修复报销附件上传与中文文件名（07-28-travel-reimbursement-guide）

server/tests/unit/routes/invoicePool.file.test.js

@@ -0,0 +1,80 @@
+const fs = require("node:fs/promises");
+const os = require("node:os");
+const path = require("node:path");
+
+const Fastify = require("fastify");
+
+const { AppError } = require("../../../src/utils/AppError");
+const { registerInvoicePoolReadRoutes } = require("../../../src/routes/invoicePool/read");
+const { signPayload } = require("../../../src/utils/signedUrl");
+
+const INVOICE_ID = "11111111-1111-4111-8111-111111111111";
+const ACTOR_ID = "22222222-2222-4222-8222-222222222222";
+const JWT_SECRET = "synthetic-test-secret";
+
+async function buildApp() {
+  const storageDir = await fs.mkdtemp(path.join(os.tmpdir(), "hyb-oa-invoice-file-"));
+  await fs.writeFile(path.join(storageDir, "invoice.pdf"), "%PDF synthetic\n%%EOF\n");
+
+  const prisma = {
+    invoicePool: {
+      findUnique: vi.fn().mockResolvedValue({
+        storage_path: "invoice.pdf",
+        mime_type: "application/pdf",
+        original_name: "住宿电子普通发票.pdf",
+      }),
+    },
+    auditLog: {
+      create: vi.fn().mockResolvedValue({ id: "audit-1" }),
+    },
+  };
+
+  const app = Fastify();
+  app.decorate("prisma", prisma);
+  app.decorate("config", { jwtSecret: JWT_SECRET, storageDir });
+  app.decorate("authenticate", async () => {});
+  app.decorate("hasPermission", () => false);
+  app.decorate("requirePermission", () => async () => {});
+  app.setErrorHandler((error, request, reply) => {
+    if (error instanceof AppError) {
+      return reply.status(error.statusCode).send({
+        requestId: request.id,
+        error: { code: error.code, message: error.message, details: error.details ?? {} },
+      });
+    }
+    return reply.status(500).send({
+      requestId: request.id,
+      error: { code: "SYS_001", message: "服务器内部错误", details: {} },
+    });
+  });
+  await app.register(registerInvoicePoolReadRoutes, { prefix: "/api" });
+  return { app, prisma, storageDir };
+}
+
+describe("GET /api/invoice-pool/:id/file", () => {
+  it("returns a Chinese PDF name through a safe inline Content-Disposition", async () => {
+    const { app, prisma, storageDir } = await buildApp();
+    const exp = Date.now() + 60_000;
+    const token = signPayload({ invoiceId: INVOICE_ID, actorId: ACTOR_ID, exp }, JWT_SECRET);
+
+    try {
+      const response = await app.inject({
+        method: "GET",
+        url: `/api/invoice-pool/${INVOICE_ID}/file?token=${encodeURIComponent(token)}`,
+      });
+
+      expect(response.statusCode).toBe(200);
+      expect(response.headers["content-type"]).toContain("application/pdf");
+      expect(response.headers["content-disposition"]).toBe(
+        "inline; filename=\"attachment.pdf\"; filename*=UTF-8''%E4%BD%8F%E5%AE%BF%E7%94%B5%E5%AD%90%E6%99%AE%E9%80%9A%E5%8F%91%E7%A5%A8.pdf",
+      );
+      expect(response.headers["content-disposition"]).not.toContain("住宿电子普通发票");
+      expect(prisma.auditLog.create).toHaveBeenCalledWith(
+        expect.objectContaining({ data: expect.objectContaining({ action: "INVOICE_FILE_DOWNLOADED" }) }),
+      );
+    } finally {
+      await app.close();
+      await fs.rm(storageDir, { recursive: true, force: true });
+    }
+  });
+});