OAPERM1 收紧启用前权限冻结

server/tests/unit/routes/workflow.permissions.test.js

@@ -1,7 +1,12 @@
 const workflowRoutes = require("../../../src/routes/workflow");
 
 describe("Workflow Route Permissions", () => {
-  const { listAllowedActionsForTask, parseTaskListQuery } = workflowRoutes.__testables;
+  const {
+    buildWorkflowEntityVisibilityWhere,
+    canViewWorkflowEntityType,
+    listAllowedActionsForTask,
+    parseTaskListQuery,
+  } = workflowRoutes.__testables;
 
   it("allows leave approvers to act on leave tasks", () => {
     const actions = listAllowedActionsForTask(
@@ -133,4 +138,26 @@ describe("Workflow Route Permissions", () => {
   it("rejects unsupported workflow entityType filters", () => {
     expect(() => parseTaskListQuery({ entityType: "invoice_pool" })).toThrow("参数校验失败");
   });
+
+  it("hides travel workflow entities when travel is frozen for the actor", () => {
+    const request = { employee: { permissionCodes: [] } };
+
+    expect(canViewWorkflowEntityType(request, "travel_request")).toBe(false);
+    expect(buildWorkflowEntityVisibilityWhere(request)).toEqual({
+      entity_type: { notIn: ["travel_request"] },
+    });
+    expect(buildWorkflowEntityVisibilityWhere(request, "travel_request")).toEqual({
+      entity_type: "__forbidden__",
+    });
+  });
+
+  it("keeps travel workflow entities visible only for system settings holders", () => {
+    const request = { employee: { permissionCodes: ["system.settings"] } };
+
+    expect(canViewWorkflowEntityType(request, "travel_request")).toBe(true);
+    expect(buildWorkflowEntityVisibilityWhere(request)).toEqual({});
+    expect(buildWorkflowEntityVisibilityWhere(request, "travel_request")).toEqual({
+      entity_type: "travel_request",
+    });
+  });
 });