OAPERM1 收紧启用前权限冻结

server/tests/unit/routes/workflow.transfer.test.js

@@ -159,7 +159,7 @@ async function buildApp({ prisma, employee }) {
 }
 
 describe("workflow transfer route", () => {
-  it.each(["leave", "purchase_request", "travel_request"])(
+  it.each(["leave", "purchase_request"])(
     "allows transfer for %s when target has matching approve permission",
     async (entityType) => {
       const tx = buildTx({ entityType });
@@ -217,6 +217,33 @@ describe("workflow transfer route", () => {
     },
   );
 
+  it("rejects transfer for frozen travel_request tasks", async () => {
+    const tx = buildTx({ entityType: "travel_request" });
+    const app = await buildApp({
+      prisma: buildPrisma(tx),
+      employee: {
+        id: "actor-1",
+        roleCodes: ["manager"],
+        permissionCodes: ["expense.transfer"],
+      },
+    });
+
+    const response = await app.inject({
+      method: "POST",
+      url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
+      headers: { authorization: "Bearer test" },
+      payload: {
+        toApproverId: "44444444-4444-4444-8444-444444444444",
+        reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
+      },
+    });
+
+    expect(response.statusCode).toBe(403);
+    expect(tx.workflowTask.update).not.toHaveBeenCalled();
+
+    await app.close();
+  });
+
   it("rejects target approver without matching entity approve permission", async () => {
     const tx = buildTx({ entityType: "leave", targetRoleCode: "finance" });
     const app = await buildApp({