R5-M1-M5 收口正式审批规则与移动反馈

server/src/routes/leave.js

@@ -1015,6 +1015,7 @@ async function leaveRoutes(fastify) {
           startIndex: 0,
           ownerId: leave.owner_id,
           logger: fastify.log,
+          blockOnUnresolvedAssignee: true,
         });
         if (!actionable) {
           throw buildValidationError({ workflow: "no_actionable_approver" }, 409);

server/src/routes/purchaseRequests.js

@@ -1524,6 +1524,7 @@ async function purchaseRequestRoutes(fastify) {
         startIndex: 0,
         ownerId: unlockedPurchaseRequest.applicant_id,
         logger: fastify.log,
+        blockOnUnresolvedAssignee: true,
       });
 
       if (!actionable) {

server/src/routes/reimbursements.js

@@ -3179,6 +3179,7 @@ async function reimbursementRoutes(fastify) {
           startIndex: 0,
           ownerId: reimbursement.owner_id,
           logger: fastify.log,
+          blockOnUnresolvedAssignee: true,
         });
 
         if (!actionable) {

server/src/routes/travelRequests.js

@@ -986,6 +986,7 @@ async function createTravelRequestsRoutes(fastify) {
           startIndex: 0,
           ownerId: travelRequest.applicant_employee_id,
           logger: fastify.log,
+          blockOnUnresolvedAssignee: true,
         });
         if (!actionable) {
           throw buildValidationError({ workflow: "no_actionable_approver" }, 409);

server/src/routes/workflow.js

@@ -2,7 +2,7 @@ const { z } = require("zod");
 const { AppError } = require("../utils/AppError");
 const { buildAuditLogData } = require("../utils/audit");
 const { sendData } = require("../utils/reply");
-const { resolvePermissionsForRoles, hasPermission, ROLE_PERMISSIONS, resolveEntityPermission } = require("../constants/permissions");
+const { hasPermission, ROLE_PERMISSIONS, resolveEntityPermission } = require("../constants/permissions");
 const { getWorkflowStepsSnapshot, resolveActionableStep, toMoneyString } = require("../utils/workflow");
 const { consumeReservedLeave, releaseReservedLeave, formatDateOnly } = require("../services/leave");
 const { FEATURE_FLAG_KEYS, evaluateFeatureFlag } = require("../services/featureFlags");
@@ -525,6 +525,7 @@ async function loadWorkflowInstanceForTask(tx, instanceId) {
       id: true,
       entity_type: true,
       entity_id: true,
+      submitter_id: true,
       current_step_id: true,
       context_data: true,
       workflow_definition: {
@@ -674,6 +675,102 @@ async function loadWorkflowNotifyContext(tx, entityType, entityId) {
   };
 }
 
