R46 A1-A7：落地绩效考核模块首版

2026-03-29 16:30:29 +08:00
@@ -27,6 +27,32 @@ async function buildApp({ permissionCodes = ["system.users"], stats } = {}) {
    { employee_id: "emp-3" },
  ]);
  const certificateCount = vi.fn().mockResolvedValue(4);
+  const performanceCycleFindFirst = vi
+    .fn()
+    .mockResolvedValueOnce({
+      id: "cycle-active",
+      name: "2026 Q2",
+      cycle_type: "quarterly",
+      status: "active",
+      start_date: new Date("2026-04-01T00:00:00.000Z"),
+      end_date: new Date("2026-06-30T00:00:00.000Z"),
+    })
+    .mockResolvedValueOnce({
+      id: "cycle-completed",
+      name: "2026 Q1",
+      cycle_type: "quarterly",
+      status: "completed",
+      start_date: new Date("2026-01-01T00:00:00.000Z"),
+      end_date: new Date("2026-03-31T00:00:00.000Z"),
+    });
+  const performanceReviewAggregate = vi.fn().mockResolvedValue({
+    _avg: { overall_score: 4.2 },
+    _count: { _all: 5 },
+  });
+  const performanceReviewGroupBy = vi.fn().mockResolvedValue([
+    { overall_score: 4, _count: { _all: 3 } },
+    { overall_score: 4.5, _count: { _all: 2 } },
+  ]);

  app.decorate("prisma", {
    employee: {
@@ -47,6 +73,13 @@ async function buildApp({ permissionCodes = ["system.users"], stats } = {}) {
      count: stats?.employeeCertificateCount ?? certificateCount,
      findMany: vi.fn().mockResolvedValue([]),
    },
+    performanceReviewCycle: {
+      findFirst: stats?.performanceReviewCycleFindFirst ?? performanceCycleFindFirst,
+    },
+    performanceReview: {
+      aggregate: stats?.performanceReviewAggregate ?? performanceReviewAggregate,
+      groupBy: stats?.performanceReviewGroupBy ?? performanceReviewGroupBy,
+    },
  });
  app.decorate("authenticate", async (request) => {
    request.employee = {
@@ -79,12 +112,34 @@ async function buildApp({ permissionCodes = ["system.users"], stats } = {}) {
  });

  await app.register(employeesRoutes, { prefix: "/api" });
-  return { app, employeeGroupBy, employeeCount, departmentFindMany, contractCount, certificateGroupBy, certificateCount };
+  return {
+    app,
+    employeeGroupBy,
+    employeeCount,
+    departmentFindMany,
+    contractCount,
+    certificateGroupBy,
+    certificateCount,
+    performanceCycleFindFirst,
+    performanceReviewAggregate,
+    performanceReviewGroupBy,
+  };
 }

 describe("employees stats route", () => {
  it("returns aggregated employee stats for read-only viewers", async () => {
-    const { app, employeeGroupBy, employeeCount, departmentFindMany, contractCount, certificateGroupBy, certificateCount } = await buildApp({
+    const {
+      app,
+      employeeGroupBy,
+      employeeCount,
+      departmentFindMany,
+      contractCount,
+      certificateGroupBy,
+      certificateCount,
+      performanceCycleFindFirst,
+      performanceReviewAggregate,
+      performanceReviewGroupBy,
+    } = await buildApp({
      permissionCodes: ["report.dashboard.view"],
    });

@@ -109,12 +164,38 @@ describe("employees stats route", () => {
      validHolderCount: 3,
      expiringSoonCount: 4,
    });
+    expect(payload.data.performanceSummary).toEqual({
+      cycle: {
+        id: "cycle-active",
+        name: "2026 Q2",
+        cycleType: "quarterly",
+        status: "active",
+        startDate: "2026-04-01",
+        endDate: "2026-06-30",
+      },
+      averageScore: 4.2,
+      reviewedCount: 5,
+      distribution: [
+        { score: 1, count: 0 },
+        { score: 1.5, count: 0 },
+        { score: 2, count: 0 },
+        { score: 2.5, count: 0 },
+        { score: 3, count: 0 },
+        { score: 3.5, count: 0 },
+        { score: 4, count: 3 },
+        { score: 4.5, count: 2 },
+        { score: 5, count: 0 },
+      ],
+    });
    expect(employeeGroupBy).toHaveBeenCalledTimes(2);
    expect(employeeCount).toHaveBeenCalledTimes(2);
    expect(departmentFindMany).toHaveBeenCalledTimes(1);
    expect(contractCount).toHaveBeenCalledTimes(1);
    expect(certificateGroupBy).toHaveBeenCalledTimes(1);
    expect(certificateCount).toHaveBeenCalledTimes(1);
