PA6 补齐权限与审计回归

client/src/auth/permissions.ts

@@ -155,6 +155,17 @@ const ROLE_PERMISSIONS: Record<string, readonly string[]> = {
   admin: ["*"],
 };
 
+export const BUSINESS_APPROVAL_PERMISSIONS = [
+  "expense.approve",
+  "leave.approve",
+  "procurement.approve",
+  "travel.approve",
+] as const;
+
+const BUSINESS_APPROVER_ROLE_CODES = ["manager", "ceo", "finance", "finance_mgr", "hr"] as const;
+const FINANCE_ROLE_CODES = ["finance", "finance_mgr"] as const;
+const FINANCE_PORTAL_PERMISSIONS = ["payment.batch.manage", "risk.review.manage", "expense.finance.pay"] as const;
+
 function rolePermissions(roleCode: string): readonly string[] {
   return ROLE_PERMISSIONS[roleCode] ?? [];
 }
@@ -183,6 +194,19 @@ export function hasAnyPermission(permissionCodes: string[], candidates: string[]
   return candidates.some((candidate) => hasPermission(permissionCodes, candidate));
 }
 
+export function hasBusinessApproverRole(roleCodes: string[] | undefined, permissionCodes: string[]) {
+  const hasBusinessRole = (roleCodes ?? []).some((roleCode) =>
+    (BUSINESS_APPROVER_ROLE_CODES as readonly string[]).includes(roleCode),
+  );
+
+  return hasBusinessRole && hasAnyPermission(permissionCodes, [...BUSINESS_APPROVAL_PERMISSIONS]);
+}
+
+export function hasFinanceRole(roleCodes: string[] | undefined, permissionCodes: string[]) {
+  const hasRole = (roleCodes ?? []).some((roleCode) => (FINANCE_ROLE_CODES as readonly string[]).includes(roleCode));
+  return hasRole && hasAnyPermission(permissionCodes, [...FINANCE_PORTAL_PERMISSIONS]);
+}
+
 export function isManagerRole(permissionCodes: string[]) {
   if (hasPermission(permissionCodes, "*") || hasPermission(permissionCodes, "system.users")) {
     return true;

client/src/components/mobile/MobileBottomNav.tsx

@@ -2,11 +2,8 @@ import { NavLink } from "react-router-dom";
 import { useQuery } from "@tanstack/react-query";
 import { fetchWorkflowTasks } from "../../api/workflow";
 import { useAuth } from "../../auth/AuthContext";
-import { hasAnyPermission } from "../../auth/permissions";
-import {
-  MOBILE_APPROVAL_PERMISSIONS,
-  MOBILE_NAV_ITEMS,
-} from "../../features/mobile/navigation";
+import { hasAnyPermission, hasBusinessApproverRole } from "../../auth/permissions";
+import { MOBILE_NAV_ITEMS } from "../../features/mobile/navigation";
 import { cn } from "../../lib/utils";
 import { MobileIcon } from "./MobileIcon";
 
@@ -18,8 +15,8 @@ function resolveBadgeLabel(count: number) {
 }
 
 export function MobileBottomNav() {
-  const { permissions } = useAuth();
-  const canAccessApprovals = hasAnyPermission(permissions, [...MOBILE_APPROVAL_PERMISSIONS]);
+  const { me, permissions } = useAuth();
+  const canAccessApprovals = hasBusinessApproverRole(me?.roleCodes, permissions);
 
   const pendingCountQuery = useQuery({
     enabled: canAccessApprovals,
@@ -40,7 +37,11 @@ export function MobileBottomNav() {
     >
       <div className="relative z-[71] grid grid-cols-4 gap-1">
         {MOBILE_NAV_ITEMS.map((item) => {
-          const disabled = item.anyOf ? !hasAnyPermission(permissions, [...item.anyOf]) : false;
+          const disabled = item.key === "approvals"
+            ? !canAccessApprovals
+            : item.anyOf
+              ? !hasAnyPermission(permissions, [...item.anyOf])
+              : false;
           const badge = item.key === "approvals" && pendingCount > 0 ? resolveBadgeLabel(pendingCount) : null;
 
