wangsli/hyb-oa
1
0
派生 0
代码 工单 合并请求 工作流 8 软件包 项目 发布 百科 活动

ASSET1 统一电子资产与固定资产台账

浏览代码
这个提交包含在：
wangsli
2026-05-22 22:04:41 +08:00
父节点 c2a3c7a84b
当前提交 9090046a97
共修改 18 个文件，包含 1457 行新增和 199 行删除
下载 Patch 文件 下载 Diff 文件 展开所有文件 折叠所有文件
server/prisma/migrations/20260522191833_asset_governance_v1/migration.sql
+28
查看文件
@@ -0,0 +1,28 @@
CREATE TYPE "AssetType" AS ENUM ('fixed_asset', 'electronic_document', 'electronic_system', 'code_repository', 'backup_media');
CREATE TYPE "AssetSensitivityLevel" AS ENUM ('public_candidate', 'internal', 'confidential', 'strictly_confidential');
ALTER TABLE "asset_cards"
ADD COLUMN "asset_type" "AssetType" NOT NULL DEFAULT 'fixed_asset',
ADD COLUMN "sensitivity_level" "AssetSensitivityLevel" NOT NULL DEFAULT 'internal',
ADD COLUMN "owner_employee_id" UUID,
ADD COLUMN "keeper_employee_id" UUID,
ADD COLUMN "archive_location" TEXT,
ADD COLUMN "external_ref" TEXT,
ADD COLUMN "source_hash" TEXT,
ADD COLUMN "verification_no" TEXT,
ADD COLUMN "confidentiality_note" TEXT,
ADD COLUMN "metadata" JSONB,
ADD COLUMN "last_verified_at" DATE,
ADD COLUMN "expires_at" DATE;
CREATE UNIQUE INDEX "asset_cards_verification_no_key" ON "asset_cards"("verification_no");
CREATE INDEX "idx_asset_cards_asset_type" ON "asset_cards"("asset_type");
CREATE INDEX "idx_asset_cards_sensitivity" ON "asset_cards"("sensitivity_level");
CREATE INDEX "idx_asset_cards_owner" ON "asset_cards"("owner_employee_id");
CREATE INDEX "idx_asset_cards_keeper" ON "asset_cards"("keeper_employee_id");
CREATE INDEX "idx_asset_cards_source_hash" ON "asset_cards"("source_hash");
CREATE INDEX "idx_asset_cards_last_verified" ON "asset_cards"("last_verified_at");
ALTER TABLE "asset_cards" ADD CONSTRAINT "asset_cards_owner_employee_id_fkey" FOREIGN KEY ("owner_employee_id") REFERENCES "employees"("id") ON DELETE SET NULL ON UPDATE CASCADE;
ALTER TABLE "asset_cards" ADD CONSTRAINT "asset_cards_keeper_employee_id_fkey" FOREIGN KEY ("keeper_employee_id") REFERENCES "employees"("id") ON DELETE SET NULL ON UPDATE CASCADE;
server/prisma/schema.prisma
+37
查看文件
@@ -111,6 +111,21 @@ enum AssetCardStatus {
archived
}
enum AssetType {
fixed_asset
electronic_document
electronic_system
code_repository
backup_media
}
enum AssetSensitivityLevel {
public_candidate
internal
confidential
strictly_confidential
}
enum InventoryCheckScopeType {
all
legal_entity
@@ -639,6 +654,8 @@ model Employee {
purchase_attachments_uploaded PurchaseAttachment[] @relation("PurchaseAttachmentUploader")
purchase_order_archives PurchaseOrderArchive[] @relation("PurchaseOrderArchiveArchivedBy")
assigned_asset_cards AssetCard[] @relation("AssetCardAssignee")
owned_asset_cards AssetCard[] @relation("AssetCardOwner")
kept_asset_cards AssetCard[] @relation("AssetCardKeeper")
asset_assignments AssetAssignment[]
asset_transfers_from AssetTransfer[] @relation("AssetTransferFromEmployee")
asset_transfers_to AssetTransfer[] @relation("AssetTransferToEmployee")
@@ -1198,6 +1215,8 @@ model AssetCard {
id String @id @default(uuid()) @db.Uuid
asset_no String @unique
name String
asset_type AssetType @default(fixed_asset)
sensitivity_level AssetSensitivityLevel @default(internal)
category_id String @db.Uuid
legal_entity_id String @db.Uuid
cost_center_id String @db.Uuid
@@ -1206,6 +1225,16 @@ model AssetCard {
location String?
status AssetCardStatus @default(in_stock)
assignee_employee_id String? @db.Uuid
owner_employee_id String? @db.Uuid
keeper_employee_id String? @db.Uuid
archive_location String?
external_ref String?
source_hash String?
verification_no String? @unique
confidentiality_note String?
metadata Json?
last_verified_at DateTime? @db.Date
expires_at DateTime? @db.Date
activated_at DateTime? @db.Date
retired_at DateTime? @db.Date
@@ -1219,15 +1248,23 @@ model AssetCard {
cost_center CostCenter @relation(fields: [cost_center_id], references: [id], onDelete: Restrict)
purchase_request PurchaseRequest? @relation(fields: [purchase_request_id], references: [id], onDelete: SetNull)
assignee Employee? @relation("AssetCardAssignee", fields: [assignee_employee_id], references: [id], onDelete: SetNull)
owner Employee? @relation("AssetCardOwner", fields: [owner_employee_id], references: [id], onDelete: SetNull)
keeper Employee? @relation("AssetCardKeeper", fields: [keeper_employee_id], references: [id], onDelete: SetNull)
assignments AssetAssignment[]
transfers AssetTransfer[]
inventory_items InventoryCheckItem[]
@@index([asset_type], map: "idx_asset_cards_asset_type")
@@index([sensitivity_level], map: "idx_asset_cards_sensitivity")
@@index([category_id], map: "idx_asset_cards_category")
@@index([legal_entity_id], map: "idx_asset_cards_legal_entity")
@@index([cost_center_id], map: "idx_asset_cards_cost_center")
@@index([purchase_request_id], map: "idx_asset_cards_purchase_request")
@@index([assignee_employee_id], map: "idx_asset_cards_assignee")
@@index([owner_employee_id], map: "idx_asset_cards_owner")
@@index([keeper_employee_id], map: "idx_asset_cards_keeper")
@@index([source_hash], map: "idx_asset_cards_source_hash")
@@index([last_verified_at], map: "idx_asset_cards_last_verified")
@@index([status], map: "idx_asset_cards_status")
@@map("asset_cards")
}
server/src/routes/assets.js
+553 -49
查看文件
@@ -16,6 +16,16 @@ const UUID_SCHEMA = z.string().uuid();
const BOOLEAN_QUERY_SCHEMA = z.enum(["0", "1", "true", "false"]).optional();
const DATE_ONLY_SCHEMA = z.string().regex(/^\d{4}-\d{2}-\d{2}$/);
const ASSET_STATUS_VALUES = ["in_stock", "in_use", "under_repair", "retired", "archived"];
const ASSET_TYPE_VALUES = ["fixed_asset", "electronic_document", "electronic_system", "code_repository", "backup_media"];
const ASSET_SENSITIVITY_VALUES = ["public_candidate", "internal", "confidential", "strictly_confidential"];
const ASSET_DOCUMENT_CATEGORY_BY_TYPE = {
fixed_asset: "ASSET_CARD_DEFAULT",
electronic_document: "ASSET_EA_DOC",
electronic_system: "ASSET_EA_SYS",
code_repository: "ASSET_EA_REPO",
backup_media: "ASSET_EA_BKP",
};
const CATEGORY_LIST_QUERY_SCHEMA = z.object({
includeArchived: BOOLEAN_QUERY_SCHEMA,
@@ -24,8 +34,12 @@ const CATEGORY_LIST_QUERY_SCHEMA = z.object({
const ASSET_LIST_QUERY_SCHEMA = z.object({
