R36-4 放开跨域转审并同步回归

client/src/pages/MobileApprovalsPage.tsx

@@ -183,10 +183,10 @@ export function MobileApprovalsPage() {
     return null;
   }, [cachedDetailQuery.data?.detail, canUseRemote, detailQuery.data]);
 
-  const canTransfer =
+  const canTransfer = Boolean(
     canUseRemote &&
-    selectedTask?.workflowInstance?.entityType === "reimbursement" &&
+    selectedTask?.allowedActions.includes("transfer"),
-    selectedTask.allowedActions.includes("transfer");
+  );
 
   const approversQuery = useQuery({
     enabled: Boolean(canTransfer),

client/src/pages/WorkflowTaskDetailPage.tsx

@@ -179,7 +179,7 @@ export function WorkflowTaskDetailPage() {
 
   const detail = detailQuery.data;
   const isLeaveTask = detail.workflowInstance?.entityType === "leave";
-  const canTransfer = allowedActions.has("transfer") && detail.workflowInstance?.entityType === "reimbursement";
+  const canTransfer = allowedActions.has("transfer");
 
   return (
     <PageScaffold>

server/scripts/regression-workflow-actions.sh

@@ -1101,7 +1101,7 @@ assert_error_detail "$TMP_DIR/transfer-same-action.json" '.error.details.transfe
 withdraw_reimbursement "$EMPLOYEE_TOKEN" "$RID_TRANSFER_SAME" "cleanup transfer same assignee" "$TMP_DIR/transfer-same-withdraw-cleanup.json"
 assert_reimbursement_status_db "$RID_TRANSFER_SAME" "draft" "transfer same cleanup"
 
-echo "[15/23] transfer chain limit: 4th transfer blocked"
+echo "[15/23] transfer chain limit: 4th transfer blocked => WORKFLOW_003"
 RID_TRANSFER_CHAIN="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/transfer-chain-create.json")"
 create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_TRANSFER_CHAIN" "transfer-chain" >/dev/null
 submit_reimbursement "$EMPLOYEE_TOKEN" "$RID_TRANSFER_CHAIN" "$TMP_DIR/transfer-chain-submit.json"
@@ -1121,7 +1121,7 @@ assert_transfer_evidence "$TASK_TRANSFER_CHAIN" "$RID_TRANSFER_CHAIN" "$MANAGER_
 
 transfer_chain_4_status="$(transfer_task "$CEO_TOKEN" "$TASK_TRANSFER_CHAIN" "$MANAGER_ID" "transfer chain step four should fail" "$TMP_DIR/transfer-chain-4.json")"
 assert_status "$transfer_chain_4_status" "409" "transfer chain step 4" "$TMP_DIR/transfer-chain-4.json"
-assert_error_code "$TMP_DIR/transfer-chain-4.json" "VALID_001" "transfer chain step 4"
+assert_error_code "$TMP_DIR/transfer-chain-4.json" "WORKFLOW_003" "transfer chain step 4"
 assert_error_detail "$TMP_DIR/transfer-chain-4.json" '.error.details.transfer' "chain_limit_exceeded" "transfer chain step 4"
 
 ceo_approve_chain_status="$(api_json_auth POST "$BASE_URL/api/workflow/tasks/$TASK_TRANSFER_CHAIN/approve" "$CEO_TOKEN" "$TMP_DIR/transfer-chain-approve-ceo.json" '{}')"

server/src/routes/workflow.js

@@ -54,7 +54,7 @@ const APPROVER_LIST_QUERY_SCHEMA = z.object({
 });
 
 const APPROVER_ROLE_CODES = Object.keys(ROLE_PERMISSIONS).filter((roleCode) =>
-  hasPermission(ROLE_PERMISSIONS[roleCode], "expense.approve"),
+  ROLE_PERMISSIONS[roleCode].some((permissionCode) => permissionCode.endsWith(".approve")),
 );
 
 function parseRequiredComment(body) {
@@ -303,14 +303,12 @@ function listAllowedActionsForTask(request, task, actionable) {
 
   const actions = [];
   const approvePermission = resolveEntityPermission(task.workflow_instance?.entity_type, "approve");
-  if (approvePermission && hasPermission(request.employee.permissionCodes, approvePermission)) {
+  const canApprove = approvePermission && hasPermission(request.employee.permissionCodes, approvePermission);
+  if (canApprove) {
     actions.push("approve", "reject", "return");
   }
 