           if (disabled) {

client/src/components/navigation/NavLinks.tsx

@@ -2,7 +2,7 @@ import { NavLink } from "react-router-dom";
 import { useQuery } from "@tanstack/react-query";
 import { fetchSystemNavigation, type NavigationItem } from "../../api/workspace";
 import { useAuth } from "../../auth/AuthContext";
-import { hasAnyPermission } from "../../auth/permissions";
+import { hasAnyPermission, hasBusinessApproverRole, hasFinanceRole } from "../../auth/permissions";
 import {
   ADMIN_NAV_ORDER,
   BACKUP_NAV_ORDER,
@@ -32,7 +32,7 @@ export const NAV_ITEMS: NavItem[] = [
   { to: "/people", label: "人员管理", icon: "group", anyOf: ["system.users", "report.dashboard.view"] },
   { to: "/organization", label: "组织架构", icon: "account_tree", anyOf: ["system.users", "report.dashboard.view"] },
   { to: "/system/workflow-definitions", label: "流程定义", icon: "schema", anyOf: ["system.settings"] },
-  { to: "/system/settings", label: "系统设置", icon: "settings", anyOf: ["system.settings", "system.users", "masterdata.view", "masterdata.manage", "notification.channel.manage", "integration.manage"] },
+  { to: "/system/settings", label: "系统设置", icon: "settings", anyOf: ["system.settings", "system.users", "masterdata.manage", "notification.channel.manage", "integration.manage"] },
   { to: "/system/feature-flags", label: "功能开关", icon: "toggle_on", anyOf: ["system.settings"] },
   { to: "/audit-logs", label: "审计日志", icon: "manage_search", anyOf: ["system.audit.view"] },
   { to: "/workflow/tasks", label: "审批待办", icon: "fact_check", anyOf: ["expense.approve", "leave.approve", "procurement.approve", "travel.approve"] },
@@ -136,9 +136,12 @@ function renderBackupSection(items: ResolvedNavItem[], onNavigate?: () => void)
   );
 }
 
-function buildFallbackItems(permissions: string[]) {
+function buildFallbackItems(permissions: string[], roleCodes: string[]) {
+  const financeOnlyPaths = new Set(["/payment-batches", "/ap-operations", "/invoice-pool"]);
   const mapItems = (paths: string[]) =>
     NAV_ITEMS.filter((item) => paths.includes(item.to))
+      .filter((item) => item.to !== "/workflow/tasks" || hasBusinessApproverRole(roleCodes, permissions))
+      .filter((item) => !financeOnlyPaths.has(item.to) || hasFinanceRole(roleCodes, permissions))
       .filter((item) => !item.anyOf || hasAnyPermission(permissions, item.anyOf))
       .map((item) => ({ key: item.to, href: item.to, label: item.label, icon: item.icon }));
 
@@ -184,7 +187,7 @@ function normalizeSections(sections: { main: NavigationItem[]; admin: Navigation
 }
 
 export function NavLinks({ onNavigate }: { onNavigate?: () => void }) {
-  const { permissions } = useAuth();
+  const { me, permissions } = useAuth();
   const navigationQuery = useQuery({
     queryKey: ["system-navigation"],
     queryFn: fetchSystemNavigation,
@@ -193,7 +196,7 @@ export function NavLinks({ onNavigate }: { onNavigate?: () => void }) {
 
   const sections = navigationQuery.data?.sections
     ? normalizeSections(navigationQuery.data.sections)
-    : buildFallbackItems(permissions);
+    : buildFallbackItems(permissions, me?.roleCodes ?? []);
 
   return (
     <nav className="space-y-5">

client/src/pages/MobileMePage.tsx

@@ -6,7 +6,7 @@ import { fetchEmployeeProfile } from "../api/employees";
 import { mapApiErrorMessage } from "../api/errorMessages";
 import { isApiError } from "../api/types";
 import { useAuth } from "../auth/AuthContext";
-import { hasAnyPermission } from "../auth/permissions";
+import { hasAnyPermission, hasBusinessApproverRole } from "../auth/permissions";
 import { EmployeeAvatar } from "../components/common/EmployeeAvatar";
 import { PageHeader } from "../components/common/PageHeader";
 import { MobileIcon } from "../components/mobile/MobileIcon";
@@ -52,8 +52,15 @@ function MobileActionLink({
 
 export function MobileMePage() {
   const { me, permissions, refreshMe, logout } = useAuth();
-  const canAccessApprovals = hasAnyPermission(permissions, ["expense.approve", "leave.approve", "procurement.approve", "travel.approve"]);
-  const canAccessAdmin = hasAnyPermission(permissions, ["*", "system.settings", "system.users", "report.dashboard.view"]);
+  const canAccessApprovals = hasBusinessApproverRole(me?.roleCodes, permissions);
+  const canAccessAdmin = hasAnyPermission(permissions, [
+    "*",
+    "system.settings",
+    "system.users",
+    "masterdata.manage",
+    "notification.channel.manage",
+    "integration.manage",
+  ]);
   const canAccessAssets = hasAnyPermission(permissions, ["asset.view_own", "asset.view_all", "asset.manage", "asset.transfer", "asset.inventory"]);
   const canAccessProjects = hasAnyPermission(permissions, ["project.view_own", "project.view_all", "project.manage"]);
 

client/src/pages/MobilePortalPage.tsx

@@ -12,13 +12,12 @@ import { fetchNotifications } from "../api/notifications";
 import { isApiError } from "../api/types";
 import { fetchWorkflowTasks } from "../api/workflow";
 import { useAuth } from "../auth/AuthContext";
-import { hasAnyPermission } from "../auth/permissions";
+import { hasAnyPermission, hasBusinessApproverRole } from "../auth/permissions";
 import { PageHeader } from "../components/common/PageHeader";
 import { PageScaffold } from "../components/patterns/PageScaffold";
 import { MobileIcon } from "../components/mobile/MobileIcon";
 import { Button } from "../components/ui/button";
 import {
-  MOBILE_APPROVAL_PERMISSIONS,
   MOBILE_CAPTURE_PERMISSIONS,
   MOBILE_LEAVE_PERMISSIONS,
   MOBILE_REIMBURSEMENT_PERMISSIONS,
@@ -155,8 +154,8 @@ function ActionTile({ action }: { action: MobileAction }) {
 