+    expect(performanceCycleFindFirst).toHaveBeenCalledTimes(2);
+    expect(performanceReviewAggregate).toHaveBeenCalledTimes(1);
+    expect(performanceReviewGroupBy).toHaveBeenCalledTimes(1);

    await app.close();
  });
@@ -0,0 +1,248 @@
+const crypto = require("node:crypto");
+const Fastify = require("fastify");
+
+const performanceRoutes = require("../../../src/routes/performance");
+const { AppError } = require("../../../src/utils/AppError");
+
+const ADMIN_ID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
+const DEPARTMENT_ID = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
+
+function buildFeatureFlagRecord() {
+  return {
+    id: "flag-1",
+    flag_key: "employee_lifecycle_v1",
+    override_mode: "force_on",
+    rollout_type: "global",
+    department_ids: [],
+    note: "",
+    version: 1,
+    created_at: new Date("2026-03-28T00:00:00.000Z"),
+    created_by: null,
+    updated_at: new Date("2026-03-28T00:00:00.000Z"),
+    updated_by: null,
+  };
+}
+
+function buildCycleRow(overrides = {}) {
+  return {
+    id: "11111111-1111-4111-8111-111111111111",
+    name: "2026 Q1",
+    cycle_type: "quarterly",
+    start_date: new Date("2026-01-01T00:00:00.000Z"),
+    end_date: new Date("2026-03-31T00:00:00.000Z"),
+    status: "draft",
+    activated_at: null,
+    completed_at: null,
+    created_at: new Date("2026-03-29T08:00:00.000Z"),
+    created_by: ADMIN_ID,
+    updated_at: new Date("2026-03-29T08:00:00.000Z"),
+    updated_by: ADMIN_ID,
+    ...overrides,
+  };
+}
+
+async function buildApp({ actor = { id: ADMIN_ID, department_id: DEPARTMENT_ID, permissionCodes: ["system.users"] } } = {}) {
+  const app = Fastify();
+  const state = {
+    cycles: [],
+  };
+  const idSequence = [
+    "11111111-1111-4111-8111-111111111111",
+    "22222222-2222-4222-8222-222222222222",
+    "33333333-3333-4333-8333-333333333333",
+  ];
+
+  const performanceReviewCycle = {
+    findMany: vi.fn(async () => [...state.cycles]),
+    findUnique: vi.fn(async ({ where }) => state.cycles.find((item) => item.id === where.id) ?? null),
+    findFirst: vi.fn(async ({ where }) => {
+      return (
+        state.cycles.find((item) => {
+          if (where.status && item.status !== where.status) {
+            return false;
+          }
+          if (where.id?.not && item.id === where.id.not) {
+            return false;
+          }
+          return true;
+        }) ?? null
+      );
+    }),
+    create: vi.fn(async ({ data }) => {
+      const cycle = buildCycleRow({
+        id: idSequence[state.cycles.length] ?? crypto.randomUUID(),
+        name: data.name,
+        cycle_type: data.cycle_type,
+        start_date: data.start_date,
+        end_date: data.end_date,
+        created_by: data.created_by,
+        updated_by: data.updated_by,
+      });
+      state.cycles.push(cycle);
+      return cycle;
+    }),
+    update: vi.fn(async ({ where, data }) => {
+      const index = state.cycles.findIndex((item) => item.id === where.id);
+      state.cycles[index] = {
+        ...state.cycles[index],
+        ...data,
+        updated_at: new Date("2026-03-29T09:00:00.000Z"),
+      };
+      return state.cycles[index];
+    }),
+  };
+
+  app.decorate("config", { appTimezone: "Asia/Shanghai", employeeLifecycleEnabled: true });
+  app.decorate("authenticate", async (request) => {
+    request.employee = actor;
+  });
+  app.decorate("requirePermission", (permissionCode) => async (request) => {
+    request.employee = actor;
+    const codes = actor.permissionCodes ?? [];
+    if (!codes.includes("*") && !codes.includes(permissionCode)) {
+      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
+    }
+  });
+  app.decorate("hasPermission", (employee, permissionCode) => {
+    const codes = employee.permissionCodes ?? [];
+    return codes.includes("*") || codes.includes(permissionCode);
+  });
+  app.decorate("prisma", {
+    featureFlag: {
+      findUnique: vi.fn().mockResolvedValue(buildFeatureFlagRecord()),
+    },
+    performanceReviewCycle,
+    auditLog: {
