WRA1 修正企微运行验收门禁

server/tests/unit/scripts/check-wecom-runtime-ready.test.js

@@ -173,6 +173,78 @@ describe("check-wecom-runtime-ready", () => {
     ]);
   });
 
+  it("uses QA-only checkin read mode when sync switch is disabled", async () => {
+    const fetchCheckinImpl = vi.fn(async ({ requireSyncEnabled }) => {
+      expect(requireSyncEnabled).toBe(false);
+      return {
+        ok: true,
+        code: "wecom_checkin_fetched",
+        records: [],
+        response: { checkindataCount: 0 },
+      };
+    });
+
+    const report = await executeRuntimeReady(baseOptions(), {
+      config: baseConfig({ wecomCheckinSyncEnabled: false }),
+      env: {},
+      oaRows: [boundEmployee()],
+      fetchProfilesImpl: vi.fn(async () => ({
+        tokenSource: { contact: "WECOM_CONTACT_SECRET", hr: "WECOM_AGENT_SECRET" },
+        profiles: [wecomProfile()],
+      })),
+      fetchCheckinImpl,
+      generatedAt: "2026-05-19T01:00:00.000Z",
+    });
+
+    expect(report.status).toBe("PASS_WITH_CONFIG_GAPS");
+    expect(report.checks.secretMatrix.matrix.checkin).toMatchObject({
+      syncEnabled: false,
+      runtimeReadyMode: "qa_read_only_sync_disabled",
+    });
+    expect(report.checks.checkinRead).toMatchObject({
+      status: "OK",
+      syncEnabled: false,
+      runtimeReadyMode: "qa_read_only_sync_disabled",
+      readiness: "readable_sync_disabled",
+    });
+  });
+
+  it("keeps real WeCom checkin API failures blocking in QA-only mode", async () => {
+    const report = await executeRuntimeReady(baseOptions(), {
+      config: baseConfig({ wecomCheckinSyncEnabled: false }),
+      env: {},
+      oaRows: [boundEmployee()],
+      fetchProfilesImpl: vi.fn(async () => ({
+        tokenSource: { contact: "WECOM_CONTACT_SECRET", hr: "WECOM_AGENT_SECRET" },
+        profiles: [wecomProfile()],
+      })),
+      fetchCheckinImpl: vi.fn(async ({ requireSyncEnabled }) => {
+        expect(requireSyncEnabled).toBe(false);
+        return {
+          ok: false,
+          code: "wecom_checkin_api_error",
+          records: [],
+          response: { errcode: 301062, errmsg: "permission denied" },
+          message: "WeCom checkin errcode 301062",
+        };
+      }),
+      generatedAt: "2026-05-19T01:00:00.000Z",
+    });
+
+    expect(report.status).toBe("SKIP");
+    expect(report.conclusion).toBe("BLOCKED_BY_EXTERNAL_CONFIG");
+    expect(report.mainBlockers).toEqual(expect.arrayContaining([
+      expect.objectContaining({
+        id: "checkin_short_window_read",
+        reason: "wecom_checkin_api_error",
+      }),
+    ]));
+    expect(report.checks.checkinRead).toMatchObject({
+      status: "BLOCKED",
+      readiness: "blocked",
+    });
+  });
+
   it("blocks instead of falling back when contact Secret is missing", async () => {
     const report = await executeRuntimeReady(baseOptions(), {
       config: baseConfig({ wecomContactSecret: "" }),