R52 A1-A6：完成 AP 运营深度操作
- AP 概览页 Tab 工作台化（待付款/异常付款/风险标记/对账异常） - AP 导出端点支持 CSV/XLSX 与筛选 - 风险标记 resolve/dismiss 支持说明审计留痕 - 支付批次深链、高风险复核提示、对账确认权限收口 - OpenClaw 浏览器级回归全部通过
这个提交包含在：
@@ -0,0 +1,272 @@
|
||||
const Fastify = require("fastify");
|
||||
|
||||
const exportsRoutes = require("../../../src/routes/exports");
|
||||
|
||||
const ACTOR_ID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
|
||||
|
||||
function buildFeatureFlagRecord(flagKey) {
|
||||
return {
|
||||
id: `flag-${flagKey}`,
|
||||
flag_key: flagKey,
|
||||
override_mode: "force_on",
|
||||
rollout_type: "global",
|
||||
department_ids: [],
|
||||
note: "unit-test",
|
||||
version: 1,
|
||||
created_at: new Date("2026-04-06T08:00:00.000Z"),
|
||||
created_by: null,
|
||||
updated_at: new Date("2026-04-06T08:00:00.000Z"),
|
||||
updated_by: null,
|
||||
};
|
||||
}
|
||||
|
||||
function buildPendingBatch(overrides = {}) {
|
||||
return {
|
||||
id: "11111111-1111-4111-8111-111111111111",
|
||||
batch_no: "PB-20260406-001",
|
||||
entity_type: "travel_order",
|
||||
name: "差旅待付款批次",
|
||||
status: "reviewed",
|
||||
created_at: new Date("2026-04-06T09:00:00.000Z"),
|
||||
items: [{ amount: "1000.00" }, { amount: "560.50" }],
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
function buildFailedItem(overrides = {}) {
|
||||
return {
|
||||
id: "22222222-2222-4222-8222-222222222222",
|
||||
payment_batch_id: "11111111-1111-4111-8111-111111111111",
|
||||
entity_id: "33333333-3333-4333-8333-333333333333",
|
||||
entity_code: "TR-001",
|
||||
entity_title: "上海差旅订单",
|
||||
amount: "560.50",
|
||||
currency_code: "CNY",
|
||||
failure_code: "BANK_TIMEOUT",
|
||||
failure_message: "银行回执超时",
|
||||
created_at: new Date("2026-04-06T10:00:00.000Z"),
|
||||
payment_batch: {
|
||||
batch_no: "PB-20260406-001",
|
||||
entity_type: "travel_order",
|
||||
},
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
function buildRiskFlag(overrides = {}) {
|
||||
return {
|
||||
id: "44444444-4444-4444-8444-444444444444",
|
||||
entity_type: "travel_order",
|
||||
entity_id: "33333333-3333-4333-8333-333333333333",
|
||||
risk_code: "budget_exceeded",
|
||||
level: "high",
|
||||
title: "预算超支",
|
||||
detail: "差旅预算已超支",
|
||||
source: "budget_control",
|
||||
status: "open",
|
||||
created_at: new Date("2026-04-06T11:00:00.000Z"),
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
function buildAnomaly(overrides = {}) {
|
||||
return {
|
||||
id: "55555555-5555-4555-8555-555555555555",
|
||||
travel_reconciliation_batch_id: "66666666-6666-4666-8666-666666666666",
|
||||
travel_order_id: "77777777-7777-4777-8777-777777777777",
|
||||
travel_request_id: "88888888-8888-4888-8888-888888888888",
|
||||
match_status: "amount_mismatch",
|
||||
resolution_status: "pending",
|
||||
anomaly_code: "AMOUNT_MISMATCH",
|
||||
order_amount: "880.00",
|
||||
transaction_amount: "860.00",
|
||||
currency: "CNY",
|
||||
created_at: new Date("2026-04-06T12:00:00.000Z"),
|
||||
batch: {
|
||||
batch_no: "TRB-20260406-001",
|
||||
},
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
async function buildApp(options = {}) {
|
||||
const app = Fastify();
|
||||
const actor = options.actor ?? {
|
||||
id: ACTOR_ID,
|
||||
permissionCodes: ["payment.batch.manage"],
|
||||
};
|
||||
const paymentBatchFindMany = options.paymentBatchFindMany ?? vi.fn().mockResolvedValue([buildPendingBatch()]);