+      create: vi.fn().mockResolvedValue({}),
+    },
+  });
+  app.setErrorHandler((error, request, reply) => {
+    reply.status(error.statusCode || 500).send({
+      requestId: request.id,
+      error: {
+        code: error.code || "SYS_001",
+        message: error.message,
+        details: error.details ?? null,
+      },
+    });
+  });
+
+  await app.register(performanceRoutes, { prefix: "/api" });
+  return { app, state, performanceReviewCycle };
+}
+
+describe("performance cycle routes", () => {
+  it("allows admins to create, update, activate and complete cycles with a single active cycle guard", async () => {
+    const { app, state, performanceReviewCycle } = await buildApp();
+
+    const createResponse = await app.inject({
+      method: "POST",
+      url: "/api/performance/cycles",
+      payload: {
+        name: "2026 Q1",
+        cycleType: "quarterly",
+        startDate: "2026-01-01",
+        endDate: "2026-03-31",
+      },
+    });
+
+    expect(createResponse.statusCode).toBe(200);
+    expect(createResponse.json().data).toMatchObject({
+      name: "2026 Q1",
+      cycleType: "quarterly",
+      status: "draft",
+    });
+
+    const patchResponse = await app.inject({
+      method: "PATCH",
+      url: `/api/performance/cycles/${state.cycles[0].id}`,
+      payload: {
+        name: "2026 Q1 调整版",
+        endDate: "2026-04-05",
+      },
+    });
+
+    expect(patchResponse.statusCode).toBe(200);
+    expect(patchResponse.json().data).toMatchObject({
+      name: "2026 Q1 调整版",
+      endDate: "2026-04-05",
+      status: "draft",
+    });
+
+    const activateResponse = await app.inject({
+      method: "PATCH",
+      url: `/api/performance/cycles/${state.cycles[0].id}`,
+      payload: {
+        status: "active",
+      },
+    });
+
+    expect(activateResponse.statusCode).toBe(200);
+    expect(activateResponse.json().data).toMatchObject({
+      status: "active",
+    });
+
+    const secondCreateResponse = await app.inject({
+      method: "POST",
+      url: "/api/performance/cycles",
+      payload: {
+        name: "2026 Q2",
+        cycleType: "quarterly",
+        startDate: "2026-04-01",
+        endDate: "2026-06-30",
+      },
+    });
+
+    expect(secondCreateResponse.statusCode).toBe(200);
+
+    const secondActivateResponse = await app.inject({
+      method: "PATCH",
+      url: `/api/performance/cycles/${state.cycles[1].id}`,
+      payload: {
+        status: "active",
+      },
+    });
+
+    expect(secondActivateResponse.statusCode).toBe(409);
+    expect(secondActivateResponse.json().error.details).toMatchObject({
+      cycle: "active_cycle_exists",
+      activeCycleId: state.cycles[0].id,
+    });
+
+    const completeResponse = await app.inject({
+      method: "PATCH",
+      url: `/api/performance/cycles/${state.cycles[0].id}`,
+      payload: {
+        status: "completed",
+      },
+    });
+
+    expect(completeResponse.statusCode).toBe(200);
+    expect(completeResponse.json().data).toMatchObject({
+      status: "completed",
+    });
+    expect(performanceReviewCycle.create).toHaveBeenCalledTimes(2);
+    expect(performanceReviewCycle.update).toHaveBeenCalledTimes(3);
+
+    await app.close();
+  });
+
+  it("rejects non-admin users", async () => {
+    const { app } = await buildApp({
+      actor: {
+        id: "employee-1",
+        department_id: DEPARTMENT_ID,
+        permissionCodes: ["employee"],
+      },
+    });
+
+    const response = await app.inject({
+      method: "GET",
+      url: "/api/performance/cycles",
+    });
+
+    expect(response.statusCode).toBe(403);
+
+    await app.close();
+  });
+});
@@ -0,0 +1,396 @@
+const Fastify = require("fastify");
+
+const performanceRoutes = require("../../../src/routes/performance");
+const { AppError } = require("../../../src/utils/AppError");
+
+const ADMIN_ID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
+const MANAGER_ID = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
+const EMPLOYEE_ID = "cccccccc-cccc-4ccc-8ccc-cccccccccccc";