-  if (
+  if (canApprove && hasPermission(request.employee.permissionCodes, "expense.transfer")) {
-    task.workflow_instance?.entity_type === "reimbursement" &&
-    hasPermission(request.employee.permissionCodes, "expense.transfer")
-  ) {
     actions.push("transfer");
   }
 
@@ -734,8 +732,8 @@ async function ensureTransferChainNotExceeded(tx, taskId) {
 
   if (transferCount >= 3) {
     throw new AppError({
-      code: "VALID_001",
+      code: "WORKFLOW_003",
-      message: "参数校验失败",
+      message: "已达转审上限",
       statusCode: 409,
       details: { transfer: "chain_limit_exceeded" },
     });
@@ -744,7 +742,7 @@ async function ensureTransferChainNotExceeded(tx, taskId) {
   return transferCount;
 }
 
-async function ensureTransferTargetEligible(tx, toApproverId) {
+async function ensureTransferTargetEligible(tx, toApproverId, approvePermission) {
   const target = await tx.employee.findUnique({
     where: { id: toApproverId },
     select: {
@@ -769,7 +767,7 @@ async function ensureTransferTargetEligible(tx, toApproverId) {
 
   const roleCodes = target.roles.map((item) => item.role_code);
   const permissionCodes = resolvePermissionsForRoles(roleCodes);
-  if (!hasPermission(permissionCodes, "expense.approve")) {
+  if (!approvePermission || !hasPermission(permissionCodes, approvePermission)) {
     throw new AppError({
       code: "VALID_001",
       message: "参数校验失败",
@@ -2039,7 +2037,11 @@ async function workflowRoutes(fastify) {
         const assignment = await ensureTaskAssignableToCurrentEmployee(tx, task, request);
 
         const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id);
-        if (workflowInstance.entity_type !== "reimbursement") {
+        const approvePermission = resolveEntityPermission(
+          workflowInstance.entity_type,
+          "approve",
+        );
+        if (!approvePermission) {
           throw new AppError({
             code: "VALID_001",
             message: "参数校验失败",
@@ -2048,7 +2050,7 @@ async function workflowRoutes(fastify) {
           });
         }
         const transferCount = await ensureTransferChainNotExceeded(tx, taskId);
-        await ensureTransferTargetEligible(tx, toApproverId);
+        await ensureTransferTargetEligible(tx, toApproverId, approvePermission);
 
         if (toApproverId === request.employee.id) {
           throw new AppError({
@@ -2067,19 +2069,23 @@ async function workflowRoutes(fastify) {
           },
         });
 
-        const transfer = await tx.approvalTransfer.create({
+        let transferId = null;
-          data: {
+        if (workflowInstance.entity_type === "reimbursement") {
-            reimbursement_id: workflowInstance.entity_id,
+          const transfer = await tx.approvalTransfer.create({
-            from_approver_id: request.employee.id,
+            data: {
-            to_approver_id: toApproverId,
+              reimbursement_id: workflowInstance.entity_id,
-            reason,
+              from_approver_id: request.employee.id,
-            status: "active",
+              to_approver_id: toApproverId,
-            created_by: request.employee.id,
+              reason,
-          },
+              status: "active",
-          select: {
+              created_by: request.employee.id,
-            id: true,
+            },
-          },
+            select: {
-        });
+              id: true,
+            },
+          });
+          transferId = transfer.id;
+        }
 
         await tx.workflowHistory.create({
           data: {
@@ -2137,8 +2143,8 @@ async function workflowRoutes(fastify) {
           taskId,
           outcome: "transferred",
           workflowInstanceId: workflowInstance.id,
-          reimbursementStatus: "reviewing",
+          reimbursementStatus: workflowInstance.entity_type === "reimbursement" ? "reviewing" : null,
-          transferId: transfer.id,
+          transferId,
           fromApproverId: request.employee.id,
           toApproverId,
           transferCount: transferCount + 1,

server/tests/unit/routes/workflow.permissions.test.js

@@ -55,7 +55,7 @@ describe("Workflow Route Permissions", () => {
     expect(actions).toEqual(["approve", "reject", "return"]);
   });
 