status: z.enum(ASSET_STATUS_VALUES).optional(),
assetType: z.enum(ASSET_TYPE_VALUES).optional(),
sensitivityLevel: z.enum(ASSET_SENSITIVITY_VALUES).optional(),
categoryId: UUID_SCHEMA.optional(),
assigneeId: UUID_SCHEMA.optional(),
ownerId: UUID_SCHEMA.optional(),
keeperId: UUID_SCHEMA.optional(),
legalEntityId: UUID_SCHEMA.optional(),
costCenterId: UUID_SCHEMA.optional(),
q: z.string().trim().max(120).optional(),
@@ -50,6 +64,8 @@ const ASSET_CATEGORY_PATCH_SCHEMA = ASSET_CATEGORY_CREATE_SCHEMA.partial();
const ASSET_CREATE_SCHEMA = z
.object({
name: z.string().trim().min(1).max(200),
assetType: z.enum(ASSET_TYPE_VALUES).optional(),
sensitivityLevel: z.enum(ASSET_SENSITIVITY_VALUES).optional(),
categoryId: UUID_SCHEMA,
legalEntityId: UUID_SCHEMA,
costCenterId: UUID_SCHEMA,
@@ -58,12 +74,54 @@ const ASSET_CREATE_SCHEMA = z
location: z.string().trim().max(200).nullable().optional(),
status: z.enum(ASSET_STATUS_VALUES).optional(),
assigneeEmployeeId: UUID_SCHEMA.nullable().optional(),
ownerEmployeeId: UUID_SCHEMA.nullable().optional(),
keeperEmployeeId: UUID_SCHEMA.nullable().optional(),
archiveLocation: z.string().trim().max(500).nullable().optional(),
externalRef: z.string().trim().max(500).nullable().optional(),
sourceHash: z.string().trim().max(128).nullable().optional(),
verificationNo: z.string().trim().regex(/^VER-\d{5,}$/).max(32).nullable().optional(),
confidentialityNote: z.string().trim().max(1000).nullable().optional(),
metadata: z.record(z.unknown()).nullable().optional(),
lastVerifiedAt: DATE_ONLY_SCHEMA.nullable().optional(),
expiresAt: DATE_ONLY_SCHEMA.nullable().optional(),
activatedAt: DATE_ONLY_SCHEMA.nullable().optional(),
retiredAt: DATE_ONLY_SCHEMA.nullable().optional(),
})
.strict();
const ASSET_PATCH_SCHEMA = ASSET_CREATE_SCHEMA.omit({ purchaseRequestId: true, assigneeEmployeeId: true }).partial();
const ASSET_PATCH_SCHEMA = ASSET_CREATE_SCHEMA.omit({ purchaseRequestId: true, assigneeEmployeeId: true, assetType: true }).partial();
const REDACTED_DOC_IMPORT_SCHEMA = z
.object({
dryRun: z.boolean().optional(),
write: z.boolean().optional(),
categoryId: UUID_SCHEMA.optional(),
legalEntityId: UUID_SCHEMA.optional(),
costCenterId: UUID_SCHEMA.optional(),
ownerEmployeeId: UUID_SCHEMA.nullable().optional(),
keeperEmployeeId: UUID_SCHEMA.nullable().optional(),
items: z
.array(
z
.object({
code: z.string().trim().max(64).optional(),
name: z.string().trim().min(1).max(200),
sourceHash: z.string().trim().max(128).nullable().optional(),
sensitivityLevel: z.enum(ASSET_SENSITIVITY_VALUES).optional(),
externalRef: z.string().trim().max(500).nullable().optional(),
archiveLocation: z.string().trim().max(500).nullable().optional(),
docType: z.string().trim().max(80).nullable().optional(),
extension: z.string().trim().max(32).nullable().optional(),
detectedCategories: z.string().trim().max(500).nullable().optional(),
requiredRedaction: z.string().trim().max(1000).nullable().optional(),
verificationNo: z.string().trim().regex(/^VER-\d{5,}$/).max(32).nullable().optional(),
})
.strict(),
)
.min(1)
.max(20),
})
.strict();
const ASSET_CATEGORY_SELECT = {
id: true,
@@ -88,6 +146,8 @@ const ASSET_CARD_SELECT = {
id: true,
asset_no: true,
name: true,
asset_type: true,
sensitivity_level: true,
category_id: true,
legal_entity_id: true,
cost_center_id: true,
@@ -96,6 +156,16 @@ const ASSET_CARD_SELECT = {
location: true,
status: true,
assignee_employee_id: true,
owner_employee_id: true,
keeper_employee_id: true,
archive_location: true,
external_ref: true,
source_hash: true,
verification_no: true,
confidentiality_note: true,
metadata: true,
last_verified_at: true,
expires_at: true,
activated_at: true,
retired_at: true,
created_at: true,
@@ -153,6 +223,32 @@ const ASSET_CARD_SELECT = {
},
},
},
owner: {
select: {
id: true,
employee_no: true,
name: true,
department: {
select: {
id: true,
name: true,
},
},
},
},
keeper: {
select: {
id: true,
employee_no: true,
name: true,
department: {
select: {
id: true,
name: true,
},
},
},
},
};
function buildValidationError(details, statusCode = 400) {
@@ -197,8 +293,12 @@ function parseAssetListQuery(query) {
}
return {
status: parsed.data.status,
assetType: parsed.data.assetType,
sensitivityLevel: parsed.data.sensitivityLevel,
categoryId: parsed.data.categoryId,
assigneeId: parsed.data.assigneeId,
ownerId: parsed.data.ownerId,
keeperId: parsed.data.keeperId,
legalEntityId: parsed.data.legalEntityId,
costCenterId: parsed.data.costCenterId,
q: parsed.data.q?.trim() ?? "",
@@ -247,6 +347,8 @@ function normalizeAssetCategoryPayload(body) {
function normalizeAssetPayload(body) {
return {
name: typeof body.name === "string" ? body.name.trim() : undefined,
assetType: body.assetType,
sensitivityLevel: body.sensitivityLevel,
categoryId: body.categoryId,
legalEntityId: body.legalEntityId,
costCenterId: body.costCenterId,
@@ -267,11 +369,120 @@ function normalizeAssetPayload(body) {
assigneeEmployeeId: Object.prototype.hasOwnProperty.call(body, "assigneeEmployeeId")
? body.assigneeEmployeeId ?? null
: undefined,
ownerEmployeeId: Object.prototype.hasOwnProperty.call(body, "ownerEmployeeId")
? body.ownerEmployeeId ?? null
: undefined,
keeperEmployeeId: Object.prototype.hasOwnProperty.call(body, "keeperEmployeeId")
? body.keeperEmployeeId ?? null
: undefined,
archiveLocation: Object.prototype.hasOwnProperty.call(body, "archiveLocation")
? body.archiveLocation?.trim()
? body.archiveLocation.trim()
: null
: undefined,
externalRef: Object.prototype.hasOwnProperty.call(body, "externalRef")
? body.externalRef?.trim()
? body.externalRef.trim()
: null
: undefined,
sourceHash: Object.prototype.hasOwnProperty.call(body, "sourceHash")
? body.sourceHash?.trim()
? body.sourceHash.trim()
: null
: undefined,
verificationNo: Object.prototype.hasOwnProperty.call(body, "verificationNo")
? body.verificationNo?.trim()
? body.verificationNo.trim().toUpperCase()
: null
: undefined,
confidentialityNote: Object.prototype.hasOwnProperty.call(body, "confidentialityNote")
? body.confidentialityNote?.trim()
? body.confidentialityNote.trim()
: null
: undefined,
metadata: Object.prototype.hasOwnProperty.call(body, "metadata") ? body.metadata ?? null : undefined,