 export function MobilePortalPage() {
   const queryClient = useQueryClient();
-  const { permissions } = useAuth();
-  const canAccessApprovals = hasAnyPermission(permissions, [...MOBILE_APPROVAL_PERMISSIONS]);
+  const { me, permissions } = useAuth();
+  const canAccessApprovals = hasBusinessApproverRole(me?.roleCodes, permissions);
   const canAccessCapture = hasAnyPermission(permissions, [...MOBILE_CAPTURE_PERMISSIONS]);
   const canAccessLeave = hasAnyPermission(permissions, [...MOBILE_LEAVE_PERMISSIONS]);
   const canAccessReimbursements = hasAnyPermission(permissions, [...MOBILE_REIMBURSEMENT_PERMISSIONS]);
@@ -217,14 +216,16 @@ export function MobilePortalPage() {
   const unreadNotificationCount = notifications.filter((item) => !item.readAt).length;
 
   const actions: MobileAction[] = [
-    {
-      key: "approvals",
-      label: "审批",
-      meta: pendingApprovalCount > 0 ? `${pendingApprovalCount} 条待处理` : "暂无待办",
-      icon: "fact_check",
-      to: "/mobile/approvals",
-      tone: pendingApprovalCount > 0 ? "warning" : "primary",
-    },
+    canAccessApprovals
+      ? {
+          key: "approvals",
+          label: "审批",
+          meta: pendingApprovalCount > 0 ? `${pendingApprovalCount} 条待处理` : "暂无待办",
+          icon: "fact_check",
+          to: "/mobile/approvals",
+          tone: pendingApprovalCount > 0 ? "warning" : "primary",
+        }
+      : null,
     canAccessCapture
       ? {
           key: "capture",

client/src/router/guards.tsx

@@ -1,7 +1,7 @@
 import type { PropsWithChildren } from "react";
 import { Navigate, useLocation } from "react-router-dom";
 import { useAuth } from "../auth/AuthContext";
-import { hasAnyPermission } from "../auth/permissions";
+import { hasAnyPermission, hasBusinessApproverRole } from "../auth/permissions";
 import { resolveDefaultWorkspacePath } from "../lib/runtimeContext";
 import { isOfflineSnapshotAllowedPath } from "../pwa";
 
@@ -78,3 +78,17 @@ export function RequirePermission({
 
   return <>{children}</>;
 }
+
+export function RequireBusinessApprover({ children }: PropsWithChildren) {
+  const { me, permissions, ready } = useAuth();
+
+  if (!ready) {
+    return <FullPageLoading />;
+  }
+
+  if (!hasBusinessApproverRole(me?.roleCodes, permissions)) {
+    return <Navigate to="/403" replace />;
+  }
+
+  return <>{children}</>;
+}

client/src/router/index.tsx

@@ -68,7 +68,7 @@ import {
   WorkflowTaskDetailPage,
   WorkflowTasksPage,
 } from "./lazy";
-import { GuestOnly, RequireAuth, RequirePermission } from "./guards";
+import { GuestOnly, RequireAuth, RequireBusinessApprover, RequirePermission } from "./guards";
 
 function withRouteFallback(node: ReactNode) {
   return <Suspense fallback={<RoutePageFallback />}>{node}</Suspense>;
@@ -277,18 +277,18 @@ export function AppRouter() {
         <Route
           path="workflow/tasks"
           element={
-            <RequirePermission anyOf={["expense.approve", "leave.approve", "procurement.approve", "travel.approve"]}>
+            <RequireBusinessApprover>
               {withRouteFallback(<WorkflowTasksPage />)}
-            </RequirePermission>
+            </RequireBusinessApprover>
           }
         />
 
         <Route
           path="workflow/tasks/:taskId"
           element={
-            <RequirePermission anyOf={["expense.approve", "leave.approve", "procurement.approve", "travel.approve"]}>
+            <RequireBusinessApprover>
               {withRouteFallback(<WorkflowTaskDetailPage />)}
-            </RequirePermission>
+            </RequireBusinessApprover>
           }
         />
 
@@ -358,7 +358,11 @@ export function AppRouter() {
 
         <Route
           path="mobile/approvals"
-          element={withRouteFallback(<MobileApprovalsPage />)}
+          element={
+            <RequireBusinessApprover>
+              {withRouteFallback(<MobileApprovalsPage />)}
+            </RequireBusinessApprover>
+          }
         />
 
