hyb-oa/server/tests/unit/routes/users.list.test.js

const Fastify = require("fastify");

const usersRoutes = require("../../../src/routes/users");
const { AppError } = require("../../../src/utils/AppError");

function buildEmployeeRow(overrides = {}) {
  const now = new Date("2026-03-28T10:00:00.000Z");
  return {
    id: "11111111-1111-4111-8111-111111111111",
    employee_no: "E001",
    name: "Alice",
    phone: "13800000000",
    email: "[email protected]",
    status: "active",
    department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
    title: "员工",
    created_at: now,
    updated_at: now,
    roles: [{ role_code: "employee" }],
    ...overrides,
  };
}

async function buildApp({ routeOptions = {}, employee } = {}) {
  const app = Fastify();
  const findMany = vi.fn().mockResolvedValue([buildEmployeeRow()]);
  const count = vi.fn().mockResolvedValue(1);
  const actor =
    employee ??
    {
      id: "actor-1",
      department_id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
      permissionCodes: ["system.users"],
    };

  app.decorate("prisma", {
    employee: {
      findMany,
      count,
    },
  });
  app.decorate("requirePermission", (permissionCode) => async (request) => {
    request.employee = actor;
    const permissionCodes = actor.permissionCodes ?? [];
    if (!permissionCodes.includes("*") && !permissionCodes.includes(permissionCode)) {
      throw new AppError({ code: "PERM_001", message: "无权限", statusCode: 403 });
    }
  });
  app.decorate("authenticate", async (request) => {
    request.employee = actor;
  });
  app.decorate("hasPermission", (requestEmployee, permissionCode) => {
    const permissionCodes = requestEmployee.permissionCodes ?? [];
    return permissionCodes.includes("*") || permissionCodes.includes(permissionCode);
  });
  app.decorate("config", {});

  await app.register(usersRoutes, { prefix: "/api", ...routeOptions });
  return { app, findMany, count };
}

describe("usersRoutes list query", () => {
  it("supports departmentId filter for /employees when enabled", async () => {
    const departmentId = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
    const { app, findMany, count } = await buildApp({
      routeOptions: {
        basePath: "/employees",
        allowDepartmentFilter: true,
      },
    });

    const response = await app.inject({
      method: "GET",
      url: `/api/employees?page=1&pageSize=20&departmentId=${departmentId}`,
    });

    expect(response.statusCode).toBe(200);
    expect(findMany).toHaveBeenCalledWith(
      expect.objectContaining({
        where: expect.objectContaining({
          department_id: departmentId,
        }),
      }),
    );
    expect(count).toHaveBeenCalledWith({
      where: expect.objectContaining({
        department_id: departmentId,
      }),
    });

    await app.close();
  });

  it("combines q + status + departmentId for /employees", async () => {
    const departmentId = "cccccccc-cccc-4ccc-8ccc-cccccccccccc";
    const { app, findMany } = await buildApp({
      routeOptions: {
        basePath: "/employees",
        allowDepartmentFilter: true,
      },
    });

    const response = await app.inject({
      method: "GET",
      url: `/api/employees?status=active&q=alice&departmentId=${departmentId}`,
    });

    expect(response.statusCode).toBe(200);
    expect(findMany).toHaveBeenCalledWith(
      expect.objectContaining({
        where: expect.objectContaining({
          status: "active",
          department_id: departmentId,
          AND: expect.arrayContaining([
            expect.objectContaining({
              OR: expect.arrayContaining([
                expect.objectContaining({ name: expect.any(Object) }),
                expect.objectContaining({ employee_no: expect.any(Object) }),
              ]),
            }),
          ]),
        }),
      }),
    );

    await app.close();
  });

  it("supports advanced filters and report.dashboard.view for /employees", async () => {
    const departmentId = "eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee";
    const managerId = "ffffffff-ffff-4fff-8fff-ffffffffffff";
    const { app, findMany, count } = await buildApp({
      routeOptions: {
        basePath: "/employees",
        allowDepartmentFilter: true,
        listPermissionCodes: ["system.users", "report.dashboard.view"],
      },
      employee: {
        id: "viewer-1",
        department_id: departmentId,
        permissionCodes: ["report.dashboard.view"],
      },
    });

    const response = await app.inject({
      method: "GET",
      url: `/api/employees?page=1&pageSize=20&departmentId=${departmentId}&title=%E7%BB%8F%E7%90%86&managerId=${managerId}&hireDateFrom=2026-01-01&hireDateTo=2026-01-31&employmentStatus=probation`,
    });

    expect(response.statusCode).toBe(200);
    expect(findMany).toHaveBeenCalledWith(
      expect.objectContaining({
        where: expect.objectContaining({
          department_id: departmentId,
          direct_manager_id: managerId,
          employment_status: "probation",
          hire_date: expect.objectContaining({
            gte: new Date("2026-01-01T00:00:00.000Z"),
            lte: new Date("2026-01-31T23:59:59.999Z"),
          }),
          AND: expect.arrayContaining([
            expect.objectContaining({
              title: expect.objectContaining({
                contains: "经理",
              }),
            }),
          ]),
        }),
      }),
    );
    expect(count).toHaveBeenCalledWith({
      where: expect.objectContaining({
        department_id: departmentId,
        direct_manager_id: managerId,
      }),
    });

    await app.close();
  });

  it("does not apply departmentId filter for /users", async () => {
    const departmentId = "dddddddd-dddd-4ddd-8ddd-dddddddddddd";
    const { app, findMany } = await buildApp();

    const response = await app.inject({
      method: "GET",
      url: `/api/users?departmentId=${departmentId}`,
    });

    expect(response.statusCode).toBe(200);
    const where = findMany.mock.calls[0][0].where;
    expect(where.department_id).toBeUndefined();

    await app.close();
  });
});