const { z } = require("zod"); const { FEATURE_FLAG_KEYS, evaluateFeatureFlag } = require("../services/featureFlags"); const { currentDateString } = require("../utils/date"); const { AppError } = require("../utils/AppError"); const { sendData } = require("../utils/reply"); const { buildAuditLogData } = require("../utils/audit"); const UUID_SCHEMA = z.string().uuid(); const DATE_SCHEMA = z.string().regex(/^\d{4}-\d{2}-\d{2}$/); const CYCLE_TYPE_SCHEMA = z.enum(["monthly", "quarterly", "semi_annual", "annual"]); const CYCLE_STATUS_SCHEMA = z.enum(["draft", "active", "completed"]); const DIMENSION_TYPE_SCHEMA = z.enum([ "work_quality", "work_efficiency", "teamwork", "initiative", "professional_skill", ]); const SCORE_SCHEMA = z .number() .min(1) .max(5) .refine((value) => Number.isFinite(value) && Math.abs(value * 2 - Math.round(value * 2)) < 1e-9, { message: "invalid_score_step", }); const PERFORMANCE_MANAGE_PERMISSION = "system.settings"; const CYCLE_CREATE_SCHEMA = z .object({ name: z.string().trim().min(1).max(200), cycleType: CYCLE_TYPE_SCHEMA, startDate: DATE_SCHEMA, endDate: DATE_SCHEMA, }) .strict(); const CYCLE_PATCH_SCHEMA = z .object({ name: z.string().trim().min(1).max(200).optional(), cycleType: CYCLE_TYPE_SCHEMA.optional(), startDate: DATE_SCHEMA.optional(), endDate: DATE_SCHEMA.optional(), status: CYCLE_STATUS_SCHEMA.optional(), }) .strict() .refine((value) => Object.keys(value).length > 0, { message: "empty_patch" }); const REVIEW_UPSERT_SCHEMA = z .object({ overallScore: SCORE_SCHEMA, comment: z.string().trim().max(3000).nullable().optional(), dimensions: z .array( z .object({ dimensionType: DIMENSION_TYPE_SCHEMA, score: SCORE_SCHEMA, }) .strict(), ) .max(5) .optional() .default([]), }) .strict() .superRefine((value, ctx) => { const seen = new Set(); value.dimensions.forEach((item, index) => { if (seen.has(item.dimensionType)) { ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["dimensions", index, "dimensionType"], message: "duplicate_dimension", }); return; } seen.add(item.dimensionType); }); }); const EMPLOYEE_SUMMARY_SELECT = { id: true, employee_no: true, name: true, title: true, status: true, direct_manager_id: true, avatar_path: true, department: { select: { id: true, name: true } }, }; const REVIEW_DETAIL_INCLUDE = { dimensions: true, reviewer_employee: { select: { id: true, employee_no: true, name: true, }, }, }; const DIMENSION_ORDER = ["work_quality", "work_efficiency", "teamwork", "initiative", "professional_skill"]; function buildValidationError(details, statusCode = 400) { return new AppError({ code: "VALID_001", message: "参数校验失败", statusCode, details }); } function parseId(value) { const parsed = UUID_SCHEMA.safeParse(value); if (!parsed.success) { throw buildValidationError({ id: "invalid_uuid" }); } return parsed.data; } function parseBody(schema, body) { const parsed = schema.safeParse(body ?? {}); if (!parsed.success) { throw buildValidationError(parsed.error.flatten()); } return parsed.data; } function parseDateOnly(value) { return value ? new Date(`${value}T00:00:00.000Z`) : null; } function buildAvatarUrl(employeeId, avatarPath) { return avatarPath ? `/api/avatars/${employeeId}` : null; } function toNumber(value) { return value == null ? null : Number(value); } function validateCycleDates(startDate, endDate) { if (startDate && endDate && startDate > endDate) { throw buildValidationError({ endDate: "must_be_after_or_equal_startDate" }); } } async function ensureFeatureEnabled(fastify, request) { const gate = await evaluateFeatureFlag({ prisma: fastify.prisma, config: fastify.config, flagKey: FEATURE_FLAG_KEYS.employeeLifecycle, departmentId: request.employee.department_id ?? null, strictDepartment: false, }); if (!gate.enabled) { throw buildValidationError({ featureFlag: "employee_lifecycle_v1_disabled", reason: gate.reason }, 409); } } function mapEmployeeSummary(employee) { return { id: employee.id, employeeNo: employee.employee_no, name: employee.name, title: employee.title, status: employee.status, avatarUrl: buildAvatarUrl(employee.id, employee.avatar_path), department: employee.department ? { id: employee.department.id, name: employee.department.name } : null, }; } function mapCycle(cycle) { return { id: cycle.id, name: cycle.name, cycleType: cycle.cycle_type, status: cycle.status, startDate: cycle.start_date?.toISOString?.()?.slice(0, 10) ?? null, endDate: cycle.end_date?.toISOString?.()?.slice(0, 10) ?? null, activatedAt: cycle.activated_at?.toISOString?.() ?? null, completedAt: cycle.completed_at?.toISOString?.() ?? null, createdAt: cycle.created_at?.toISOString?.() ?? null, createdBy: cycle.created_by ?? null, updatedAt: cycle.updated_at?.toISOString?.() ?? null, updatedBy: cycle.updated_by ?? null, }; } function mapReview(review) { return { id: review.id, cycleId: review.cycle_id, employeeId: review.employee_id, reviewerEmployeeId: review.reviewer_employee_id, overallScore: toNumber(review.overall_score), comment: review.comment ?? null, reviewer: review.reviewer_employee ? { id: review.reviewer_employee.id, employeeNo: review.reviewer_employee.employee_no, name: review.reviewer_employee.name, } : null, dimensions: [...(review.dimensions ?? [])] .sort((left, right) => DIMENSION_ORDER.indexOf(left.dimension_type) - DIMENSION_ORDER.indexOf(right.dimension_type)) .map((item) => ({ dimensionType: item.dimension_type, score: toNumber(item.score), })), createdAt: review.created_at?.toISOString?.() ?? null, createdBy: review.created_by ?? null, updatedAt: review.updated_at?.toISOString?.() ?? null, updatedBy: review.updated_by ?? null, }; } function resolveViewerRole(fastify, request, employee) { if (fastify.hasPermission(request.employee, PERFORMANCE_MANAGE_PERMISSION)) { return "admin"; } return null; } async function ensureCycleExists(prisma, cycleId) { const cycle = await prisma.performanceReviewCycle.findUnique({ where: { id: cycleId } }); if (!cycle) { throw new AppError({ code: "SYS_404", message: "Not Found", statusCode: 404 }); } return cycle; } async function ensureEmployeeExists(prisma, employeeId) { const employee = await prisma.employee.findUnique({ where: { id: employeeId }, select: EMPLOYEE_SUMMARY_SELECT, }); if (!employee) { throw new AppError({ code: "SYS_404", message: "Not Found", statusCode: 404 }); } return employee; } async function ensureNoOtherActiveCycle(prisma, excludedCycleId = null) { const existing = await prisma.performanceReviewCycle.findFirst({ where: { status: "active", ...(excludedCycleId ? { id: { not: excludedCycleId } } : {}), }, }); if (existing) { throw buildValidationError({ cycle: "active_cycle_exists", activeCycleId: existing.id }, 409); } } async function lockCycleForUpdate(prisma, cycleId) { if (typeof prisma.$queryRaw === "function") { const rows = await prisma.$queryRaw` SELECT "id", "status" FROM "performance_review_cycles" WHERE "id" = ${cycleId}::uuid FOR UPDATE `; if (!rows.length) { throw new AppError({ code: "SYS_404", message: "Not Found", statusCode: 404 }); } return rows[0]; } return ensureCycleExists(prisma, cycleId); } function isPrismaUniqueConstraintError(error) { return Boolean(error && typeof error === "object" && "code" in error && error.code === "P2002"); } function sortCycles(items) { const rank = { active: 0, draft: 1, completed: 2 }; return [...items].sort((left, right) => { const rankDiff = (rank[left.status] ?? 