fix: 用专用权限收窄经理 AP 访问（09-07-manager-ap-access-scope）

server/tests/unit/constants/permissions.test.js

@@ -5,6 +5,18 @@ const {
 } = require("../../../src/constants/permissions");
 
 describe("Permission Constants", () => {
+  it("separates full AP reading from payment review and preserves multi-role grants", () => {
+    for (const role of ["ceo", "finance", "finance_mgr"]) {
+      expect(hasPermission(resolvePermissionsForRoles([role]), "finance.ledger.view")).toBe(true);
+    }
+    for (const role of ["manager", "employee", "system_admin", "hr", "administration"]) {
+      expect(hasPermission(resolvePermissionsForRoles([role]), "finance.ledger.view")).toBe(false);
+    }
+    expect(hasPermission(resolvePermissionsForRoles(["manager", "finance"]), "finance.ledger.view")).toBe(true);
+    expect(hasPermission(resolvePermissionsForRoles(["manager"]), "payment.batch.review")).toBe(true);
+    expect(hasPermission(resolvePermissionsForRoles(["ceo"]), "payment.batch.manage")).toBe(false);
+  });
+
   it("grants leave self-service permissions to employee roles", () => {
     const employeePermissions = resolvePermissionsForRoles(["employee"]);