feat(approval): add safe risk disposition workflow
This commit is contained in:
caoxiaozhu
661
server/tests/test_risk_dispositions.py
Normal file
661
server/tests/test_risk_dispositions.py
Normal file
@@ -0,0 +1,661 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from collections.abc import Generator
|
||||
from datetime import UTC, datetime, timedelta
|
||||
from decimal import Decimal
|
||||
|
||||
import pytest
|
||||
from auth_helpers import install_legacy_header_auth_override
|
||||
from fastapi import FastAPI
|
||||
from fastapi.testclient import TestClient
|
||||
from sqlalchemy import create_engine, func, select
|
||||
from sqlalchemy.orm import Session, sessionmaker
|
||||
from sqlalchemy.pool import StaticPool
|
||||
|
||||
from app.api.deps import CurrentUserContext, get_db
|
||||
from app.api.v1.endpoints.risk_observations import router as risk_observations_router
|
||||
from app.db.base import Base
|
||||
from app.models.employee import Employee
|
||||
from app.models.financial_record import ExpenseClaim
|
||||
from app.models.risk_disposition import RiskDispositionEvent
|
||||
from app.models.risk_observation import RiskObservationFeedback
|
||||
from app.schemas.risk_disposition import RiskDispositionActionCreate
|
||||
from app.services.risk_dispositions import (
|
||||
RiskDispositionConflictError,
|
||||
RiskDispositionIdempotencyConflictError,
|
||||
RiskDispositionPermissionError,
|
||||
RiskDispositionService,
|
||||
RiskDispositionVersionConflictError,
|
||||
)
|
||||
from app.services.risk_observation_access_policy import RiskObservationAccessPolicy
|
||||
from app.services.risk_observations import RiskObservationService
|
||||
|
||||
|
||||
def test_risk_disposition_separates_adjudication_and_lifecycle_with_audit_events(
|
||||
monkeypatch: pytest.MonkeyPatch,
|
||||
) -> None:
|
||||
monkeypatch.setenv("FEW_SHOT_INJECTION_ENABLED", "false")
|
||||
with _build_session() as db:
|
||||
observation = RiskObservationService(db).upsert_observation(
|
||||
_observation_payload("risk:typed:duplicate")
|
||||
)
|
||||
db.commit()
|
||||
service = RiskDispositionService(db)
|
||||
|
||||
confirmed = service.execute_action(
|
||||
observation.id,
|
||||
_action("confirm", version=0, request_id="request-confirm-001"),
|
||||
tenant_id="default",
|
||||
actor_id="finance-1",
|
||||
actor_name="财务甲",
|
||||
)
|
||||
assert confirmed.disposition.adjudication == "confirmed"
|
||||
assert confirmed.disposition.lifecycle_status == "open"
|
||||
assert confirmed.disposition.version == 1
|
||||
assert confirmed.event.before_json["adjudication"] == "unreviewed"
|
||||
assert confirmed.event.after_json["adjudication"] == "confirmed"
|
||||
|
||||
supplemented = service.execute_action(
|
||||
observation.id,
|
||||
RiskDispositionActionCreate(
|
||||
action="request_supplement",
|
||||
expected_version=1,
|
||||
request_id="request-supplement-001",
|
||||
assignee="员工甲",
|
||||
due_at=datetime.now(UTC) + timedelta(days=2),
|
||||
comment="请补齐行程单",
|
||||
),
|
||||
tenant_id="default",
|
||||
actor_id="finance-1",
|
||||
actor_name="财务甲",
|
||||
)
|
||||
assert supplemented.disposition.adjudication == "confirmed"
|
||||
assert supplemented.disposition.lifecycle_status == "supplement_requested"