+const OTHER_EMPLOYEE_ID = "dddddddd-dddd-4ddd-8ddd-dddddddddddd";
+const DEPARTMENT_ID = "eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee";
+const ACTIVE_CYCLE_ID = "11111111-1111-4111-8111-111111111111";
+const COMPLETED_CYCLE_ID = "22222222-2222-4222-8222-222222222222";
+
+function buildFeatureFlagRecord() {
+  return {
+    id: "flag-1",
+    flag_key: "employee_lifecycle_v1",
+    override_mode: "force_on",
+    rollout_type: "global",
+    department_ids: [],
+    note: "",
+    version: 1,
+    created_at: new Date("2026-03-28T00:00:00.000Z"),
+    created_by: null,
+    updated_at: new Date("2026-03-28T00:00:00.000Z"),
+    updated_by: null,
+  };
+}
+
+function buildCycleRow(overrides = {}) {
+  return {
+    id: ACTIVE_CYCLE_ID,
+    name: "2026 Q2",
+    cycle_type: "quarterly",
+    start_date: new Date("2026-04-01T00:00:00.000Z"),
+    end_date: new Date("2026-06-30T00:00:00.000Z"),
+    status: "active",
+    activated_at: new Date("2026-04-01T00:00:00.000Z"),
+    completed_at: null,
+    created_at: new Date("2026-03-29T08:00:00.000Z"),
+    created_by: ADMIN_ID,
+    updated_at: new Date("2026-03-29T08:00:00.000Z"),
+    updated_by: ADMIN_ID,
+    ...overrides,
+  };
+}
+
+function buildEmployeeRow(overrides = {}) {
+  return {
+    id: EMPLOYEE_ID,
+    employee_no: "E001",
+    name: "Alice",
+    title: "专员",
+    status: "active",
+    direct_manager_id: MANAGER_ID,
+    avatar_path: null,
+    department: { id: DEPARTMENT_ID, name: "行政部" },
+    ...overrides,
+  };
+}
+
+function buildReviewRow(overrides = {}) {
+  return {
+    id: "33333333-3333-4333-8333-333333333333",
+    cycle_id: COMPLETED_CYCLE_ID,
+    employee_id: EMPLOYEE_ID,
+    reviewer_employee_id: MANAGER_ID,
+    overall_score: 4,
+    comment: "完成良好",
+    created_at: new Date("2026-03-28T08:00:00.000Z"),
+    created_by: MANAGER_ID,
+    updated_at: new Date("2026-03-28T08:00:00.000Z"),
+    updated_by: MANAGER_ID,
+    ...overrides,
+  };
+}
+
+async function buildApp({
+  actor = { id: MANAGER_ID, department_id: DEPARTMENT_ID, permissionCodes: ["employee"] },
+} = {}) {
+  const app = Fastify();
+  const state = {
+    cycles: [
+      buildCycleRow(),
+      buildCycleRow({
+        id: COMPLETED_CYCLE_ID,
+        name: "2026 Q1",
+        start_date: new Date("2026-01-01T00:00:00.000Z"),
+        end_date: new Date("2026-03-31T00:00:00.000Z"),
+        status: "completed",
+        activated_at: new Date("2026-01-01T00:00:00.000Z"),
+        completed_at: new Date("2026-03-31T10:00:00.000Z"),
+      }),
+    ],
+    employees: [
+      buildEmployeeRow(),
+      buildEmployeeRow({
+        id: MANAGER_ID,
+        employee_no: "M001",
+        name: "Bob",
+        title: "经理",
+        direct_manager_id: null,
+      }),
+      buildEmployeeRow({
+        id: OTHER_EMPLOYEE_ID,
+        employee_no: "E002",
+        name: "Carol",
+        direct_manager_id: ADMIN_ID,
+      }),
+    ],
+    reviews: [buildReviewRow()],
+    dimensions: [
+      {
+        id: "dim-1",
+        review_id: "33333333-3333-4333-8333-333333333333",
+        dimension_type: "work_quality",
+        score: 4,
+      },
+    ],
+  };
+
+  function hydrateReview(review) {
+    const employee = state.employees.find((item) => item.id === review.employee_id);
+    const reviewer = state.employees.find((item) => item.id === review.reviewer_employee_id);
+    return {
+      ...review,
+      employee,
+      reviewer_employee: reviewer
+        ? {
+            id: reviewer.id,
+            employee_no: reviewer.employee_no,
+            name: reviewer.name,
+          }
+        : null,
+      dimensions: state.dimensions.filter((item) => item.review_id === review.id),
+    };
+  }
+
+  const performanceReview = {
+    findMany: vi.fn(async ({ where }) => {
+      let rows = [...state.reviews];
+      if (typeof where?.cycle_id === "string") {
+        rows = rows.filter((item) => item.cycle_id === where.cycle_id);
+      }
+      if (where?.cycle_id?.in) {
+        rows = rows.filter((item) => where.cycle_id.in.includes(item.cycle_id));
