hyb-oa/server/tests/unit/routes/workflow.transfer.test.js

const Fastify = require("fastify");

const { AppError } = require("../../../src/utils/AppError");
const workflowRoutes = require("../../../src/routes/workflow");

function buildTaskRow() {
  return {
    id: "11111111-1111-4111-8111-111111111111",
    instance_id: "22222222-2222-4222-8222-222222222222",
    step_id: "manager_approval",
    step_name: "经理审批",
    assignee_id: "actor-1",
    assignee_role: null,
    status: "pending",
  };
}

function buildWorkflowInstance(entityType) {
  return {
    id: "22222222-2222-4222-8222-222222222222",
    entity_type: entityType,
    entity_id: "33333333-3333-4333-8333-333333333333",
    current_step_id: "manager_approval",
    context_data: {},
    workflow_definition: {
      definition_json: {
        steps: [],
      },
    },
  };
}

function buildTarget(roleCode) {
  return {
    id: "44444444-4444-4444-8444-444444444444",
    status: "active",
    roles: [
      {
        role_code: roleCode,
      },
    ],
  };
}

function buildTx({ entityType, targetRoleCode = "manager", transferCount = 0 }) {
  return {
    $queryRaw: vi.fn().mockResolvedValue([buildTaskRow()]),
    workflowInstance: {
      findUnique: vi.fn().mockResolvedValue(buildWorkflowInstance(entityType)),
    },
    employee: {
      findUnique: vi.fn().mockResolvedValue(buildTarget(targetRoleCode)),
    },
    workflowTask: {
      update: vi.fn().mockResolvedValue({ id: "11111111-1111-4111-8111-111111111111" }),
    },
    workflowHistory: {
      count: vi.fn().mockResolvedValue(transferCount),
      create: vi.fn().mockResolvedValue({ id: "history-1" }),
    },
    approvalTransfer: {
      create: vi.fn().mockResolvedValue({ id: "transfer-1" }),
    },
  };
}

function buildPrisma(tx) {
  return {
    $transaction: vi.fn().mockImplementation((callback) => callback(tx)),
  };
}

async function buildApp({ prisma, employee }) {
  const app = Fastify();

  app.decorate("prisma", prisma);
  app.decorate("config", {});
  app.decorate("authenticate", async (request) => {
    if (!request.headers.authorization) {
      throw new AppError({
        code: "AUTH_001",
        message: "未登录",
        statusCode: 401,
      });
    }

    request.employee = employee;
  });
  app.decorate("hasPermission", (actor, permissionCode) => {
    return (actor?.permissionCodes ?? []).includes("*") || (actor?.permissionCodes ?? []).includes(permissionCode);
  });
  app.decorate("requirePermission", (permissionCode) => async (request) => {
    await app.authenticate(request);
    if (!app.hasPermission(request.employee, permissionCode)) {
      throw new AppError({
        code: "PERM_001",
        message: "无权限",
        statusCode: 403,
        details: { permission: permissionCode },
      });
    }
  });

  app.setErrorHandler((error, request, reply) => {
    if (error instanceof AppError) {
      return reply.status(error.statusCode).send({
        requestId: request.id,
        error: {
          code: error.code,
          message: error.message,
          details: error.details ?? {},
        },
      });
    }

    return reply.status(500).send({
      requestId: request.id,
      error: { code: "SYS_001", message: "服务器内部错误", details: {} },
    });
  });

  await app.register(workflowRoutes, { prefix: "/api" });
  return app;
}

describe("workflow transfer route", () => {
  it.each(["leave", "purchase_request", "travel_request"])(
    "allows transfer for %s when target has matching approve permission",
    async (entityType) => {
      const tx = buildTx({ entityType });
      const app = await buildApp({
        prisma: buildPrisma(tx),
        employee: {
          id: "actor-1",
          roleCodes: [],
          permissionCodes: ["expense.transfer"],
        },
      });

      const response = await app.inject({
        method: "POST",
        url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
        headers: { authorization: "Bearer test" },
        payload: {
          toApproverId: "44444444-4444-4444-8444-444444444444",
          reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
        },
      });

      expect(response.statusCode).toBe(200);
      expect(response.json().data).toEqual(
        expect.objectContaining({
          outcome: "transferred",
          toApproverId: "44444444-4444-4444-8444-444444444444",
          transferCount: 1,
          transferId: null,
        }),
      );
      expect(tx.workflowTask.update).toHaveBeenCalledWith(
        expect.objectContaining({
          where: { id: buildTaskRow().id },
          data: expect.objectContaining({
            assignee_id: "44444444-4444-4444-8444-444444444444",
            assignee_role: null,
          }),
        }),
      );
      expect(tx.workflowHistory.create).toHaveBeenCalledWith(
        expect.objectContaining({
          data: expect.objectContaining({
            action: "transfer",
            payload: expect.objectContaining({
              to_approver_id: "44444444-4444-4444-8444-444444444444",
              transfer_count: 1,
            }),
          }),
        }),
      );
      expect(tx.approvalTransfer.create).not.toHaveBeenCalled();

      await app.close();
    },
  );

  it("rejects target approver without matching entity approve permission", async () => {
    const tx = buildTx({ entityType: "leave", targetRoleCode: "finance" });
    const app = await buildApp({
      prisma: buildPrisma(tx),
      employee: {
        id: "actor-1",
        roleCodes: [],
        permissionCodes: ["expense.transfer"],
      },
    });

    const response = await app.inject({
      method: "POST",
      url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
      headers: { authorization: "Bearer test" },
      payload: {
        toApproverId: "44444444-4444-4444-8444-444444444444",
        reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
      },
    });

    expect(response.statusCode).toBe(409);
    expect(response.json().error).toEqual(
      expect.objectContaining({
        code: "VALID_001",
        details: expect.objectContaining({
          toApproverId: "target_not_approver",
        }),
      }),
    );
    expect(tx.workflowTask.update).not.toHaveBeenCalled();

    await app.close();
  });

  it("returns WORKFLOW_003 when transfer chain exceeds limit", async () => {
    const tx = buildTx({ entityType: "leave", transferCount: 3 });
    const app = await buildApp({
      prisma: buildPrisma(tx),
      employee: {
        id: "actor-1",
        roleCodes: [],
        permissionCodes: ["expense.transfer"],
      },
    });

    const response = await app.inject({
      method: "POST",
      url: `/api/workflow/tasks/${buildTaskRow().id}/transfer`,
      headers: { authorization: "Bearer test" },
      payload: {
        toApproverId: "44444444-4444-4444-8444-444444444444",
        reason: "当前事项需转交对应审批人继续处理，请及时跟进。",
      },
    });

    expect(response.statusCode).toBe(409);
    expect(response.json().error).toEqual(
      expect.objectContaining({
        code: "WORKFLOW_003",
        details: expect.objectContaining({
          transfer: "chain_limit_exceeded",
        }),
      }),
    );
    expect(tx.workflowTask.update).not.toHaveBeenCalled();
    expect(tx.workflowHistory.create).not.toHaveBeenCalled();

    await app.close();
  });
});