         <Route path="notifications" element={withRouteFallback(<NotificationsPage />)} />
@@ -485,7 +489,7 @@ export function AppRouter() {
         <Route
           path="system/settings"
           element={
-            <RequirePermission anyOf={["system.settings", "system.users", "masterdata.view", "masterdata.manage", "notification.channel.manage", "integration.manage"]}>
+            <RequirePermission anyOf={["system.settings", "system.users", "masterdata.manage", "notification.channel.manage", "integration.manage"]}>
               {withRouteFallback(<SystemSettingsPage />)}
             </RequirePermission>
           }

client/tests/e2e/permission-direct-access.spec.ts

@@ -6,6 +6,8 @@ import {
   FINANCE,
   FINANCE_MGR,
   MANAGER,
+  apiGetData,
+  apiPostData,
   createAuthenticatedApiClient,
   login,
   type AuthenticatedApiClient,
@@ -23,6 +25,81 @@ type ApiExpectation = {
   note: string;
 };
 
+type ApiMutationExpectation = ApiExpectation & {
+  method: "post" | "patch" | "delete";
+  data?: unknown;
+};
+
+type PortalHomeResponse = {
+  roleCapabilities?: {
+    canApproveTasks: boolean;
+    canUseFinance: boolean;
+    canManageSystem: boolean;
+    isAdminOnly: boolean;
+  };
+  financeSummary?: unknown;
+};
+
+type WorkflowSubmitResponse = {
+  currentTaskId: string;
+  workflowInstanceId: string;
+};
+
+type WorkflowTaskDetailResponse = {
+  history: Array<{
+    action: string;
+    actorId: string | null;
+    payload: unknown;
+  }>;
+};
+
+type AuditLogListResponse = {
+  items: Array<{
+    action: string;
+    targetType: string | null;
+    targetId: string | null;
+    actorId: string | null;
+    extra: unknown;
+  }>;
+};
+
+type NotificationDeliveryListResponse = {
+  items: unknown[];
+};
+
+type LeaveTypeListResponse = {
+  items: Array<{
+    id: string;
+    name: string;
+    requiresAttachment?: boolean;
+  }>;
+};
+
+type ReimbursementCreatedResponse = {
+  id: string;
+  formNumber?: string | null;
+};
+
+type ReimbursementAttachmentUploadResponse = {
+  items: Array<{
+    id: string;
+  }>;
+};
+
+type MasterDataListResponse = {
+  items: Array<{
+    id: string;
+    legalEntityId?: string | null;
+    entityType?: string | null;
+  }>;
+};
+
+type PurchaseCreateResponse = {
+  purchaseRequest: {
+    id: string;
+  };
+};
+
 const SENSITIVE_KEY_PATTERN = /(secret|password|token)/i;
 
 test.use({ serviceWorkers: "block" });
@@ -50,6 +127,20 @@ async function expectApiStatus({ role, api, path, statuses, note }: ApiExpectati
   };
 }
 
+async function expectApiMutationStatus({ role, api, path, statuses, note, method, data }: ApiMutationExpectation) {
+  const response =
+    method === "post"
+      ? await api.post(path, data === undefined ? undefined : { data })
+      : method === "patch"
+        ? await api.patch(path, data === undefined ? undefined : { data })
+        : await api.delete(path);
+  expectStatus(response.status(), statuses, `${role} ${method.toUpperCase()} ${path} (${note})`);
+  return {
+    response,
+    body: await parseJson(response),
+  };
+}
+
 async function openAs(browser: Browser, user: E2EUser) {
   const context = await browser.newContext();
   const page = await context.newPage();
@@ -100,6 +191,172 @@ function expectArray(value: unknown, context: string) {
   return value as JsonObject[];
 }
 