+      }
+      if (where?.employee_id) {
+        rows = rows.filter((item) => item.employee_id === where.employee_id);
+      }
+      return rows.map(hydrateReview);
+    }),
+    findFirst: vi.fn(async ({ where }) => {
+      const review = state.reviews.find((item) => item.cycle_id === where.cycle_id && item.employee_id === where.employee_id);
+      return review ? hydrateReview(review) : null;
+    }),
+    findUnique: vi.fn(async ({ where }) => {
+      const review = state.reviews.find((item) => item.id === where.id);
+      return review ? hydrateReview(review) : null;
+    }),
+    create: vi.fn(async ({ data }) => {
+      const review = buildReviewRow({
+        id: "44444444-4444-4444-8444-444444444444",
+        cycle_id: data.cycle_id,
+        employee_id: data.employee_id,
+        reviewer_employee_id: data.reviewer_employee_id,
+        overall_score: data.overall_score,
+        comment: data.comment,
+        created_by: data.created_by,
+        updated_by: data.updated_by,
+      });
+      state.reviews.push(review);
+      return review;
+    }),
+    update: vi.fn(async ({ where, data }) => {
+      const index = state.reviews.findIndex((item) => item.id === where.id);
+      state.reviews[index] = {
+        ...state.reviews[index],
+        ...data,
+      };
+      return state.reviews[index];
+    }),
+  };
+
+  const performanceReviewDimension = {
+    deleteMany: vi.fn(async ({ where }) => {
+      state.dimensions = state.dimensions.filter((item) => item.review_id !== where.review_id);
+      return { count: 1 };
+    }),
+    createMany: vi.fn(async ({ data }) => {
+      state.dimensions.push(
+        ...data.map((item, index) => ({
+          id: `dim-${state.dimensions.length + index + 1}`,
+          review_id: item.review_id,
+          dimension_type: item.dimension_type,
+          score: item.score,
+        })),
+      );
+      return { count: data.length };
+    }),
+  };
+
+  app.decorate("config", { appTimezone: "Asia/Shanghai", employeeLifecycleEnabled: true });
+  app.decorate("authenticate", async (request) => {
+    request.employee = actor;
+  });
+  app.decorate("requirePermission", (permissionCode) => async (request) => {
+    request.employee = actor;
+    const codes = actor.permissionCodes ?? [];
+    if (!codes.includes("*") && !codes.includes(permissionCode)) {
+      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
+    }
+  });
+  app.decorate("hasPermission", (employee, permissionCode) => {
+    const codes = employee.permissionCodes ?? [];
+    return codes.includes("*") || codes.includes(permissionCode);
+  });
+  app.decorate("prisma", {
+    featureFlag: {
+      findUnique: vi.fn().mockResolvedValue(buildFeatureFlagRecord()),
+    },
+    employee: {
+      findUnique: vi.fn(async ({ where }) => state.employees.find((item) => item.id === where.id) ?? null),
+      findMany: vi.fn(async ({ where }) => {
+        if (where?.status === "active") {
+          return state.employees.filter((item) => item.status === "active");
+        }
+        return [...state.employees];
+      }),
+    },
+    performanceReviewCycle: {
+      findMany: vi.fn(async ({ where }) =>
+        state.cycles.filter((item) => {
+          if (!where) {
+            return true;
+          }
+          if (where?.status?.in) {
+            return where.status.in.includes(item.status);
+          }
+          return item.status === where?.status;
+        }),
+      ),
+      findUnique: vi.fn(async ({ where }) => state.cycles.find((item) => item.id === where.id) ?? null),
+      findFirst: vi.fn(async ({ where }) =>
+        state.cycles.find((item) => {
+          if (where?.status && item.status !== where.status) {
+            return false;
+          }
+          if (where?.id?.not && item.id === where.id.not) {
+            return false;
+          }
+          return true;
+        }) ?? null,
+      ),
+    },
+    performanceReview,
+    performanceReviewDimension,
+    auditLog: {
+      create: vi.fn().mockResolvedValue({}),