lastVerifiedAt: Object.prototype.hasOwnProperty.call(body, "lastVerifiedAt") ? body.lastVerifiedAt ?? null : undefined,
expiresAt: Object.prototype.hasOwnProperty.call(body, "expiresAt") ? body.expiresAt ?? null : undefined,
activatedAt: Object.prototype.hasOwnProperty.call(body, "activatedAt") ? body.activatedAt ?? null : undefined,
retiredAt: Object.prototype.hasOwnProperty.call(body, "retiredAt") ? body.retiredAt ?? null : undefined,
};
}
const SAFE_HASH_PATTERN = /^[A-Za-z0-9:_-]+$/;
const FORBIDDEN_ASSET_TEXT_PATTERNS = [
{ code: "secret_assignment", pattern: /(?:token|secret|password|passwd|pwd|api[_-]?key|access[_-]?key|private[_-]?key|encodingaeskey)\s*[:=]/i },
{ code: "secret_env_name", pattern: /\b[A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PRIVATE_KEY|ENCODINGAESKEY)[A-Z0-9_]*\b/ },
{ code: "secret_cn_assignment", pattern: /(?:密码|密钥|私钥|令牌)\s*[:：=]/ },
{ code: "bearer_token", pattern: /\bBearer\s+[A-Za-z0-9._-]{10,}/i },
{ code: "private_key_material", pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----/i },
{ code: "local_absolute_path", pattern: /(^|[\s"'（(，,;；])(?:\/(?:home|root|Users|var|etc|mnt|Volumes|app)\/|[A-Za-z]:[\\/]|\\\\)/i },
{ code: "raw_payload", pattern: /(原始\s*(?:payload|xml|报文|正文|表单)|raw\s*(?:payload|xml|body|form))/i },
];
function findUnsafeAssetText(value) {
if (typeof value !== "string" || !value.trim()) {
return null;
}
if (value.length > 1500) {
return "too_long";
}
const matched = FORBIDDEN_ASSET_TEXT_PATTERNS.find((rule) => rule.pattern.test(value));
return matched?.code ?? null;
}
function validateSourceHash(fieldName, value, details) {
if (typeof value === "string" && value && !SAFE_HASH_PATTERN.test(value)) {
details[fieldName] = "unsafe_hash_format";
}
}
function validateSafeTextField(fieldName, value, details) {
const unsafeReason = findUnsafeAssetText(value);
if (unsafeReason) {
details[fieldName] = unsafeReason;
}
}
function validateMetadataField(fieldName, value, details) {
if (value == null) {
return;
}
const serialized = JSON.stringify(value);
if (serialized.length > 2000) {
details[fieldName] = "too_large";
return;
}
validateSafeTextField(fieldName, serialized, details);
}
function validateAssetTextBoundaries(payload) {
const details = {};
validateSafeTextField("name", payload.name, details);
validateSafeTextField("archiveLocation", payload.archiveLocation, details);
validateSafeTextField("externalRef", payload.externalRef, details);
validateSafeTextField("confidentialityNote", payload.confidentialityNote, details);
validateSourceHash("sourceHash", payload.sourceHash, details);
validateMetadataField("metadata", payload.metadata, details);
if (Object.keys(details).length > 0) {
throw buildValidationError(details);
}
}
function validateRedactedImportBoundaries(payload) {
const details = {};
for (const [index, item] of payload.items.entries()) {
validateSafeTextField(`items.${index}.name`, item.name, details);
validateSafeTextField(`items.${index}.archiveLocation`, item.archiveLocation, details);
validateSafeTextField(`items.${index}.externalRef`, item.externalRef, details);
validateSafeTextField(`items.${index}.detectedCategories`, item.detectedCategories, details);
validateSafeTextField(`items.${index}.requiredRedaction`, item.requiredRedaction, details);
validateSourceHash(`items.${index}.sourceHash`, item.sourceHash, details);
}
if (Object.keys(details).length > 0) {
throw buildValidationError(details);
}
}
function canReadAssets(fastify, employee) {
return ["asset.view_own", "asset.view_all", "asset.manage", "asset.transfer", "asset.inventory"].some((permission) =>
fastify.hasPermission(employee, permission),
@@ -303,7 +514,12 @@ function ensureAssetViewerOwnsRecord(fastify, request, assetRecord) {
if (canViewAllAssets(fastify, request.employee)) {
return;
}
if (assetRecord.assignee_employee_id !== request.employee.id) {
const employeeId = request.employee.id;
if (
assetRecord.assignee_employee_id !== employeeId &&
assetRecord.owner_employee_id !== employeeId &&
assetRecord.keeper_employee_id !== employeeId
) {
throw new AppError({
code: "PERM_001",
message: "无权限",
@@ -313,6 +529,26 @@ function ensureAssetViewerOwnsRecord(fastify, request, assetRecord) {
}
}
function isAssetRelatedEmployee(request, record) {
const employeeId = request.employee?.id;
return Boolean(
employeeId &&
(record.assignee_employee_id === employeeId ||
record.owner_employee_id === employeeId ||
record.keeper_employee_id === employeeId),
);
}
function canViewAssetSensitiveFields(fastify, request, record) {
if (canManageAssets(fastify, request.employee) || isAssetRelatedEmployee(request, record)) {
return true;
}
if (record.asset_type && record.asset_type !== "fixed_asset") {
return false;
}
return !["confidential", "strictly_confidential"].includes(record.sensitivity_level);
}
function mapAssetCategory(record) {
return {
id: record.id,
@@ -334,11 +570,31 @@ function mapAssetCategory(record) {
};
}
function mapEmployeeRef(record) {
if (!record) {
return null;
}
return {
id: record.id,
employeeNo: record.employee_no,
name: record.name,
department: record.department
? {
id: record.department.id,
name: record.department.name,
}
: null,
};
}
function mapAsset(record, request, fastify) {
const canViewSensitiveFields = canViewAssetSensitiveFields(fastify, request, record);
return {
id: record.id,
assetNo: record.asset_no,
name: record.name,
assetType: record.asset_type,
sensitivityLevel: record.sensitivity_level,
categoryId: record.category_id,
legalEntityId: record.legal_entity_id,
costCenterId: record.cost_center_id,
@@ -347,6 +603,17 @@ function mapAsset(record, request, fastify) {
location: record.location ?? null,
status: record.status,
assigneeEmployeeId: record.assignee_employee_id ?? null,
ownerEmployeeId: record.owner_employee_id ?? null,
keeperEmployeeId: record.keeper_employee_id ?? null,
archiveLocation: canViewSensitiveFields ? record.archive_location ?? null : null,
externalRef: canViewSensitiveFields ? record.external_ref ?? null : null,
sourceHash: canViewSensitiveFields ? record.source_hash ?? null : null,
verificationNo: record.verification_no ?? null,
confidentialityNote: canViewSensitiveFields ? record.confidentiality_note ?? null : null,
