完成五人团队正式内用最小收口（07-18-small-team-internal-readiness）

server/tests/unit/utils/workflow.test.js

@@ -86,6 +86,32 @@ describe("workflow assignee resolution", () => {
     it("throws if rule is empty or missing roles", () => {
       expect(() => workflowUtils.buildWorkflowStepsFromApprovalRule({})).toThrow(/参数校验失败/);
     });
+
+    it.each(["admin", "system_admin"])(
+      "rejects protected system role %s in approval rules",
+      (roleCode) => {
+        expect(() => workflowUtils.buildWorkflowStepsFromApprovalRule({ level1_role: roleCode }))
+          .toThrow(/参数校验失败/);
+      },
+    );
+  });
+
+  describe("getWorkflowStepsSnapshot", () => {
+    it.each(["admin", "system_admin"])(
+      "rejects protected system role %s in historical snapshots",
+      (roleCode) => {
+        expect(() => workflowUtils.getWorkflowStepsSnapshot({
+          context_data: {
+            workflow_steps_snapshot: [
+              {
+                id: `approval_1_${roleCode}`,
+                assignee_rule: { type: "role", value: roleCode },
+              },
+            ],
+          },
+        })).toThrow(/参数校验失败/);
+      },
+    );
   });
 
   describe("buildApprovalWorkflowSnapshot", () => {
@@ -265,6 +291,17 @@ describe("workflow assignee resolution", () => {
       await expect(workflowUtils.resolveAssigneeFromRule(null)).rejects.toThrow(/参数校验失败/);
       await expect(workflowUtils.resolveAssigneeFromRule({ type: "unknown" })).rejects.toThrow(/参数校验失败/);
     });
+
+    it.each(["admin", "system_admin"])(
+      "rejects protected system role %s during runtime resolution",
+      async (roleCode) => {
+        await expect(
+          workflowUtils.resolveAssigneeFromRule({ type: "role", value: roleCode }),
+        ).rejects.toMatchObject({
+          details: { workflow: "unsupported_business_approval_role" },
+        });
+      },
+    );
   });
 
   describe("toMoneyString", () => {