PA6 补齐权限与审计回归

server/src/routes/reimbursements.js

@@ -2645,6 +2645,18 @@ async function reimbursementRoutes(fastify) {
         throw error;
       }
 
+      await fastify.prisma.auditLog.create({
+        data: buildAuditLogData(request, {
+          actorId: request.employee.id,
+          action: "REIMBURSEMENT_ATTACHMENT_DOWNLOADED",
+          targetType: "reimbursement",
+          targetId: reimbursementId,
+          extra: {
+            attachmentId: attachment.id,
+          },
+        }),
+      });
+
       reply.type(attachment.mime_type || "application/octet-stream");
       reply.header(
         "content-disposition",