实现企微原生材料预览（07-27-yang-jun-reimbursement-readiness）

server/tests/unit/routes/reimbursements.attachments.test.js

@@ -7,6 +7,10 @@ const multipart = require("@fastify/multipart");
 
 const { AppError } = require("../../../src/utils/AppError");
 const reimbursementRoutes = require("../../../src/routes/reimbursements");
+const { signPayload, verifyToken } = require("../../../src/utils/signedUrl");
+
+const ACTOR_ID = "cccccccc-cccc-4ccc-8ccc-cccccccccccc";
+const JWT_SECRET = "synthetic-reimbursement-preview-secret";
 
 function buildMultipartRequest({ files, fields = {} }) {
   const boundary = "----codex-reimbursement-attachment-boundary";
@@ -49,8 +53,8 @@ async function buildApp({ reimbursementStatus = "draft" } = {}) {
     reimbursementForm: {
       findUnique: vi.fn().mockResolvedValue({
         id: reimbursementId,
-        owner_id: "actor-1",
-        submitter_id: "actor-1",
+        owner_id: ACTOR_ID,
+        submitter_id: ACTOR_ID,
         status: reimbursementStatus,
       }),
     },
@@ -76,7 +80,7 @@ async function buildApp({ reimbursementStatus = "draft" } = {}) {
           storage_path: data.storage_path,
           created_at: new Date("2026-05-08T08:00:00.000Z"),
           uploader: {
-            id: "actor-1",
+            id: ACTOR_ID,
             employee_no: "E001",
             name: "测试用户",
           },
@@ -109,13 +113,14 @@ async function buildApp({ reimbursementStatus = "draft" } = {}) {
           storage_path: item.storage_path,
           original_name: item.original_name,
           mime_type: item.mime_type,
+          file_size: item.file_size,
           governance_status: item.governance_status,
           sensitivity_level: item.sensitivity_level,
           attachment_type: item.attachment_type,
           download_policy: item.download_policy,
           reimbursement_form: {
-            owner_id: "actor-1",
-            submitter_id: "actor-1",
+            owner_id: ACTOR_ID,
+            submitter_id: ACTOR_ID,
           },
         };
       }),
@@ -126,8 +131,8 @@ async function buildApp({ reimbursementStatus = "draft" } = {}) {
     $queryRaw: vi.fn().mockResolvedValue([
       {
         id: reimbursementId,
-        owner_id: "actor-1",
-        submitter_id: "actor-1",
+        owner_id: ACTOR_ID,
+        submitter_id: ACTOR_ID,
         status: reimbursementStatus,
       },
     ]),
@@ -140,13 +145,16 @@ async function buildApp({ reimbursementStatus = "draft" } = {}) {
     appTimezone: "Asia/Shanghai",
     storageDir: tempDir,
     maxUploadSizeBytes: 5 * 1024 * 1024,
+    jwtSecret: JWT_SECRET,
+    appOrigin: "https://oa.hyinda.com",
+    signedUrlTtlSeconds: 600,
   });
   app.decorate("authenticate", async (request) => {
     if (!request.headers.authorization) {
       throw new AppError({ code: "AUTH_001", message: "未登录", statusCode: 401 });
     }
     request.employee = {
-      id: "actor-1",
+      id: ACTOR_ID,
       roleCodes: ["employee"],
       permissionCodes: ["expense.edit_own", "expense.view_own"],
     };
@@ -464,4 +472,214 @@ describe("reimbursement attachment routes", () => {
       await fs.rm(tempDir, { recursive: true, force: true });
     }
   });
+
+  it("issues and consumes a short-lived object-bound WeCom preview URL", async () => {
+    const { app, prisma, tempDir, reimbursementId } = await buildApp();
+
+    try {
+      const requestPayload = buildMultipartRequest({
+        files: [{ filename: "evidence.pdf", contentType: "application/pdf", content: "%PDF preview" }],
+      });
+      const uploadResponse = await app.inject({
+        method: "POST",
+        url: `/api/reimbursements/${reimbursementId}/attachments`,
+        headers: { authorization: "Bearer test", ...requestPayload.headers },
+        payload: requestPayload.payload,
+      });
+      const attachment = uploadResponse.json().data.items[0];
+      const issuedBefore = Date.now();
+
+      const previewResponse = await app.inject({
+        method: "POST",
+        url: `/api/reimbursements/${reimbursementId}/attachments/${attachment.id}/preview-url`,