|
||||
assert supplemented.disposition.assignee == "员工甲"
|
||||
assert supplemented.disposition.version == 2
|
||||
|
||||
resolved = service.execute_action(
|
||||
observation.id,
|
||||
RiskDispositionActionCreate(
|
||||
action="resolve",
|
||||
expected_version=2,
|
||||
request_id="request-resolve-001",
|
||||
resolution="补充材料已核验，风险关闭。",
|
||||
),
|
||||
tenant_id="default",
|
||||
actor_id="finance-1",
|
||||
actor_name="财务甲",
|
||||
)
|
||||
assert resolved.disposition.adjudication == "confirmed"
|
||||
assert resolved.disposition.lifecycle_status == "resolved"
|
||||
assert resolved.disposition.resolution == "补充材料已核验，风险关闭。"
|
||||
assert resolved.disposition.version == 3
|
||||
assert db.scalar(select(func.count()).select_from(RiskDispositionEvent)) == 3
|
||||
assert db.scalar(select(func.count()).select_from(RiskObservationFeedback)) == 1
|
||||
|
||||
with pytest.raises(RiskDispositionConflictError, match="已解决"):
|
||||
service.execute_action(
|
||||
observation.id,
|
||||
_action(
|
||||
"start_remediation",
|
||||
version=3,
|
||||
request_id="request-remediation-after-resolve",
|
||||
),
|
||||
tenant_id="default",
|
||||
actor_id="finance-1",
|
||||
actor_name="财务甲",
|
||||
)
|
||||
with pytest.raises(RiskDispositionConflictError, match="已解决"):
|
||||
service.execute_action(
|
||||
observation.id,
|
||||
_action(
|
||||
"false_positive",
|
||||
version=3,
|
||||
request_id="request-readjudicate-after-resolve",
|
||||
),
|
||||
tenant_id="default",
|
||||
actor_id="finance-1",
|
||||
actor_name="财务甲",
|
||||
)
|
||||
|
||||
|
||||
def test_risk_disposition_requires_confirmation_before_remediation_or_resolution(
|
||||
monkeypatch: pytest.MonkeyPatch,
|
||||
) -> None:
|
||||
monkeypatch.setenv("FEW_SHOT_INJECTION_ENABLED", "false")
|
||||
with _build_session() as db:
|
||||
observation = RiskObservationService(db).upsert_observation(
|
||||
_observation_payload("risk:typed:transition-guard")
|
||||
)
|
||||
db.commit()
|
||||
service = RiskDispositionService(db)
|
||||
|
||||
with pytest.raises(RiskDispositionConflictError, match="必须先确认成立"):
|
||||
service.execute_action(
|
||||
observation.id,
|
||||
RiskDispositionActionCreate(
|
||||
action="resolve",
|
||||
expected_version=0,
|
||||
request_id="request-resolve-unreviewed",
|
||||
resolution="不能跳过裁决直接关闭。",
|
||||
),
|
||||
tenant_id="default",
|
||||
actor_id="finance-1",
|
||||
actor_name="财务甲",
|
||||
)
|
||||
|
||||
supplemented = service.execute_action(
|
||||
observation.id,
|
||||
RiskDispositionActionCreate(
|
||||
action="request_supplement",
|
||||
expected_version=0,
|
||||
request_id="request-supplement-unreviewed",
|
||||
comment="先补充材料再裁决。",
|
||||
),
|
||||
tenant_id="default",
|
||||
actor_id="finance-1",
|
||||
actor_name="财务甲",
|
||||
)
|
||||
assert supplemented.disposition.adjudication == "unreviewed"
|
||||
assert supplemented.disposition.lifecycle_status == "supplement_requested"
|
||||
|
||||
|
||||
def test_risk_disposition_imports_legacy_confirmation_before_first_typed_action(
|
||||
monkeypatch: pytest.MonkeyPatch,
|
||||
) -> None:
|
||||
monkeypatch.setenv("FEW_SHOT_INJECTION_ENABLED", "false")
|
||||
with _build_session() as db:
|
||||