metadata: canViewSensitiveFields ? record.metadata ?? null : null,
sensitiveFieldsRedacted: !canViewSensitiveFields,
lastVerifiedAt: record.last_verified_at?.toISOString?.().slice(0, 10) ?? null,
expiresAt: record.expires_at?.toISOString?.().slice(0, 10) ?? null,
activatedAt: record.activated_at?.toISOString?.().slice(0, 10) ?? null,
retiredAt: record.retired_at?.toISOString?.().slice(0, 10) ?? null,
createdAt: record.created_at?.toISOString?.() ?? null,
@@ -389,19 +656,9 @@ function mapAsset(record, request, fastify) {
status: record.purchase_request.status,
}
: null,
assignee: record.assignee
? {
id: record.assignee.id,
employeeNo: record.assignee.employee_no,
name: record.assignee.name,
department: record.assignee.department
? {
id: record.assignee.department.id,
name: record.assignee.department.name,
}
: null,
}
: null,
assignee: mapEmployeeRef(record.assignee),
owner: mapEmployeeRef(record.owner),
keeper: mapEmployeeRef(record.keeper),
permissions: {
canEdit: canManageAssets(fastify, request.employee),
},
@@ -521,12 +778,12 @@ async function ensureCostCenterAvailable(tx, costCenterId, legalEntityId) {
return record;
}
async function ensureAssigneeEmployee(tx, assigneeEmployeeId) {
if (!assigneeEmployeeId) {
async function ensureActiveEmployee(tx, fieldName, employeeId) {
if (!employeeId) {
return null;
}
const record = await tx.employee.findUnique({
where: { id: assigneeEmployeeId },
where: { id: employeeId },
select: {
id: true,
employee_no: true,
@@ -535,14 +792,29 @@ async function ensureAssigneeEmployee(tx, assigneeEmployeeId) {
},
});
if (!record) {
throw buildValidationError({ assigneeEmployeeId: "not_found" }, 404);
throw buildValidationError({ [fieldName]: "not_found" }, 404);
}
if (record.status !== "active") {
throw buildValidationError({ assigneeEmployeeId: "inactive" }, 409);
throw buildValidationError({ [fieldName]: "inactive" }, 409);
}
return record;
}
async function ensureAssigneeEmployee(tx, assigneeEmployeeId) {
return ensureActiveEmployee(tx, "assigneeEmployeeId", assigneeEmployeeId);
}
function assetDocumentCategoryCode(assetType, category = null) {
if (assetType === "fixed_asset" && category?.document_category?.code) {
return category.document_category.code;
}
return ASSET_DOCUMENT_CATEGORY_BY_TYPE[assetType] ?? ASSET_DOCUMENT_CATEGORY_BY_TYPE.fixed_asset;
}
function assetSequenceKey(assetType, documentCategoryCode) {
return `asset_card:${documentCategoryCode || assetDocumentCategoryCode(assetType)}`;
}
async function ensureApprovedPurchaseRequest(tx, purchaseRequestId) {
if (!purchaseRequestId) {
return null;
@@ -878,6 +1150,12 @@ async function assetsRoutes(fastify) {
if (query.status) {
baseWhere.status = query.status;
}
if (query.assetType) {
baseWhere.asset_type = query.assetType;
}
if (query.sensitivityLevel) {
baseWhere.sensitivity_level = query.sensitivityLevel;
}
if (query.categoryId) {
baseWhere.category_id = query.categoryId;
}
@@ -888,10 +1166,20 @@ async function assetsRoutes(fastify) {
baseWhere.cost_center_id = query.costCenterId;
}
if (mine) {
baseWhere.assignee_employee_id = request.employee.id;
baseWhere.OR = [
{ assignee_employee_id: request.employee.id },
{ owner_employee_id: request.employee.id },
{ keeper_employee_id: request.employee.id },
];
} else if (query.assigneeId) {
baseWhere.assignee_employee_id = query.assigneeId;
}
if (!mine && query.ownerId) {
baseWhere.owner_employee_id = query.ownerId;
}
if (!mine && query.keeperId) {
baseWhere.keeper_employee_id = query.keeperId;
}
const listOptions = {
orderBy: [{ updated_at: "desc" }, { created_at: "desc" }],
@@ -900,36 +1188,24 @@ async function assetsRoutes(fastify) {
let items;
if (query.q) {
const searchConditions = [
{ asset_no: query.q },
{ serial_no: query.q },
{ verification_no: query.q.toUpperCase() },
{ name: { contains: query.q, mode: "insensitive" } },
];
if (canManageAssets(fastify, request.employee) || mine) {
searchConditions.splice(3, 0, { source_hash: query.q });
searchConditions.splice(4, 0, { external_ref: { contains: query.q, mode: "insensitive" } });
searchConditions.splice(5, 0, { archive_location: { contains: query.q, mode: "insensitive" } });
}
const searchWhere = {
OR: searchConditions,
};
items = await fastify.prisma.assetCard.findMany({
where: {
...baseWhere,
asset_no: query.q,
},
where: { AND: [baseWhere, searchWhere] },
...listOptions,
});
if (!items.length) {
items = await fastify.prisma.assetCard.findMany({
where: {
...baseWhere,
serial_no: query.q,
},
...listOptions,
});
}
if (!items.length) {
items = await fastify.prisma.assetCard.findMany({
where: {
...baseWhere,
name: {
contains: query.q,
mode: "insensitive",
},
},
...listOptions,
});
}
} else {
items = await fastify.prisma.assetCard.findMany({
where: baseWhere,
@@ -952,16 +1228,22 @@ async function assetsRoutes(fastify) {
},
async (request, reply) => {
const payload = normalizeAssetPayload(parseCreateBody(ASSET_CREATE_SCHEMA, request.body));
validateAssetTextBoundaries(payload);
const asset = await fastify.prisma.$transaction(async (tx) => {
const category = await ensureAssetCategoryExists(tx, payload.categoryId, { requireActive: true });
await ensureLegalEntityAvailable(tx, payload.legalEntityId);
await ensureCostCenterAvailable(tx, payload.costCenterId, payload.legalEntityId);
await ensureAssigneeEmployee(tx, payload.assigneeEmployeeId ?? null);
await ensureActiveEmployee(tx, "ownerEmployeeId", payload.ownerEmployeeId ?? null);
await ensureActiveEmployee(tx, "keeperEmployeeId", payload.keeperEmployeeId ?? null);
await ensureApprovedPurchaseRequest(tx, payload.purchaseRequestId ?? null);
const assetType = payload.assetType ?? "fixed_asset";
const documentCategoryCode = assetDocumentCategoryCode(assetType, category);
const issued = await issueDocumentNumber(tx, {
documentType: "asset_card",
documentCategoryCode: category.document_category?.code ?? null,
documentCategoryCode,
sequenceKey: assetSequenceKey(assetType, documentCategoryCode),
actorId: request.employee.id,
});
@@ -971,6 +1253,8 @@ async function assetsRoutes(fastify) {
data: {
asset_no: issued.documentNumber,
name: payload.name,
asset_type: assetType,