+        headers: { authorization: "Bearer test", "content-type": "application/json" },
+        payload: {},
+      });
+
+      expect(previewResponse.statusCode).toBe(200);
+      expect(previewResponse.json().data).toEqual(expect.objectContaining({
+        signedUrl: expect.stringMatching(/^https:\/\/oa\.hyinda\.com\/api\/reimbursements\//),
+        originalName: "evidence.pdf",
+        mimeType: "application/pdf",
+        fileSize: Buffer.byteLength("%PDF preview"),
+      }));
+      const signedUrl = new URL(previewResponse.json().data.signedUrl);
+      const verified = verifyToken(signedUrl.searchParams.get("previewToken"), JWT_SECRET);
+      expect(verified).toEqual(expect.objectContaining({
+        ok: true,
+        payload: expect.objectContaining({
+          purpose: "wecom_preview",
+          reimbursementId,
+          attachmentId: attachment.id,
+          actorId: ACTOR_ID,
+        }),
+      }));
+      expect(verified.payload.exp).toBeGreaterThanOrEqual(issuedBefore + 119_000);
+      expect(verified.payload.exp).toBeLessThanOrEqual(Date.now() + 120_000);
+      expect(prisma.auditLog.create).toHaveBeenCalledWith(expect.objectContaining({
+        data: expect.objectContaining({ action: "REIMBURSEMENT_ATTACHMENT_PREVIEW_URL_ISSUED" }),
+      }));
+
+      const fileResponse = await app.inject({
+        method: "GET",
+        url: `${signedUrl.pathname}${signedUrl.search}`,
+      });
+      expect(fileResponse.statusCode).toBe(200);
+      expect(fileResponse.body).toBe("%PDF preview");
+      expect(fileResponse.headers["cache-control"]).toBe("private, no-store");
+      expect(fileResponse.headers["referrer-policy"]).toBe("no-referrer");
+      expect(prisma.auditLog.create).toHaveBeenCalledWith(expect.objectContaining({
+        data: expect.objectContaining({
+          action: "REIMBURSEMENT_ATTACHMENT_DOWNLOADED",
+          actor_id: ACTOR_ID,
+          extra: expect.objectContaining({ reason: "企业微信在线预览" }),
+        }),
+      }));
+    } finally {
+      await app.close();
+      await fs.rm(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it("rejects tampered, expired, and object-mismatched preview grants", async () => {
+    const { app, tempDir, reimbursementId } = await buildApp();
+
+    try {
+      const requestPayload = buildMultipartRequest({
+        files: [{ filename: "evidence.pdf", contentType: "application/pdf", content: "%PDF preview" }],
+      });
+      const uploadResponse = await app.inject({
+        method: "POST",
+        url: `/api/reimbursements/${reimbursementId}/attachments`,
+        headers: { authorization: "Bearer test", ...requestPayload.headers },
+        payload: requestPayload.payload,
+      });
+      const attachmentId = uploadResponse.json().data.items[0].id;
+      const basePayload = {
+        purpose: "wecom_preview",
+        reimbursementId,
+        attachmentId,
+        actorId: ACTOR_ID,
+      };
+      const validToken = signPayload({ ...basePayload, exp: Date.now() + 60_000 }, JWT_SECRET);
+      const tamperedToken = `${validToken.slice(0, -1)}${validToken.endsWith("a") ? "b" : "a"}`;
+      const expiredToken = signPayload({ ...basePayload, exp: Date.now() - 1 }, JWT_SECRET);
+      const mismatchedToken = signPayload({
+        ...basePayload,
+        reimbursementId: "dddddddd-dddd-4ddd-8ddd-dddddddddddd",
+        exp: Date.now() + 60_000,
+      }, JWT_SECRET);
+
+      for (const token of [tamperedToken, expiredToken, mismatchedToken]) {
+        const response = await app.inject({
+          method: "GET",
+          url: `/api/reimbursements/${reimbursementId}/attachments/${attachmentId}/file?previewToken=${encodeURIComponent(token)}`,
+        });
+        expect(response.statusCode).toBe(403);
+        expect(response.json().error.code).toBe("PERM_001");
+      }
+    } finally {
+      await app.close();
+      await fs.rm(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it("requires login and any configured download reason before issuing a preview URL", async () => {
