修复附件治理部署检查缺口（05-28-attachment-governance-deploy-smoke）

client/tests/e2e/manual/p2-fin-live-payment-batch.spec.ts

@@ -52,6 +52,10 @@ type ReceiptAttachment = {
   originalName: string;
   mimeType: string;
   fileSize: number;
+  governanceStatus: string;
+  sensitivityLevel: string;
+  attachmentType: string;
+  downloadPolicy: string;
 };
 
 type FinanceLedgerResponse = {
@@ -500,8 +504,18 @@ test.describe("公网付款批次受控验收", () => {
         finance.api,
         `/api/payment-batches/${batch.id}/receipt-attachments`,
       );
-      expect(receiptList.items.some((item) => item.id === receipt.id)).toBe(true);
-      const receiptDownload = await finance.api.get(`/api/payment-batches/${batch.id}/receipt-attachments/${receipt.id}/file`);
+      const listedReceipt = receiptList.items.find((item) => item.id === receipt.id);
+      expect(listedReceipt).toBeTruthy();
+      expect(listedReceipt?.governanceStatus).toBe("approved");
+      expect(listedReceipt?.sensitivityLevel).toBe("confidential");
+      expect(listedReceipt?.attachmentType).toBe("receipt");
+      expect(listedReceipt?.downloadPolicy).toBe("reason_required");
+      const receiptDownloadWithoutReason = await finance.api.get(`/api/payment-batches/${batch.id}/receipt-attachments/${receipt.id}/file`);
+      expect(receiptDownloadWithoutReason.status(), "bank receipt download without reason should be rejected").toBe(400);
+      const receiptDownloadReason = `${issueId} live payment receipt verification`;
+      const receiptDownload = await finance.api.get(
+        `/api/payment-batches/${batch.id}/receipt-attachments/${receipt.id}/file?reason=${encodeURIComponent(receiptDownloadReason)}`,
+      );
       expect(receiptDownload.status(), "bank receipt download should succeed").toBe(200);
 
       batch = (await apiPostData<{ item: PaymentBatch }>(finance.api, `/api/payment-batches/${batch.id}/execute`, {})).item;
@@ -533,6 +547,14 @@ test.describe("公网付款批次受控验收", () => {
       await expectAuditAction(admin.api, "PAYMENT_BATCH_RECEIPT_UPLOADED", (item) =>
         item.targetId === batch.id && Array.isArray(item.extra?.attachmentIds),
       );
+      await expectAuditAction(admin.api, "PAYMENT_BATCH_RECEIPT_DOWNLOADED", (item) =>
+        item.targetId === batch.id &&
+        item.extra?.attachmentId === receipt.id &&
+        item.extra?.attachmentType === "receipt" &&
+        item.extra?.sensitivityLevel === "confidential" &&
+        item.extra?.governanceStatus === "approved" &&
+        item.extra?.reason === receiptDownloadReason,
+      );
       await expectAuditAction(admin.api, "PAYMENT_BATCH_EXECUTED", (item) => item.targetId === batch.id);
       await expectAuditAction(admin.api, "REIMBURSEMENT_PAYMENT_MARKED", (item) => item.targetId === reimbursement.id);
       await expectAuditAction(admin.api, "EXPORT_AP_OPERATIONS", (item) => item.actorId === finance.me.id);
@@ -542,7 +564,14 @@ test.describe("公网付款批次受控验收", () => {
         batchStatus: batch.status,
         receiptAttachmentId: receipt.id,
         missingReceiptExecuteStatus,
+        receiptDownloadWithoutReasonStatus: receiptDownloadWithoutReason.status(),
         receiptDownloadStatus: receiptDownload.status(),
+        receiptGovernance: {
+          governanceStatus: listedReceipt?.governanceStatus,
+          sensitivityLevel: listedReceipt?.sensitivityLevel,
+          attachmentType: listedReceipt?.attachmentType,
+          downloadPolicy: listedReceipt?.downloadPolicy,
+        },
         reimbursementStatus: paid.status,
         invoiceStatus: invoice.status,
         ledgerPaymentStatus: ledgerItem?.payment.status ?? "missing",