X-Financial/web/tests/accessControl.test.mjs

import assert from 'node:assert/strict'
import test from 'node:test'

import {
  canApproveLeaderExpenseClaims,
  canAccessAppView,
  canDeleteArchivedExpenseClaims,
  canManageExpenseClaims,
  canReturnExpenseClaims
} from '../src/utils/accessControl.js'
import { canProcessApprovalRequest } from '../src/utils/approvalInbox.js'

test('direct approvers can return claims without receiving delete permissions', () => {
  const managerUser = { roleCodes: ['manager'] }
  const approverUser = { roleCodes: ['approver'] }

  assert.equal(canReturnExpenseClaims(managerUser), true)
  assert.equal(canReturnExpenseClaims(approverUser), true)
  assert.equal(canApproveLeaderExpenseClaims(managerUser), true)
  assert.equal(canApproveLeaderExpenseClaims(approverUser), true)
  assert.equal(canManageExpenseClaims(managerUser), false)
  assert.equal(canManageExpenseClaims(approverUser), false)
})

test('finance can return and final approve, but only executives can manage delete permissions', () => {
  assert.equal(canReturnExpenseClaims({ roleCodes: ['finance'] }), true)
  assert.equal(canApproveLeaderExpenseClaims({ roleCodes: ['finance'] }), false)
  assert.equal(canManageExpenseClaims({ roleCodes: ['finance'] }), false)
  assert.equal(canReturnExpenseClaims({ roleCodes: ['executive'] }), true)
  assert.equal(canManageExpenseClaims({ roleCodes: ['executive'] }), true)
})

test('archived claims can only be deleted by admin users', () => {
  assert.equal(canDeleteArchivedExpenseClaims({ roleCodes: ['executive'] }), false)
  assert.equal(canDeleteArchivedExpenseClaims({ roleCodes: ['finance'] }), false)
  assert.equal(canDeleteArchivedExpenseClaims({ isAdmin: true, roleCodes: ['manager'] }), true)
})

test('legacy reimbursement approval and archive centers are no longer accessible app views', () => {
  const adminUser = { isAdmin: true, roleCodes: ['manager', 'finance'] }

  assert.equal(canAccessAppView(adminUser, 'requests'), false)
  assert.equal(canAccessAppView(adminUser, 'approval'), false)
  assert.equal(canAccessAppView(adminUser, 'archive'), false)
  assert.equal(canAccessAppView(adminUser, 'documents'), true)
})

test('finance approval inbox only processes finance-stage requests', () => {
  const financeUser = { roleCodes: ['finance'], name: '财务' }

  assert.equal(
    canProcessApprovalRequest({ workflowNode: '财务审批', person: '张三' }, financeUser),
    true
  )
  assert.equal(
    canProcessApprovalRequest({ workflowNode: '直属领导审批', person: '张三' }, financeUser),
    false
  )
})

test('users with both finance and manager roles can process both relevant stages', () => {
  const financeManagerUser = { roleCodes: ['finance', 'manager'], name: '李经理' }

  assert.equal(
    canProcessApprovalRequest({ workflowNode: '财务审批', person: '张三' }, financeManagerUser),
    true
  )
  assert.equal(
    canProcessApprovalRequest({ workflowNode: '直属领导审批', person: '张三' }, financeManagerUser),
    true
  )
})