fix: 取消CEO默认AP台账权限（09-07-manager-ap-access-scope）

server/src/constants/permissions.js

@@ -162,7 +162,6 @@ const ROLE_PERMISSIONS = {
     "payment.batch.review",
   ],
   ceo: [
-    "finance.ledger.view",
     ...EMPLOYEE_BASE_PERMISSIONS,
     ...PROCUREMENT_SELF_SERVICE_PERMISSIONS,
     ...MASTERDATA_VIEW_PERMISSIONS,

server/tests/unit/constants/permissions.test.js

@@ -6,13 +6,18 @@ const {
 
 describe("Permission Constants", () => {
   it("separates full AP reading from payment review and preserves multi-role grants", () => {
-    for (const role of ["ceo", "finance", "finance_mgr"]) {
+    for (const role of ["finance", "finance_mgr"]) {
       expect(hasPermission(resolvePermissionsForRoles([role]), "finance.ledger.view")).toBe(true);
     }
-    for (const role of ["manager", "employee", "system_admin", "hr", "administration"]) {
+    for (const role of ["ceo", "manager", "employee", "system_admin", "hr", "administration"]) {
       expect(hasPermission(resolvePermissionsForRoles([role]), "finance.ledger.view")).toBe(false);
     }
-    expect(hasPermission(resolvePermissionsForRoles(["manager", "finance"]), "finance.ledger.view")).toBe(true);
+    for (const role of ["manager", "ceo"]) {
+      expect(hasPermission(resolvePermissionsForRoles([role, "finance"]), "finance.ledger.view")).toBe(true);
+      for (const permission of ["expense.approve", "leave.approve", "attendance.approve", "procurement.approve", "payment.batch.review"]) {
+        expect(hasPermission(resolvePermissionsForRoles([role]), permission)).toBe(true);
+      }
+    }
     expect(hasPermission(resolvePermissionsForRoles(["manager"]), "payment.batch.review")).toBe(true);
     expect(hasPermission(resolvePermissionsForRoles(["ceo"]), "payment.batch.manage")).toBe(false);
   });

server/tests/unit/routes/apOperations.permissions.test.js

@@ -44,7 +44,7 @@ async function buildApp(permissionCodes, enabled = true) {
 describe("AP full-ledger permission boundary", () => {
   it.each([
     ["employee", false], ["manager", false], ["system_admin", false],
-    ["ceo", true], ["finance", true], ["finance_mgr", true], ["admin", true],
+    ["ceo", false], ["finance", true], ["finance_mgr", true], ["admin", true],
   ])("checks both reads for %s", async (role, allowed) => {
     const { app, queries } = await buildApp(resolvePermissionsForRoles([role]));
     try {
@@ -74,7 +74,7 @@ describe("AP full-ledger permission boundary", () => {
     },
   );
 
-  it.each([["finance.ledger.view"], resolvePermissionsForRoles(["manager", "finance"])].map((permissions) => [permissions]))(
+  it.each([["finance.ledger.view"], resolvePermissionsForRoles(["manager", "finance"]), resolvePermissionsForRoles(["ceo", "finance"])].map((permissions) => [permissions]))(
     "honors explicit or combined-role ledger authority %j", async (permissions) => {
       const { app } = await buildApp(permissions);
       try {

server/tests/unit/workspaceSettings.navigation.test.js

@@ -64,8 +64,8 @@ describe("workspace small-team navigation defaults", () => {
       hasPermission: (candidate, permission) => hasPermission(candidate.permissionCodes, permission),
     });
     const keys = Object.values(navigation.sections).flat().map((item) => item.key);
-    expect(keys.includes("apOperations")).toBe(["ceo", "finance", "finance_mgr"].includes(role));
-    if (role === "manager") expect(keys).toContain("paymentBatches");
+    expect(keys.includes("apOperations")).toBe(["finance", "finance_mgr"].includes(role));
+    if (["manager", "ceo"].includes(role)) expect(keys).toContain("paymentBatches");
   });
 
   it("keeps only the small-team task path in default main navigation", () => {