实现 B-2a 报销审批内容工作台（reimbursement-approval-content-workbench）

server/src/routes/reimbursements.js

@@ -271,6 +271,36 @@ function ensureOwnOrCanViewAll(fastify, request, reimbursement) {
   }
 }
 
+async function ensureOwnCanViewAllOrWorkflowReviewer(fastify, request, reimbursement) {
+  const canViewAll = fastify.hasPermission(request.employee, "expense.view_all");
+  const isOwn = reimbursement.owner_id === request.employee.id || reimbursement.submitter_id === request.employee.id;
+  const canViewOwn = fastify.hasPermission(request.employee, "expense.view_own") && isOwn;
+  if (canViewAll || canViewOwn) return;
+
+  const delegatedPrincipalIds = await listActiveDelegationPrincipals(fastify.prisma, {
+    delegateEmployeeId: request.employee.id,
+    allowedScopes: ["all"],
+  });
+  const assigneeFilters = [
+    { assignee_id: request.employee.id },
+    ...(request.employee.roleCodes?.length ? [{ assignee_role: { in: request.employee.roleCodes } }] : []),
+    ...(delegatedPrincipalIds.length ? [{ assignee_id: { in: delegatedPrincipalIds } }] : []),
+  ];
+  const reviewerTask = await fastify.prisma.workflowTask.findFirst({
+    where: {
+      OR: assigneeFilters,
+      workflow_instance: {
+        entity_type: "reimbursement",
+        entity_id: reimbursement.id,
+      },
+    },
+    select: { id: true },
+  });
+  if (reviewerTask) return;
+
+  throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
+}
+
 function buildWorkflowProgress(workflowInstance, historyItems = []) {
   if (!workflowInstance?.current_step_id) {
     return null;
@@ -2518,7 +2548,7 @@ async function reimbursementRoutes(fastify) {
         });
       }
 
-      ensureOwnOrCanViewAll(fastify, request, reimbursement);
+      await ensureOwnCanViewAllOrWorkflowReviewer(fastify, request, reimbursement);
 
       const controlMode = normalizeBudgetControlMode(fastify.config);
       const budgetPool = await resolveApplicableBudgetPool(fastify.prisma, reimbursement);
@@ -3323,7 +3353,10 @@ async function reimbursementRoutes(fastify) {
         actorId = previewGrant.actorId;
         downloadReason = "企业微信在线预览";
       } else {
-        ensureOwnOrCanViewAll(fastify, request, attachment.reimbursement_form);
+        await ensureOwnCanViewAllOrWorkflowReviewer(fastify, request, {
+          id: reimbursementId,
+          ...attachment.reimbursement_form,
+        });
         actorId = request.employee.id;
         downloadReason = sanitizeDownloadReason(request.query?.reason);
         if (requiresDownloadReason(attachment) && !downloadReason) {
@@ -3408,7 +3441,10 @@ async function reimbursementRoutes(fastify) {
       if (!attachment) {
         throw new AppError({ code: "SYS_404", message: "Not Found", statusCode: 404 });
       }
-      ensureOwnOrCanViewAll(fastify, request, attachment.reimbursement_form);
+      await ensureOwnCanViewAllOrWorkflowReviewer(fastify, request, {
+        id: reimbursementId,
+        ...attachment.reimbursement_form,
+      });
       const reason = sanitizeDownloadReason(parsedBody.data.reason);
       if (requiresDownloadReason(attachment) && !reason) {
         throw new AppError({
@@ -3501,7 +3537,7 @@ async function reimbursementRoutes(fastify) {
       if (!reimbursement) {
         throw new AppError({ code: "SYS_404", message: "Not Found", statusCode: 404 });
       }
-      ensureOwnOrCanViewAll(fastify, request, reimbursement);
+      await ensureOwnCanViewAllOrWorkflowReviewer(fastify, request, reimbursement);
 
       const reason = sanitizeDownloadReason(parsedBody.data.reason);
       if (reimbursement.attachments.some((attachment) => requiresDownloadReason(attachment)) && !reason) {
@@ -4532,6 +4568,8 @@ async function reimbursementRoutes(fastify) {
               workflow_steps_snapshot: workflowSteps,
               approval_rule_id: approvalRule.id,
               standardViolations,
+              budgetCheck,
+              budgetCheckRecorded: true,
             },
             context_department_id: reimbursement.department_id,
             created_by: request.employee.id,

server/src/routes/workflow.js

@@ -76,6 +76,95 @@ const WORKFLOW_OVERDUE_ACTION = "overdue_remind";
 const WORKFLOW_REMINDER_COOLDOWN_MS = 24 * 60 * 60 * 1000;
 const WORKFLOW_DEFAULT_DUE_MS = 24 * 60 * 60 * 1000;
 
