fix: 用专用权限收窄经理 AP 访问（09-07-manager-ap-access-scope）

client/tests/e2e/payment-reviewer-permissions.spec.ts

@@ -346,19 +346,40 @@ async function login(page: Page, actor: SyntheticActor) {
   await expect(page).toHaveURL(/\/(?:portal|mobile)$/);
 }
 
-test("只有付款复核职责的经理可看应付账款但看不到导出", async ({ page }) => {
+test("只有付款复核职责的经理不能直连应付账款且不请求台账", async ({ page }) => {
   test.skip(process.env.E2E_MODE === "live", "只使用本地合成角色，不访问公网");
   const pageErrors = capturePageErrors(page);
   await mockSyntheticApis(page, REVIEWER_ACTOR);
   await login(page, REVIEWER_ACTOR);
 
+  let apRequests = 0;
+  page.on("request", (request) => {
+    if (new URL(request.url()).pathname.startsWith("/api/ap-operations")) apRequests += 1;
+  });
   await page.goto("/ap-operations");
-  await expect(page).toHaveURL(/\/ap-operations$/);
-  await expect(page.getByRole("heading", { level: 1, name: "应付账款", exact: true })).toBeVisible();
+  await expect(page).toHaveURL(/\/403$/);
+  await expect(page.getByRole("link", { name: "应付账款", exact: true })).toHaveCount(0);
+  expect(apRequests).toBe(0);
   await expect(page.getByTestId("ap-export")).toHaveCount(0);
   expectNoPageErrors(pageErrors);
 });
 
+for (const roleCodes of [["ceo"], ["finance"], ["finance_mgr"], ["manager", "finance"]]) {
+  test(`AP 专用读取权限允许 ${roleCodes.join("+")} 进入台账且不提升导出权限`, async ({ page }) => {
+    test.skip(process.env.E2E_MODE === "live", "只使用本地合成角色，不访问公网");
+    const actor = { ...FINANCE_ACTOR, roleCodes };
+    await mockSyntheticApis(page, actor);
+    await login(page, actor);
+    await page.goto("/ap-operations");
+    await expect(page).toHaveURL(/\/ap-operations$/);
+    await expect(page.getByRole("heading", { level: 1, name: "应付账款", exact: true })).toBeVisible();
+    await page.getByRole("tab", { name: /^财务台账/ }).click();
+    await expect(page.getByTestId("finance-ledger-table")).toBeVisible();
+    if (roleCodes.includes("ceo")) await expect(page.getByTestId("ap-export")).toHaveCount(0);
+    else await expect(page.getByTestId("ap-export")).toBeVisible();
+  });
+}
+
 test("只有付款复核职责的经理看不到新建批次", async ({ page }) => {
   test.skip(process.env.E2E_MODE === "live", "只使用本地合成角色，不访问公网");
   const pageErrors = capturePageErrors(page);