|
||||
const paymentBatchItemFindMany = options.paymentBatchItemFindMany ?? vi.fn().mockResolvedValue([buildFailedItem()]);
|
||||
const entityRiskFlagFindMany = options.entityRiskFlagFindMany ?? vi.fn().mockResolvedValue([buildRiskFlag()]);
|
||||
const travelReconciliationItemFindMany =
|
||||
options.travelReconciliationItemFindMany ?? vi.fn().mockResolvedValue([buildAnomaly()]);
|
||||
const auditCreate = options.auditCreate ?? vi.fn().mockResolvedValue({});
|
||||
|
||||
app.decorate("authenticate", async (request) => {
|
||||
request.employee = actor;
|
||||
});
|
||||
app.decorate("hasPermission", (employee, permissionCode) => {
|
||||
const permissionCodes = employee.permissionCodes ?? [];
|
||||
return permissionCodes.includes("*") || permissionCodes.includes(permissionCode);
|
||||
});
|
||||
app.decorate("requirePermission", (permissionCode) => async (request) => {
|
||||
request.employee = actor;
|
||||
const permissionCodes = actor.permissionCodes ?? [];
|
||||
if (!permissionCodes.includes("*") && !permissionCodes.includes(permissionCode)) {
|
||||
throw new Error(`unexpected permission check: ${permissionCode}`);
|
||||
}
|
||||
});
|
||||
app.decorate("config", {
|
||||
appTimezone: "Asia/Shanghai",
|
||||
paymentBatchEnabled: true,
|
||||
projectLinkingEnabled: true,
|
||||
});
|
||||
app.decorate("prisma", {
|
||||
featureFlag: {
|
||||
findUnique: vi.fn().mockImplementation(async ({ where }) => buildFeatureFlagRecord(where.flag_key)),
|
||||
},
|
||||
paymentBatch: {
|
||||
findMany: paymentBatchFindMany,
|
||||
},
|
||||
paymentBatchItem: {
|
||||
findMany: paymentBatchItemFindMany,
|
||||
},
|
||||
entityRiskFlag: {
|
||||
findMany: entityRiskFlagFindMany,
|
||||
},
|
||||
travelReconciliationItem: {
|
||||
findMany: travelReconciliationItemFindMany,
|
||||
},
|
||||
auditLog: {
|
||||
create: auditCreate,
|
||||
},
|
||||
contractRegistry: {
|
||||
count: vi.fn().mockResolvedValue(0),
|
||||
findMany: vi.fn().mockResolvedValue([]),
|
||||
},
|
||||
});
|
||||
|
||||
await app.register(exportsRoutes, { prefix: "/api" });
|
||||
return {
|
||||
app,
|
||||
paymentBatchFindMany,
|
||||
paymentBatchItemFindMany,
|
||||
entityRiskFlagFindMany,
|
||||
travelReconciliationItemFindMany,
|
||||
auditCreate,
|
||||
};
|
||||
}
|
||||
|
||||
describe("ap operations export route", () => {
|
||||
it("exports ap operations as csv with section blocks and filters", async () => {
|
||||
const {
|
||||
app,
|
||||
paymentBatchFindMany,
|
||||
entityRiskFlagFindMany,
|
||||
travelReconciliationItemFindMany,
|
||||
auditCreate,
|
||||
} = await buildApp();
|
||||
|
||||
const response = await app.inject({
|
||||
method: "POST",
|
||||
url: "/api/exports/ap-operations",
|
||||
payload: {
|
||||
format: "csv",
|
||||
pendingEntityType: "travel_order",
|
||||
pendingCreatedAtFrom: "2026-04-01",
|
||||
pendingCreatedAtTo: "2026-04-30",
|
||||
riskBucket: "budget_overspend",
|
||||
},
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(200);
|
||||
expect(response.headers["content-type"]).toContain("text/csv");
|
||||
expect(response.headers["content-disposition"]).toContain("ap-operations-");
|
||||
expect(response.body).toContain("待付款批次");
|
||||
expect(response.body).toContain("异常付款项");
|
||||
expect(response.body).toContain("风险标记");
|