9) - (rank[right.status] ?? 9); if (rankDiff !== 0) return rankDiff; const leftDate = left.endDate ?? left.startDate ?? ""; const rightDate = right.endDate ?? right.startDate ?? ""; return rightDate.localeCompare(leftDate) || String(right.name ?? "").localeCompare(String(left.name ?? "")); }); } function sortEmployeeItems(items) { return [...items].sort((left, right) => { const leftDepartment = left.employee.department?.name ?? ""; const rightDepartment = right.employee.department?.name ?? ""; return ( leftDepartment.localeCompare(rightDepartment) || left.employee.employeeNo.localeCompare(right.employee.employeeNo) || left.employee.name.localeCompare(right.employee.name) ); }); } async function buildCycleOverview(prisma, cycle) { const reviews = await prisma.performanceReview.findMany({ where: { cycle_id: cycle.id }, include: { ...REVIEW_DETAIL_INCLUDE, employee: { select: EMPLOYEE_SUMMARY_SELECT, }, }, }); const reviewByEmployeeId = new Map(reviews.map((item) => [item.employee_id, item])); if (cycle.status === "completed") { return sortEmployeeItems( reviews.map((item) => ({ employee: mapEmployeeSummary(item.employee), review: mapReview(item), })), ); } const activeEmployees = await prisma.employee.findMany({ where: { status: "active" }, select: EMPLOYEE_SUMMARY_SELECT, }); const items = activeEmployees.map((employee) => ({ employee: mapEmployeeSummary(employee), review: reviewByEmployeeId.has(employee.id) ? mapReview(reviewByEmployeeId.get(employee.id)) : null, })); for (const review of reviews) { if (!items.some((item) => item.employee.id === review.employee_id)) { items.push({ employee: mapEmployeeSummary(review.employee), review: mapReview(review), }); } } return sortEmployeeItems(items); } async function buildEmployeeTimeline(prisma, employeeId, viewerRole) { const cycles = await prisma.performanceReviewCycle.findMany({ where: viewerRole === "self" ? { status: "completed", } : { status: { in: ["active", "completed"], }, }, }); if (!cycles.length) { return []; } const reviews = await prisma.performanceReview.findMany({ where: { employee_id: employeeId, cycle_id: { in: cycles.map((item) => item.id) }, }, include: REVIEW_DETAIL_INCLUDE, }); const reviewByCycleId = new Map(reviews.map((item) => [item.cycle_id, item])); const items = cycles .map((cycle) => ({ cycle: mapCycle(cycle), review: reviewByCycleId.has(cycle.id) ? mapReview(reviewByCycleId.get(cycle.id)) : null, canEdit: viewerRole !== "self" && cycle.status === "active", })) .filter((item) => (viewerRole === "self" ? Boolean(item.review) : true)); return sortCycles(items.map((item) => ({ ...item, status: item.cycle.status, endDate: item.cycle.endDate, startDate: item.cycle.startDate }))).map( ({ status, endDate, startDate, ...item }) => item, ); } async function performanceRoutes(fastify) { fastify.get("/performance/cycles", { preHandler: fastify.authenticate }, async (request, reply) => { await ensureFeatureEnabled(fastify, request); if (!fastify.hasPermission(request.employee, PERFORMANCE_MANAGE_PERMISSION)) { throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: PERFORMANCE_MANAGE_PERMISSION } }); } const cycles = await fastify.prisma.performanceReviewCycle.findMany(); return sendData(reply, request, { items: sortCycles(cycles.map(mapCycle)), }); }); fastify.post("/performance/cycles", { preHandler: fastify.authenticate }, async (request, reply) => { await ensureFeatureEnabled(fastify, request); if (!fastify.hasPermission(request.employee, PERFORMANCE_MANAGE_PERMISSION)) { throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: PERFORMANCE_MANAGE_PERMISSION } }); } const body = parseBody(CYCLE_CREATE_SCHEMA, request.body); validateCycleDates(body.startDate, body.endDate); const cycle = await fastify.prisma.performanceReviewCycle.create({ data: { name: body.name, cycle_type: body.cycleType, start_date: parseDateOnly(body.startDate), end_date: parseDateOnly(body.endDate), created_by: request.employee.id, updated_by: request.employee.id, }, }); await fastify.prisma.auditLog.create({ data: buildAuditLogData(request, { actorId: request.employee.id, action: "PERFORMANCE_REVIEW_CYCLE_CREATED", targetType: "performance_review_cycle", targetId: cycle.id, extra: { status: cycle.status }, }), }); return sendData(reply, request, mapCycle(cycle)); }); fastify.patch("/performance/cycles/:cycleId", { preHandler: fastify.authenticate }, async (request, reply) => { await ensureFeatureEnabled(fastify, request); if (!fastify.hasPermission(request.employee, PERFORMANCE_MANAGE_PERMISSION)) { throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: PERFORMANCE_MANAGE_PERMISSION } }); } const cycleId = parseId(request.params?.cycleId); const body = parseBody(CYCLE_PATCH_SCHEMA, request.body); const current = await ensureCycleExists(fastify.prisma, cycleId); const nextStartDate = body.startDate ?? current.start_date?.toISOString?.()?.slice(0, 10) ?? null; const nextEndDate = body.endDate ?? current.end_date?.toISOString?.()?.slice(0, 10) ?? null; validateCycleDates(nextStartDate, nextEndDate); if (current.status === "completed") { throw buildValidationError({ cycle: "completed_cycle_locked" }, 409); } let action = "PERFORMANCE_REVIEW_CYCLE_UPDATED"; let data; if (current.status === "active") { const invalidKeys = Object.keys(body).filter((key) => key !== "status"); if (invalidKeys.length > 0 || body.status !== "completed") { throw buildValidationError({ cycle: "active_cycle_only_supports_complete" }, 409); } action = "PERFORMANCE_REVIEW_CYCLE_COMPLETED"; data = { status: "completed", completed_at: new Date(), updated_by: request.employee.id, }; } else { if (body.status === "completed") { throw buildValidationError({ cycle: "draft_cycle_cannot_complete_directly" }, 409); } if (body.status === "active") { await ensureNoOtherActiveCycle(fastify.prisma, cycleId); action = "PERFORMANCE_REVIEW_CYCLE_ACTIVATED"; } data = { ...(body.name !== undefined ? { name: body.name } : {}), ...(body.cycleType !== undefined ? { cycle_type: body.cycleType } : {}), ...(body.startDate !== undefined ? { start_date: parseDateOnly(body.startDate) } : {}), ...(body.endDate !== undefined ? { end_date: parseDateOnly(body.endDate) } : {}), ...(body.status !== undefined ? { status: body.status } : {}), ...(body.status === "active" ? { activated_at: new Date() } : {}), updated_by: request.employee.id, }; } let cycle; try { cycle = await fastify.prisma.performanceReviewCycle.update({ where: { id: cycleId }, data, }); } catch (error) { if (body.status === "active" && isPrismaUniqueConstraintError(error)) { throw buildValidationError({ cycle: "active_cycle_exists" }, 409); } throw error; } await fastify.prisma.auditLog.create({ data: buildAuditLogData(request, { actorId: request.employee.id, action, targetType: "performance_review_cycle", targetId: cycle.id, extra: { status: cycle.status }, }), }); return sendData(reply, request, mapCycle(cycle)); }); fastify.get("/performance/cycles/:cycleId/reviews", { preHandler: fastify.authenticate }, async (request, reply) => { await ensureFeatureEnabled(fastify, request); if (!fastify.hasPermission(request.employee, PERFORMANCE_MANAGE_PERMISSION)) { throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: PERFORMANCE_MANAGE_PERMISSION } }); } const cycleId = parseId(request.params?.cycleId); const cycle = await ensureCycleExists(fastify.prisma, cycleId); const items = await buildCycleOverview(fastify.prisma, cycle); return sendData(reply, request, { cycle: mapCycle(cycle), items, }); }); fastify.get("/performance/employees/:employeeId/reviews", { preHandler: fastify.authenticate }, async (request, reply) => { await ensureFeatureEnabled(fastify, request); const employeeId = parseId(request.params?.employeeId); const employee = await ensureEmployeeExists(fastify.prisma, employeeId); const viewerRole = resolveViewerRole(fastify, request, employee); if (!viewerRole) { throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: "performance.review.view" }, }); } const items = await buildEmployeeTimeline(fastify.prisma, employeeId, viewerRole); return sendData(reply, request, { employee: mapEmployeeSummary(employee), viewerRole, items, }); }); fastify.put("/performance/cycles/:cycleId/reviews/:employeeId", { preHandler: fastify.authenticate }, async (request, reply) => { await ensureFeatureEnabled(fastify, request); const cycleId = parseId(request.params?.cycleId); const employeeId = parseId(request.params?.employeeId); const body = parseBody(REVIEW_UPSERT_SCHEMA, request.body); const employee = await ensureEmployeeExists(fastify.prisma, employeeId); const viewerRole = resolveViewerRole(fastify, request, employee); if (viewerRole !== "admin" && viewerRole !== "manager") { throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: "performance.review.write" }, }); } if (employee.status !== "active") { throw buildValidationError({ employee: "inactive_employee_not_reviewable" }, 409); } await ensureCycleExists(fastify.prisma, cycleId); const savedReview = await fastify.prisma.$transaction(async (tx) => { const lockedCycle = await lockCycleForUpdate(tx, cycleId); if (lockedCycle.status !== "active") { throw buildValidationError({ cycle: "active_cycle_required" }, 409); } const existing = await tx.performanceReview.findFirst({ where: { cycle_id: cycleId, employee_id: employeeId, }, include: REVIEW_DETAIL_INCLUDE, }); const payload = { reviewer_employee_id: request.employee.id, overall_score: body.overallScore, comment: body.comment?.trim() ? body.comment.trim() : null, updated_by: request.employee.id, }; let reviewId = existing?.id ?? null; if (existing) { await tx.performanceReview.update({ where: { id: existing.id }, data: payload, }); } else { const created = await tx.performanceReview.create({ data: { cycle_id: cycleId, employee_id: employeeId, ...payload, created_by: request.employee.id, }, }); reviewId = created.id; } await tx.performanceReviewDimension.deleteMany({ where: { review_id: reviewId }, }); if (body.dimensions.length > 0) { await tx.performanceReviewDimension.createMany({ data: body.dimensions.map((item) => ({ review_id: reviewId, dimension_type: item.dimensionType, score: item.score, })), }); } return tx.performanceReview.findUnique({ where: { id: reviewId }, include: REVIEW_DETAIL_INCLUDE, }); }); await fastify.prisma.auditLog.create({ data: buildAuditLogData(request, { actorId: request.employee.id, action: "PERFORMANCE_REVIEW_UPSERTED", targetType: "performance_review", targetId: savedReview.id, extra: { cycleId, employeeId, reviewerRole: viewerRole, }, }), }); return sendData(reply, request, mapReview(savedReview)); }); } module.exports = performanceRoutes; module.exports.__testables = { buildCycleOverview, buildEmployeeTimeline, buildValidationError, mapCycle, mapEmployeeSummary, mapReview, resolveViewerRole, sortCycles, };