observation = RiskObservationService(db).upsert_observation(
|
||||
_observation_payload("risk:typed:legacy-confirmed")
|
||||
)
|
||||
observation.status = "confirmed"
|
||||
observation.feedback_status = "confirmed"
|
||||
db.commit()
|
||||
|
||||
resolved = RiskDispositionService(db).execute_action(
|
||||
observation.id,
|
||||
RiskDispositionActionCreate(
|
||||
action="resolve",
|
||||
expected_version=0,
|
||||
request_id="request-resolve-legacy-confirmed",
|
||||
resolution="历史确认风险已完成整改。",
|
||||
),
|
||||
tenant_id="default",
|
||||
actor_id="finance-1",
|
||||
actor_name="财务甲",
|
||||
)
|
||||
|
||||
assert resolved.event.before_json["adjudication"] == "confirmed"
|
||||
assert resolved.disposition.adjudication == "confirmed"
|
||||
assert resolved.disposition.lifecycle_status == "resolved"
|
||||
|
||||
|
||||
def test_risk_disposition_idempotency_and_optimistic_version_are_enforced(
|
||||
monkeypatch: pytest.MonkeyPatch,
|
||||
) -> None:
|
||||
monkeypatch.setenv("FEW_SHOT_INJECTION_ENABLED", "false")
|
||||
with _build_session() as db:
|
||||
observation = RiskObservationService(db).upsert_observation(
|
||||
_observation_payload("risk:typed:idempotency")
|
||||
)
|
||||
second_observation = RiskObservationService(db).upsert_observation(
|
||||
{
|
||||
**_observation_payload("risk:typed:idempotency:second"),
|
||||
"claim_id": None,
|
||||
"claim_no": "",
|
||||
"subject_key": "standalone:second",
|
||||
}
|
||||
)
|
||||
db.commit()
|
||||
service = RiskDispositionService(db)
|
||||
payload = _action("confirm", version=0, request_id="request-idempotent-001")
|
||||
|
||||
first = service.execute_action(
|
||||
observation.id,
|
||||
payload,
|
||||
tenant_id="default",
|
||||
actor_id="finance-1",
|
||||
actor_name="财务甲",
|
||||
)
|
||||
replay = service.execute_action(
|
||||
observation.id,
|
||||
payload,
|
||||
tenant_id="default",
|
||||
actor_id="finance-1",
|
||||
actor_name="财务甲",
|
||||
)
|
||||
|
||||
assert replay.replayed is True
|
||||
assert replay.event.id == first.event.id
|
||||
assert db.scalar(select(func.count()).select_from(RiskDispositionEvent)) == 1
|
||||
|
||||
with pytest.raises(RiskDispositionIdempotencyConflictError):
|
||||
service.execute_action(
|
||||
observation.id,
|
||||
_action(
|
||||
"false_positive",
|
||||
version=0,
|
||||
request_id="request-idempotent-001",
|
||||
),
|
||||
tenant_id="default",
|
||||
actor_id="finance-1",
|
||||
actor_name="财务甲",
|
||||
)
|
||||
|
||||
with pytest.raises(RiskDispositionIdempotencyConflictError):
|
||||
service.execute_action(
|
||||
second_observation.id,
|
||||
payload,
|
||||
tenant_id="default",
|
||||
actor_id="finance-1",
|
||||
actor_name="财务甲",
|
||||
)
|
||||
|
||||
with pytest.raises(RiskDispositionIdempotencyConflictError):
|
||||
service.execute_action(
|
||||
observation.id,
|
||||
payload,
|
||||
tenant_id="default",
|
||||
actor_id="finance-2",
|
||||
actor_name="财务乙",
|
||||
)
|
||||
|
||||
with pytest.raises(RiskDispositionVersionConflictError) as error:
|
||||
service.execute_action(
|
||||
observation.id,
|
||||
_action("request_waiver", version=0, request_id="request-stale-001"),
|
||||
tenant_id="default",
|
||||
actor_id="finance-1",
|
||||
actor_name="财务甲",
