修正CEO报销财务兜底与部署护栏（07-28-ceo-finance-fallback）

server/tests/unit/routes/approvalRules.permissions.test.js

@@ -14,7 +14,7 @@ function buildCreatePayload(roleCode) {
     level1Role: roleCode,
     level2Role: null,
     level3Role: null,
-    ownerSelfFallbackRole: "finance_mgr",
+    ownerSelfFallbackRole: "finance",
     enabled: true,
     priority: 1,
   };
@@ -82,6 +82,74 @@ async function buildApp() {
 }
 
 describe("reimbursement approval-rule role whitelist", () => {
+  it.each(["finance", "finance_mgr"])(
+    "allows owner self fallback role %s",
+    async (fallbackRole) => {
+      const testApp = await buildApp();
+      try {
+        const response = await testApp.app.inject({
+          method: "POST",
+          url: "/api/approval-rules",
+          payload: {
+            ...buildCreatePayload("manager"),
+            ownerSelfFallbackRole: fallbackRole,
+          },
+        });
+
+        expect(response.statusCode).toBe(200);
+        expect(response.json().data.ownerSelfFallbackRole).toBe(fallbackRole);
+      } finally {
+        await testApp.app.close();
+      }
+    },
+  );
+
+  it("defaults owner self fallback to finance when omitted", async () => {
+    const testApp = await buildApp();
+    try {
+      const payload = buildCreatePayload("manager");
+      delete payload.ownerSelfFallbackRole;
+      const response = await testApp.app.inject({
+        method: "POST",
+        url: "/api/approval-rules",
+        payload,
+      });
+
+      expect(response.statusCode).toBe(200);
+      expect(response.json().data.ownerSelfFallbackRole).toBe("finance");
+      expect(testApp.approvalRuleCreate).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({ owner_self_fallback_role: "finance" }),
+        }),
+      );
+    } finally {
+      await testApp.app.close();
+    }
+  });
+
+  it.each(["admin", "system_admin", "hr"])(
+    "rejects owner self fallback role %s",
+    async (fallbackRole) => {
+      const testApp = await buildApp();
+      try {
+        const response = await testApp.app.inject({
+          method: "POST",
+          url: "/api/approval-rules",
+          payload: {
+            ...buildCreatePayload("manager"),
+            ownerSelfFallbackRole: fallbackRole,
+          },
+        });
+
+        expect(response.statusCode).toBe(400);
+        expect(response.json().error.code).toBe("VALID_001");
+        expect(testApp.transaction).not.toHaveBeenCalled();
+      } finally {
+        await testApp.app.close();
+      }
+    },
+  );
+
   it.each(["manager", "ceo", "finance", "finance_mgr"])(
     "allows role %s because it carries expense.approve",
     async (roleCode) => {

server/tests/unit/routes/reimbursements.expense-standards.test.js

@@ -399,7 +399,7 @@ describe("reimbursements routes expense standard integration", () => {
     await app.close();
   });
 
-  it("uses finance_mgr fallback and persists the adjusted workflow snapshot for CEO owner submit", async () => {
+  it("uses one finance fallback and persists the adjusted workflow snapshot for CEO owner submit", async () => {
     resolveEntityPrecheckMock.mockResolvedValue(buildPrecheck());
 
     const { app, state } = await buildApp({
@@ -409,8 +409,8 @@ describe("reimbursements routes expense standard integration", () => {
         id: "55555555-5555-4555-8555-555555555555",
         level1_role: "manager",
         level2_role: "finance",
-        level3_role: "ceo",
-        owner_self_fallback_role: "finance_mgr",
+        level3_role: null,
+        owner_self_fallback_role: "finance",
         priority: 1,
       },
     });
@@ -424,7 +424,7 @@ describe("reimbursements routes expense standard integration", () => {
     expect(state.workflowTaskCreatePayload).toEqual(
       expect.objectContaining({
         assignee_id: null,
-        assignee_role: "finance_mgr",
+        assignee_role: "finance",
       }),
     );
     expect(state.workflowInstanceCreatePayload.current_step_id).toContain("owner_self_fallback");
@@ -432,10 +432,7 @@ describe("reimbursements routes expense standard integration", () => {
       state.workflowInstanceCreatePayload.context_data.workflow_steps_snapshot.map(
         (step) => step.assignee_rule,
       ),
-    ).toEqual([
-      { type: "role", value: "finance_mgr" },
-      { type: "role", value: "finance" },
-    ]);
+    ).toEqual([{ type: "role", value: "finance" }]);
 
     await app.close();
   });
@@ -452,7 +449,7 @@ describe("reimbursements routes expense standard integration", () => {
         level1_role: "manager",
         level2_role: "finance",
         level3_role: null,
-        owner_self_fallback_role: "finance_mgr",
+        owner_self_fallback_role: "finance",
         priority: 1,
       },
     });
@@ -467,7 +464,7 @@ describe("reimbursements routes expense standard integration", () => {
       expect.objectContaining({
         workflow: "no_actionable_approver",
         reason: "owner_self_fallback_role_unavailable",
-        fallbackRole: "finance_mgr",
+        fallbackRole: "finance",
       }),
     );
     expect(tx.workflowInstance.create).not.toHaveBeenCalled();