实现 B-2a 报销审批内容工作台（reimbursement-approval-content-workbench）

server/tests/unit/routes/reimbursements.detail.test.js

@@ -99,6 +99,8 @@ function buildReimbursementRecord(overrides = {}) {
 async function buildApp({
   employeeId = OWNER_ID,
   permissionCodes = ["expense.view_own"],
+  roleCodes = [],
+  reviewerTask = null,
   reimbursement = buildReimbursementRecord(),
   latestWorkflowInstance = {
     id: PENDING_INSTANCE_ID,
@@ -273,6 +275,12 @@ async function buildApp({
     budgetPool: {
       findMany: vi.fn(async () => []),
     },
+    delegationGrant: {
+      findMany: vi.fn(async () => []),
+    },
+    workflowTask: {
+      findFirst: vi.fn(async () => reviewerTask),
+    },
   };
 
   app.decorate("prisma", prisma);
@@ -289,7 +297,7 @@ async function buildApp({
     request.employee = {
       id: employeeId,
       permissionCodes,
-      roleCodes: [],
+      roleCodes,
       department_id: DEPARTMENT_ID,
     };
   });
@@ -329,6 +337,48 @@ async function buildApp({
 }
 
 describe("GET /api/reimbursements/:id detail enhancements", () => {
+  it("allows an assigned workflow reviewer to read evidence without expense view permissions", async () => {
+    const { app, prisma } = await buildApp({
+      employeeId: "99999999-9999-4999-8999-999999999999",
+      permissionCodes: ["expense.approve"],
+      roleCodes: ["finance"],
+      reviewerTask: { id: "review-task" },
+    });
+
+    const response = await app.inject({
+      method: "GET",
+      url: `/api/reimbursements/${REIMBURSEMENT_ID}`,
+      headers: { authorization: "Bearer test" },
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(prisma.workflowTask.findFirst).toHaveBeenCalledWith(expect.objectContaining({
+      where: expect.objectContaining({
+        workflow_instance: { entity_type: "reimbursement", entity_id: REIMBURSEMENT_ID },
+      }),
+      select: { id: true },
+    }));
+
+    await app.close();
+  });
+
+  it("keeps an unrelated employee outside the reimbursement evidence projection", async () => {
+    const { app } = await buildApp({
+      employeeId: "99999999-9999-4999-8999-999999999999",
+      permissionCodes: ["expense.approve"],
+      reviewerTask: null,
+    });
+
+    const response = await app.inject({
+      method: "GET",
+      url: `/api/reimbursements/${REIMBURSEMENT_ID}`,
+      headers: { authorization: "Bearer test" },
+    });
+
+    expect(response.statusCode).toBe(403);
+    await app.close();
+  });
+
   it("returns department, submittedAt, expanded invoices and printable approvalHistory", async () => {
     const { app } = await buildApp();
 

server/tests/unit/routes/reimbursements.expense-standards.test.js

@@ -854,6 +854,40 @@ describe("reimbursements routes expense standard integration", () => {
         exceededAmount: "60.00",
       }),
     ]);
+    expect(state.workflowInstanceCreatePayload?.context_data).toEqual(expect.objectContaining({
+      budgetCheck: null,
+      budgetCheckRecorded: true,
+    }));
+
+    await app.close();
+  });
+
+  it("persists the calculated budget check in the workflow submission snapshot", async () => {
+    resolveEntityPrecheckMock.mockResolvedValue(buildPrecheck());
+    resolveApplicableBudgetPoolByContextMock.mockResolvedValue({
+      id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+      code: "BUDGET-2026",
+      allocated_amount: "1000.00",
+      used_amount: "700.00",
+      warning_threshold_percent: 80,
+    });
+
+    const { app, state } = await buildApp();
+    const response = await app.inject({
+      method: "POST",
+      url: `/api/reimbursements/${REIMBURSEMENT_ID}/submit`,
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(state.workflowInstanceCreatePayload?.context_data?.budgetCheck).toEqual({
+      budgetId: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+      budgetCode: "BUDGET-2026",
+      controlMode: "warn",
+      usagePercent: 88,
+      exceededThreshold: true,
+      exceededBudget: false,
+    });
+    expect(state.workflowInstanceCreatePayload?.context_data?.budgetCheckRecorded).toBe(true);
 