sensitivity_level: payload.sensitivityLevel ?? "internal",
category_id: payload.categoryId,
legal_entity_id: payload.legalEntityId,
cost_center_id: payload.costCenterId,
@@ -979,6 +1263,16 @@ async function assetsRoutes(fastify) {
location: payload.location ?? null,
status: resolvedStatus,
assignee_employee_id: payload.assigneeEmployeeId ?? null,
owner_employee_id: payload.ownerEmployeeId ?? null,
keeper_employee_id: payload.keeperEmployeeId ?? null,
archive_location: payload.archiveLocation ?? null,
external_ref: payload.externalRef ?? null,
source_hash: payload.sourceHash ?? null,
verification_no: payload.verificationNo ?? null,
confidentiality_note: payload.confidentialityNote ?? null,
metadata: payload.metadata ?? null,
last_verified_at: payload.lastVerifiedAt ? parseDateOnlyString(payload.lastVerifiedAt) : null,
expires_at: payload.expiresAt ? parseDateOnlyString(payload.expiresAt) : null,
activated_at: payload.activatedAt ? parseDateOnlyString(payload.activatedAt) : null,
retired_at: payload.retiredAt ? parseDateOnlyString(payload.retiredAt) : null,
created_by: request.employee.id,
@@ -1009,8 +1303,12 @@ async function assetsRoutes(fastify) {
targetId: asset.id,
extra: {
assetNo: asset.asset_no,
assetType: asset.asset_type,
sensitivityLevel: asset.sensitivity_level,
purchaseRequestId: asset.purchase_request_id ?? null,
assigneeEmployeeId: asset.assignee_employee_id ?? null,
ownerEmployeeId: asset.owner_employee_id ?? null,
keeperEmployeeId: asset.keeper_employee_id ?? null,
},
}),
}).catch((error) => {
@@ -1032,6 +1330,177 @@ async function assetsRoutes(fastify) {
},
);
fastify.post(
"/assets/import/redacted-doc-index",
{
schema: { tags: ["Assets"], summary: "Import Redacted Electronic Document Asset Index" },
preHandler: fastify.requirePermission("asset.manage"),
},
async (request, reply) => {
const payload = parseCreateBody(REDACTED_DOC_IMPORT_SCHEMA, request.body);
validateRedactedImportBoundaries(payload);
const shouldWrite = payload.write === true && payload.dryRun !== true;
if (shouldWrite && process.env.ASSET_INDEX_IMPORT_WRITE !== "1") {
throw new AppError({
code: "CONFIG_001",
message: "资产索引写入开关未开启",
statusCode: 409,
details: { requiredEnv: "ASSET_INDEX_IMPORT_WRITE=1" },
});
}
if (shouldWrite && (!payload.categoryId || !payload.legalEntityId || !payload.costCenterId)) {
throw buildValidationError({
categoryId: payload.categoryId ? undefined : "required_for_write",
legalEntityId: payload.legalEntityId ? undefined : "required_for_write",
costCenterId: payload.costCenterId ? undefined : "required_for_write",
});
}
const preview = payload.items.map((item, index) => ({
index,
code: item.code ?? null,
name: item.name,
sourceHash: item.sourceHash ?? null,
sensitivityLevel: item.sensitivityLevel ?? "confidential",
action: shouldWrite ? "create_or_skip" : "dry_run",
}));
if (!shouldWrite) {
return sendData(reply, request, {
mode: "dry_run",
readOnly: true,
imported: 0,
items: preview,
boundaries: {
noFileUpload: true,
noRawContent: true,
noFullPathOutput: true,
},
});
}
const result = await fastify.prisma.$transaction(async (tx) => {
const category = await ensureAssetCategoryExists(tx, payload.categoryId, { requireActive: true });
await ensureLegalEntityAvailable(tx, payload.legalEntityId);
await ensureCostCenterAvailable(tx, payload.costCenterId, payload.legalEntityId);
await ensureActiveEmployee(tx, "ownerEmployeeId", payload.ownerEmployeeId ?? null);
await ensureActiveEmployee(tx, "keeperEmployeeId", payload.keeperEmployeeId ?? null);
const items = [];
for (const [index, item] of payload.items.entries()) {
const existing = item.sourceHash
? await tx.assetCard.findFirst({
where: { source_hash: item.sourceHash, asset_type: "electronic_document" },
select: { id: true, asset_no: true },
})
: null;
if (existing) {
items.push({
index,
code: item.code ?? null,
status: "skipped_existing_hash",
assetId: existing.id,
assetNo: existing.asset_no,
sourceHash: item.sourceHash ?? null,
});
continue;
}
const issued = await issueDocumentNumber(tx, {
documentType: "asset_card",
documentCategoryCode: assetDocumentCategoryCode("electronic_document"),
sequenceKey: assetSequenceKey("electronic_document", assetDocumentCategoryCode("electronic_document")),
actorId: request.employee.id,
});
const created = await tx.assetCard.create({
data: {
asset_no: issued.documentNumber,
name: item.name.trim(),
asset_type: "electronic_document",
sensitivity_level: item.sensitivityLevel ?? "confidential",
category_id: payload.categoryId,
legal_entity_id: payload.legalEntityId,
cost_center_id: payload.costCenterId,
status: "archived",
owner_employee_id: payload.ownerEmployeeId ?? null,
keeper_employee_id: payload.keeperEmployeeId ?? null,
archive_location: item.archiveLocation ?? null,
external_ref: item.code ?? item.externalRef ?? null,
source_hash: item.sourceHash ?? null,
verification_no: item.verificationNo ?? null,
confidentiality_note: item.requiredRedaction ?? null,
metadata: {
source: "redacted_company_index",
docType: item.docType ?? null,
extension: item.extension ?? null,
detectedCategories: item.detectedCategories ?? null,
rawFileImported: false,
},
last_verified_at: new Date(),
created_by: request.employee.id,
updated_by: request.employee.id,
},
select: { id: true, asset_no: true },
});
await tx.auditLog.create({
data: buildAuditLogData(request, {
actorId: request.employee.id,
action: "ASSET_REDACTED_DOC_INDEX_IMPORTED",
targetType: "asset_card",
targetId: created.id,
extra: {
assetNo: created.asset_no,
code: item.code ?? null,
sourceHash: item.sourceHash ?? null,
rawFileImported: false,
},
}),
});
items.push({
index,
code: item.code ?? null,
status: "created",
assetId: created.id,
assetNo: created.asset_no,
sourceHash: item.sourceHash ?? null,
});
}
await tx.auditLog.create({
data: buildAuditLogData(request, {
actorId: request.employee.id,
action: "ASSET_REDACTED_DOC_INDEX_IMPORT_BATCH",
targetType: "asset_card",
targetId: null,
extra: {
itemCount: payload.items.length,
createdCount: items.filter((item) => item.status === "created").length,
categoryId: category.id,
rawFileImported: false,
},
}),
});
return items;
});
return sendData(reply, request, {
mode: "write",