+async function expectPcNavMatrix(browser: Browser, user: E2EUser, input: {
+  visible?: string[];
+  hidden?: string[];
+}) {
+  const { context, page } = await openAs(browser, user);
+  try {
+    await page.setViewportSize({ width: 1440, height: 960 });
+    await page.goto("/portal");
+    for (const href of input.visible ?? []) {
+      await expect
+        .poll(() => page.locator(`nav a[href="${href}"]`).count(), {
+          message: `${user.name} should have entry ${href}`,
+        })
+        .toBeGreaterThan(0);
+    }
+    for (const href of input.hidden ?? []) {
+      await expect(page.locator(`nav a[href="${href}"]`), `${user.name} should not see ${href}`).toHaveCount(0);
+    }
+  } finally {
+    await context.close();
+  }
+}
+
+async function expectMobileApprovalEntry(browser: Browser, user: E2EUser, canApprove: boolean) {
+  const { context, page } = await openAs(browser, user);
+  try {
+    await page.setViewportSize({ width: 390, height: 844 });
+    await page.goto("/mobile");
+    await expect(page.getByTestId("mobile-bottom-nav")).toBeVisible();
+    const approvalTab = page.getByTestId("mobile-nav-approvals");
+    if (canApprove) {
+      await expect(approvalTab).toHaveAttribute("href", "/mobile/approvals");
+      await expect(page.getByTestId("mobile-action-grid").locator('a[href="/mobile/approvals"]').first()).toBeVisible();
+      await page.goto("/mobile/approvals");
+      await expect(page).not.toHaveURL(/\/403/);
+    } else {
+      await expect(approvalTab).toBeDisabled();
+      await expect(page.getByTestId("mobile-action-grid").locator('a[href="/mobile/approvals"]')).toHaveCount(0);
+      await page.goto("/mobile/approvals");
+      await assertForbiddenPage(page);
+    }
+  } finally {
+    await context.close();
+  }
+}
+
+function formatDate(offsetDays: number) {
+  const value = new Date();
+  value.setUTCDate(value.getUTCDate() + offsetDays);
+  return value.toISOString().slice(0, 10);
+}
+
+async function createSubmittedLeave(api: APIRequestContext, label: string): Promise<WorkflowSubmitResponse & { leaveRequestId: string }> {
+  const leaveTypes = await apiGetData<LeaveTypeListResponse>(api, "/api/leave-types?enabled=true");
+  const leaveType = leaveTypes.items.find((item) => !item.requiresAttachment) ?? leaveTypes.items[0];
+  if (!leaveType) {
+    throw new Error("未找到可用于 PA6 回归的请假类型");
+  }
+
+  const startDate = formatDate(3600 + (Date.now() % 1200));
+  const created = await apiPostData<{ id: string }>(api, "/api/leave-requests", {
+    leaveTypeId: leaveType.id,
+    startDate,
+    endDate: startDate,
+    startSession: "am",
+    endSession: "pm",
+    reason: `PA6 权限回归 ${label}`,
+  });
+  const submitted = await apiPostData<WorkflowSubmitResponse>(api, `/api/leave-requests/${created.id}/submit`, {});
+  return {
+    ...submitted,
+    leaveRequestId: created.id,
+  };
+}
+
+async function firstItem<T extends { id: string }>(items: T[], context: string) {
+  const item = items[0];
+  if (!item) {
+    throw new Error(`未找到可用于 PA6 回归的${context}`);
+  }
+  return item;
+}
+
+async function createSubmittedPurchase(api: APIRequestContext, label: string): Promise<WorkflowSubmitResponse & { purchaseRequestId: string }> {
+  const legalEntities = await apiGetData<MasterDataListResponse>(api, "/api/master-data/legal-entities?enabled=true");
+  const legalEntity = await firstItem(legalEntities.items, "法人主体");
+  const costCenters = await apiGetData<MasterDataListResponse>(
+    api,
+    `/api/master-data/cost-centers?enabled=true&legalEntityId=${legalEntity.id}`,
+  );
+  const costCenter = await firstItem(costCenters.items, "成本中心");
+  const suppliers = await apiGetData<MasterDataListResponse>(
+    api,
+    `/api/master-data/suppliers?enabled=true&legalEntityId=${legalEntity.id}`,
+  );
+  const supplier = await firstItem(suppliers.items, "供应商");
+  const documentCategories = await apiGetData<MasterDataListResponse>(
+    api,
+    "/api/master-data/document-categories?enabled=true&entityType=purchase_request",
+  );
+  const documentCategory = await firstItem(documentCategories.items, "采购单据类型");
+
+  const created = await apiPostData<PurchaseCreateResponse>(api, "/api/purchase-requests", {});
+  const purchaseRequestId = created.purchaseRequest.id;
+  const updateResponse = await api.patch(`/api/purchase-requests/${purchaseRequestId}`, {
+    data: {
+      title: `PA6 采购权限回归 ${label}`,
+      reason: "PA6 验证采购自审和 admin-only 审批拒绝",
+      legalEntityId: legalEntity.id,
+      costCenterId: costCenter.id,
+      supplierId: supplier.id,
+      documentCategoryId: documentCategory.id,
+      expectedDeliveryDate: formatDate(45),
+      items: [
+        {
+          description: `PA6 采购项 ${label}`,
+          quantity: "1",
+          unitPrice: "88.00",
+          isAssetCandidate: false,
+        },
+      ],
+    },
+  });
+  expect(updateResponse.ok(), `purchase update failed: ${updateResponse.status()} ${await updateResponse.text()}`).toBe(true);
+
+  const submitted = await apiPostData<WorkflowSubmitResponse>(api, `/api/purchase-requests/${purchaseRequestId}/submit`, {});
+  return {
+    ...submitted,
+    purchaseRequestId,
+  };
+}
+
+async function createReimbursementAttachment(api: APIRequestContext) {
+  const reimbursementDate = formatDate(30 + (Date.now() % 90));
+  const reimbursement = await apiPostData<ReimbursementCreatedResponse>(api, "/api/reimbursements", {
+    reimbursementDate,
+    description: `PA6 附件审计 ${Date.now()}`,
+  });
+  const uploadResponse = await api.post(`/api/reimbursements/${reimbursement.id}/attachments`, {
+    multipart: {
+      file: {
+        name: `pa6-attachment-${Date.now()}.pdf`,
+        mimeType: "application/pdf",
+        buffer: Buffer.from(`%PDF-1.4\nPA6_ATTACHMENT_AUDIT_${Date.now()}\n%%EOF\n`, "utf8"),
+      },
+    },
+  });
+  expect(uploadResponse.ok(), `upload attachment failed: ${uploadResponse.status()} ${await uploadResponse.text()}`).toBe(true);
+  const payload = await parseJson(uploadResponse) as { data?: ReimbursementAttachmentUploadResponse } | null;
+  const attachmentId = payload?.data?.items?.[0]?.id;
+  if (!attachmentId) {
+    throw new Error(`上传附件后未返回 attachmentId: ${JSON.stringify(payload)}`);
+  }
+  return {
+    reimbursementId: reimbursement.id,
+    attachmentId,
+  };
+}
+
+async function expectAuditAction(api: APIRequestContext, action: string, predicate: (item: AuditLogListResponse["items"][number]) => boolean) {
+  const encoded = encodeURIComponent(action);
+  const data = await apiGetData<AuditLogListResponse>(api, `/api/audit-logs?action=${encoded}&page=1&pageSize=50`);
+  expectNoSensitiveKeys(data);
+  expect(data.items.some(predicate), `audit action ${action} should be traceable`).toBe(true);
+}
+
 test.describe("R3 权限直连审计", () => {
   test("前端直连备用路径按角色拦截", async ({ browser }) => {
     await expectForbiddenRoutes(browser, EMPLOYEE, [
@@ -118,6 +375,93 @@ test.describe("R3 权限直连审计", () => {
     await expectForbiddenRoutes(browser, FINANCE, [
       "/system/integrations/erp",
     ]);
+
+    await expectForbiddenRoutes(browser, ADMIN, [
+      "/workflow/tasks",
+      "/mobile/approvals",
+    ]);
+  });
+
+  test("PA6 角色入口矩阵：PC 与移动入口按正式业务角色裁剪", async ({ browser }) => {
+    await expectPcNavMatrix(browser, EMPLOYEE, {
+      visible: ["/portal", "/reimbursements"],
+      hidden: ["/workflow/tasks", "/ap-operations", "/payment-batches", "/audit-logs", "/system/settings"],
+    });
+    await expectPcNavMatrix(browser, MANAGER, {
+      visible: ["/workflow/tasks"],
+      hidden: ["/ap-operations", "/payment-batches", "/audit-logs", "/system/settings"],
+    });
+    await expectPcNavMatrix(browser, FINANCE, {
+      visible: ["/invoice-pool"],
+      hidden: ["/audit-logs", "/system/settings", "/system/integrations/erp"],
+    });
+    await expectPcNavMatrix(browser, ADMIN, {
+      visible: ["/audit-logs", "/system/settings"],
+      hidden: ["/workflow/tasks", "/ap-operations", "/payment-batches"],
+    });
+
+    await expectMobileApprovalEntry(browser, EMPLOYEE, false);
+    await expectMobileApprovalEntry(browser, MANAGER, true);
+    await expectMobileApprovalEntry(browser, ADMIN, false);
+
+    const { context, page } = await openAs(browser, FINANCE);
+    try {
+      await page.setViewportSize({ width: 390, height: 844 });
+      await page.goto("/mobile/me");
+      await expect(page.getByText("管理入口", { exact: true })).toHaveCount(0);
+      await expect(page.getByTestId("mobile-me-action-link").filter({ hasText: "审批" }).first()).toBeVisible();
+    } finally {
+      await context.close();
+    }
+  });
+
+  test("PA6 portal 角色能力字段不把 admin-only 当业务审批人", async () => {
+    const clients = await Promise.all([
+      createAuthenticatedApiClient(EMPLOYEE),
+      createAuthenticatedApiClient(MANAGER),
+      createAuthenticatedApiClient(FINANCE),
+      createAuthenticatedApiClient(ADMIN),
+    ]);
+    const [employee, manager, finance, admin] = clients;
+
+    try {
+      const employeePortal = await apiGetData<PortalHomeResponse>(employee.api, "/api/portal/home");
+      expect(employeePortal.roleCapabilities).toMatchObject({
+        canApproveTasks: false,
+        canUseFinance: false,
+        canManageSystem: false,
+        isAdminOnly: false,
+      });
+      expect(employeePortal.financeSummary).toBeNull();
+
+      const managerPortal = await apiGetData<PortalHomeResponse>(manager.api, "/api/portal/home");
+      expect(managerPortal.roleCapabilities).toMatchObject({
+        canApproveTasks: true,
+        canUseFinance: false,
+        canManageSystem: false,
+        isAdminOnly: false,
+      });
+
+      const financePortal = await apiGetData<PortalHomeResponse>(finance.api, "/api/portal/home");
+      expect(financePortal.roleCapabilities).toMatchObject({
+        canApproveTasks: true,
+        canUseFinance: true,
+        canManageSystem: false,
+        isAdminOnly: false,
+      });
+      expect(financePortal.financeSummary).toBeTruthy();
+
+      const adminPortal = await apiGetData<PortalHomeResponse>(admin.api, "/api/portal/home");
+      expect(adminPortal.roleCapabilities).toMatchObject({
+        canApproveTasks: false,
+        canUseFinance: false,
+        canManageSystem: true,
+        isAdminOnly: true,
+      });
+      expect(adminPortal.financeSummary).toBeNull();
+    } finally {
+      await Promise.all(clients.map((client) => client.dispose()));
+    }
   });
 
