完成五人团队正式内用最小收口（07-18-small-team-internal-readiness）

server/tests/unit/routes/reimbursements.attachments.test.js

@@ -327,7 +327,8 @@ describe("reimbursement attachment routes", () => {
       const deleteResponse = await app.inject({
         method: "DELETE",
         url: `/api/reimbursements/${reimbursementId}/attachments/${attachmentId}`,
-        headers: { authorization: "Bearer test" },
+        headers: { authorization: "Bearer test", "content-type": "application/json" },
+        payload: { reason: "重复上传" },
       });
 
       expect(deleteResponse.statusCode).toBe(200);
@@ -341,10 +342,40 @@ describe("reimbursement attachment routes", () => {
           reimbursement_id: reimbursementId,
         },
       });
+      expect(prisma.auditLog.create).toHaveBeenLastCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            action: "REIMBURSEMENT_ATTACHMENT_DELETED",
+            target_id: attachmentId,
+            extra: expect.objectContaining({ reimbursementId, reason: "重复上传" }),
+          }),
+        }),
+      );
       expect(createdAttachments).toHaveLength(0);
     } finally {
       await app.close();
       await fs.rm(tempDir, { recursive: true, force: true });
     }
   });
+
+  it("rejects attachment deletion without a meaningful reason before mutation", async () => {
+    const { app, prisma, tempDir, reimbursementId } = await buildApp();
+
+    try {
+      const response = await app.inject({
+        method: "DELETE",
+        url: `/api/reimbursements/${reimbursementId}/attachments/bbbbbbbb-bbbb-4bbb-8bbb-000000000001`,
+        headers: { authorization: "Bearer test", "content-type": "application/json" },
+        payload: { reason: " " },
+      });
+
+      expect(response.statusCode).toBe(400);
+      expect(response.json().error.code).toBe("VALID_001");
+      expect(prisma.reimbursementAttachment.deleteMany).not.toHaveBeenCalled();
+      expect(prisma.auditLog.create).not.toHaveBeenCalled();
+    } finally {
+      await app.close();
+      await fs.rm(tempDir, { recursive: true, force: true });
+    }
+  });
 });