|
||||
)
|
||||
assert error.value.current_version == 1
|
||||
|
||||
|
||||
def test_risk_observation_api_enforces_pool_claim_and_typed_action_permissions(
|
||||
monkeypatch: pytest.MonkeyPatch,
|
||||
) -> None:
|
||||
monkeypatch.setenv("FEW_SHOT_INJECTION_ENABLED", "false")
|
||||
client, session_factory = _build_client()
|
||||
with session_factory() as db:
|
||||
db.add(_employee())
|
||||
db.add(_claim())
|
||||
db.flush()
|
||||
observation = RiskObservationService(db).upsert_observation(
|
||||
_observation_payload("risk:api:duplicate")
|
||||
)
|
||||
standalone_observation = RiskObservationService(db).upsert_observation(
|
||||
{
|
||||
**_observation_payload("risk:api:standalone"),
|
||||
"claim_id": None,
|
||||
"claim_no": "",
|
||||
"subject_key": "default:standalone",
|
||||
}
|
||||
)
|
||||
foreign_observation = RiskObservationService(db).upsert_observation(
|
||||
{
|
||||
**_observation_payload("risk:api:foreign"),
|
||||
"claim_id": None,
|
||||
"claim_no": "",
|
||||
"subject_key": "tenant-b:standalone",
|
||||
},
|
||||
tenant_id="tenant-b",
|
||||
)
|
||||
observation_id = observation.id
|
||||
standalone_observation_id = standalone_observation.id
|
||||
foreign_observation_id = foreign_observation.id
|
||||
db.commit()
|
||||
|
||||
employee_headers = {
|
||||
"X-Auth-Username": "risk.employee@example.com",
|
||||
"X-Auth-Name": "Risk Employee",
|
||||
"X-Auth-Employee-No": "E-RISK",
|
||||
}
|
||||
finance_headers = {
|
||||
"X-Auth-Username": "finance@example.com",
|
||||
"X-Auth-Name": "Finance Reviewer",
|
||||
"X-Auth-Role-Codes": "finance",
|
||||
}
|
||||
|
||||
assert client.get("/api/v1/risk-observations", headers=employee_headers).status_code == 403
|
||||
assert (
|
||||
client.get(
|
||||
f"/api/v1/risk-observations/{observation_id}",
|
||||
headers=employee_headers,
|
||||
).status_code
|
||||
== 403
|
||||
)
|
||||
assert (
|
||||
client.get(
|
||||
"/api/v1/risk-observations/claim/claim-risk-1",
|
||||
headers=employee_headers,
|
||||
).status_code
|
||||
== 404
|
||||
)
|
||||
assert (
|
||||
client.post(
|
||||
f"/api/v1/risk-observations/{observation_id}/feedback",
|
||||
headers=employee_headers,
|
||||
json={"feedback_type": "confirm"},
|
||||
).status_code
|
||||
== 403
|
||||
)
|
||||
|
||||
first = client.post(
|
||||
f"/api/v1/risk-observations/{observation_id}/disposition/actions",
|
||||
headers=finance_headers,
|
||||
json={
|
||||
"action": "confirm",
|
||||
"expected_version": 0,
|
||||
"request_id": "api-confirm-request-001",
|
||||
"comment": "人工复核确认",
|
||||
},
|
||||
)
|
||||
replay = client.post(
|
||||
f"/api/v1/risk-observations/{observation_id}/disposition/actions",
|
||||
headers=finance_headers,
|
||||
json={
|
||||
"action": "confirm",
|
||||
"expected_version": 0,
|
||||
"request_id": "api-confirm-request-001",
|
||||
"comment": "人工复核确认",
|
||||
},
|
||||
)
|
||||
stale = client.post(
|
||||
f"/api/v1/risk-observations/{observation_id}/disposition/actions",
|
||||
headers=finance_headers,
|
||||
json={
|
||||
"action": "request_waiver",
|
||||
"expected_version": 0,
|
||||
"request_id": "api-stale-request-001",
|
||||
"comment": "申请风险豁免复核",
|
||||
},
|
||||
)
|
||||
changed_replay = client.post(
|