   test("员工自助直连页面不进入管理态 403", async ({ browser }) => {
@@ -143,6 +487,9 @@ test.describe("R3 权限直连审计", () => {
       await expectApiStatus({ role: "employee", api: employee.api, path: "/api/payment-batches", statuses: [403, 409], note: "员工不得直连付款批次；409 表示功能门禁关闭且未泄露数据" });
       await expectApiStatus({ role: "employee", api: employee.api, path: "/api/integrations/erp/master-data/status", statuses: [403], note: "员工不得直连 ERP 管理" });
       await expectApiStatus({ role: "employee", api: employee.api, path: "/api/invoice-pool?ownerScope=all", statuses: [403], note: "员工不得查看全量票据" });
+      await expectApiStatus({ role: "employee", api: employee.api, path: "/api/audit-logs", statuses: [403], note: "员工不得查看审计日志" });
+      await expectApiStatus({ role: "employee", api: employee.api, path: "/api/notifications/deliveries", statuses: [403], note: "员工不得查看通知投递审计" });
+      await expectApiMutationStatus({ role: "employee", api: employee.api, path: "/api/exports/ap-operations", method: "post", data: { format: "csv" }, statuses: [403, 409], note: "员工不得导出 AP 运营数据；409 表示功能门禁关闭且未泄露数据" });
       await expectApiStatus({ role: "employee", api: employee.api, path: "/api/contracts-registry", statuses: [200, 409], note: "员工合同台账只能走范围过滤或功能门禁" });
       await expectApiStatus({ role: "employee", api: employee.api, path: "/api/travel-requests?mine=0&pageSize=50", statuses: [200], note: "员工差旅列表强制本人范围" });
 