-  it("keeps transfer action limited to reimbursement tasks", () => {
+  it("allows transfer on approval tasks when actor also has expense.transfer", () => {
     const reimbursementActions = listAllowedActionsForTask(
       { employee: { permissionCodes: ["expense.approve", "expense.transfer"] } },
       {
@@ -72,8 +72,39 @@ describe("Workflow Route Permissions", () => {
       },
       true,
     );
+    const purchaseActions = listAllowedActionsForTask(
+      { employee: { permissionCodes: ["procurement.approve", "expense.transfer"] } },
+      {
+        status: "pending",
+        workflow_instance: { entity_type: "purchase_request" },
+      },
+      true,
+    );
+    const travelActions = listAllowedActionsForTask(
+      { employee: { permissionCodes: ["travel.approve", "expense.transfer"] } },
+      {
+        status: "pending",
+        workflow_instance: { entity_type: "travel_request" },
+      },
+      true,
+    );
 
     expect(reimbursementActions).toContain("transfer");
-    expect(leaveActions).not.toContain("transfer");
+    expect(leaveActions).toContain("transfer");
+    expect(purchaseActions).toContain("transfer");
+    expect(travelActions).toContain("transfer");
+  });
+
+  it("does not allow transfer without matching approve permission", () => {
+    const actions = listAllowedActionsForTask(
+      { employee: { permissionCodes: ["expense.transfer"] } },
+      {
+        status: "pending",
+        workflow_instance: { entity_type: "leave" },
+      },
+      true,
+    );
+
+    expect(actions).toEqual([]);
   });
 });

