purchaseRequest: {
|
||||
update: vi.fn(async ({ data }) => {
|
||||
state.purchaseRequest = {
|
||||
...state.purchaseRequest,
|
||||
...(data.project_id !== undefined ? { project_id: data.project_id } : {}),
|
||||
...(data.title !== undefined ? { title: data.title } : {}),
|
||||
...(data.reason !== undefined ? { reason: data.reason } : {}),
|
||||
...(data.currency_code !== undefined ? { currency_code: data.currency_code } : {}),
|
||||
...(data.total_amount !== undefined ? { total_amount: data.total_amount } : {}),
|
||||
updated_by: data.updated_by,
|
||||
updated_at: NOW,
|
||||
};
|
||||
return attachProjectRelation(state.purchaseRequest);
|
||||
}),
|
||||
findUnique: vi.fn(async () => attachProjectRelation(state.purchaseRequest)),
|
||||
},
|
||||
auditLog: {
|
||||
create: vi.fn(async ({ data }) => {
|
||||
state.auditEntries.push(data);
|
||||
return { id: "audit-1" };
|
||||
}),
|
||||
},
|
||||
};
|
||||
|
||||
function listMatchesWhere(item, where = {}) {
|
||||
if (where.project_id && item.project_id !== where.project_id) {
|
||||
return false;
|
||||
}
|
||||
if (where.status && item.status !== where.status) {
|
||||
return false;
|
||||
}
|
||||
if (where.OR) {
|
||||
return where.OR.some((entry) => {
|
||||
if (entry.applicant_id) return item.applicant_id === entry.applicant_id;
|
||||
if (entry.submitter_id) return item.submitter_id === entry.submitter_id;
|
||||
return false;
|
||||
});
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
const prisma = {
|
||||
$transaction: vi.fn(async (callback) => callback(tx)),
|
||||
purchaseRequest: {
|
||||
findUnique: vi.fn(async () => attachProjectRelation(state.purchaseRequest)),
|
||||
findMany: vi.fn(async ({ where }) => state.purchaseRequests.filter((item) => listMatchesWhere(item, where)).map(attachProjectRelation)),
|
||||
count: vi.fn(async ({ where }) => state.purchaseRequests.filter((item) => listMatchesWhere(item, where)).length),
|
||||
},
|
||||
entityRiskFlag: {
|
||||
findMany: vi.fn(async () => []),
|
||||
},
|
||||
};
|
||||
|
||||
app.decorate("prisma", prisma);
|
||||
app.decorate("config", {
|
||||
appTimezone: "Asia/Shanghai",
|
||||
projectLinkingEnabled: true,
|
||||
cutoverConsoleEnabled: false,
|
||||
});
|
||||
app.decorate("hasPermission", (employee, permissionCode) => {
|
||||
const permissionCodes = employee?.permissionCodes ?? [];
|
||||
return permissionCodes.includes("*") || permissionCodes.includes(permissionCode);
|
||||
});
|
||||
app.decorate("requirePermission", (permissionCode) => async (request) => {
|
||||
request.employee = actor;
|
||||
if (!app.hasPermission(actor, permissionCode)) {
|
||||
throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
|
||||
}
|
||||
});
|
||||
app.decorate("authenticate", async (request) => {
|
||||
request.employee = actor;
|
||||
});
|
||||
app.setErrorHandler((error, request, reply) => {
|
||||
reply.status(error.statusCode || 500).send({
|
||||
requestId: request.id,
|
||||
error: {
|
||||
code: error.code || "SYS_001",
|
||||
message: error.message,
|
||||
details: error.details ?? null,
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
await app.register(purchaseRequestRoutes, { prefix: "/api" });
|
||||
return { app, tx, state };
|
||||
}
|
||||
|
||||
describe("purchase request project link", () => {
|
||||
it("links draft purchase request to a readable active project", async () => {
|
||||
const { app, tx, state } = await buildApp();
|
||||
|
||||
const response = await app.inject({
|
||||
method: "PATCH",
|
||||
url: `/api/purchase-requests/${PURCHASE_REQUEST_ID}`,
|
||||
payload: { projectId: PROJECT_ID },
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(200);
|
||||
expect(response.json().data.purchaseRequest).toEqual(
|
||||
expect.objectContaining({
|
||||
id: PURCHASE_REQUEST_ID,
|
||||
projectId: PROJECT_ID,
|
||||
project: {
|
||||
id: PROJECT_ID,
|
||||
projectNo: "PRJ-BIZ8",
|
||||
name: "BIZ8 测试项目",
|
||||
status: "active",
|
||||
},
|
||||
}),
|
||||
);
|
||||
expect(state.purchaseRequest.project_id).toBe(PROJECT_ID);
|
||||
expect(tx.auditLog.create).toHaveBeenCalledTimes(1);
|
||||