+function resolveBusinessApprovePermission(entityType) {
+  return resolveEntityPermission(normalizeWorkflowEntityType(entityType), "approve");
+}
+
+function roleHasBusinessApprovePermission(roleCode, approvePermission) {
+  if (!roleCode || roleCode === "admin" || !approvePermission) {
+    return false;
+  }
+
+  return (ROLE_PERMISSIONS[roleCode] ?? []).includes(approvePermission);
+}
+
+function employeeHasBusinessApproveRole(employee, entityType) {
+  const approvePermission = resolveBusinessApprovePermission(entityType);
+  return Boolean(
+    approvePermission &&
+      (employee?.roleCodes ?? []).some((roleCode) =>
+        roleHasBusinessApprovePermission(roleCode, approvePermission),
+      ),
+  );
+}
+
+function ensureBusinessApproveRole(employee, entityType) {
+  if (employeeHasBusinessApproveRole(employee, entityType)) {
+    return;
+  }
+
+  throw new AppError({
+    code: "PERM_002",
+    message: "不在审批范围/非当前处理人",
+    statusCode: 403,
+    details: { workflow: "business_approval_role_required" },
+  });
+}
+
+function collectWorkflowApplicantIds(workflowInstance, record) {
+  const entityType = normalizeWorkflowEntityType(workflowInstance.entity_type);
+
+  if (entityType === "reimbursement") {
+    return uniq([record?.owner_id, record?.submitter_id, workflowInstance.submitter_id]);
+  }
+
+  if (entityType === "leave") {
+    return uniq([record?.owner_id, workflowInstance.submitter_id]);
+  }
+
+  if (entityType === "purchase_request") {
+    return uniq([record?.applicant_id, record?.submitter_id, workflowInstance.submitter_id]);
+  }
+
+  if (entityType === "travel_request") {
+    return uniq([record?.applicant_employee_id, record?.submitter_id, workflowInstance.submitter_id]);
+  }
+
+  return uniq([workflowInstance.submitter_id]);
+}
+
+async function loadWorkflowApplicantIds(tx, workflowInstance) {
+  const { record } = await loadWorkflowNotifyContext(
+    tx,
+    workflowInstance.entity_type,
+    workflowInstance.entity_id,
+  );
+
+  if (!record) {
+    throw new AppError({
+      code: "VALID_001",
+      message: "参数校验失败",
+      statusCode: 409,
+      details: { workflow: "entity_not_processable" },
+    });
+  }
+
+  return collectWorkflowApplicantIds(workflowInstance, record);
+}
+
+function ensureNoSelfApproval(actorIds, applicantIds) {
+  if (!actorIds.some((actorId) => applicantIds.includes(actorId))) {
+    return;
+  }
+
+  throw new AppError({
+    code: "VALID_001",
+    message: "参数校验失败",
+    statusCode: 409,
+    details: { workflow: "self_approval_not_allowed" },
+  });
+}
+
+async function ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment) {
+  ensureBusinessApproveRole(request.employee, workflowInstance.entity_type);
+  const applicantIds = await loadWorkflowApplicantIds(tx, workflowInstance);
+  ensureNoSelfApproval(uniq([request.employee.id, assignment?.principalId]), applicantIds);
+  return applicantIds;
+}
+
 function resolveWorkflowOutcomeNotificationType(entityType, outcome) {
   const normalizedEntityType = normalizeWorkflowEntityType(entityType);
 
@@ -877,8 +974,7 @@ async function ensureTransferTargetEligible(tx, toApproverId, approvePermission)
   }
 
   const roleCodes = target.roles.map((item) => item.role_code);
-  const permissionCodes = resolvePermissionsForRoles(roleCodes);
-  if (!approvePermission || !hasPermission(permissionCodes, approvePermission)) {
+  if (!roleCodes.some((roleCode) => roleHasBusinessApprovePermission(roleCode, approvePermission))) {
     throw new AppError({
       code: "VALID_001",
       message: "参数校验失败",
@@ -943,6 +1039,7 @@ async function executeApproveWorkflowTask({
     const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id);
     ensureWorkflowEntityType(workflowInstance, allowedEntityType);
     fastify.assertEntityPermission(request.employee, workflowInstance.entity_type, "approve");
+    await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment);
     const steps = getWorkflowStepsSnapshot(workflowInstance);
     const currentStepIndex = steps.findIndex((step) => step.id === workflowInstance.current_step_id);
     if (currentStepIndex < 0) {
@@ -1238,6 +1335,7 @@ async function executeRejectWorkflowTask({
     const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id);
     ensureWorkflowEntityType(workflowInstance, allowedEntityType);
     fastify.assertEntityPermission(request.employee, workflowInstance.entity_type, "approve");
+    await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment);
     const now = new Date();
 
     await tx.workflowTask.update({
@@ -1406,6 +1504,14 @@ function mapBatchTaskError(taskId, error) {
     };
   }
 
+  if (error instanceof AppError && error.details?.workflow === "self_approval_not_allowed") {
+    return {
+      taskId,
+      outcome: "error",
+      reason: "self_approval_not_allowed",
+    };
+  }
+
   if (error instanceof AppError) {
     return {
       taskId,
@@ -2219,6 +2325,7 @@ async function workflowRoutes(fastify) {
 
         const workflowInstance = await loadWorkflowInstanceForTask(tx, task.instance_id);
         fastify.assertEntityPermission(request.employee, workflowInstance.entity_type, "approve");
+        await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment);
         const now = new Date();
 
         await tx.workflowTask.update({
@@ -2421,8 +2528,10 @@ async function workflowRoutes(fastify) {
             details: { transfer: "unsupported_entity_type" },
           });
         }
+        const applicantIds = await ensureWorkflowApprovalAllowed(tx, workflowInstance, request, assignment);
         const transferCount = await ensureTransferChainNotExceeded(tx, taskId);
         await ensureTransferTargetEligible(tx, toApproverId, approvePermission);
+        ensureNoSelfApproval([toApproverId], applicantIds);
 
         if (toApproverId === request.employee.id) {
           throw new AppError({