+    },
+    $transaction: vi.fn(async (callback) => callback(app.prisma)),
+  });
+  app.setErrorHandler((error, request, reply) => {
+    reply.status(error.statusCode || 500).send({
+      requestId: request.id,
+      error: {
+        code: error.code || "SYS_001",
+        message: error.message,
+        details: error.details ?? null,
+      },
+    });
+  });
+
+  await app.register(performanceRoutes, { prefix: "/api" });
+  return { app, state, performanceReview, performanceReviewDimension };
+}
+
+describe("performance review routes", () => {
+  it("allows direct managers to score direct reports in active cycles", async () => {
+    const { app, state, performanceReviewDimension } = await buildApp();
+
+    const response = await app.inject({
+      method: "PUT",
+      url: `/api/performance/cycles/${ACTIVE_CYCLE_ID}/reviews/${EMPLOYEE_ID}`,
+      payload: {
+        overallScore: 4.5,
+        comment: "表现稳定",
+        dimensions: [
+          { dimensionType: "work_quality", score: 4.5 },
+          { dimensionType: "teamwork", score: 4 },
+        ],
+      },
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json().data).toMatchObject({
+      employeeId: EMPLOYEE_ID,
+      overallScore: 4.5,
+      comment: "表现稳定",
+      dimensions: [
+        { dimensionType: "work_quality", score: 4.5 },
+        { dimensionType: "teamwork", score: 4 },
+      ],
+    });
+    expect(state.reviews.find((item) => item.cycle_id === ACTIVE_CYCLE_ID && item.employee_id === EMPLOYEE_ID)).toBeTruthy();
+    expect(performanceReviewDimension.createMany).toHaveBeenCalledTimes(1);
+
+    await app.close();
+  });
+
+  it("returns completed results only for self viewers", async () => {
+    const { app } = await buildApp({
+      actor: {
+        id: EMPLOYEE_ID,
+        department_id: DEPARTMENT_ID,
+        permissionCodes: ["employee"],
+      },
+    });
+
+    const response = await app.inject({
+      method: "GET",
+      url: `/api/performance/employees/${EMPLOYEE_ID}/reviews`,
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json().data.viewerRole).toBe("self");
+    expect(response.json().data.items).toHaveLength(1);
+    expect(response.json().data.items[0].cycle.status).toBe("completed");
+    expect(response.json().data.items[0].review.overallScore).toBe(4);
+
+    await app.close();
+  });
+
+  it("rejects non-manager non-admin access to other employees", async () => {
+    const { app } = await buildApp({
+      actor: {
+        id: OTHER_EMPLOYEE_ID,
+        department_id: DEPARTMENT_ID,
+        permissionCodes: ["employee"],
+      },
+    });
+
+    const response = await app.inject({
+      method: "PUT",
+      url: `/api/performance/cycles/${ACTIVE_CYCLE_ID}/reviews/${EMPLOYEE_ID}`,
+      payload: {
+        overallScore: 4,
+        comment: "无权限",
+      },
+    });
+
+    expect(response.statusCode).toBe(403);
+
+    await app.close();
+  });
+
+  it("blocks updates on completed cycles and lets admins inspect cycle overviews", async () => {
+    const { app } = await buildApp({
+      actor: {
+        id: ADMIN_ID,
+        department_id: DEPARTMENT_ID,
+        permissionCodes: ["system.users"],
+      },
+    });
+
+    const overviewResponse = await app.inject({
+      method: "GET",
+      url: `/api/performance/cycles/${ACTIVE_CYCLE_ID}/reviews`,
+    });
+
+    expect(overviewResponse.statusCode).toBe(200);
+    expect(overviewResponse.json().data.items).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          employee: expect.objectContaining({ id: EMPLOYEE_ID }),
+        }),
+      ]),
+    );
+
+    const completedResponse = await app.inject({
+      method: "PUT",
+      url: `/api/performance/cycles/${COMPLETED_CYCLE_ID}/reviews/${EMPLOYEE_ID}`,
+      payload: {
+        overallScore: 4.5,
+        comment: "不允许修改",
+      },
+    });
+
+    expect(completedResponse.statusCode).toBe(409);
+    expect(completedResponse.json().error.details).toMatchObject({
+      cycle: "active_cycle_required",
+    });
+
+    await app.close();
+  });
+});