PA6 补齐权限与审计回归

server/tests/unit/workspaceSettings.navigation.test.js

@@ -81,6 +81,7 @@ describe("workspace small-team navigation defaults", () => {
     const employee = {
       id: "employee-1",
       department_id: "dept-1",
+      roleCodes: ["employee"],
       permissionCodes: resolvePermissionsForRoles(["employee"]),
     };
 
@@ -102,4 +103,29 @@ describe("workspace small-team navigation defaults", () => {
     expect(backupKeys).not.toContain("erpIntegrations");
     expect(backupKeys).not.toContain("dashboard");
   });
+
+  it("does not expose workflow task entry to admin-only navigation", async () => {
+    const adminOnly = {
+      id: "admin-1",
+      department_id: "dept-1",
+      roleCodes: ["admin"],
+      permissionCodes: resolvePermissionsForRoles(["admin"]),
+    };
+
+    const navigation = await getSystemNavigation({
+      prisma: buildPrisma(),
+      config: { ...buildConfig(), workflowDefinitionAdminEnabled: true },
+      employee: adminOnly,
+      hasPermission: (candidate, permissionCode) => hasPermission(candidate.permissionCodes, permissionCode),
+    });
+
+    const allKeys = [
+      ...navigation.sections.main,
+      ...navigation.sections.admin,
+      ...navigation.sections.backup,
+    ].map((item) => item.key);
+
+    expect(allKeys).toContain("auditLogs");
+    expect(allKeys).not.toContain("workflowTasks");
+  });
 });