OAPERM1 收紧启用前权限冻结

server/src/routes/payroll.js

@@ -21,6 +21,7 @@ const DATE_SCHEMA = z.string().regex(/^\d{4}-\d{2}-\d{2}$/);
 const PAY_MONTH_SCHEMA = z.string().regex(/^\d{4}-\d{2}$/);
 const MONEY_INPUT_SCHEMA = z.union([z.number(), z.string()]);
 const SALARY_ITEM_TYPE_SCHEMA = z.enum(["earning", "deduction"]);
+const PAYROLL_MANAGE_PERMISSION = "system.settings";
 
 const SALARY_ITEM_CREATE_SCHEMA = z
   .object({
@@ -232,14 +233,14 @@ async function ensurePayslipExists(prisma, payslipId) {
 }
 
 function canViewEmployeePayslips(fastify, request, employeeId) {
-  return request.employee.id === employeeId || fastify.hasPermission(request.employee, "system.users");
+  return request.employee.id === employeeId || fastify.hasPermission(request.employee, PAYROLL_MANAGE_PERMISSION);
 }
 
 async function payrollRoutes(fastify) {
   fastify.get(
     "/payroll/items",
     {
-      preHandler: fastify.requirePermission("system.users"),
+      preHandler: fastify.requirePermission(PAYROLL_MANAGE_PERMISSION),
     },
     async (request, reply) => {
       const items = await fastify.prisma.salaryItem.findMany({
@@ -255,7 +256,7 @@ async function payrollRoutes(fastify) {
   fastify.post(
     "/payroll/items",
     {
-      preHandler: fastify.requirePermission("system.users"),
+      preHandler: fastify.requirePermission(PAYROLL_MANAGE_PERMISSION),
     },
     async (request, reply) => {
       const body = parseBody(SALARY_ITEM_CREATE_SCHEMA, request.body);
@@ -300,7 +301,7 @@ async function payrollRoutes(fastify) {
   fastify.patch(
     "/payroll/items/:itemId",
     {
-      preHandler: fastify.requirePermission("system.users"),
+      preHandler: fastify.requirePermission(PAYROLL_MANAGE_PERMISSION),
     },
     async (request, reply) => {
       const itemId = parseId(request.params?.itemId);
@@ -347,7 +348,7 @@ async function payrollRoutes(fastify) {
   fastify.get(
     "/payroll/employees/:employeeId/profile",
     {
-      preHandler: fastify.requirePermission("system.users"),
+      preHandler: fastify.requirePermission(PAYROLL_MANAGE_PERMISSION),
     },
     async (request, reply) => {
       const employeeId = parseId(request.params?.employeeId);
@@ -375,7 +376,7 @@ async function payrollRoutes(fastify) {
   fastify.put(
     "/payroll/employees/:employeeId/profile",
     {
-      preHandler: fastify.requirePermission("system.users"),
+      preHandler: fastify.requirePermission(PAYROLL_MANAGE_PERMISSION),
     },
     async (request, reply) => {
       const employeeId = parseId(request.params?.employeeId);
@@ -461,7 +462,7 @@ async function payrollRoutes(fastify) {
       }
       await ensureEmployeeExists(fastify.prisma, employeeId);
 
-      const isAdmin = fastify.hasPermission(request.employee, "system.users");
+      const isAdmin = fastify.hasPermission(request.employee, PAYROLL_MANAGE_PERMISSION);
       const payslips = await fastify.prisma.payslip.findMany({
         where: {
           employee_id: employeeId,
@@ -496,7 +497,7 @@ async function payrollRoutes(fastify) {
   fastify.get(
     "/payroll/payslips",
     {
-      preHandler: fastify.requirePermission("system.users"),
+      preHandler: fastify.requirePermission(PAYROLL_MANAGE_PERMISSION),
     },
     async (request, reply) => {
       const query = parseQuery(PAYSLIP_QUERY_SCHEMA, request.query);
@@ -519,7 +520,7 @@ async function payrollRoutes(fastify) {
   fastify.post(
     "/payroll/payslips/generate",
     {
-      preHandler: fastify.requirePermission("system.users"),
+      preHandler: fastify.requirePermission(PAYROLL_MANAGE_PERMISSION),
     },
     async (request, reply) => {
       const body = parseBody(PAYSLIP_GENERATE_SCHEMA, request.body);
@@ -679,7 +680,7 @@ async function payrollRoutes(fastify) {
   fastify.patch(
     "/payroll/payslips/:payslipId",
     {
-      preHandler: fastify.requirePermission("system.users"),
+      preHandler: fastify.requirePermission(PAYROLL_MANAGE_PERMISSION),
     },
     async (request, reply) => {
       const payslipId = parseId(request.params?.payslipId);
@@ -753,7 +754,7 @@ async function payrollRoutes(fastify) {
   fastify.post(
     "/payroll/payslips/issue",
     {
-      preHandler: fastify.requirePermission("system.users"),
+      preHandler: fastify.requirePermission(PAYROLL_MANAGE_PERMISSION),
     },
     async (request, reply) => {
       const body = parseBody(PAYSLIP_ISSUE_SCHEMA, request.body);