||||
f"/api/v1/risk-observations/{observation_id}/disposition/actions",
|
||||
headers=finance_headers,
|
||||
json={
|
||||
"action": "false_positive",
|
||||
"expected_version": 0,
|
||||
"request_id": "api-confirm-request-001",
|
||||
"comment": "经核验属于误报",
|
||||
},
|
||||
)
|
||||
unsafe_legacy = client.post(
|
||||
f"/api/v1/risk-observations/{observation_id}/feedback",
|
||||
headers=finance_headers,
|
||||
json={"feedback_type": "comment", "payload_json": {"arbitrary": True}},
|
||||
)
|
||||
foreign_action = client.post(
|
||||
f"/api/v1/risk-observations/{foreign_observation_id}/disposition/actions",
|
||||
headers=finance_headers,
|
||||
json={
|
||||
"action": "confirm",
|
||||
"expected_version": 0,
|
||||
"request_id": "api-cross-tenant-001",
|
||||
},
|
||||
)
|
||||
standalone_action = client.post(
|
||||
f"/api/v1/risk-observations/{standalone_observation_id}/disposition/actions",
|
||||
headers=finance_headers,
|
||||
json={
|
||||
"action": "confirm",
|
||||
"expected_version": 0,
|
||||
"request_id": "api-standalone-finance-001",
|
||||
},
|
||||
)
|
||||
|
||||
assert first.status_code == 200
|
||||
assert first.json()["disposition"]["adjudication"] == "confirmed"
|
||||
assert first.json()["disposition"]["lifecycle_status"] == "open"
|
||||
assert replay.status_code == 200
|
||||
assert replay.json()["replayed"] is True
|
||||
assert replay.json()["event"]["id"] == first.json()["event"]["id"]
|
||||
assert stale.status_code == 409
|
||||
assert stale.json()["detail"]["code"] == "RISK_DISPOSITION_VERSION_CONFLICT"
|
||||
assert stale.json()["detail"]["message"] == "风险处置状态已更新，请刷新证据链后重试。"
|
||||
assert changed_replay.status_code == 409
|
||||
assert unsafe_legacy.status_code == 410
|
||||
assert foreign_action.status_code == 404
|
||||
assert standalone_action.status_code == 403
|
||||
|
||||
detail = client.get(
|
||||
f"/api/v1/risk-observations/{observation_id}",
|
||||
headers=finance_headers,
|
||||
)
|
||||
assert detail.status_code == 200
|
||||
assert detail.json()["disposition"]["version"] == 1
|
||||
assert len(detail.json()["disposition"]["events"]) == 1
|
||||
|
||||
|
||||
def test_current_claim_approver_can_manage_disposition_without_pool_access() -> None:
|
||||
with _build_session() as db:
|
||||
manager = Employee(
|
||||
id="manager-risk",
|
||||
employee_no="M-RISK",
|
||||
name="风险主管",
|
||||
email="risk.manager@example.com",
|
||||
position="部门经理",
|
||||
grade="P8",
|
||||
)
|
||||
employee = _employee()
|
||||
employee.manager_id = manager.id
|
||||
claim = _claim()
|
||||
claim.approval_stage = "直属领导审批"
|
||||
db.add_all([manager, employee, claim])
|
||||
db.flush()
|
||||
observation = RiskObservationService(db).upsert_observation(
|
||||
_observation_payload("risk:approver:duplicate")
|
||||
)
|
||||
db.commit()
|
||||
current_user = CurrentUserContext(
|
||||
username="risk.manager@example.com",
|
||||
name="风险主管",
|
||||
role_codes=["approver"],
|
||||
is_admin=False,
|
||||
employee_no="M-RISK",
|
||||
)
|
||||
policy = RiskObservationAccessPolicy(db)
|
||||
|
||||
assert policy.can_read_tenant_pool(current_user) is False
|
||||
assert policy.can_read_claim_risks(claim.id, current_user) is True
|
||||
