R44 A2-A8 完成员工高级筛选批量操作与统计页

server/tests/unit/routes/employees.stats.test.js

@@ -0,0 +1,115 @@
+const Fastify = require("fastify");
+
+const employeesRoutes = require("../../../src/routes/employees");
+const { AppError } = require("../../../src/utils/AppError");
+
+async function buildApp({ permissionCodes = ["system.users"], stats } = {}) {
+  const app = Fastify();
+  const employeeGroupBy = vi
+    .fn()
+    .mockResolvedValueOnce([
+      { employment_status: "active", _count: { _all: 8 } },
+      { employment_status: "probation", _count: { _all: 2 } },
+    ])
+    .mockResolvedValueOnce([
+      { department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa", _count: { _all: 6 } },
+      { department_id: "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb", _count: { _all: 4 } },
+    ]);
+  const employeeCount = vi.fn().mockResolvedValueOnce(3).mockResolvedValueOnce(1);
+  const departmentFindMany = vi.fn().mockResolvedValue([
+    { id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa", name: "行政部" },
+    { id: "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb", name: "研发部" },
+  ]);
+  const contractCount = vi.fn().mockResolvedValue(2);
+
+  app.decorate("prisma", {
+    employee: {
+      groupBy: stats?.employeeGroupBy ?? employeeGroupBy,
+      count: stats?.employeeCount ?? employeeCount,
+      findMany: vi.fn().mockResolvedValue([]),
+      findUnique: vi.fn().mockResolvedValue(null),
+    },
+    department: {
+      findMany: stats?.departmentFindMany ?? departmentFindMany,
+    },
+    employeeContract: {
+      count: stats?.employeeContractCount ?? contractCount,
+      findMany: vi.fn().mockResolvedValue([]),
+    },
+  });
+  app.decorate("authenticate", async (request) => {
+    request.employee = {
+      id: "actor-1",
+      department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+      permissionCodes,
+      roleCodes: [],
+    };
+  });
+  app.decorate("requirePermission", (permissionCode) => async (request) => {
+    request.employee = {
+      id: "actor-1",
+      department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+      permissionCodes,
+      roleCodes: [],
+    };
+    if (!permissionCodes.includes("*") && !permissionCodes.includes(permissionCode)) {
+      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
+    }
+  });
+  app.decorate("hasPermission", (employee, permissionCode) => {
+    const codes = employee.permissionCodes ?? [];
+    return codes.includes("*") || codes.includes(permissionCode);
+  });
+  app.decorate("config", { appTimezone: "Asia/Shanghai" });
+  app.setErrorHandler((error, request, reply) => {
+    reply
+      .status(error.statusCode || 500)
+      .send({ code: error.code || "ERR", message: error.message, details: error.details ?? null });
+  });
+
+  await app.register(employeesRoutes, { prefix: "/api" });
+  return { app, employeeGroupBy, employeeCount, departmentFindMany, contractCount };
+}
+
+describe("employees stats route", () => {
+  it("returns aggregated employee stats for read-only viewers", async () => {
+    const { app, employeeGroupBy, employeeCount, departmentFindMany, contractCount } = await buildApp({
+      permissionCodes: ["report.dashboard.view"],
+    });
+
+    const response = await app.inject({
+      method: "GET",
+      url: "/api/employees/stats",
+    });
+
+    expect(response.statusCode).toBe(200);
+    const payload = response.json();
+    expect(payload.data.employmentStatusSummary.total).toBe(10);
+    expect(payload.data.departmentHeadcount).toEqual([
+      { departmentId: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa", departmentName: "行政部", count: 6 },
+      { departmentId: "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb", departmentName: "研发部", count: 4 },
+    ]);
+    expect(payload.data.recentMovements.hires).toBe(3);
+    expect(payload.data.recentMovements.departures).toBe(1);
+    expect(payload.data.expiringContracts.count).toBe(2);
+    expect(employeeGroupBy).toHaveBeenCalledTimes(2);
+    expect(employeeCount).toHaveBeenCalledTimes(2);
+    expect(departmentFindMany).toHaveBeenCalledTimes(1);
+    expect(contractCount).toHaveBeenCalledTimes(1);
+
+    await app.close();
+  });
+
+  it("rejects requests without people directory permission", async () => {
+    const { app } = await buildApp({ permissionCodes: ["employee"] });
+
+    const response = await app.inject({
+      method: "GET",
+      url: "/api/employees/stats",
+    });
+
+    expect(response.statusCode).toBe(403);
+
+    await app.close();
+  });
+});