@@ -175,9 +522,13 @@ test.describe("R3 权限直连审计", () => {
       await expectApiStatus({ role: "manager", api: manager.api, path: "/api/ap-operations", statuses: [403, 409], note: "主管不得直连 AP" });
       await expectApiStatus({ role: "manager", api: manager.api, path: "/api/payment-batches", statuses: [403, 409], note: "主管不得直连付款批次" });
       await expectApiStatus({ role: "manager", api: manager.api, path: "/api/integrations/erp/master-data/status", statuses: [403], note: "主管不得直连 ERP 管理" });
+      await expectApiStatus({ role: "manager", api: manager.api, path: "/api/audit-logs", statuses: [403], note: "主管不得查看审计日志" });
       await expectApiStatus({ role: "manager", api: manager.api, path: "/api/budgets", statuses: [200], note: "主管可直连预算" });
 
       await expectApiStatus({ role: "finance", api: finance.api, path: "/api/integrations/erp/master-data/status", statuses: [403], note: "财务不得直连 ERP 管理" });
+      await expectApiStatus({ role: "finance", api: finance.api, path: "/api/audit-logs", statuses: [403], note: "普通财务不得查看审计日志" });
+      await expectApiStatus({ role: "finance", api: finance.api, path: "/api/system/feature-flags", statuses: [403], note: "普通财务不得管理系统开关" });
+      await expectApiStatus({ role: "finance", api: finance.api, path: "/api/notifications/deliveries", statuses: [403], note: "普通财务不得查看通知渠道投递审计" });
       await expectApiStatus({ role: "finance", api: finance.api, path: "/api/invoice-pool?ownerScope=all&pageSize=20", statuses: [200], note: "财务可看票据财务范围" });
       await expectApiStatus({ role: "finance", api: finance.api, path: "/api/payment-batches", statuses: [200, 409], note: "财务可看付款批次或受功能门禁限制" });
 
@@ -190,6 +541,24 @@ test.describe("R3 权限直连审计", () => {
       });
       expectNoSensitiveKeys(erpStatus.body?.data);
 
