A7 收口权限导航与备用模块护栏

server/tests/unit/workspaceSettings.navigation.test.js

@@ -1,8 +1,40 @@
 const {
   DEFAULT_MODULE_VISIBILITY,
   buildDefaultWorkspaceSetting,
+  getSystemNavigation,
   normalizeModuleVisibilityJson,
 } = require("../../src/services/workspaceSettings");
+const { hasPermission, resolvePermissionsForRoles } = require("../../src/constants/permissions");
+
+function buildPrisma() {
+  return {
+    workspaceSetting: {
+      findFirst: vi.fn().mockResolvedValue(null),
+    },
+    featureFlag: {
+      findUnique: vi.fn().mockResolvedValue(null),
+    },
+  };
+}
+
+function buildConfig() {
+  return {
+    announcementsEnabled: false,
+    attendanceEnabled: false,
+    budgetPrecheckEnabled: false,
+    cutoverConsoleEnabled: false,
+    employeeLifecycleEnabled: false,
+    globalSearchEnabled: false,
+    paymentBatchEnabled: false,
+    portalHomeEnabled: false,
+    presenceBoardEnabled: false,
+    projectDomainEnabled: false,
+    projectLinkingEnabled: false,
+    todoBoardEnabled: false,
+    weeklyReportEnabled: false,
+    workflowDefinitionAdminEnabled: false,
+  };
+}
 
 describe("workspace small-team navigation defaults", () => {
   it("keeps only the R66 daily path in default main navigation", () => {
@@ -44,4 +76,30 @@ describe("workspace small-team navigation defaults", () => {
     expect(workspace.profile).toBe("small_team_internal");
     expect(workspace.moduleVisibility.attendance).toBe("hidden");
   });
+
+  it("keeps P2 and finance-only backup modules out of employee navigation", async () => {
+    const employee = {
+      id: "employee-1",
+      department_id: "dept-1",
+      permissionCodes: resolvePermissionsForRoles(["employee"]),
+    };
+
+    const navigation = await getSystemNavigation({
+      prisma: buildPrisma(),
+      config: buildConfig(),
+      employee,
+      hasPermission: (candidate, permissionCode) => hasPermission(candidate.permissionCodes, permissionCode),
+    });
+
+    const backupKeys = navigation.sections.backup.map((item) => item.key);
+    expect(backupKeys).toContain("purchaseRequests");
+    expect(backupKeys).not.toContain("travelRequests");
+    expect(backupKeys).not.toContain("invoicePool");
+    expect(backupKeys).not.toContain("contractsRegistry");
+    expect(backupKeys).not.toContain("budgets");
+    expect(backupKeys).not.toContain("paymentBatches");
+    expect(backupKeys).not.toContain("apOperations");
+    expect(backupKeys).not.toContain("erpIntegrations");
+    expect(backupKeys).not.toContain("dashboard");
+  });
 });