WHMSLIVE 部署验证企微HR主数据镜像

server/tests/unit/wecomHrMaster.service.test.js

@@ -2,11 +2,20 @@ const {
   maskEmail,
   maskExternalUserId,
   maskPhone,
+  fetchWecomHrProfiles,
   normalizeWecomHrProfile,
   __testables,
 } = require("../../src/services/integrations/wecomHrMaster");
 
 describe("wecom HR master sync helpers", () => {
+  function jsonResponse(payload, status = 200) {
+    return {
+      ok: status >= 200 && status < 300,
+      status,
+      json: async () => payload,
+    };
+  }
+
   it("normalizes contact and HR assistant data without leaking full sensitive values in summary", () => {
     const departmentMap = new Map([
       ["1", { externalId: "1", name: "研发部" }],
@@ -101,4 +110,67 @@ describe("wecom HR master sync helpers", () => {
     expect(changes.email.before).toBe(maskEmail("[email protected]"));
     expect(changes.externalUserId.after).toBe(maskExternalUserId("oa_smoke002"));
   });
+
+  it("falls back to the authorized app secret when the contact secret is forbidden for read APIs", async () => {
+    const calls = [];
+    const fetchImpl = async (url, init = {}) => {
+      const parsed = new URL(String(url));
+      calls.push({ path: parsed.pathname, token: parsed.searchParams.get("access_token") });
+      if (parsed.pathname === "/cgi-bin/gettoken") {
+        const secret = parsed.searchParams.get("corpsecret");
+        if (secret === "contact-secret-whms-fallback") {
+          return jsonResponse({ errcode: 0, access_token: "contact-token", expires_in: 7200 });
+        }
+        if (secret === "agent-secret-whms-fallback") {
+          return jsonResponse({ errcode: 0, access_token: "agent-token", expires_in: 7200 });
+        }
+        if (secret === "hr-secret-whms-fallback") {
+          return jsonResponse({ errcode: 0, access_token: "hr-token", expires_in: 7200 });
+        }
+      }
+      if (parsed.pathname === "/cgi-bin/department/list" && parsed.searchParams.get("access_token") === "contact-token") {
+        return jsonResponse({ errcode: 48009, errmsg: "api forbidden for contact assistant" });
+      }
+      if (parsed.pathname === "/cgi-bin/department/list" && parsed.searchParams.get("access_token") === "agent-token") {
+        return jsonResponse({ errcode: 0, department: [{ id: 1, name: "管理部", parentid: 0 }] });
+      }
+      if (parsed.pathname === "/cgi-bin/user/get" && parsed.searchParams.get("access_token") === "agent-token") {
+        return jsonResponse({
+          errcode: 0,
+          userid: "oa_smoke002",
+          name: "测试员工",
+          mobile: "19912345678",
+          email: "[email protected]",
+          department: [1],
+          enable: 1,
+        });
+      }
+      if (parsed.pathname === "/cgi-bin/hr/get_staff_info" && parsed.searchParams.get("access_token") === "hr-token") {
+        expect(init.method).toBe("POST");
+        return jsonResponse({ errcode: 0, staff_info: [{ fieldid: "在职状态", value: "在职" }] });
+      }
+      return jsonResponse({ errcode: 40001, errmsg: "unexpected mock request" });
+    };
+
+    const result = await fetchWecomHrProfiles({
+      config: {
+        wecomCorpId: "corp-whms-fallback",
+        wecomAgentId: "1000002",
+        wecomContactSecret: "contact-secret-whms-fallback",
+        wecomAgentSecret: "agent-secret-whms-fallback",
+        wecomHrAssistantSecret: "hr-secret-whms-fallback",
+        wecomContactDefaultDepartmentId: "1",
+      },
+      userids: ["oa_smoke002"],
+      limit: 1,
+      fetchImpl,
+    });
+
+    expect(result.tokenSource.contact).toBe("WECOM_AGENT_SECRET_FALLBACK");
+    expect(result.tokenSource.hr).toBe("WECOM_HR_ASSISTANT_SECRET");
+    expect(result.profiles).toHaveLength(1);
+    expect(result.profiles[0].externalUserId).toBe("oa_smoke002");
+    expect(calls.some((call) => call.path === "/cgi-bin/department/list" && call.token === "contact-token")).toBe(true);
+    expect(calls.some((call) => call.path === "/cgi-bin/department/list" && call.token === "agent-token")).toBe(true);
+  });
 });