server/tests/unit/routes/exports.employees.test.js

@@ -62,7 +62,7 @@ describe("employee exports route", () => {
 
     const response = await app.inject({
       method: "GET",
-      url: `/api/exports/employees?format=csv&status=active&departmentId=${DEPARTMENT_ID}&q=alice`,
+      url: `/api/exports/employees?format=csv&status=active&departmentId=${DEPARTMENT_ID}&q=alice&title=%E7%BB%8F%E7%90%86&managerId=bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb&hireDateFrom=2026-01-01&hireDateTo=2026-01-31&employmentStatus=active`,
     });
 
     expect(response.statusCode).toBe(200);
@@ -73,9 +73,22 @@ describe("employee exports route", () => {
         where: expect.objectContaining({
           status: "active",
           department_id: DEPARTMENT_ID,
-          OR: expect.arrayContaining([
-            expect.objectContaining({ name: expect.any(Object) }),
-            expect.objectContaining({ employee_no: expect.any(Object) }),
+          direct_manager_id: "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb",
+          employment_status: "active",
+          hire_date: expect.objectContaining({
+            gte: new Date("2026-01-01T00:00:00.000Z"),
+            lte: new Date("2026-01-31T23:59:59.999Z"),
+          }),
+          AND: expect.arrayContaining([
+            expect.objectContaining({
+              OR: expect.arrayContaining([
+                expect.objectContaining({ name: expect.any(Object) }),
+                expect.objectContaining({ employee_no: expect.any(Object) }),
+              ]),
+            }),
+            expect.objectContaining({
+              title: expect.objectContaining({ contains: "经理" }),
+            }),
           ]),
         }),
       }),
@@ -84,12 +97,20 @@ describe("employee exports route", () => {
       where: expect.objectContaining({
         status: "active",
         department_id: DEPARTMENT_ID,
+        direct_manager_id: "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb",
       }),
     });
     expect(auditCreate).toHaveBeenCalledWith(
       expect.objectContaining({
         data: expect.objectContaining({
           action: "EXPORT_EMPLOYEES",
+          extra: expect.objectContaining({
+            title: "经理",
+            managerId: "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb",
+            hireDateFrom: "2026-01-01",
+            hireDateTo: "2026-01-31",
+            employmentStatus: "active",
+          }),
         }),
       }),
     );

server/tests/unit/routes/users.list.test.js

@@ -1,6 +1,7 @@
 const Fastify = require("fastify");
 
 const usersRoutes = require("../../../src/routes/users");
+const { AppError } = require("../../../src/utils/AppError");
 
 function buildEmployeeRow(overrides = {}) {
   const now = new Date("2026-03-28T10:00:00.000Z");
@@ -20,10 +21,17 @@ function buildEmployeeRow(overrides = {}) {
   };
 }
 
-async function buildApp(routeOptions = {}) {
+async function buildApp({ routeOptions = {}, employee } = {}) {
   const app = Fastify();
   const findMany = vi.fn().mockResolvedValue([buildEmployeeRow()]);
   const count = vi.fn().mockResolvedValue(1);
+  const actor =
+    employee ??
+    {
+      id: "actor-1",
+      department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+      permissionCodes: ["system.users"],
+    };
 
   app.decorate("prisma", {
     employee: {
@@ -31,21 +39,20 @@ async function buildApp(routeOptions = {}) {
       count,
     },
   });
-  app.decorate("requirePermission", () => async (request) => {
-    request.employee = {
-      id: "actor-1",
-      department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
-      permissionCodes: ["system.users"],
-    };
+  app.decorate("requirePermission", (permissionCode) => async (request) => {
+    request.employee = actor;
+    const permissionCodes = actor.permissionCodes ?? [];
+    if (!permissionCodes.includes("*") && !permissionCodes.includes(permissionCode)) {
+      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
+    }
   });
   app.decorate("authenticate", async (request) => {
-    request.employee = {
-      id: "actor-1",
-      department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
-      permissionCodes: ["system.users"],
-    };
+    request.employee = actor;
+  });
+  app.decorate("hasPermission", (requestEmployee, permissionCode) => {
+    const permissionCodes = requestEmployee.permissionCodes ?? [];
+    return permissionCodes.includes("*") || permissionCodes.includes(permissionCode);
   });
-  app.decorate("hasPermission", () => true);
   app.decorate("config", {});
 