     await app.close();
   });

server/tests/unit/routes/workflow.task-detail.test.js

@@ -36,18 +36,33 @@ async function buildApp(options = {}) {
           entity_id: "44444444-4444-4444-8444-444444444444",
           current_status: "pending",
           current_step_id: "approval_1_finance",
-          context_data: {
+          context_data: options.contextData ?? {
             standardViolations: [
               {
                 itemId: "item-1",
+                expenseTypeId: "66666666-6666-4666-8666-666666666666",
                 expenseTypeName: "交通费",
                 amount: "180.00",
+                standardId: "77777777-7777-4777-8777-777777777777",
                 standardName: "交通费上限",
                 maxAmount: "120.00",
+                perUnit: "item",
                 exceededAmount: "60.00",
                 controlMode: "warn",
+                scopeType: "global",
+                scopeKey: null,
+                exceeded: true,
+                secretNestedField: "must-not-be-projected",
               },
             ],
+            budgetCheck: {
+              budgetId: "55555555-5555-4555-8555-555555555555",
+              budgetCode: "BUDGET-2026",
+              controlMode: "warn",
+              usagePercent: 82.5,
+              exceededThreshold: true,
+              exceededBudget: false,
+            },
           },
           started_at: new Date("2026-04-08T08:00:00.000Z"),
           completed_at: null,
@@ -128,6 +143,82 @@ describe("workflow task detail route", () => {
         exceededAmount: "60.00",
       }),
     ]);
+    expect(response.json().data.workflowInstance.contextData.standardViolations[0]).not.toHaveProperty("secretNestedField");
+
+    await app.close();
+  });
+
+  it("projects the allowed budget snapshot fields", async () => {
+    const { app } = await buildApp();
+
+    const response = await app.inject({ method: "GET", url: `/api/workflow/tasks/${TASK_ID}` });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json().data.workflowInstance.contextData).toEqual(expect.objectContaining({
+      budgetCheck: {
+        budgetId: "55555555-5555-4555-8555-555555555555",
+        budgetCode: "BUDGET-2026",
+        controlMode: "warn",
+        usagePercent: 82.5,
+        exceededThreshold: true,
+        exceededBudget: false,
+      },
+      budgetCheckStatus: "available",
+      parseStatus: "ready",
+    }));
+
+    await app.close();
+  });
+
+  it("marks a historical missing budget snapshot without failing parsing", async () => {
+    const { app } = await buildApp({ contextData: { standardViolations: [] } });
+
+    const response = await app.inject({ method: "GET", url: `/api/workflow/tasks/${TASK_ID}` });
+
+    expect(response.json().data.workflowInstance.contextData).toEqual({
+      standardViolations: [],
+      budgetCheck: null,
+      budgetCheckStatus: "missing",
+      parseStatus: "ready",
+    });
+
+    await app.close();
+  });
+
+  it("distinguishes a recorded submission with no applicable budget from historical missing data", async () => {
+    const { app } = await buildApp({ contextData: { standardViolations: [], budgetCheck: null, budgetCheckRecorded: true } });
+
+    const response = await app.inject({ method: "GET", url: `/api/workflow/tasks/${TASK_ID}` });
+
+    expect(response.json().data.workflowInstance.contextData).toEqual({
+      standardViolations: [],
+      budgetCheck: null,
+      budgetCheckStatus: "not_applicable",
+      parseStatus: "ready",
+    });
+
+    await app.close();
+  });
+
+  it("fails the snapshot projection closed when stored fields are malformed", async () => {
+    const { app } = await buildApp({
+      contextData: {
+        standardViolations: { itemId: "not-an-array" },
+        budgetCheck: { budgetCode: "BUDGET-2026", usagePercent: "unknown" },
+        secretField: "must-not-be-projected",
+      },
+    });
+
+    const response = await app.inject({ method: "GET", url: `/api/workflow/tasks/${TASK_ID}` });
+    const contextData = response.json().data.workflowInstance.contextData;
+
+    expect(contextData).toEqual({
+      standardViolations: [],
+      budgetCheck: null,
+      budgetCheckStatus: "missing",
+      parseStatus: "invalid",
+    });
+    expect(contextData).not.toHaveProperty("secretField");
 
     await app.close();
   });