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("blocks archived projects from new purchase links", async () => {
|
||||
const { app, tx } = await buildApp({
|
||||
project: buildProject({ status: "archived" }),
|
||||
});
|
||||
|
||||
const response = await app.inject({
|
||||
method: "PATCH",
|
||||
url: `/api/purchase-requests/${PURCHASE_REQUEST_ID}`,
|
||||
payload: { projectId: PROJECT_ID },
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(409);
|
||||
expect(response.json().error.details).toEqual({ projectId: "archived" });
|
||||
expect(tx.purchaseRequest.update).not.toHaveBeenCalled();
|
||||
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("does not revalidate an unchanged existing project link during draft edits", async () => {
|
||||
const { app, tx } = await buildApp({
|
||||
project: buildProject({ status: "archived" }),
|
||||
purchaseRequestOverrides: {
|
||||
project_id: PROJECT_ID,
|
||||
},
|
||||
});
|
||||
|
||||
const response = await app.inject({
|
||||
method: "PATCH",
|
||||
url: `/api/purchase-requests/${PURCHASE_REQUEST_ID}`,
|
||||
payload: { projectId: PROJECT_ID, title: "只修改标题" },
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(200);
|
||||
expect(response.json().data.purchaseRequest).toEqual(
|
||||
expect.objectContaining({
|
||||
projectId: PROJECT_ID,
|
||||
title: "只修改标题",
|
||||
project: expect.objectContaining({ status: "archived" }),
|
||||
}),
|
||||
);
|
||||
expect(tx.project.findUnique).not.toHaveBeenCalled();
|
||||
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("does not let unreadable projects be linked to purchase drafts", async () => {
|
||||
const { app, tx } = await buildApp({
|
||||
project: buildProject({ owner_employee_id: OTHER_EMPLOYEE_ID }),
|
||||
});
|
||||
|
||||
const response = await app.inject({
|
||||
method: "PATCH",
|
||||
url: `/api/purchase-requests/${PURCHASE_REQUEST_ID}`,
|
||||
payload: { projectId: PROJECT_ID },
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(403);
|
||||
expect(response.json().error.code).toBe("PERM_001");
|
||||
expect(tx.purchaseRequest.update).not.toHaveBeenCalled();
|
||||
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("filters purchase request list by project id", async () => {
|
||||
const otherProjectId = "66666666-6666-4666-8666-666666666666";
|
||||
const { app } = await buildApp({
|
||||
permissionCodes: ["procurement.view_all"],
|
||||
purchaseRequests: [
|
||||
{
|
||||
id: PURCHASE_REQUEST_ID,
|
||||
project_id: PROJECT_ID,
|
||||
request_no: "PR-001",
|
||||
title: "关联项目采购",
|
||||
status: "draft",
|
||||
},
|
||||
{
|
||||
id: "77777777-7777-4777-8777-777777777777",
|
||||
project_id: otherProjectId,
|
||||
request_no: "PR-002",
|
||||
title: "其他项目采购",
|
||||
status: "draft",
|
||||
},
|
||||
],
|
||||
});
|
||||
|
||||
const response = await app.inject({
|
||||
method: "GET",
|
||||
url: `/api/purchase-requests?projectId=${PROJECT_ID}&mine=0`,
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(200);
|
||||
expect(response.json().data).toEqual(
|
||||
expect.objectContaining({
|
||||
total: 1,
|
||||
items: [
|
||||
expect.objectContaining({
|
||||
id: PURCHASE_REQUEST_ID,
|
||||
projectId: PROJECT_ID,
|
||||
project: expect.objectContaining({
|
||||
projectNo: "PRJ-BIZ8",
|
||||
name: "BIZ8 测试项目",
|
||||
}),
|
||||
}),
|
||||
],
|
||||
}),
|
||||
);
|
||||
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("does not let project membership bypass purchase detail permission", async () => {
|
||||
const { app } = await buildApp({
|
||||
actorId: OTHER_EMPLOYEE_ID,
|
||||
project: buildProject({ owner_employee_id: OTHER_EMPLOYEE_ID }),
|
||||
permissionCodes: ["procurement.view_own", "project.view_own"],
|
||||
purchaseRequestOverrides: {
|
||||
applicant_id: EMPLOYEE_ID,
|
||||
project_id: PROJECT_ID,
|
||||
},
|
||||
});
|
||||
|
||||
const response = await app.inject({
|
||||
method: "GET",
|
||||
url: `/api/purchase-requests/${PURCHASE_REQUEST_ID}`,
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(403);
|
||||
expect(response.json().error.code).toBe("PERM_001");
|
||||
|
||||
await app.close();
|
||||
});
|
||||
});
|
||||
在新工单中引用
屏蔽一个用户