R44 A2-A8 完成员工高级筛选批量操作与统计页

server/tests/unit/routes/users.list.test.js

@@ -1,6 +1,7 @@
 const Fastify = require("fastify");
 
 const usersRoutes = require("../../../src/routes/users");
+const { AppError } = require("../../../src/utils/AppError");
 
 function buildEmployeeRow(overrides = {}) {
   const now = new Date("2026-03-28T10:00:00.000Z");
@@ -20,10 +21,17 @@ function buildEmployeeRow(overrides = {}) {
   };
 }
 
-async function buildApp(routeOptions = {}) {
+async function buildApp({ routeOptions = {}, employee } = {}) {
   const app = Fastify();
   const findMany = vi.fn().mockResolvedValue([buildEmployeeRow()]);
   const count = vi.fn().mockResolvedValue(1);
+  const actor =
+    employee ??
+    {
+      id: "actor-1",
+      department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+      permissionCodes: ["system.users"],
+    };
 
   app.decorate("prisma", {
     employee: {
@@ -31,21 +39,20 @@ async function buildApp(routeOptions = {}) {
       count,
     },
   });
-  app.decorate("requirePermission", () => async (request) => {
-    request.employee = {
-      id: "actor-1",
-      department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
-      permissionCodes: ["system.users"],
-    };
+  app.decorate("requirePermission", (permissionCode) => async (request) => {
+    request.employee = actor;
+    const permissionCodes = actor.permissionCodes ?? [];
+    if (!permissionCodes.includes("*") && !permissionCodes.includes(permissionCode)) {
+      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
+    }
   });
   app.decorate("authenticate", async (request) => {
-    request.employee = {
-      id: "actor-1",
-      department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
-      permissionCodes: ["system.users"],
-    };
+    request.employee = actor;
+  });
+  app.decorate("hasPermission", (requestEmployee, permissionCode) => {
+    const permissionCodes = requestEmployee.permissionCodes ?? [];
+    return permissionCodes.includes("*") || permissionCodes.includes(permissionCode);
   });
-  app.decorate("hasPermission", () => true);
   app.decorate("config", {});
 
   await app.register(usersRoutes, { prefix: "/api", ...routeOptions });
@@ -56,8 +63,10 @@ describe("usersRoutes list query", () => {
   it("supports departmentId filter for /employees when enabled", async () => {
     const departmentId = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
     const { app, findMany, count } = await buildApp({
-      basePath: "/employees",
-      allowDepartmentFilter: true,
+      routeOptions: {
+        basePath: "/employees",
+        allowDepartmentFilter: true,
+      },
     });
 
     const response = await app.inject({
@@ -85,8 +94,10 @@ describe("usersRoutes list query", () => {
   it("combines q + status + departmentId for /employees", async () => {
     const departmentId = "cccccccc-cccc-4ccc-8ccc-cccccccccccc";
     const { app, findMany } = await buildApp({
-      basePath: "/employees",
-      allowDepartmentFilter: true,
+      routeOptions: {
+        basePath: "/employees",
+        allowDepartmentFilter: true,
+      },
     });
 
     const response = await app.inject({
@@ -100,9 +111,13 @@ describe("usersRoutes list query", () => {
         where: expect.objectContaining({
           status: "active",
           department_id: departmentId,
-          OR: expect.arrayContaining([
-            expect.objectContaining({ name: expect.any(Object) }),
-            expect.objectContaining({ employee_no: expect.any(Object) }),
+          AND: expect.arrayContaining([
+            expect.objectContaining({
+              OR: expect.arrayContaining([
+                expect.objectContaining({ name: expect.any(Object) }),
+                expect.objectContaining({ employee_no: expect.any(Object) }),
+              ]),
+            }),
           ]),
         }),
       }),
@@ -111,6 +126,58 @@ describe("usersRoutes list query", () => {
     await app.close();
   });
 
+  it("supports advanced filters and report.dashboard.view for /employees", async () => {
+    const departmentId = "eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee";
+    const managerId = "ffffffff-ffff-4fff-8fff-ffffffffffff";
+    const { app, findMany, count } = await buildApp({
+      routeOptions: {
+        basePath: "/employees",
+        allowDepartmentFilter: true,
+        listPermissionCodes: ["system.users", "report.dashboard.view"],
+      },
+      employee: {
+        id: "viewer-1",
+        department_id: departmentId,
+        permissionCodes: ["report.dashboard.view"],
+      },
+    });
+
+    const response = await app.inject({
+      method: "GET",
+      url: `/api/employees?page=1&pageSize=20&departmentId=${departmentId}&title=%E7%BB%8F%E7%90%86&managerId=${managerId}&hireDateFrom=2026-01-01&hireDateTo=2026-01-31&employmentStatus=probation`,
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(findMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: expect.objectContaining({
+          department_id: departmentId,
+          direct_manager_id: managerId,
+          employment_status: "probation",
+          hire_date: expect.objectContaining({
+            gte: new Date("2026-01-01T00:00:00.000Z"),
+            lte: new Date("2026-01-31T23:59:59.999Z"),
+          }),
+          AND: expect.arrayContaining([
+            expect.objectContaining({
+              title: expect.objectContaining({
+                contains: "经理",
+              }),
+            }),
+          ]),
+        }),
+      }),
+    );
+    expect(count).toHaveBeenCalledWith({
+      where: expect.objectContaining({
+        department_id: departmentId,
+        direct_manager_id: managerId,
+      }),
+    });
+
+    await app.close();
+  });
+
   it("does not apply departmentId filter for /users", async () => {
     const departmentId = "dddddddd-dddd-4ddd-8ddd-dddddddddddd";
     const { app, findMany } = await buildApp();