+    const { app, prisma, tempDir, reimbursementId, createdAttachments } = await buildApp();
+
+    try {
+      const requestPayload = buildMultipartRequest({
+        files: [{ filename: "evidence.pdf", contentType: "application/pdf", content: "%PDF preview" }],
+      });
+      const uploadResponse = await app.inject({
+        method: "POST",
+        url: `/api/reimbursements/${reimbursementId}/attachments`,
+        headers: { authorization: "Bearer test", ...requestPayload.headers },
+        payload: requestPayload.payload,
+      });
+      const attachmentId = uploadResponse.json().data.items[0].id;
+      createdAttachments[0].download_policy = "reason_required";
+      prisma.auditLog.create.mockClear();
+
+      const unauthenticated = await app.inject({
+        method: "POST",
+        url: `/api/reimbursements/${reimbursementId}/attachments/${attachmentId}/preview-url`,
+        payload: {},
+      });
+      const missingReason = await app.inject({
+        method: "POST",
+        url: `/api/reimbursements/${reimbursementId}/attachments/${attachmentId}/preview-url`,
+        headers: { authorization: "Bearer test", "content-type": "application/json" },
+        payload: {},
+      });
+
+      expect(unauthenticated.statusCode).toBe(401);
+      expect(missingReason.statusCode).toBe(400);
+      expect(missingReason.json().error.details).toEqual({ reason: "required" });
+      expect(prisma.auditLog.create).not.toHaveBeenCalled();
+    } finally {
+      await app.close();
+      await fs.rm(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it("fails closed before preview bytes when the access audit cannot be written", async () => {
+    const { app, prisma, tempDir, reimbursementId } = await buildApp();
+
+    try {
+      const requestPayload = buildMultipartRequest({
+        files: [{ filename: "evidence.pdf", contentType: "application/pdf", content: "%PDF preview" }],
+      });
+      const uploadResponse = await app.inject({
+        method: "POST",
+        url: `/api/reimbursements/${reimbursementId}/attachments`,
+        headers: { authorization: "Bearer test", ...requestPayload.headers },
+        payload: requestPayload.payload,
+      });
+      const attachmentId = uploadResponse.json().data.items[0].id;
+      const previewToken = signPayload({
+        purpose: "wecom_preview",
+        reimbursementId,
+        attachmentId,
+        actorId: ACTOR_ID,
+        exp: Date.now() + 60_000,
+      }, JWT_SECRET);
+      prisma.auditLog.create.mockRejectedValueOnce(new Error("synthetic audit outage"));
+
+      const response = await app.inject({
+        method: "GET",
+        url: `/api/reimbursements/${reimbursementId}/attachments/${attachmentId}/file?previewToken=${encodeURIComponent(previewToken)}`,
+      });
+
+      expect(response.statusCode).toBe(500);
+      expect(response.json().error.code).toBe("SYS_001");
+      expect(response.body).not.toContain("%PDF preview");
+    } finally {
+      await app.close();
+      await fs.rm(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it("rejects missing or invalid authorization before looking up the attachment", async () => {
+    const { app, prisma, tempDir, reimbursementId } = await buildApp();
+    const attachmentId = "bbbbbbbb-bbbb-4bbb-8bbb-000000000001";
+
+    try {
+      const unauthenticated = await app.inject({
+        method: "GET",
+        url: `/api/reimbursements/${reimbursementId}/attachments/${attachmentId}/file`,
+      });
+      const invalidGrant = await app.inject({
+        method: "GET",
+        url: `/api/reimbursements/${reimbursementId}/attachments/${attachmentId}/file?previewToken=invalid`,
+      });
+
+      expect(unauthenticated.statusCode).toBe(401);
+      expect(invalidGrant.statusCode).toBe(403);
+      expect(prisma.reimbursementAttachment.findFirst).not.toHaveBeenCalled();
+    } finally {
+      await app.close();
+      await fs.rm(tempDir, { recursive: true, force: true });
+    }
+  });
 });