server/tests/unit/routes/workflow.transfer.test.js

@@ -0,0 +1,255 @@
+const Fastify = require("fastify");
+
+const { AppError } = require("../../../src/utils/AppError");
+const workflowRoutes = require("../../../src/routes/workflow");
+
+function buildTaskRow() {
+  return {
+    id: "11111111-1111-4111-8111-111111111111",
+    instance_id: "22222222-2222-4222-8222-222222222222",
+    step_id: "manager_approval",
+    step_name: "经理审批",
+    assignee_id: "actor-1",
+    assignee_role: null,
+    status: "pending",
+  };
+}
+
+function buildWorkflowInstance(entityType) {
+  return {
+    id: "22222222-2222-4222-8222-222222222222",
+    entity_type: entityType,
+    entity_id: "33333333-3333-4333-8333-333333333333",
+    current_step_id: "manager_approval",
+    context_data: {},
+    workflow_definition: {
+      definition_json: {
+        steps: [],
+      },
+    },
+  };
+}
+
+function buildTarget(roleCode) {
+  return {
+    id: "44444444-4444-4444-8444-444444444444",
+    status: "active",
+    roles: [
+      {
+        role_code: roleCode,
+      },
+    ],
+  };
+}
+
+function buildTx({ entityType, targetRoleCode = "manager", transferCount = 0 }) {
+  return {
+    $queryRaw: vi.fn().mockResolvedValue([buildTaskRow()]),
+    workflowInstance: {
+      findUnique: vi.fn().mockResolvedValue(buildWorkflowInstance(entityType)),
+    },
+    employee: {
+      findUnique: vi.fn().mockResolvedValue(buildTarget(targetRoleCode)),
+    },
+    workflowTask: {
+      update: vi.fn().mockResolvedValue({ id: "11111111-1111-4111-8111-111111111111" }),
+    },
+    workflowHistory: {
+      count: vi.fn().mockResolvedValue(transferCount),
+      create: vi.fn().mockResolvedValue({ id: "history-1" }),
+    },
+    approvalTransfer: {
+      create: vi.fn().mockResolvedValue({ id: "transfer-1" }),
+    },
+  };
+}
+
+function buildPrisma(tx) {
+  return {
+    $transaction: vi.fn().mockImplementation((callback) => callback(tx)),
+  };
+}
+
+async function buildApp({ prisma, employee }) {
+  const app = Fastify();
+
+  app.decorate("prisma", prisma);
+  app.decorate("config", {});
+  app.decorate("authenticate", async (request) => {
+    if (!request.headers.authorization) {
+      throw new AppError({
+        code: "AUTH_001",
+        message: "未登录",
+        statusCode: 401,
+      });
+    }
+
+    request.employee = employee;
+  });
+  app.decorate("hasPermission", (actor, permissionCode) => {
+    return (actor?.permissionCodes ?? []).includes("*") || (actor?.permissionCodes ?? []).includes(permissionCode);
+  });
+  app.decorate("requirePermission", (permissionCode) => async (request) => {
+    await app.authenticate(request);
+    if (!app.hasPermission(request.employee, permissionCode)) {
+      throw new AppError({
+        code: "PERM_001",
+        message: "无权限",
+        statusCode: 403,
+        details: { permission: permissionCode },
+      });
+    }
+  });
+
+  app.setErrorHandler((error, request, reply) => {
+    if (error instanceof AppError) {
+      return reply.status(error.statusCode).send({
+        requestId: request.id,
+        error: {
+          code: error.code,
+          message: error.message,
+          details: error.details ?? {},
+        },
+      });
+    }
+
+    return reply.status(500).send({
+      requestId: request.id,
+      error: { code: "SYS_001", message: "服务器内部错误", details: {} },
+    });
+  });
+
+  await app.register(workflowRoutes, { prefix: "/api" });
+  return app;
+}
+
+describe("workflow transfer route", () => {
+  it.each(["leave", "purchase_request", "travel_request"])(
+    "allows transfer for %s when target has matching approve permission",
+    async (entityType) => {
+      const tx = buildTx({ entityType });
+      const app = await buildApp({
+        prisma: buildPrisma(tx),
+        employee: {
+          id: "actor-1",
+          roleCodes: [],
+          permissionCodes: ["expense.transfer"],
+        },
+      });
+
+      const response = await app.inject({
+        method: "POST",
+        url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
+        headers: { authorization: "Bearer test" },
+        payload: {
+          toApproverId: "44444444-4444-4444-8444-444444444444",
+          reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
+        },
+      });
+
+      expect(response.statusCode).toBe(200);
+      expect(response.json().data).toEqual(
+        expect.objectContaining({
+          outcome: "transferred",
+          toApproverId: "44444444-4444-4444-8444-444444444444",
+          transferCount: 1,
+          transferId: null,
+        }),
+      );
+      expect(tx.workflowTask.update).toHaveBeenCalledWith(
+        expect.objectContaining({
+          where: { id: buildTaskRow().id },
+          data: expect.objectContaining({
+            assignee_id: "44444444-4444-4444-8444-444444444444",
+            assignee_role: null,
+          }),
+        }),
+      );
+      expect(tx.workflowHistory.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            action: "transfer",
+            payload: expect.objectContaining({
+              to_approver_id: "44444444-4444-4444-8444-444444444444",
+              transfer_count: 1,
+            }),
+          }),
+        }),
+      );
+      expect(tx.approvalTransfer.create).not.toHaveBeenCalled();
+
+      await app.close();
+    },
+  );
+
+  it("rejects target approver without matching entity approve permission", async () => {
+    const tx = buildTx({ entityType: "leave", targetRoleCode: "finance" });
+    const app = await buildApp({
+      prisma: buildPrisma(tx),
+      employee: {
+        id: "actor-1",
+        roleCodes: [],
+        permissionCodes: ["expense.transfer"],
+      },
+    });
+
+    const response = await app.inject({
+      method: "POST",
+      url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
+      headers: { authorization: "Bearer test" },
+      payload: {
+        toApproverId: "44444444-4444-4444-8444-444444444444",
+        reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
+      },
+    });
+
+    expect(response.statusCode).toBe(409);
+    expect(response.json().error).toEqual(
+      expect.objectContaining({
+        code: "VALID_001",
+        details: expect.objectContaining({
+          toApproverId: "target_not_approver",
+        }),
+      }),
+    );
+    expect(tx.workflowTask.update).not.toHaveBeenCalled();
+
+    await app.close();
+  });
+
+  it("returns WORKFLOW_003 when transfer chain exceeds limit", async () => {
+    const tx = buildTx({ entityType: "leave", transferCount: 3 });
+    const app = await buildApp({
+      prisma: buildPrisma(tx),
+      employee: {
+        id: "actor-1",
+        roleCodes: [],
+        permissionCodes: ["expense.transfer"],
+      },
+    });
+
+    const response = await app.inject({
+      method: "POST",
+      url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
+      headers: { authorization: "Bearer test" },
+      payload: {
+        toApproverId: "44444444-4444-4444-8444-444444444444",
+        reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
+      },
+    });
+
+    expect(response.statusCode).toBe(409);
+    expect(response.json().error).toEqual(
+      expect.objectContaining({
+        code: "WORKFLOW_003",
+        details: expect.objectContaining({
+          transfer: "chain_limit_exceeded",
+        }),
+      }),
+    );
+    expect(tx.workflowTask.update).not.toHaveBeenCalled();
+    expect(tx.workflowHistory.create).not.toHaveBeenCalled();
+
+    await app.close();
+  });
+});