readOnly: false,
imported: result.filter((item) => item.status === "created").length,
items: result,
boundaries: {
noFileUpload: true,
noRawContent: true,
noFullPathOutput: true,
},
});
},
);
fastify.get(
"/assets/:id",
{
@@ -1062,6 +1531,7 @@ async function assetsRoutes(fastify) {
async (request, reply) => {
const assetId = parseUuid("id", request.params?.id);
const payload = normalizeAssetPayload(parsePatchBody(ASSET_PATCH_SCHEMA, request.body));
validateAssetTextBoundaries(payload);
const { asset, assetLedgerSummaryChange } = await fastify.prisma.$transaction(async (tx) => {
const current = await tx.assetCard.findUnique({
@@ -1070,6 +1540,8 @@ async function assetsRoutes(fastify) {
id: true,
asset_no: true,
name: true,
asset_type: true,
sensitivity_level: true,
category_id: true,
legal_entity_id: true,
cost_center_id: true,
@@ -1078,6 +1550,16 @@ async function assetsRoutes(fastify) {
location: true,
status: true,
assignee_employee_id: true,
owner_employee_id: true,
keeper_employee_id: true,
archive_location: true,
external_ref: true,
source_hash: true,
verification_no: true,
confidentiality_note: true,
metadata: true,
last_verified_at: true,
expires_at: true,
activated_at: true,
retired_at: true,
},
@@ -1093,6 +1575,8 @@ async function assetsRoutes(fastify) {
if (payload.categoryId !== undefined) {
await ensureAssetCategoryExists(tx, nextCategoryId, { requireActive: true });
}
await ensureActiveEmployee(tx, "ownerEmployeeId", payload.ownerEmployeeId ?? null);
await ensureActiveEmployee(tx, "keeperEmployeeId", payload.keeperEmployeeId ?? null);
if (payload.legalEntityId !== undefined) {
await ensureLegalEntityAvailable(tx, nextLegalEntityId);
}
@@ -1104,12 +1588,28 @@ async function assetsRoutes(fastify) {
where: { id: assetId },
data: {
...(payload.name !== undefined ? { name: payload.name } : {}),
...(payload.assetType !== undefined ? { asset_type: payload.assetType } : {}),
...(payload.sensitivityLevel !== undefined ? { sensitivity_level: payload.sensitivityLevel } : {}),
...(payload.categoryId !== undefined ? { category_id: payload.categoryId } : {}),
...(payload.legalEntityId !== undefined ? { legal_entity_id: payload.legalEntityId } : {}),
...(payload.costCenterId !== undefined ? { cost_center_id: payload.costCenterId } : {}),
...(payload.serialNo !== undefined ? { serial_no: payload.serialNo } : {}),
...(payload.location !== undefined ? { location: payload.location } : {}),
...(payload.status !== undefined ? { status: payload.status } : {}),
...(payload.ownerEmployeeId !== undefined ? { owner_employee_id: payload.ownerEmployeeId } : {}),
...(payload.keeperEmployeeId !== undefined ? { keeper_employee_id: payload.keeperEmployeeId } : {}),
...(payload.archiveLocation !== undefined ? { archive_location: payload.archiveLocation } : {}),
...(payload.externalRef !== undefined ? { external_ref: payload.externalRef } : {}),
...(payload.sourceHash !== undefined ? { source_hash: payload.sourceHash } : {}),
...(payload.verificationNo !== undefined ? { verification_no: payload.verificationNo } : {}),
...(payload.confidentialityNote !== undefined ? { confidentiality_note: payload.confidentialityNote } : {}),
...(payload.metadata !== undefined ? { metadata: payload.metadata } : {}),
...(payload.lastVerifiedAt !== undefined
? { last_verified_at: payload.lastVerifiedAt ? parseDateOnlyString(payload.lastVerifiedAt) : null }
: {}),
...(payload.expiresAt !== undefined
? { expires_at: payload.expiresAt ? parseDateOnlyString(payload.expiresAt) : null }
: {}),
...(payload.activatedAt !== undefined
? { activated_at: payload.activatedAt ? parseDateOnlyString(payload.activatedAt) : null }
: {}),
@@ -1129,8 +1629,12 @@ async function assetsRoutes(fastify) {
targetId: updated.id,
extra: {
assetNo: current.asset_no,
assetType: updated.asset_type,
sensitivityLevel: updated.sensitivity_level,
status: updated.status,
assigneeEmployeeId: updated.assignee_employee_id ?? null,
ownerEmployeeId: updated.owner_employee_id ?? null,
keeperEmployeeId: updated.keeper_employee_id ?? null,
},
}),
});
server/src/scripts/seed-config.js
+42 -2
查看文件
@@ -186,8 +186,48 @@ const DEFAULT_DOCUMENT_CATEGORIES = [
code: "ASSET_CARD_DEFAULT",
name: "固定资产卡片",
entity_type: "asset_card",
sequence_prefix: "ZC",
number_length: 4,
sequence_prefix: "FA",
number_length: 6,
reset_period: "yearly",
default_workflow_key: null,
enabled: true,
},
{
code: "ASSET_EA_DOC",
name: "电子资料资产",
entity_type: "asset_card",
sequence_prefix: "EA-DOC",
number_length: 6,
reset_period: "yearly",
default_workflow_key: null,
enabled: true,
},
{
code: "ASSET_EA_SYS",
name: "电子系统资产",
entity_type: "asset_card",
sequence_prefix: "EA-SYS",
number_length: 6,
reset_period: "yearly",
default_workflow_key: null,
enabled: true,
},
{
code: "ASSET_EA_REPO",
name: "代码仓库资产",
entity_type: "asset_card",
sequence_prefix: "EA-REPO",
number_length: 6,
reset_period: "yearly",
default_workflow_key: null,
enabled: true,
},
{
code: "ASSET_EA_BKP",
name: "备份介质资产",
entity_type: "asset_card",
sequence_prefix: "EA-BKP",
number_length: 6,
reset_period: "yearly",
default_workflow_key: null,
enabled: true,
server/src/services/documentSequence.js
+26 -10
查看文件
@@ -65,10 +65,10 @@ const DOCUMENT_TYPE_CONFIG = {
defaultCategoryCode: "ASSET_CARD_DEFAULT",
preferLegacySequence: false,
fallback: {
prefix: "ZC",
dateFormat: "YYYYMMDD",
prefix: "FA",
dateFormat: "YYYY",
separator: "-",
numberLength: 4,
numberLength: 6,
resetPeriod: "yearly",
},
},
@@ -151,6 +151,7 @@ function buildConfigFromFallback(documentType) {
function buildConfigFromCategory(documentType, category, sequenceRecord) {
const fallback = DOCUMENT_TYPE_CONFIG[documentType].fallback;
const mappedSequence = mapSequenceRecord(sequenceRecord);
const shouldPreferFallbackDateFormat = documentType === "asset_card";
return {
exists: Boolean(sequenceRecord),
@@ -158,7 +159,7 @@ function buildConfigFromCategory(documentType, category, sequenceRecord) {
documentType,
documentCategoryCode: category.code,
prefix: category.sequence_prefix,
dateFormat: mappedSequence?.dateFormat ?? fallback.dateFormat,
dateFormat: shouldPreferFallbackDateFormat ? fallback.dateFormat : mappedSequence?.dateFormat ?? fallback.dateFormat,
