feat(server): 完成 P2 后端能力（支付幂等、委派回收、OCR异步、审计）

server/src/routes/invoicePool.js

@@ -10,6 +10,7 @@ const { compactDateString } = require("../utils/date");
 const { sha256Hex } = require("../utils/crypto");
 const { signPayload, verifyToken } = require("../utils/signedUrl");
 const { toMoneyString } = require("../utils/workflow");
+const { isOcrEnabledForType } = require("../services/ocr");
 
 const MIME_ALLOWLIST = new Set([
   "application/pdf",
@@ -258,6 +259,8 @@ async function invoicePoolRoutes(fastify) {
       await fs.mkdir(path.dirname(absoluteStoragePath), { recursive: true });
       await fs.writeFile(absoluteStoragePath, fileBuffer);
 
+      const status = isOcrEnabledForType(fastify.config, ocrType) ? "pending_ocr" : "available";
+
       const invoice = await fastify.prisma.invoicePool.create({
         data: {
           owner_employee_id: ownerEmployeeId,
@@ -268,7 +271,7 @@ async function invoicePoolRoutes(fastify) {
           file_size: fileSize,
           file_sha256: fileSha256,
           ocr_type: ocrType,
-          status: "available",
+          status,
           created_by: request.employee.id,
           updated_by: request.employee.id,
         },
@@ -287,6 +290,94 @@ async function invoicePoolRoutes(fastify) {
     },
   );
 
+  fastify.get(
+    "/invoice-pool/:id",
+    {
+      preHandler: fastify.authenticate,
+    },
+    async (request, reply) => {
+      const parsedInvoiceId = z.string().uuid().safeParse(request.params?.id);
+      if (!parsedInvoiceId.success) {
+        throw new AppError({
+          code: "VALID_001",
+          message: "参数校验失败",
+          statusCode: 400,
+          details: { id: "invalid_uuid" },
+        });
+      }
+
+      const invoice = await fastify.prisma.invoicePool.findUnique({
+        where: { id: parsedInvoiceId.data },
+        select: {
+          id: true,
+          status: true,
+          owner_employee_id: true,
+          uploaded_by_employee_id: true,
+          ocr_type: true,
+          ocr_provider: true,
+          ocr_attempts: true,
+          ocr_last_error: true,
+          ocr_completed_at: true,
+          invoice_code: true,
+          invoice_number: true,
+          invoice_date: true,
+          amount: true,
+          tax_amount: true,
+          total_amount: true,
+          linked_reimbursement_id: true,
+          linked_item_id: true,
+          created_at: true,
+          updated_at: true,
+          linked_reimbursement: {
+            select: {
+              owner_id: true,
+              submitter_id: true,
+            },
+          },
+        },
+      });
+
+      if (!invoice) {
+        throw new AppError({
+          code: "SYS_404",
+          message: "Not Found",
+          statusCode: 404,
+        });
+      }
+
+      let canAccess = ensureInvoiceReadableByUser(request, invoice);
+      if (!canAccess && invoice.linked_reimbursement_id) {
+        const pendingTask = await fastify.prisma.workflowTask.findFirst({
+          where: {
+            status: "pending",
+            workflow_instance: {
+              entity_type: "reimbursement",
+              entity_id: invoice.linked_reimbursement_id,
+              current_status: "pending",
+            },
+            OR: [
+              { assignee_id: request.employee.id },
+              { assignee_role: { in: request.employee.roleCodes } },
+            ],
+          },
+          select: { id: true },
+        });
+
+        canAccess = Boolean(pendingTask);
+      }
+
+      if (!canAccess) {
+        throw new AppError({
+          code: "PERM_001",
+          message: "无权限",
+          statusCode: 403,
+        });
+      }
+
+      return sendData(reply, request, normalizeInvoiceResponse(invoice));
+    },
+  );
+
   fastify.post(
     "/invoice-pool/:id/signed-url",
     {