实现 B-2a 报销审批内容工作台（reimbursement-approval-content-workbench）

server/src/routes/reimbursements.js

@@ -271,6 +271,36 @@ function ensureOwnOrCanViewAll(fastify, request, reimbursement) {
   }
 }
 
+async function ensureOwnCanViewAllOrWorkflowReviewer(fastify, request, reimbursement) {
+  const canViewAll = fastify.hasPermission(request.employee, "expense.view_all");
+  const isOwn = reimbursement.owner_id === request.employee.id || reimbursement.submitter_id === request.employee.id;
+  const canViewOwn = fastify.hasPermission(request.employee, "expense.view_own") && isOwn;
+  if (canViewAll || canViewOwn) return;
+
+  const delegatedPrincipalIds = await listActiveDelegationPrincipals(fastify.prisma, {
+    delegateEmployeeId: request.employee.id,
+    allowedScopes: ["all"],
+  });
+  const assigneeFilters = [
+    { assignee_id: request.employee.id },
+    ...(request.employee.roleCodes?.length ? [{ assignee_role: { in: request.employee.roleCodes } }] : []),
+    ...(delegatedPrincipalIds.length ? [{ assignee_id: { in: delegatedPrincipalIds } }] : []),
+  ];
+  const reviewerTask = await fastify.prisma.workflowTask.findFirst({
+    where: {
+      OR: assigneeFilters,
+      workflow_instance: {
+        entity_type: "reimbursement",
+        entity_id: reimbursement.id,
+      },
+    },
+    select: { id: true },
+  });
+  if (reviewerTask) return;
+
+  throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
+}
+
 function buildWorkflowProgress(workflowInstance, historyItems = []) {
   if (!workflowInstance?.current_step_id) {
     return null;
@@ -2518,7 +2548,7 @@ async function reimbursementRoutes(fastify) {
         });
       }
 
-      ensureOwnOrCanViewAll(fastify, request, reimbursement);
+      await ensureOwnCanViewAllOrWorkflowReviewer(fastify, request, reimbursement);
 
       const controlMode = normalizeBudgetControlMode(fastify.config);
       const budgetPool = await resolveApplicableBudgetPool(fastify.prisma, reimbursement);
@@ -3323,7 +3353,10 @@ async function reimbursementRoutes(fastify) {
         actorId = previewGrant.actorId;
         downloadReason = "企业微信在线预览";
       } else {
-        ensureOwnOrCanViewAll(fastify, request, attachment.reimbursement_form);
+        await ensureOwnCanViewAllOrWorkflowReviewer(fastify, request, {
+          id: reimbursementId,
+          ...attachment.reimbursement_form,
+        });
         actorId = request.employee.id;
         downloadReason = sanitizeDownloadReason(request.query?.reason);
         if (requiresDownloadReason(attachment) && !downloadReason) {
@@ -3408,7 +3441,10 @@ async function reimbursementRoutes(fastify) {
       if (!attachment) {
         throw new AppError({ code: "SYS_404", message: "Not Found", statusCode: 404 });
       }
-      ensureOwnOrCanViewAll(fastify, request, attachment.reimbursement_form);
+      await ensureOwnCanViewAllOrWorkflowReviewer(fastify, request, {
+        id: reimbursementId,
+        ...attachment.reimbursement_form,
+      });
       const reason = sanitizeDownloadReason(parsedBody.data.reason);
       if (requiresDownloadReason(attachment) && !reason) {
         throw new AppError({
@@ -3501,7 +3537,7 @@ async function reimbursementRoutes(fastify) {
       if (!reimbursement) {
         throw new AppError({ code: "SYS_404", message: "Not Found", statusCode: 404 });
       }
-      ensureOwnOrCanViewAll(fastify, request, reimbursement);
+      await ensureOwnCanViewAllOrWorkflowReviewer(fastify, request, reimbursement);
 
       const reason = sanitizeDownloadReason(parsedBody.data.reason);
       if (reimbursement.attachments.some((attachment) => requiresDownloadReason(attachment)) && !reason) {
@@ -4532,6 +4568,8 @@ async function reimbursementRoutes(fastify) {
               workflow_steps_snapshot: workflowSteps,
               approval_rule_id: approvalRule.id,
               standardViolations,
+              budgetCheck,
+              budgetCheckRecorded: true,
             },
             context_department_id: reimbursement.department_id,
             created_by: request.employee.id,