separator: mappedSequence?.separator ?? fallback.separator,
numberLength: category.number_length,
resetPeriod: category.reset_period,
@@ -249,12 +250,13 @@ async function findDocumentCategory(prisma, { documentType, documentCategoryCode
});
}
async function resolveDocumentSequenceConfig(prisma, { documentType, documentCategoryCode = null } = {}) {
async function resolveDocumentSequenceConfig(prisma, { documentType, documentCategoryCode = null, sequenceKey = null } = {}) {
const normalizedDocumentType = normalizeDocumentType(documentType);
const documentTypeConfig = DOCUMENT_TYPE_CONFIG[normalizedDocumentType];
const resolvedSequenceKey = sequenceKey || normalizedDocumentType;
const sequenceRecord = await prisma.documentSequence.findUnique({
where: { document_type: normalizedDocumentType },
where: { document_type: resolvedSequenceKey },
select: {
document_type: true,
prefix: true,
@@ -299,24 +301,37 @@ async function resolveDocumentSequenceConfig(prisma, { documentType, documentCat
return buildConfigFromFallback(normalizedDocumentType);
}
function formatDatePart(dateFormat, timeZone) {
const compact = compactDateString(timeZone);
if (dateFormat === "YYYY") {
return compact.slice(0, 4);
}
if (dateFormat === "YYYYMM") {
return compact.slice(0, 6);
}
return compact;
}
function formatDocumentNumber(sequenceConfig, timeZone) {
const datePart = compactDateString(timeZone);
const datePart = formatDatePart(sequenceConfig.dateFormat, timeZone);
const serial = String(sequenceConfig.current_number).padStart(sequenceConfig.number_length, "0");
return `${sequenceConfig.prefix}${sequenceConfig.separator}${datePart}${sequenceConfig.separator}${serial}`;
}
async function issueDocumentNumber(
tx,
{ documentType, documentCategoryCode = null, actorId = null, timeZone = "Asia/Shanghai" } = {},
{ documentType, documentCategoryCode = null, sequenceKey = null, actorId = null, timeZone = "Asia/Shanghai" } = {},
) {
const normalizedDocumentType = normalizeDocumentType(documentType);
const resolvedSequenceKey = sequenceKey || normalizedDocumentType;
const config = await resolveDocumentSequenceConfig(tx, {
documentType: normalizedDocumentType,
documentCategoryCode,
sequenceKey: resolvedSequenceKey,
});
const sequenceRecord = await tx.documentSequence.upsert({
where: { document_type: normalizedDocumentType },
where: { document_type: resolvedSequenceKey },
update: {
prefix: config.prefix,
date_format: config.dateFormat,
@@ -327,7 +342,7 @@ async function issueDocumentNumber(
updated_by: actorId,
},
create: {
document_type: normalizedDocumentType,
document_type: resolvedSequenceKey,
prefix: config.prefix,
date_format: config.dateFormat,
separator: config.separator,
@@ -356,6 +371,7 @@ async function issueDocumentNumber(
{
prefix: mappedSequence.prefix,
separator: mappedSequence.separator,
dateFormat: mappedSequence.dateFormat,
number_length: mappedSequence.numberLength,
current_number: mappedSequence.currentNumber,
},
server/tests/unit/documentSequence.service.test.js
+41
查看文件
@@ -207,4 +207,45 @@ describe("documentSequence service", () => {
expect(config.documentCategoryCode).toBe("ASSET_CARD_DEFAULT");
expect(config.prefix).toBe("ZC");
});
it("can issue asset numbers with independent sequence keys per asset number family", async () => {
const prisma = buildPrisma({
sequenceMap: {
"asset_card:ASSET_EA_DOC": {
document_type: "asset_card:ASSET_EA_DOC",
prefix: "EA-DOC",
date_format: "YYYY",
separator: "-",
number_length: 6,
reset_period: "yearly",
current_number: 8,
last_reset_date: null,
updated_at: new Date("2026-03-07T00:00:00.000Z"),
updated_by: "tester",
},
},
categoryMap: {
ASSET_EA_DOC: {
code: "ASSET_EA_DOC",
entity_type: "asset_card",
sequence_prefix: "EA-DOC",
number_length: 6,
reset_period: "yearly",
enabled: true,
archived_at: null,
},
},
});
const issued = await issueDocumentNumber(prisma, {
documentType: "asset_card",
documentCategoryCode: "ASSET_EA_DOC",
sequenceKey: "asset_card:ASSET_EA_DOC",
actorId: "tester",
timeZone: "Asia/Shanghai",
});
expect(issued.sequence.documentType).toBe("asset_card:ASSET_EA_DOC");
expect(issued.documentNumber).toMatch(/^EA-DOC-\d{4}-000009$/);
});
});
server/tests/unit/routes/assets.search.test.js
+132 -121
查看文件
@@ -5,9 +5,18 @@ const assetsRoutes = require('../../../src/routes/assets');
function buildAssetRecord({
id = 'asset-1',
assetNo = 'ZC-001',
assetNo = 'FA-2026-000001',
serialNo = 'SN-001',
assetType = 'fixed_asset',
sensitivityLevel = 'internal',
assigneeEmployeeId = 'employee-1',
ownerEmployeeId = null,
keeperEmployeeId = null,
archiveLocation = null,
externalRef = null,
sourceHash = null,
confidentialityNote = null,
metadata = null,
name = '测试笔记本',
} = {}) {
const now = new Date('2026-03-11T00:00:00.000Z');
@@ -15,6 +24,8 @@ function buildAssetRecord({
id,
asset_no: assetNo,
name,
asset_type: assetType,
sensitivity_level: sensitivityLevel,
category_id: 'cat-1',
legal_entity_id: 'legal-1',
cost_center_id: 'cc-1',
@@ -23,6 +34,16 @@ function buildAssetRecord({
location: '深圳办公室',
status: 'in_use',
assignee_employee_id: assigneeEmployeeId,
owner_employee_id: ownerEmployeeId,
keeper_employee_id: keeperEmployeeId,
archive_location: archiveLocation,
external_ref: externalRef,
source_hash: sourceHash,
verification_no: null,
confidentiality_note: confidentialityNote,
metadata,
last_verified_at: null,
expires_at: null,
activated_at: now,
retired_at: null,
created_at: now,
@@ -46,6 +67,8 @@ function buildAssetRecord({
name: '张三',
department: null,
},
owner: null,
keeper: null,
};
}
@@ -109,25 +132,25 @@ async function buildApp({ employee, prisma }) {
}
describe('assets search route', () => {
it('prefers exact assetNo matching before serial or fuzzy lookup', async () => {
it('uses one scoped OR query for assetNo, serialNo, VER/hash/ref/location and name lookup', async () => {
const prisma = buildPrisma({
items: [buildAssetRecord()],
});
const app = await buildApp({
employee: { id: 'manager-1', permissionCodes: ['asset.view_all'] },
employee: { id: 'admin-1', permissionCodes: ['asset.manage'] },
prisma,
});
const response = await app.inject({
method: 'GET',
url: '/api/assets?q=ZC-001',
url: '/api/assets?q=FA-2026-000001',