||||
expect(response.body).toContain("对账异常");
|
||||
expect(response.body).toContain("预算超支");
|
||||
expect(paymentBatchFindMany).toHaveBeenCalledWith(
|
||||
expect.objectContaining({
|
||||
where: expect.objectContaining({
|
||||
entity_type: "travel_order",
|
||||
status: { in: ["draft", "reviewed", "failed"] },
|
||||
created_at: expect.objectContaining({
|
||||
gte: new Date("2026-04-01T00:00:00.000Z"),
|
||||
lte: new Date("2026-04-30T23:59:59.999Z"),
|
||||
}),
|
||||
}),
|
||||
}),
|
||||
);
|
||||
expect(entityRiskFlagFindMany).toHaveBeenCalledWith(
|
||||
expect.objectContaining({
|
||||
where: expect.objectContaining({
|
||||
status: "open",
|
||||
risk_code: { in: ["budget_exceeded", "budget_threshold_exceeded"] },
|
||||
}),
|
||||
}),
|
||||
);
|
||||
expect(travelReconciliationItemFindMany).toHaveBeenCalledWith(
|
||||
expect.objectContaining({
|
||||
where: expect.objectContaining({
|
||||
resolution_status: "pending",
|
||||
match_status: { not: "matched" },
|
||||
}),
|
||||
take: 50,
|
||||
}),
|
||||
);
|
||||
expect(auditCreate).toHaveBeenCalledWith(
|
||||
expect.objectContaining({
|
||||
data: expect.objectContaining({
|
||||
action: "EXPORT_AP_OPERATIONS",
|
||||
extra: expect.objectContaining({
|
||||
format: "csv",
|
||||
pendingEntityType: "travel_order",
|
||||
pendingCreatedAtFrom: "2026-04-01",
|
||||
pendingCreatedAtTo: "2026-04-30",
|
||||
riskBucket: "budget_overspend",
|
||||
pendingPaymentBatchTotal: 1,
|
||||
failedPaymentItemTotal: 1,
|
||||
openRiskFlagTotal: 1,
|
||||
reconciliationAnomalyTotal: 1,
|
||||
}),
|
||||
}),
|
||||
}),
|
||||
);
|
||||
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("exports ap operations as xlsx", async () => {
|
||||
const { app, auditCreate } = await buildApp();
|
||||
|
||||
const response = await app.inject({
|
||||
method: "POST",
|
||||
url: "/api/exports/ap-operations",
|
||||
payload: {
|
||||
format: "xlsx",
|
||||
},
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(200);
|
||||
expect(response.headers["content-type"]).toContain(
|
||||
"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
|
||||
);
|
||||
expect(response.headers["content-disposition"]).toContain("ap-operations-");
|
||||
expect(Buffer.from(response.rawPayload).length).toBeGreaterThan(0);
|
||||
expect(auditCreate).toHaveBeenCalledWith(
|
||||
expect.objectContaining({
|
||||
data: expect.objectContaining({
|
||||
action: "EXPORT_AP_OPERATIONS",
|
||||
extra: expect.objectContaining({
|
||||
format: "xlsx",
|
||||
riskBucket: "all",
|
||||
}),
|
||||
}),
|
||||
}),
|
||||
);
|
||||
|
||||
await app.close();
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,125 @@
|
||||
const Fastify = require("fastify");
|
||||
|
||||
const riskFlagsRoutes = require("../../../src/routes/riskFlags");
|
||||
|
||||
const ACTOR_ID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
|
||||
const RISK_FLAG_ID = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
|
||||
|
||||
function buildRiskFlag(overrides = {}) {
|
||||
return {
|
||||
id: RISK_FLAG_ID,
|
||||
entity_type: "reimbursement",
|
||||
entity_id: "cccccccc-cccc-4ccc-8ccc-cccccccccccc",
|
||||
risk_code: "budget_exceeded",
|
||||
level: "high",
|
||||
title: "预算已超支",
|
||||
detail: "部门预算已超预算阈值",
|
||||
source: "budget_control",
|
||||
status: "open",
|
||||
payload_json: null,
|
