OAPERM1 收紧启用前权限冻结

server/tests/unit/routes/performance.reviews.test.js

@@ -276,7 +276,7 @@ async function buildApp({
 }
 
 describe("performance review routes", () => {
-  it("allows direct managers to score direct reports in active cycles", async () => {
+  it("rejects direct managers while performance management is frozen before launch", async () => {
     const { app, state, performanceReviewDimension } = await buildApp();
 
     const response = await app.inject({
@@ -292,23 +292,14 @@ describe("performance review routes", () => {
       },
     });
 
-    expect(response.statusCode).toBe(200);
-    expect(response.json().data).toMatchObject({
-      employeeId: EMPLOYEE_ID,
-      overallScore: 4.5,
-      comment: "表现稳定",
-      dimensions: [
-        { dimensionType: "work_quality", score: 4.5 },
-        { dimensionType: "teamwork", score: 4 },
-      ],
-    });
-    expect(state.reviews.find((item) => item.cycle_id === ACTIVE_CYCLE_ID && item.employee_id === EMPLOYEE_ID)).toBeTruthy();
-    expect(performanceReviewDimension.createMany).toHaveBeenCalledTimes(1);
+    expect(response.statusCode).toBe(403);
+    expect(state.reviews.find((item) => item.cycle_id === ACTIVE_CYCLE_ID && item.employee_id === EMPLOYEE_ID)).toBeFalsy();
+    expect(performanceReviewDimension.createMany).not.toHaveBeenCalled();
 
     await app.close();
   });
 
-  it("returns completed results only for self viewers", async () => {
+  it("rejects self viewers while performance management is frozen before launch", async () => {
     const { app } = await buildApp({
       actor: {
         id: EMPLOYEE_ID,
@@ -322,11 +313,7 @@ describe("performance review routes", () => {
       url: `/api/performance/employees/${EMPLOYEE_ID}/reviews`,
     });
 
-    expect(response.statusCode).toBe(200);
-    expect(response.json().data.viewerRole).toBe("self");
-    expect(response.json().data.items).toHaveLength(1);
-    expect(response.json().data.items[0].cycle.status).toBe("completed");
-    expect(response.json().data.items[0].review.overallScore).toBe(4);
+    expect(response.statusCode).toBe(403);
 
     await app.close();
   });
@@ -359,7 +346,7 @@ describe("performance review routes", () => {
       actor: {
         id: ADMIN_ID,
         department_id: DEPARTMENT_ID,
-        permissionCodes: ["system.users"],
+        permissionCodes: ["system.settings"],
       },
     });