R36-4 放开跨域转审并同步回归

server/tests/unit/routes/workflow.permissions.test.js

@@ -55,7 +55,7 @@ describe("Workflow Route Permissions", () => {
     expect(actions).toEqual(["approve", "reject", "return"]);
   });
 
-  it("keeps transfer action limited to reimbursement tasks", () => {
+  it("allows transfer on approval tasks when actor also has expense.transfer", () => {
     const reimbursementActions = listAllowedActionsForTask(
       { employee: { permissionCodes: ["expense.approve", "expense.transfer"] } },
       {
@@ -72,8 +72,39 @@ describe("Workflow Route Permissions", () => {
       },
       true,
     );
+    const purchaseActions = listAllowedActionsForTask(
+      { employee: { permissionCodes: ["procurement.approve", "expense.transfer"] } },
+      {
+        status: "pending",
+        workflow_instance: { entity_type: "purchase_request" },
+      },
+      true,
+    );
+    const travelActions = listAllowedActionsForTask(
+      { employee: { permissionCodes: ["travel.approve", "expense.transfer"] } },
+      {
+        status: "pending",
+        workflow_instance: { entity_type: "travel_request" },
+      },
+      true,
+    );
 
     expect(reimbursementActions).toContain("transfer");
-    expect(leaveActions).not.toContain("transfer");
+    expect(leaveActions).toContain("transfer");
+    expect(purchaseActions).toContain("transfer");
+    expect(travelActions).toContain("transfer");
+  });
+
+  it("does not allow transfer without matching approve permission", () => {
+    const actions = listAllowedActionsForTask(
+      { employee: { permissionCodes: ["expense.transfer"] } },
+      {
+        status: "pending",
+        workflow_instance: { entity_type: "leave" },
+      },
+      true,
+    );
+
+    expect(actions).toEqual([]);
   });
 });