assert policy.can_manage_disposition(observation, current_user) is True
|
||||
|
||||
unrelated_manager = CurrentUserContext(
|
||||
username="unrelated.manager@example.com",
|
||||
name="其他经理",
|
||||
role_codes=["manager"],
|
||||
is_admin=False,
|
||||
)
|
||||
finance_outside_stage = CurrentUserContext(
|
||||
username="finance@example.com",
|
||||
name="财务甲",
|
||||
role_codes=["finance"],
|
||||
is_admin=False,
|
||||
)
|
||||
assert policy.can_read_tenant_pool(unrelated_manager) is False
|
||||
assert policy.can_read_claim_risks(claim.id, unrelated_manager) is False
|
||||
assert policy.can_manage_disposition(observation, unrelated_manager) is False
|
||||
assert policy.can_manage_disposition(observation, finance_outside_stage) is False
|
||||
|
||||
|
||||
def test_disposition_rechecks_current_approver_after_claim_stage_changes() -> None:
|
||||
with _build_session() as db:
|
||||
manager = Employee(
|
||||
id="manager-risk-stage-change",
|
||||
employee_no="M-RISK-STAGE",
|
||||
name="原审批主管",
|
||||
email="risk.stage.manager@example.com",
|
||||
)
|
||||
employee = _employee()
|
||||
employee.id = "emp-risk-stage-change"
|
||||
employee.employee_no = "E-RISK-STAGE"
|
||||
employee.email = "risk.stage.employee@example.com"
|
||||
employee.manager_id = manager.id
|
||||
claim = _claim()
|
||||
claim.id = "claim-risk-stage-change"
|
||||
claim.claim_no = "BX-RISK-STAGE"
|
||||
claim.employee_id = employee.id
|
||||
claim.approval_stage = "直属领导审批"
|
||||
db.add_all([manager, employee, claim])
|
||||
db.flush()
|
||||
observation = RiskObservationService(db).upsert_observation(
|
||||
{
|
||||
**_observation_payload("risk:approver:stage-change"),
|
||||
"claim_id": claim.id,
|
||||
"claim_no": claim.claim_no,
|
||||
"subject_key": f"claim:{claim.id}",
|
||||
}
|
||||
)
|
||||
db.commit()
|
||||
current_user = CurrentUserContext(
|
||||
username=manager.email,
|
||||
name=manager.name,
|
||||
role_codes=["manager"],
|
||||
is_admin=False,
|
||||
employee_no=manager.employee_no,
|
||||
)
|
||||
|
||||
claim.approval_stage = "财务审批"
|
||||
db.commit()
|
||||
|
||||
with pytest.raises(RiskDispositionPermissionError, match="不再是"):
|
||||
RiskDispositionService(db).execute_action(
|
||||
observation.id,
|
||||
_action("confirm", version=0, request_id="request-stage-changed-001"),
|
||||
tenant_id="default",
|
||||
actor_id=manager.id,
|
||||
actor_name=manager.name,
|
||||
current_user=current_user,
|
||||
)
|
||||
assert db.scalar(select(func.count()).select_from(RiskDispositionEvent)) == 0
|
||||
|
||||
|
||||
@pytest.mark.parametrize(
|
||||
"action",
|
||||
["false_positive", "request_supplement", "request_waiver"],
|
||||
)
|
||||
def test_evidence_sensitive_actions_require_server_side_comment(action: str) -> None:
|
||||
with pytest.raises(ValueError, match="必须填写 comment"):
|
||||
RiskDispositionActionCreate(
|
||||
action=action,
|
||||
expected_version=0,
|
||||
request_id=f"request-comment-{action}",
|
||||
)
|
||||
|
||||
|
||||
def _action(
|
||||
action: str,
|
||||
*,
|
||||
version: int,
|
||||
request_id: str,
|
||||
) -> RiskDispositionActionCreate:
|
||||
return RiskDispositionActionCreate(
|
||||
action=action,
|
||||
expected_version=version,
|
||||
request_id=request_id,