headers: { authorization: 'Bearer token' },
});
expect(response.statusCode).toBe(200);
expect(response.json().data.items[0]).toEqual(
expect.objectContaining({
assetNo: 'ZC-001',
assetNo: 'FA-2026-000001',
serialNo: 'SN-001',
}),
);
@@ -135,100 +158,18 @@ describe('assets search route', () => {
expect(prisma.assetCard.findMany).toHaveBeenCalledWith(
expect.objectContaining({
where: expect.objectContaining({
asset_no: 'ZC-001',
}),
}),
);
await app.close();
});
it('falls back to serialNo exact lookup when assetNo misses', async () => {
const prisma = {
assetCard: {
findMany: vi
.fn()
.mockResolvedValueOnce([])
.mockResolvedValueOnce([buildAssetRecord({ id: 'asset-2', assetNo: 'ZC-003', serialNo: 'SN-003' })]),
},
};
const app = await buildApp({
employee: { id: 'manager-1', permissionCodes: ['asset.view_all'] },
prisma,
});
const response = await app.inject({
method: 'GET',
url: '/api/assets?q=SN-003',
headers: { authorization: 'Bearer token' },
});
expect(response.statusCode).toBe(200);
expect(prisma.assetCard.findMany).toHaveBeenCalledTimes(2);
expect(prisma.assetCard.findMany).toHaveBeenNthCalledWith(
1,
expect.objectContaining({
where: expect.objectContaining({
asset_no: 'SN-003',
}),
}),
);
expect(prisma.assetCard.findMany).toHaveBeenNthCalledWith(
2,
expect.objectContaining({
where: expect.objectContaining({
serial_no: 'SN-003',
}),
}),
);
await app.close();
});
it('falls back to fuzzy name search only after both exact lookups miss', async () => {
const prisma = {
assetCard: {
findMany: vi
.fn()
.mockResolvedValueOnce([])
.mockResolvedValueOnce([])
.mockResolvedValueOnce([buildAssetRecord({ id: 'asset-3', assetNo: 'ZC-004', serialNo: 'SN-004', name: '研发测试笔记本' })]),
},
};
const app = await buildApp({
employee: { id: 'manager-1', permissionCodes: ['asset.view_all'] },
prisma,
});
const response = await app.inject({
method: 'GET',
url: '/api/assets?q=测试笔记本',
headers: { authorization: 'Bearer token' },
});
expect(response.statusCode).toBe(200);
expect(prisma.assetCard.findMany).toHaveBeenCalledTimes(3);
expect(prisma.assetCard.findMany).toHaveBeenNthCalledWith(
1,
expect.objectContaining({
where: expect.objectContaining({
asset_no: '测试笔记本',
}),
}),
);
expect(prisma.assetCard.findMany).toHaveBeenNthCalledWith(
2,
expect.objectContaining({
where: expect.objectContaining({
serial_no: '测试笔记本',
}),
}),
);
expect(prisma.assetCard.findMany).toHaveBeenNthCalledWith(
3,
expect.objectContaining({
where: expect.objectContaining({
name: { contains: '测试笔记本', mode: 'insensitive' },
AND: expect.arrayContaining([
expect.objectContaining({}),
expect.objectContaining({
OR: expect.arrayContaining([
{ asset_no: 'FA-2026-000001' },
{ serial_no: 'FA-2026-000001' },
{ verification_no: 'FA-2026-000001' },
{ source_hash: 'FA-2026-000001' },
{ name: { contains: 'FA-2026-000001', mode: 'insensitive' } },
]),
}),
]),
}),
}),
);
@@ -237,14 +178,9 @@ describe('assets search route', () => {
});
it('forces own-scope lookup even when caller passes mine=0', async () => {
const prisma = {
assetCard: {
findMany: vi
.fn()
.mockResolvedValueOnce([])
.mockResolvedValueOnce([buildAssetRecord({ assigneeEmployeeId: 'employee-1', assetNo: 'ZC-002', serialNo: 'SN-002' })]),
},
};
const prisma = buildPrisma({
items: [buildAssetRecord({ assigneeEmployeeId: 'employee-1', assetNo: 'FA-2026-000002', serialNo: 'SN-002' })],
});
const app = await buildApp({
employee: { id: 'employee-1', permissionCodes: ['asset.view_own'] },
prisma,
@@ -258,26 +194,101 @@ describe('assets search route', () => {
expect(response.statusCode).toBe(200);
expect(response.json().data.mine).toBe(true);
expect(prisma.assetCard.findMany).toHaveBeenCalledTimes(2);
expect(prisma.assetCard.findMany).toHaveBeenNthCalledWith(
1,
expect(prisma.assetCard.findMany).toHaveBeenCalledTimes(1);
expect(prisma.assetCard.findMany).toHaveBeenCalledWith(
expect.objectContaining({
where: expect.objectContaining({
assignee_employee_id: 'employee-1',
asset_no: 'SN-002',
}),
}),
);
expect(prisma.assetCard.findMany).toHaveBeenNthCalledWith(
2,
expect.objectContaining({
where: expect.objectContaining({
assignee_employee_id: 'employee-1',
serial_no: 'SN-002',
AND: expect.arrayContaining([
expect.objectContaining({
OR: [
{ assignee_employee_id: 'employee-1' },
{ owner_employee_id: 'employee-1' },
{ keeper_employee_id: 'employee-1' },
],
}),
expect.objectContaining({
OR: expect.arrayContaining([{ serial_no: 'SN-002' }]),
}),
]),
}),
}),
);
await app.close();
});
it('redacts sensitive electronic asset fields for asset.view_all callers that are not related employees', async () => {
const prisma = buildPrisma({
items: [
buildAssetRecord({
id: 'asset-3',
assetNo: 'EA-DOC-2026-000001',
assetType: 'electronic_document',
sensitivityLevel: 'confidential',
archiveLocation: '离线档案柜-A',
externalRef: 'DOC-001',
sourceHash: 'sha256:abcdef',
confidentialityNote: '仅负责人可查看',
metadata: { source: 'redacted_index' },
}),
],
});
const app = await buildApp({
employee: { id: 'manager-1', permissionCodes: ['asset.view_all'] },
prisma,
});
const response = await app.inject({
method: 'GET',
url: '/api/assets?q=EA-DOC-2026-000001',
headers: { authorization: 'Bearer token' },
});
expect(response.statusCode).toBe(200);
expect(response.json().data.items[0]).toEqual(
expect.objectContaining({
assetNo: 'EA-DOC-2026-000001',
archiveLocation: null,
externalRef: null,
sourceHash: null,
confidentialityNote: null,
metadata: null,
sensitiveFieldsRedacted: true,
}),
);
await app.close();
});
it('rejects redacted index import items that still contain full local paths', async () => {
const prisma = buildPrisma();
const app = await buildApp({
employee: { id: 'admin-1', permissionCodes: ['asset.manage'] },
prisma,
});
const response = await app.inject({
method: 'POST',
url: '/api/assets/import/redacted-doc-index',
headers: { authorization: 'Bearer token' },
payload: {
dryRun: true,
items: [
{
name: '合同索引',
archiveLocation: '/home/shunli/Projects/faculty-daily-assistant/公司/合同.pdf',
},
],
},
});
expect(response.statusCode).toBe(400);
expect(response.json().error.details).toEqual(
expect.objectContaining({
'items.0.archiveLocation': 'local_absolute_path',
}),
);
await app.close();
});
});