||||
created_at: new Date("2026-04-06T08:00:00.000Z"),
|
||||
created_by: null,
|
||||
resolved_at: null,
|
||||
resolved_by: null,
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
async function buildApp(options = {}) {
|
||||
const app = Fastify();
|
||||
const actor = options.actor ?? {
|
||||
id: ACTOR_ID,
|
||||
permissionCodes: ["risk.review.manage"],
|
||||
};
|
||||
const currentRecord = options.currentRecord ?? buildRiskFlag();
|
||||
const findUnique = options.findUnique ?? vi.fn().mockResolvedValue(currentRecord);
|
||||
const update = options.update ?? vi.fn().mockImplementation(async ({ data }) => ({
|
||||
...currentRecord,
|
||||
status: data.status,
|
||||
resolved_at: data.resolved_at,
|
||||
resolved_by: data.resolved_by,
|
||||
}));
|
||||
const auditCreate = options.auditCreate ?? vi.fn().mockResolvedValue({});
|
||||
|
||||
app.decorate("authenticate", async (request) => {
|
||||
request.employee = actor;
|
||||
});
|
||||
app.decorate("hasPermission", (employee, permissionCode) => {
|
||||
const permissionCodes = employee.permissionCodes ?? [];
|
||||
return permissionCodes.includes("*") || permissionCodes.includes(permissionCode);
|
||||
});
|
||||
app.decorate("prisma", {
|
||||
entityRiskFlag: {
|
||||
findMany: vi.fn().mockResolvedValue([]),
|
||||
findUnique,
|
||||
update,
|
||||
},
|
||||
auditLog: {
|
||||
create: auditCreate,
|
||||
},
|
||||
});
|
||||
|
||||
await app.register(riskFlagsRoutes, { prefix: "/api" });
|
||||
return { app, findUnique, update, auditCreate };
|
||||
}
|
||||
|
||||
describe("risk flags routes", () => {
|
||||
it("writes resolve note into audit extra while keeping response shape", async () => {
|
||||
const { app, update, auditCreate } = await buildApp();
|
||||
|
||||
const response = await app.inject({
|
||||
method: "POST",
|
||||
url: `/api/risk-flags/${RISK_FLAG_ID}/resolve`,
|
||||
payload: {
|
||||
note: "已人工核查，无需继续挂起",
|
||||
},
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(200);
|
||||
expect(update).toHaveBeenCalledWith(
|
||||
expect.objectContaining({
|
||||
where: { id: RISK_FLAG_ID },
|
||||
data: expect.objectContaining({
|
||||
status: "resolved",
|
||||
resolved_by: ACTOR_ID,
|
||||
}),
|
||||
}),
|
||||
);
|
||||
expect(auditCreate).toHaveBeenCalledWith(
|
||||
expect.objectContaining({
|
||||
data: expect.objectContaining({
|
||||
action: "ENTITY_RISK_FLAG_RESOLVED",
|
||||
extra: expect.objectContaining({
|
||||
riskCode: "budget_exceeded",
|
||||
note: "已人工核查，无需继续挂起",
|
||||
}),
|
||||
}),
|
||||
}),
|
||||
);
|
||||
|
||||
const payload = response.json();
|
||||
expect(payload.data.item.status).toBe("resolved");
|
||||
expect(payload.data.item.resolvedBy).toBe(ACTOR_ID);
|
||||
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("rejects unexpected fields for resolve action body", async () => {
|
||||
const { app, update, auditCreate } = await buildApp();
|
||||
|
||||
const response = await app.inject({
|
||||
method: "POST",
|
||||
url: `/api/risk-flags/${RISK_FLAG_ID}/resolve`,
|
||||
payload: {
|
||||
note: "ok",
|
||||
extra: "not-allowed",
|
||||
},
|
||||
});
|
||||
|
||||
expect(response.statusCode).toBe(400);
|
||||
expect(update).not.toHaveBeenCalled();
|
||||
expect(auditCreate).not.toHaveBeenCalled();
|
||||
|
||||
await app.close();
|
||||
});
|
||||
});
|
||||
在新工单中引用
屏蔽一个用户