|
||||
comment=(
|
||||
"风险处置说明"
|
||||
if action in {"false_positive", "request_supplement", "request_waiver"}
|
||||
else None
|
||||
),
|
||||
)
|
||||
|
||||
|
||||
def _build_session() -> Session:
|
||||
engine = create_engine(
|
||||
"sqlite+pysqlite:///:memory:",
|
||||
connect_args={"check_same_thread": False},
|
||||
poolclass=StaticPool,
|
||||
)
|
||||
Base.metadata.create_all(bind=engine)
|
||||
factory = sessionmaker(bind=engine, autoflush=False, autocommit=False)
|
||||
return factory()
|
||||
|
||||
|
||||
def _build_client() -> tuple[TestClient, sessionmaker[Session]]:
|
||||
engine = create_engine(
|
||||
"sqlite+pysqlite:///:memory:",
|
||||
connect_args={"check_same_thread": False},
|
||||
poolclass=StaticPool,
|
||||
)
|
||||
Base.metadata.create_all(bind=engine)
|
||||
factory = sessionmaker(bind=engine, autoflush=False, autocommit=False)
|
||||
app = FastAPI()
|
||||
app.include_router(risk_observations_router, prefix="/api/v1")
|
||||
install_legacy_header_auth_override(app)
|
||||
|
||||
def override_db() -> Generator[Session, None, None]:
|
||||
db = factory()
|
||||
try:
|
||||
yield db
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
app.dependency_overrides[get_db] = override_db
|
||||
return TestClient(app), factory
|
||||
|
||||
|
||||
def _employee() -> Employee:
|
||||
return Employee(
|
||||
id="emp-risk",
|
||||
employee_no="E-RISK",
|
||||
name="风险员工",
|
||||
email="risk.employee@example.com",
|
||||
position="高级专员",
|
||||
grade="P6",
|
||||
)
|
||||
|
||||
|
||||
def _claim() -> ExpenseClaim:
|
||||
now = datetime(2026, 7, 16, tzinfo=UTC)
|
||||
return ExpenseClaim(
|
||||
id="claim-risk-1",
|
||||
claim_no="BX-RISK-001",
|
||||
employee_id="emp-risk",
|
||||
employee_name="风险员工",
|
||||
department_id="dept-risk",
|
||||
department_name="风控部",
|
||||
expense_type="travel",
|
||||
reason="客户拜访",
|
||||
location="上海",
|
||||
amount=Decimal("1200"),
|
||||
currency="CNY",
|
||||
invoice_count=1,
|
||||
occurred_at=now,
|
||||
submitted_at=now,
|
||||
status="submitted",
|
||||
approval_stage="财务审批",
|
||||
risk_flags_json=[],
|
||||
)
|
||||
|
||||
|
||||
def _observation_payload(observation_key: str) -> dict[str, object]:
|
||||
return {
|
||||
"observation_key": observation_key,
|
||||
"subject_type": "expense_claim",
|
||||
"subject_key": "claim:claim-risk-1",
|
||||
"subject_label": "BX-RISK-001",
|
||||
"claim_id": "claim-risk-1",
|
||||
"claim_no": "BX-RISK-001",
|
||||
"risk_type": "duplicate_invoice",
|
||||
"risk_signal": "duplicate_invoice",
|
||||
"title": "重复票据风险",
|
||||
"description": "同一票据可能重复报销。",
|
||||
"risk_score": 86,
|
||||
"risk_level": "high",
|
||||
"confidence_score": 0.91,
|
||||
"control_stage": "reimbursement",
|
||||
"control_mode": "risk_observation",
|
||||
"automation_mode": "semi_auto_review",
|
||||
"source": "financial_risk_graph",
|
||||
"algorithm_version": "financial_risk_graph.v1",
|
||||
"contribution_scores": {},
|
||||
"baseline": {},
|
||||
"evidence": [],
|
||||
"graph_node_keys": [],
|
||||
"graph_edge_keys": [],
|
||||
"policy_refs": [],
|
||||
"similar_case_claim_ids": [],
|
||||
"ontology_json": {},
|
||||
"decision_trace": {},
|
||||
}
|
||||
Reference in New Issue
Block a user