feat(P25-1/P25-5/P26-1/P26-3/P24-1/P29-4): 落地内部OA够用版后端与试运行能力

关联 Issue: P25-1, P25-2, P25-3, P25-4, P25-5, P26-1, P26-3, P24-1, P24-2, P29-1, P29-2, P29-3, P29-4

server/src/routes/travelRequests.js

@@ -12,6 +12,13 @@ const { sendNotificationEmailSafe } = require("../services/email");
 const { createNotifications, resolveRecipientsForAssignee } = require("../services/notifications");
 const { enqueueImNotifications } = require("../services/notifications/imEnqueue");
 const { buildTravelPaymentTrack } = require("../services/travelPayments");
+const { FEATURE_FLAG_KEYS, evaluateFeatureFlag } = require("../services/featureFlags");
+const { ensureCutoverAllowed } = require("../services/cutover");
+const {
+  buildPersistedRiskFlag,
+  buildTravelRequestPrecheck,
+  createRiskFlagsFromPrecheck,
+} = require("../services/feeControl");
 const { NOTIFICATION_TYPES } = require("../constants/notificationTypes");
 
 const UUID_SCHEMA = z.string().uuid();
@@ -281,6 +288,29 @@ function ensureDateRangeValid(startDate, endDate) {
   }
 }
 
+function buildDisabledPrecheck(entityType, entityId) {
+  return {
+    entityType,
+    entityId,
+    decision: "pass",
+    matchedBudgetControlRule: null,
+    budgetHint: null,
+    warnings: [],
+    blockingReasons: [],
+    riskFlags: [],
+    nextActions: ["功能未开启，沿用当前提交流程"],
+  };
+}
+
+function buildPrecheckBlockedError(precheck) {
+  return new AppError({
+    code: "VALID_001",
+    message: "参数校验失败",
+    statusCode: 409,
+    details: { precheck: precheck.blockingReasons },
+  });
+}
+
 async function ensureFinancialDimensions(tx, { legalEntityId, costCenterId }) {
   const [legalEntity, costCenter] = await Promise.all([
     tx.legalEntity.findUnique({
@@ -641,6 +671,14 @@ async function createTravelRequestsRoutes(fastify) {
     },
     async (request, reply) => {
       const body = parseBody(TRAVEL_CREATE_BODY_SCHEMA, request.body);
+      await ensureCutoverAllowed({
+        prisma: fastify.prisma,
+        config: fastify.config,
+        request,
+        domain: "travel",
+        departmentId: request.employee.department_id ?? null,
+        legalEntityId: body.legalEntityId,
+      });
       const startDate = parseDateOnlyString(body.startDate);
       const endDate = parseDateOnlyString(body.endDate);
       ensureDateRangeValid(startDate, endDate);
@@ -719,7 +757,18 @@ async function createTravelRequestsRoutes(fastify) {
       ensureTravelReadPermission(fastify, request);
       const travelRequestId = parseTravelRequestId(request.params?.id);
       const detail = await loadReadableTravelRequest(fastify.prisma, travelRequestId, request);
-      return sendData(reply, request, mapTravelRequestDetail(detail, request));
+      const riskFlags = await fastify.prisma.entityRiskFlag.findMany({
+        where: {
+          entity_type: "travel_request",
+          entity_id: travelRequestId,
+          status: "open",
+        },
+        orderBy: [{ created_at: "desc" }, { id: "desc" }],
+      });
+      return sendData(reply, request, {
+        ...mapTravelRequestDetail(detail, request),
+        riskFlags: riskFlags.map(buildPersistedRiskFlag),
+      });
     },
   );
 
@@ -836,6 +885,41 @@ async function createTravelRequestsRoutes(fastify) {
     },
   );
 
+  fastify.post(
+    "/travel-requests/:id/precheck",
+    {
+      preHandler: fastify.requirePermission("travel.submit"),
+    },
+    async (request, reply) => {
+      const travelRequestId = parseTravelRequestId(request.params?.id);
+      const travelRequest = await fastify.prisma.travelRequest.findUnique({
+        where: { id: travelRequestId },
+        select: { id: true, department_id: true },
+      });
+      if (!travelRequest) {
+        throw new AppError({ code: "SYS_404", message: "Not Found", statusCode: 404 });
+      }
+
+      const gate = await evaluateFeatureFlag({
+        prisma: fastify.prisma,
+        config: fastify.config,
+        flagKey: FEATURE_FLAG_KEYS.budgetPrecheck,
+        departmentId: travelRequest.department_id ?? request.employee.department_id ?? null,
+        strictDepartment: false,
+      });
+      if (!gate.enabled) {
+        return sendData(reply, request, buildDisabledPrecheck("travel_request", travelRequestId));
+      }
+
+      const precheck = await buildTravelRequestPrecheck(fastify.prisma, {
+        travelRequestId,
+        config: fastify.config,
+        logger: fastify.log,
+      });
+      return sendData(reply, request, precheck);
+    },
+  );
+
   fastify.post(
     "/travel-requests/:id/submit",
     {
@@ -849,6 +933,14 @@ async function createTravelRequestsRoutes(fastify) {
       await fastify.prisma.$transaction(async (tx) => {
         const travelRequest = await loadTravelRequestForUpdate(tx, travelRequestId);
         ensureDraftOwner(request, travelRequest);
+        await ensureCutoverAllowed({
+          prisma: tx,
+          config: fastify.config,
+          request,
+          domain: "travel",
+          departmentId: travelRequest.department_id ?? request.employee.department_id ?? null,
+          legalEntityId: travelRequest.legal_entity_id ?? null,
+        });
         if (travelRequest.status !== "draft") {
           throw buildValidationError({ status: "only_draft_submittable" }, 409);
         }
@@ -856,6 +948,30 @@ async function createTravelRequestsRoutes(fastify) {
           throw buildValidationError({ segments: "required" }, 409);
         }
 
+        const budgetPrecheckGate = await evaluateFeatureFlag({
+          prisma: tx,
+          config: fastify.config,
+          flagKey: FEATURE_FLAG_KEYS.budgetPrecheck,
+          departmentId: travelRequest.department_id ?? request.employee.department_id ?? null,
+          strictDepartment: false,
+        });
+        const authoritativePrecheck = budgetPrecheckGate.enabled
+          ? await buildTravelRequestPrecheck(tx, {
+              travelRequestId,
+              config: fastify.config,
+              logger: fastify.log,
+            })
+          : buildDisabledPrecheck("travel_request", travelRequestId);
+        if (authoritativePrecheck.decision === "block") {
+          throw buildPrecheckBlockedError(authoritativePrecheck);
+        }
+        const openedRiskFlags = await createRiskFlagsFromPrecheck(tx, {
+          entityType: "travel_request",
+          entityId: travelRequestId,
+          actorId: request.employee.id,
+          precheck: authoritativePrecheck,
+        });
+
         const workflowDefinition = await tx.workflowDefinition.findFirst({
           where: { entity_type: "travel_request", is_active: true },
           orderBy: { version: "desc" },
@@ -1050,6 +1166,8 @@ async function createTravelRequestsRoutes(fastify) {
           currentTaskId: workflowTask.id,
           budgetPoolId: selectedBudgetPoolId,
           budgetReservation,
+          precheckDecision: authoritativePrecheck.decision,
+          openedRiskFlagCount: openedRiskFlags.length,
         };
       });