server/tests/unit/routes/workflow.transfer.test.js

@@ -0,0 +1,255 @@
+const Fastify = require("fastify");
+
+const { AppError } = require("../../../src/utils/AppError");
+const workflowRoutes = require("../../../src/routes/workflow");
+
+function buildTaskRow() {
+  return {
+    id: "11111111-1111-4111-8111-111111111111",
+    instance_id: "22222222-2222-4222-8222-222222222222",
+    step_id: "manager_approval",
+    step_name: "经理审批",
+    assignee_id: "actor-1",
+    assignee_role: null,
+    status: "pending",
+  };
+}
+
+function buildWorkflowInstance(entityType) {
+  return {
+    id: "22222222-2222-4222-8222-222222222222",
+    entity_type: entityType,
+    entity_id: "33333333-3333-4333-8333-333333333333",
+    current_step_id: "manager_approval",
+    context_data: {},
+    workflow_definition: {
+      definition_json: {
+        steps: [],
+      },
+    },
+  };
+}
+
+function buildTarget(roleCode) {
+  return {
+    id: "44444444-4444-4444-8444-444444444444",
+    status: "active",
+    roles: [
+      {
+        role_code: roleCode,
+      },
+    ],
+  };
+}
+
+function buildTx({ entityType, targetRoleCode = "manager", transferCount = 0 }) {
+  return {
+    $queryRaw: vi.fn().mockResolvedValue([buildTaskRow()]),
+    workflowInstance: {
+      findUnique: vi.fn().mockResolvedValue(buildWorkflowInstance(entityType)),
+    },
+    employee: {
+      findUnique: vi.fn().mockResolvedValue(buildTarget(targetRoleCode)),
+    },
+    workflowTask: {
+      update: vi.fn().mockResolvedValue({ id: "11111111-1111-4111-8111-111111111111" }),
+    },
+    workflowHistory: {
+      count: vi.fn().mockResolvedValue(transferCount),
+      create: vi.fn().mockResolvedValue({ id: "history-1" }),
+    },
+    approvalTransfer: {
+      create: vi.fn().mockResolvedValue({ id: "transfer-1" }),
+    },
+  };
+}
+
+function buildPrisma(tx) {
+  return {
+    $transaction: vi.fn().mockImplementation((callback) => callback(tx)),
+  };
+}
+
+async function buildApp({ prisma, employee }) {
+  const app = Fastify();
+
+  app.decorate("prisma", prisma);
+  app.decorate("config", {});
+  app.decorate("authenticate", async (request) => {
+    if (!request.headers.authorization) {
+      throw new AppError({
+        code: "AUTH_001",
+        message: "未登录",
+        statusCode: 401,
+      });
+    }
+
+    request.employee = employee;
+  });
+  app.decorate("hasPermission", (actor, permissionCode) => {
+    return (actor?.permissionCodes ?? []).includes("*") || (actor?.permissionCodes ?? []).includes(permissionCode);
+  });
+  app.decorate("requirePermission", (permissionCode) => async (request) => {
+    await app.authenticate(request);
+    if (!app.hasPermission(request.employee, permissionCode)) {
+      throw new AppError({
+        code: "PERM_001",
+        message: "无权限",
+        statusCode: 403,
+        details: { permission: permissionCode },
+      });
+    }
+  });
+
+  app.setErrorHandler((error, request, reply) => {
+    if (error instanceof AppError) {
+      return reply.status(error.statusCode).send({
+        requestId: request.id,
+        error: {
+          code: error.code,
+          message: error.message,
+          details: error.details ?? {},
+        },
+      });
+    }
+
+    return reply.status(500).send({
+      requestId: request.id,
+      error: { code: "SYS_001", message: "服务器内部错误", details: {} },
+    });
+  });
+
+  await app.register(workflowRoutes, { prefix: "/api" });
+  return app;
+}
+
+describe("workflow transfer route", () => {
+  it.each(["leave", "purchase_request", "travel_request"])(
+    "allows transfer for %s when target has matching approve permission",
+    async (entityType) => {
+      const tx = buildTx({ entityType });
+      const app = await buildApp({
+        prisma: buildPrisma(tx),
+        employee: {
+          id: "actor-1",
+          roleCodes: [],
+          permissionCodes: ["expense.transfer"],
+        },
+      });
+
+      const response = await app.inject({
+        method: "POST",
+        url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
+        headers: { authorization: "Bearer test" },
+        payload: {
+          toApproverId: "44444444-4444-4444-8444-444444444444",
+          reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
+        },
+      });
+
+      expect(response.statusCode).toBe(200);
+      expect(response.json().data).toEqual(
+        expect.objectContaining({
+          outcome: "transferred",
+          toApproverId: "44444444-4444-4444-8444-444444444444",
+          transferCount: 1,
+          transferId: null,
+        }),
+      );
+      expect(tx.workflowTask.update).toHaveBeenCalledWith(
+        expect.objectContaining({
+          where: { id: buildTaskRow().id },
+          data: expect.objectContaining({
+            assignee_id: "44444444-4444-4444-8444-444444444444",
+            assignee_role: null,
+          }),
+        }),
+      );
+      expect(tx.workflowHistory.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            action: "transfer",
+            payload: expect.objectContaining({
+              to_approver_id: "44444444-4444-4444-8444-444444444444",
+              transfer_count: 1,
+            }),
+          }),
+        }),
+      );
+      expect(tx.approvalTransfer.create).not.toHaveBeenCalled();
+
+      await app.close();
+    },
+  );
+
+  it("rejects target approver without matching entity approve permission", async () => {
+    const tx = buildTx({ entityType: "leave", targetRoleCode: "finance" });
+    const app = await buildApp({
+      prisma: buildPrisma(tx),
+      employee: {
+        id: "actor-1",
+        roleCodes: [],
+        permissionCodes: ["expense.transfer"],
+      },
+    });
+
+    const response = await app.inject({
+      method: "POST",
+      url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
+      headers: { authorization: "Bearer test" },
+      payload: {
+        toApproverId: "44444444-4444-4444-8444-444444444444",
+        reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
+      },
+    });
+
+    expect(response.statusCode).toBe(409);
+    expect(response.json().error).toEqual(
+      expect.objectContaining({
+        code: "VALID_001",
+        details: expect.objectContaining({
+          toApproverId: "target_not_approver",
+        }),
+      }),
+    );
+    expect(tx.workflowTask.update).not.toHaveBeenCalled();
+
+    await app.close();
+  });
+
+  it("returns WORKFLOW_003 when transfer chain exceeds limit", async () => {
+    const tx = buildTx({ entityType: "leave", transferCount: 3 });
+    const app = await buildApp({
+      prisma: buildPrisma(tx),
+      employee: {
+        id: "actor-1",
+        roleCodes: [],
+        permissionCodes: ["expense.transfer"],
+      },
+    });
+
+    const response = await app.inject({
+      method: "POST",
+      url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
+      headers: { authorization: "Bearer test" },
+      payload: {
+        toApproverId: "44444444-4444-4444-8444-444444444444",
+        reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
+      },
+    });
+
+    expect(response.statusCode).toBe(409);
+    expect(response.json().error).toEqual(
+      expect.objectContaining({
+        code: "WORKFLOW_003",
+        details: expect.objectContaining({
+          transfer: "chain_limit_exceeded",
+        }),
+      }),
+    );
+    expect(tx.workflowTask.update).not.toHaveBeenCalled();
+    expect(tx.workflowHistory.create).not.toHaveBeenCalled();
+
+    await app.close();
+  });
+});