const Fastify = require("fastify"); const { AppError } = require("../../../src/utils/AppError"); const workflowRoutes = require("../../../src/routes/workflow"); function buildTaskRow() { return { id: "11111111-1111-4111-8111-111111111111", instance_id: "22222222-2222-4222-8222-222222222222", step_id: "manager_approval", step_name: "经理审批", assignee_id: "actor-1", assignee_role: null, status: "pending", }; } function buildWorkflowInstance(entityType) { return { id: "22222222-2222-4222-8222-222222222222", entity_type: entityType, entity_id: "33333333-3333-4333-8333-333333333333", current_step_id: "manager_approval", context_data: {}, workflow_definition: { definition_json: { steps: [], }, }, }; } function buildTarget(roleCode) { return { id: "44444444-4444-4444-8444-444444444444", status: "active", roles: [ { role_code: roleCode, }, ], }; } function buildTx({ entityType, targetRoleCode = "manager", transferCount = 0 }) { return { $queryRaw: vi.fn().mockResolvedValue([buildTaskRow()]), workflowInstance: { findUnique: vi.fn().mockResolvedValue(buildWorkflowInstance(entityType)), }, employee: { findUnique: vi.fn().mockResolvedValue(buildTarget(targetRoleCode)), }, workflowTask: { update: vi.fn().mockResolvedValue({ id: "11111111-1111-4111-8111-111111111111" }), }, workflowHistory: { count: vi.fn().mockResolvedValue(transferCount), create: vi.fn().mockResolvedValue({ id: "history-1" }), }, approvalTransfer: { create: vi.fn().mockResolvedValue({ id: "transfer-1" }), }, }; } function buildPrisma(tx) { return { $transaction: vi.fn().mockImplementation((callback) => callback(tx)), }; } async function buildApp({ prisma, employee }) { const app = Fastify(); app.decorate("prisma", prisma); app.decorate("config", {}); app.decorate("authenticate", async (request) => { if (!request.headers.authorization) { throw new AppError({ code: "AUTH_001", message: "未登录", statusCode: 401, }); } request.employee = employee; }); app.decorate("hasPermission", (actor, permissionCode) => { return (actor?.permissionCodes ?? []).includes("*") || (actor?.permissionCodes ?? []).includes(permissionCode); }); app.decorate("requirePermission", (permissionCode) => async (request) => { await app.authenticate(request); if (!app.hasPermission(request.employee, permissionCode)) { throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403, details: { permission: permissionCode }, }); } }); app.setErrorHandler((error, request, reply) => { if (error instanceof AppError) { return reply.status(error.statusCode).send({ requestId: request.id, error: { code: error.code, message: error.message, details: error.details ?? {}, }, }); } return reply.status(500).send({ requestId: request.id, error: { code: "SYS_001", message: "服务器内部错误", details: {} }, }); }); await app.register(workflowRoutes, { prefix: "/api" }); return app; } describe("workflow transfer route", () => { it.each(["leave", "purchase_request", "travel_request"])( "allows transfer for %s when target has matching approve permission", async (entityType) => { const tx = buildTx({ entityType }); const app = await buildApp({ prisma: buildPrisma(tx), employee: { id: "actor-1", roleCodes: [], permissionCodes: ["expense.transfer"], }, }); const response = await app.inject({ method: "POST", url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`, headers: { authorization: "Bearer test" }, payload: { toApproverId: "44444444-4444-4444-8444-444444444444", reason: "当前事项需转交对应审批人继续处理,请及时跟进。", }, }); expect(response.statusCode).toBe(200); expect(response.json().data).toEqual( expect.objectContaining({ outcome: "transferred", toApproverId: "44444444-4444-4444-8444-444444444444", transferCount: 1, transferId: null, }), ); expect(tx.workflowTask.update).toHaveBeenCalledWith( expect.objectContaining({ where: { id: buildTaskRow().id }, data: expect.objectContaining({ assignee_id: "44444444-4444-4444-8444-444444444444", assignee_role: null, }), }), ); expect(tx.workflowHistory.create).toHaveBeenCalledWith( expect.objectContaining({ data: expect.objectContaining({ action: "transfer", payload: expect.objectContaining({ to_approver_id: "44444444-4444-4444-8444-444444444444", transfer_count: 1, }), }), }), ); expect(tx.approvalTransfer.create).not.toHaveBeenCalled(); await app.close(); }, ); it("rejects target approver without matching entity approve permission", async () => { const tx = buildTx({ entityType: "leave", targetRoleCode: "finance" }); const app = await buildApp({ prisma: buildPrisma(tx), employee: { id: "actor-1", roleCodes: [], permissionCodes: ["expense.transfer"], }, }); const response = await app.inject({ method: "POST", url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`, headers: { authorization: "Bearer test" }, payload: { toApproverId: "44444444-4444-4444-8444-444444444444", reason: "当前事项需转交对应审批人继续处理,请及时跟进。", }, }); expect(response.statusCode).toBe(409); expect(response.json().error).toEqual( expect.objectContaining({ code: "VALID_001", details: expect.objectContaining({ toApproverId: "target_not_approver", }), }), ); expect(tx.workflowTask.update).not.toHaveBeenCalled(); await app.close(); }); it("returns WORKFLOW_003 when transfer chain exceeds limit", async () => { const tx = buildTx({ entityType: "leave", transferCount: 3 }); const app = await buildApp({ prisma: buildPrisma(tx), employee: { id: "actor-1", roleCodes: [], permissionCodes: ["expense.transfer"], }, }); const response = await app.inject({ method: "POST", url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`, headers: { authorization: "Bearer test" }, payload: { toApproverId: "44444444-4444-4444-8444-444444444444", reason: "当前事项需转交对应审批人继续处理,请及时跟进。", }, }); expect(response.statusCode).toBe(409); expect(response.json().error).toEqual( expect.objectContaining({ code: "WORKFLOW_003", details: expect.objectContaining({ transfer: "chain_limit_exceeded", }), }), ); expect(tx.workflowTask.update).not.toHaveBeenCalled(); expect(tx.workflowHistory.create).not.toHaveBeenCalled(); await app.close(); }); });