hyb-oa/server/tests/unit/routes/payroll.items.test.js

const Fastify = require("fastify");

const payrollRoutes = require("../../../src/routes/payroll");
const { AppError } = require("../../../src/utils/AppError");

const ADMIN_ID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";

function buildSalaryItem(overrides = {}) {
  return {
    id: "11111111-1111-4111-8111-111111111111",
    name: "基本工资",
    item_type: "earning",
    sort_order: 10,
    enabled: true,
    created_at: new Date("2026-03-29T08:00:00.000Z"),
    created_by: ADMIN_ID,
    updated_at: new Date("2026-03-29T08:00:00.000Z"),
    updated_by: ADMIN_ID,
    ...overrides,
  };
}

async function buildApp({
  actor = { id: ADMIN_ID, permissionCodes: ["payroll.manage"] },
} = {}) {
  const app = Fastify();
  const state = {
    salaryItems: [buildSalaryItem()],
  };

  const salaryItem = {
    findMany: vi.fn(async () => [...state.salaryItems].sort((left, right) => left.sort_order - right.sort_order)),
    findUnique: vi.fn(async ({ where }) => state.salaryItems.find((item) => item.id === where.id) ?? null),
    create: vi.fn(async ({ data }) => {
      const item = buildSalaryItem({
        id: "22222222-2222-4222-8222-222222222222",
        name: data.name,
        item_type: data.item_type,
        sort_order: data.sort_order,
        enabled: data.enabled,
        created_by: data.created_by,
        updated_by: data.updated_by,
      });
      state.salaryItems.push(item);
      return item;
    }),
    update: vi.fn(async ({ where, data }) => {
      const index = state.salaryItems.findIndex((item) => item.id === where.id);
      state.salaryItems[index] = {
        ...state.salaryItems[index],
        ...data,
      };
      return state.salaryItems[index];
    }),
  };

  app.decorate("authenticate", async (request) => {
    request.employee = actor;
  });
  app.decorate("requirePermission", (permissionCode) => async (request) => {
    request.employee = actor;
    const codes = actor.permissionCodes ?? [];
    if (!codes.includes("*") && !codes.includes(permissionCode)) {
      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
    }
  });
  app.decorate("hasPermission", (employee, permissionCode) => {
    const codes = employee.permissionCodes ?? [];
    return codes.includes("*") || codes.includes(permissionCode);
  });
  app.decorate("prisma", {
    salaryItem,
    auditLog: {
      create: vi.fn().mockResolvedValue({}),
    },
  });
  app.setErrorHandler((error, request, reply) => {
    reply.status(error.statusCode || 500).send({
      requestId: request.id,
      error: {
        code: error.code || "SYS_001",
        message: error.message,
        details: error.details ?? null,
      },
    });
  });

  await app.register(payrollRoutes, { prefix: "/api" });
  return { app, state, salaryItem };
}

describe("payroll salary item routes", () => {
  it("allows payroll managers to create, list and patch salary items", async () => {
    const { app, state, salaryItem } = await buildApp();

    const createResponse = await app.inject({
      method: "POST",
      url: "/api/payroll/items",
      payload: {
        name: "岗位津贴",
        itemType: "earning",
        sortOrder: 20,
      },
    });

    expect(createResponse.statusCode).toBe(200);
    expect(createResponse.json().data).toMatchObject({
      name: "岗位津贴",
      itemType: "earning",
      sortOrder: 20,
      enabled: true,
    });

    const patchResponse = await app.inject({
      method: "PATCH",
      url: `/api/payroll/items/${state.salaryItems[1].id}`,
      payload: {
        itemType: "deduction",
        enabled: false,
      },
    });

    expect(patchResponse.statusCode).toBe(200);
    expect(patchResponse.json().data).toMatchObject({
      name: "岗位津贴",
      itemType: "deduction",
      enabled: false,
    });

    const listResponse = await app.inject({
      method: "GET",
      url: "/api/payroll/items",
    });

    expect(listResponse.statusCode).toBe(200);
    expect(listResponse.json().data.items).toHaveLength(2);
    expect(salaryItem.create).toHaveBeenCalledTimes(1);
    expect(salaryItem.update).toHaveBeenCalledTimes(1);

    await app.close();
  });

  it("rejects non-admin users", async () => {
    const { app } = await buildApp({
      actor: {
        id: "employee-1",
        permissionCodes: ["employee"],
      },
    });

    const response = await app.inject({
      method: "GET",
      url: "/api/payroll/items",
    });

    expect(response.statusCode).toBe(403);

    await app.close();
  });

  it("does not accept system.settings as a substitute for payroll.manage", async () => {
    const { app } = await buildApp({
      actor: {
        id: "system-admin-1",
        permissionCodes: ["system.settings", "system.accounts.manage"],
      },
    });

    const response = await app.inject({ method: "GET", url: "/api/payroll/items" });

    expect(response.statusCode).toBe(403);
    await app.close();
  });
});

describe("salary item reasons", () => {
  it.each([
    ["POST", "/api/payroll/items", {}, "payroll.item_create_input_invalid"],
    ["PATCH", "/api/payroll/items/11111111-1111-4111-8111-111111111111", {}, "payroll.item_update_input_invalid"],
    ["PATCH", "/api/payroll/items/invalid", { enabled: false }, "payroll.id_invalid"],
  ])("explains %s %s before business access", async (method, url, payload, reasonCode) => {
    const { app, salaryItem } = await buildApp();
    try {
      const response = await app.inject({ method, url, payload });
      expect(response.statusCode).toBe(400);
      expect(response.json().error).toMatchObject({ code: "VALID_001", details: { reasonCode } });
      if (reasonCode === "payroll.id_invalid") expect(response.json().error.details).toEqual({ id: "invalid_uuid", reasonCode });
      for (const fn of Object.values(salaryItem)) expect(fn).not.toHaveBeenCalled();
      expect(app.prisma.auditLog.create).not.toHaveBeenCalled();
    } finally { await app.close(); }
  });
  it.each(["POST", "PATCH"])("explains %s duplicate name without success audit", async (method) => {
    const { app, salaryItem } = await buildApp();
    const mutation = method === "POST" ? salaryItem.create : salaryItem.update;
    mutation.mockRejectedValueOnce(Object.assign(new Error("synthetic uniqueness failure"), { code: "P2002" }));
    try {
      const response = await app.inject({ method, url: method === "POST" ? "/api/payroll/items" : "/api/payroll/items/11111111-1111-4111-8111-111111111111", payload: { name: "合成薪资项", itemType: "earning", sortOrder: 1 } });
      expect(response.statusCode).toBe(400);
      expect(response.json().error.details).toEqual({ name: "duplicate", reasonCode: "payroll.item_name_duplicate" });
      expect(app.prisma.auditLog.create).not.toHaveBeenCalled();
    } finally { await app.close(); }
  });
});