修复非参与人报销只读边界（08-28-reimbursement-nonparticipant-readonly-projection）

server/tests/unit/routes/invoicePool.travel-bind.test.js

@@ -87,7 +87,7 @@ function buildPrisma({
   return { prisma, state };
 }
 
-async function buildApp({ prisma, permissionCodes = ["travel.payment.manage"] }) {
+async function buildApp({ prisma, permissionCodes = ["travel.payment.manage"], employeeId = "actor-1" }) {
   const app = Fastify();
 
   app.decorate("prisma", prisma);
@@ -101,7 +101,7 @@ async function buildApp({ prisma, permissionCodes = ["travel.payment.manage"] })
     if (!request.headers.authorization) {
       throw new AppError({ code: "AUTH_001", message: "未登录", statusCode: 401 });
     }
-    request.employee = { id: "actor-1", permissionCodes };
+    request.employee = { id: employeeId, permissionCodes };
   });
   app.decorate("hasPermission", (employee, permissionCode) => (employee?.permissionCodes ?? []).includes("*") || (employee?.permissionCodes ?? []).includes(permissionCode));
   app.decorate("requirePermission", (permissionCode) => async (request) => {
@@ -133,6 +133,84 @@ async function buildApp({ prisma, permissionCodes = ["travel.payment.manage"] })
 }
 
 describe("invoicePool travel-order bind routes", () => {
+  it("rejects a view-all nonparticipant before binding a reimbursement invoice", async () => {
+    const reimbursementId = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
+    const { prisma, state } = buildPrisma({
+      invoice: {
+        id: "11111111-1111-4111-8111-111111111111",
+        status: "available",
+        linked_reimbursement_id: null,
+        linked_item_id: null,
+        travel_order_id: null,
+        total_amount: "1683.00",
+      },
+      reimbursement: {
+        id: reimbursementId,
+        owner_id: "actor-1",
+        submitter_id: "actor-1",
+        status: "draft",
+        reimbursement_date: new Date("2026-05-08T00:00:00.000Z"),
+      },
+    });
+    const app = await buildApp({
+      prisma,
+      employeeId: "finance-viewer",
+      permissionCodes: ["invoice.upload", "expense.view_all"],
+    });
+
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/invoice-pool/11111111-1111-4111-8111-111111111111/bind",
+      headers: { authorization: "Bearer test" },
+      payload: { reimbursementId },
+    });
+
+    expect(response.statusCode).toBe(403);
+    expect(state.invoice.status).toBe("available");
+    expect(prisma.invoicePool.update).not.toHaveBeenCalled();
+    expect(prisma.reimbursementItem.create).not.toHaveBeenCalled();
+    expect(prisma.auditLog.create).not.toHaveBeenCalled();
+    await app.close();
+  });
+
+  it("rejects a view-all nonparticipant before unbinding a reimbursement invoice", async () => {
+    const reimbursementId = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
+    const { prisma, state } = buildPrisma({
+      invoice: {
+        id: "11111111-1111-4111-8111-111111111111",
+        status: "bound",
+        linked_reimbursement_id: reimbursementId,
+        linked_item_id: "item-1",
+        travel_order_id: null,
+        total_amount: "1683.00",
+      },
+      reimbursement: {
+        id: reimbursementId,
+        owner_id: "actor-1",
+        submitter_id: "actor-1",
+        status: "draft",
+      },
+    });
+    const app = await buildApp({
+      prisma,
+      employeeId: "finance-viewer",
+      permissionCodes: ["expense.view_all"],
+    });
+
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/invoice-pool/11111111-1111-4111-8111-111111111111/unbind",
+      headers: { authorization: "Bearer test" },
+      payload: {},
+    });
+
+    expect(response.statusCode).toBe(403);
+    expect(state.invoice.status).toBe("bound");
+    expect(prisma.invoicePool.update).not.toHaveBeenCalled();
+    expect(prisma.auditLog.create).not.toHaveBeenCalled();
+    await app.close();
+  });
+
   it("adds invoice to reimbursement and auto-creates an item when no detail matches", async () => {
     const reimbursementId = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
     const { prisma, state } = buildPrisma({