   await app.register(usersRoutes, { prefix: "/api", ...routeOptions });
@@ -56,8 +63,10 @@ describe("usersRoutes list query", () => {
   it("supports departmentId filter for /employees when enabled", async () => {
     const departmentId = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
     const { app, findMany, count } = await buildApp({
-      basePath: "/employees",
-      allowDepartmentFilter: true,
+      routeOptions: {
+        basePath: "/employees",
+        allowDepartmentFilter: true,
+      },
     });
 
     const response = await app.inject({
@@ -85,8 +94,10 @@ describe("usersRoutes list query", () => {
   it("combines q + status + departmentId for /employees", async () => {
     const departmentId = "cccccccc-cccc-4ccc-8ccc-cccccccccccc";
     const { app, findMany } = await buildApp({
-      basePath: "/employees",
-      allowDepartmentFilter: true,
+      routeOptions: {
+        basePath: "/employees",
+        allowDepartmentFilter: true,
+      },
     });
 
     const response = await app.inject({
@@ -100,9 +111,13 @@ describe("usersRoutes list query", () => {
         where: expect.objectContaining({
           status: "active",
           department_id: departmentId,
-          OR: expect.arrayContaining([
-            expect.objectContaining({ name: expect.any(Object) }),
-            expect.objectContaining({ employee_no: expect.any(Object) }),
+          AND: expect.arrayContaining([
+            expect.objectContaining({
+              OR: expect.arrayContaining([
+                expect.objectContaining({ name: expect.any(Object) }),
+                expect.objectContaining({ employee_no: expect.any(Object) }),
+              ]),
+            }),
           ]),
         }),
       }),
@@ -111,6 +126,58 @@ describe("usersRoutes list query", () => {
     await app.close();
   });
 
+  it("supports advanced filters and report.dashboard.view for /employees", async () => {
+    const departmentId = "eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee";
+    const managerId = "ffffffff-ffff-4fff-8fff-ffffffffffff";
+    const { app, findMany, count } = await buildApp({
+      routeOptions: {
+        basePath: "/employees",
+        allowDepartmentFilter: true,
+        listPermissionCodes: ["system.users", "report.dashboard.view"],
+      },
+      employee: {
+        id: "viewer-1",
+        department_id: departmentId,
+        permissionCodes: ["report.dashboard.view"],
+      },
+    });
+
+    const response = await app.inject({
+      method: "GET",
+      url: `/api/employees?page=1&pageSize=20&departmentId=${departmentId}&title=%E7%BB%8F%E7%90%86&managerId=${managerId}&hireDateFrom=2026-01-01&hireDateTo=2026-01-31&employmentStatus=probation`,
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(findMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: expect.objectContaining({
+          department_id: departmentId,
+          direct_manager_id: managerId,
+          employment_status: "probation",
+          hire_date: expect.objectContaining({
+            gte: new Date("2026-01-01T00:00:00.000Z"),
+            lte: new Date("2026-01-31T23:59:59.999Z"),
+          }),
+          AND: expect.arrayContaining([
+            expect.objectContaining({
+              title: expect.objectContaining({
+                contains: "经理",
+              }),
+            }),
+          ]),
+        }),
+      }),
+    );
+    expect(count).toHaveBeenCalledWith({
+      where: expect.objectContaining({
+        department_id: departmentId,
+        direct_manager_id: managerId,
+      }),
+    });
+
+    await app.close();
+  });
+
   it("does not apply departmentId filter for /users", async () => {
     const departmentId = "dddddddd-dddd-4ddd-8ddd-dddddddddddd";
     const { app, findMany } = await buildApp();