+      const adminAudit = await expectApiStatus({
+        role: "admin",
+        api: admin.api,
+        path: "/api/audit-logs?page=1&pageSize=5",
+        statuses: [200],
+        note: "管理员可查看审计日志",
+      });
+      expectNoSensitiveKeys(adminAudit.body?.data);
+
+      const deliveryAudit = await expectApiStatus({
+        role: "admin",
+        api: admin.api,
+        path: "/api/notifications/deliveries?limit=5",
+        statuses: [200],
+        note: "管理员可查看通知投递审计",
+      });
+      expectNoSensitiveKeys(deliveryAudit.body?.data);
+
       const wecomConfig = await expectApiStatus({
         role: "admin",
         api: admin.api,
@@ -202,4 +571,111 @@ test.describe("R3 权限直连审计", () => {
       await Promise.all(clients.map((client) => client.dispose()));
     }
   });
+
+  test("PA6 请假和采购自审、admin-only 业务审批被服务端拒绝", async () => {
+    const employee = await createAuthenticatedApiClient(EMPLOYEE);
+    const manager = await createAuthenticatedApiClient(MANAGER);
+    const admin = await createAuthenticatedApiClient(ADMIN);
+    const clients = [employee, manager, admin];
+
+    try {
+      const leave = await createSubmittedLeave(employee.api, `admin-only-${Date.now()}`);
+      const purchase = await createSubmittedPurchase(employee.api, `admin-only-${Date.now()}`);
+
+      await expectApiMutationStatus({
+        role: "employee",
+        api: employee.api,
+        path: `/api/workflow/tasks/${leave.currentTaskId}/approve`,
+        method: "post",
+        statuses: [403, 409],
+        note: "提交人本人不能审批自己的请假单",
+      });
+      await expectApiMutationStatus({
+        role: "admin",
+        api: admin.api,
+        path: `/api/workflow/tasks/${leave.currentTaskId}/approve`,
+        method: "post",
+        statuses: [403, 409],
+        note: "admin-only 不获得业务审批权",
+      });
+      await expectApiMutationStatus({
+        role: "employee",
+        api: employee.api,
+        path: `/api/workflow/tasks/${purchase.currentTaskId}/approve`,
+        method: "post",
+        statuses: [403, 409],
+        note: "提交人本人不能审批自己的采购单",
+      });
+      await expectApiMutationStatus({
+        role: "admin",
+        api: admin.api,
+        path: `/api/workflow/tasks/${purchase.currentTaskId}/approve`,
+        method: "post",
+        statuses: [403, 409],
+        note: "admin-only 不获得采购业务审批权",
+      });
+
+      const approved = await apiPostData<{ outcome: string; workflowInstanceId: string }>(
+        manager.api,
+        `/api/workflow/tasks/${leave.currentTaskId}/approve`,
+        {},
+      );
+      expect(approved.outcome).toBe("approved");
+
+      const detail = await apiGetData<WorkflowTaskDetailResponse>(manager.api, `/api/workflow/tasks/${leave.currentTaskId}`);
+      expect(detail.history.map((item) => item.action)).toEqual(expect.arrayContaining(["start", "approve"]));
+      expectNoSensitiveKeys(detail.history);
+
+      const purchaseApproved = await apiPostData<{ outcome: string }>(
+        manager.api,
+        `/api/workflow/tasks/${purchase.currentTaskId}/approve`,
+        {},
+      );
+      expect(purchaseApproved.outcome).toBe("approved");
+    } finally {
+      await Promise.all(clients.map((client) => client.dispose()));
+    }
+  });
+
+  test("PA6 审计留痕：登录、审批历史、附件下载、导出与通知投递可追溯且脱敏", async () => {
+    const employee = await createAuthenticatedApiClient(EMPLOYEE);
+    const manager = await createAuthenticatedApiClient(MANAGER);
+    const finance = await createAuthenticatedApiClient(FINANCE);
+    const admin = await createAuthenticatedApiClient(ADMIN);
+    const clients = [employee, manager, finance, admin];
+
+    try {
+      await expectAuditAction(admin.api, "AUTH_LOGIN_SUCCESS", (item) => item.actorId === employee.me.id);
+
+      const leave = await createSubmittedLeave(employee.api, `audit-${Date.now()}`);
+      await apiPostData<{ outcome: string }>(manager.api, `/api/workflow/tasks/${leave.currentTaskId}/approve`, {});
+      const workflowDetail = await apiGetData<WorkflowTaskDetailResponse>(manager.api, `/api/workflow/tasks/${leave.currentTaskId}`);
+      expect(workflowDetail.history.some((item) => item.action === "approve" && item.actorId === manager.me.id)).toBe(true);
+      expectNoSensitiveKeys(workflowDetail.history);
+
+      const attachment = await createReimbursementAttachment(employee.api);
+      const downloadResponse = await employee.api.get(
+        `/api/reimbursements/${attachment.reimbursementId}/attachments/${attachment.attachmentId}/file`,
+      );
+      expect(downloadResponse.ok(), `download attachment failed: ${downloadResponse.status()}`).toBe(true);
+      await expectAuditAction(
+        admin.api,
+        "REIMBURSEMENT_ATTACHMENT_DOWNLOADED",
+        (item) => item.targetId === attachment.reimbursementId &&
+          (item.extra as JsonObject | null)?.attachmentId === attachment.attachmentId,
+      );
+
+      const exportResponse = await finance.api.post("/api/exports/ap-operations", { data: { format: "csv" } });
+      expectStatus(exportResponse.status(), [200, 409], "finance POST /api/exports/ap-operations");
+      if (exportResponse.status() === 200) {
+        await expectAuditAction(admin.api, "EXPORT_AP_OPERATIONS", (item) => item.actorId === finance.me.id);
+      }
+
+      const deliveryData = await apiGetData<NotificationDeliveryListResponse>(admin.api, "/api/notifications/deliveries?limit=10");
+      expect(Array.isArray(deliveryData.items), "notification delivery audit items should be an array").toBe(true);
+      expectNoSensitiveKeys(deliveryData);
+    } finally {
+      await Promise.all(clients.map((client) => client.dispose()));
+    }
+  });
 });