+const REIMBURSEMENT_SNAPSHOT_CONTROL_MODES = new Set(["warn", "block"]);
+
+function projectReimbursementSubmissionSnapshot(contextData) {
+  const source = contextData && typeof contextData === "object" && !Array.isArray(contextData)
+    ? contextData
+    : {};
+  const standardViolationsPresent = Object.prototype.hasOwnProperty.call(source, "standardViolations");
+  const budgetCheckPresent = Object.prototype.hasOwnProperty.call(source, "budgetCheck") && source.budgetCheck != null;
+  const budgetCheckRecordedPresent = Object.prototype.hasOwnProperty.call(source, "budgetCheckRecorded");
+  const standardViolationsValid = Array.isArray(source.standardViolations) && source.standardViolations.every((item) => (
+    item &&
+    typeof item === "object" &&
+    typeof item.itemId === "string" &&
+    typeof item.expenseTypeId === "string" &&
+    typeof item.expenseTypeName === "string" &&
+    typeof item.amount === "string" &&
+    typeof item.standardId === "string" &&
+    typeof item.standardName === "string" &&
+    typeof item.maxAmount === "string" &&
+    ["item", "day", "trip"].includes(item.perUnit) &&
+    REIMBURSEMENT_SNAPSHOT_CONTROL_MODES.has(item.controlMode) &&
+    ["global", "department"].includes(item.scopeType) &&
+    (item.scopeKey == null || typeof item.scopeKey === "string") &&
+    typeof item.exceeded === "boolean" &&
+    typeof item.exceededAmount === "string"
+  ));
+  const standardViolations = standardViolationsValid
+    ? source.standardViolations.map((item) => ({
+        itemId: item.itemId,
+        expenseTypeId: item.expenseTypeId,
+        expenseTypeName: item.expenseTypeName,
+        amount: item.amount,
+        standardId: item.standardId,
+        standardName: item.standardName,
+        maxAmount: item.maxAmount,
+        perUnit: item.perUnit,
+        controlMode: item.controlMode,
+        scopeType: item.scopeType,
+        scopeKey: item.scopeKey,
+        exceeded: item.exceeded,
+        exceededAmount: item.exceededAmount,
+      }))
+    : [];
+
+  let budgetCheck = null;
+  if (budgetCheckPresent) {
+    const candidate = source.budgetCheck;
+    const usagePercent = Number(candidate?.usagePercent);
+    if (
+      candidate &&
+      typeof candidate === "object" &&
+      !Array.isArray(candidate) &&
+      typeof candidate.budgetId === "string" &&
+      typeof candidate.budgetCode === "string" &&
+      REIMBURSEMENT_SNAPSHOT_CONTROL_MODES.has(candidate.controlMode) &&
+      Number.isFinite(usagePercent) &&
+      typeof candidate.exceededThreshold === "boolean" &&
+      typeof candidate.exceededBudget === "boolean"
+    ) {
+      budgetCheck = {
+        budgetId: candidate.budgetId,
+        budgetCode: candidate.budgetCode,
+        controlMode: candidate.controlMode,
+        usagePercent,
+        exceededThreshold: candidate.exceededThreshold,
+        exceededBudget: candidate.exceededBudget,
+      };
+    }
+  }
+
+  const parseStatus =
+    (standardViolationsPresent && !standardViolationsValid) ||
+    (budgetCheckPresent && !budgetCheck) ||
+    (budgetCheckRecordedPresent && source.budgetCheckRecorded !== true)
+      ? "invalid"
+      : "ready";
+
+  return {
+    standardViolations,
+    budgetCheck,
+    budgetCheckStatus: budgetCheck
+      ? "available"
+      : source.budgetCheckRecorded === true
+        ? "not_applicable"
+        : "missing",
+    parseStatus,
+  };
+}
+
 const APPROVER_LIST_QUERY_SCHEMA = z.object({
   keyword: z.string().trim().max(100).optional(),
   page: z.coerce.number().int().min(1).optional(),
@@ -2429,6 +2518,9 @@ async function workflowRoutes(fastify) {
           },
         },
       });
+      const reimbursementSubmissionSnapshot = task.workflow_instance?.entity_type === "reimbursement"
+        ? projectReimbursementSubmissionSnapshot(task.workflow_instance.context_data)
+        : null;
 
       return sendData(reply, request, {
         task: {
@@ -2451,9 +2543,10 @@ async function workflowRoutes(fastify) {
             currentStatus: task.workflow_instance.current_status,
             currentStepId: task.workflow_instance.current_step_id,
             contextData: {
-              standardViolations: Array.isArray(task.workflow_instance.context_data?.standardViolations)
-                ? task.workflow_instance.context_data.standardViolations
-                : [],
+              standardViolations: reimbursementSubmissionSnapshot?.standardViolations ?? [],
+              budgetCheck: reimbursementSubmissionSnapshot?.budgetCheck ?? null,
+              budgetCheckStatus: reimbursementSubmissionSnapshot?.budgetCheckStatus ?? "missing",
+              parseStatus: reimbursementSubmissionSnapshot?.parseStatus ?? "ready",
             },
             startedAt: isoOrNull(task.workflow_instance.started_at),
             completedAt: isoOrNull(task.workflow_instance.completed_at),