feat(expenses): add authoritative pre-review workflow

web/tests/travel-request-detail-submit-confirm.test.mjs

@@ -59,9 +59,9 @@ const deleteDialogComponent = readFileSync(
 )
 
 function extractFunction(source, name) {
-  let signatureIndex = source.indexOf(`function ${name}(`)
+  let signatureIndex = source.indexOf(`async function ${name}(`)
   if (signatureIndex === -1) {
-    signatureIndex = source.indexOf(`async function ${name}(`)
+    signatureIndex = source.indexOf(`function ${name}(`)
   }
   assert.notEqual(signatureIndex, -1, `${name} should exist`)
 
@@ -84,6 +84,46 @@ function extractFunction(source, name) {
   assert.fail(`${name} body should be closed`)
 }
 
+function createSubmitRunner({
+  claimId = 'claim-001',
+  preReviewExpenseClaim,
+  submitExpenseClaim,
+  applyClaimRiskFlagsPayload = () => {},
+  toast = () => {},
+  emit = () => {}
+}) {
+  const runSubmitRequest = extractFunction(detailViewScript, 'runSubmitRequest')
+  const factory = new Function(
+    'preReviewExpenseClaim',
+    'submitExpenseClaim',
+    'applyClaimRiskFlagsPayload',
+    'toast',
+    'emit',
+    'request',
+    'submitConfirmDialogOpen',
+    'submitBusy',
+    'submitTaskSeq',
+    `${runSubmitRequest}; return runSubmitRequest`
+  )
+  const submitConfirmDialogOpen = { value: true }
+  const submitBusy = { value: true }
+  return {
+    run: factory(
+      preReviewExpenseClaim,
+      submitExpenseClaim,
+      applyClaimRiskFlagsPayload,
+      toast,
+      emit,
+      { value: { claimId } },
+      submitConfirmDialogOpen,
+      submitBusy,
+      1
+    ),
+    submitConfirmDialogOpen,
+    submitBusy
+  }
+}
+
 test('detail submit opens a confirmation dialog before calling submit API', () => {
   assert.match(detailViewTemplate, /<ConfirmDialog[\s\S]*:open="submitConfirmDialogOpen"[\s\S]*:confirm-text="submitConfirmText"[\s\S]*@close="closeSubmitConfirmDialog"[\s\S]*@confirm="confirmSubmitRequest"/)
   assert.match(detailViewTemplate, /:secondary-text="submitConfirmSecondaryText"/)
@@ -94,7 +134,7 @@ test('detail submit opens a confirmation dialog before calling submit API', () =
 
   assert.match(detailViewScript, /const submitConfirmDialogOpen = ref\(false\)/)
   assert.match(detailViewTemplate, /v-if="submitBusy" class="expense-recognition-banner submit-progress-banner"/)
-  assert.doesNotMatch(detailViewScript, /preReviewExpenseClaim\(request\.value\.claimId\)/)
+  assert.match(detailViewScript, /preReviewExpenseClaim/)
   assert.match(detailViewScript, /const submitActionLabel = computed/)
   assert.match(detailViewScript, /const submitConfirmSecondaryText = computed/)
   assert.match(detailViewScript, /submitConfirmDialogOpen\.value = true/)
@@ -111,10 +151,120 @@ test('detail submit opens a confirmation dialog before calling submit API', () =
   assert.doesNotMatch(confirmSubmitRequest, /await /)
   assert.doesNotMatch(confirmSubmitRequest, /submitExpenseClaim/)
   const runSubmitRequest = extractFunction(detailViewScript, 'runSubmitRequest')
-  assert.match(runSubmitRequest, /submitExpenseClaim\(claimId\)/)
+  const preReviewIndex = runSubmitRequest.indexOf('preReviewExpenseClaim(claimId)')
+  const submitIndex = runSubmitRequest.indexOf('submitExpenseClaim(claimId,')
+  assert.ok(preReviewIndex > -1)
+  assert.ok(submitIndex > preReviewIndex)
+  assert.match(runSubmitRequest, /pre_review_id:[\s\S]*preReview\?\.review_id/)
+  assert.match(runSubmitRequest, /input_fingerprint:[\s\S]*preReview\?\.input_fingerprint/)
   assert.match(runSubmitRequest, /taskSeq !== submitTaskSeq/)
 })
 
+test('detail submit uses the ready pre-review identity and fingerprint', async () => {
+  const calls = []
+  const appliedPayloads = []
+  const { run, submitBusy } = createSubmitRunner({
+    preReviewExpenseClaim: async (claimId) => {
+      calls.push(['pre-review', claimId])
+      return {
+        claim_risk_flags: [],
+        pre_review: {
+          decision: 'ready',
+          review_id: 'review-ready-001',
+          input_fingerprint: 'sha256:ready-input'
+        }
+      }
+    },
+    submitExpenseClaim: async (claimId, payload) => {
+      calls.push(['submit', claimId, payload])
+      return { status: 'submitted', approval_stage: 'manager' }
+    },
+    applyClaimRiskFlagsPayload: (payload) => appliedPayloads.push(payload)
+  })
+
+  await run('claim-001', 'BX-001', false, 1)
+
+  assert.deepEqual(calls, [
+    ['pre-review', 'claim-001'],
+    [
+      'submit',
+      'claim-001',
+      {
+        pre_review_id: 'review-ready-001',
+        input_fingerprint: 'sha256:ready-input'
+      }
+    ]
+  ])
+  assert.equal(appliedPayloads.length, 1)
+  assert.equal(submitBusy.value, false)
+})
+
+test('detail submit stops after needs_fix and refreshes visible risks', async () => {
+  let submitCalls = 0
+  const appliedPayloads = []
+  const emitted = []
+  const toasts = []
+  const reviewedClaim = {
+    claim_risk_flags: [{ source: 'policy', severity: 'high' }],
+    pre_review: {
+      decision: 'needs_fix',
+      message: '住宿费超标，请先按标准调整。'
+    }
+  }
+  const { run, submitBusy } = createSubmitRunner({
+    preReviewExpenseClaim: async () => reviewedClaim,
+    submitExpenseClaim: async () => {
+      submitCalls += 1
+      return { status: 'submitted' }
+    },
+    applyClaimRiskFlagsPayload: (payload) => appliedPayloads.push(payload),
+    toast: (message) => toasts.push(message),
+    emit: (...args) => emitted.push(args)
+  })
+
+  await run('claim-001', 'BX-001', false, 1)
+
+  assert.equal(submitCalls, 0)
+  assert.deepEqual(appliedPayloads, [reviewedClaim])
+  assert.deepEqual(emitted, [['request-updated', { claimId: 'claim-001' }]])
+  assert.deepEqual(toasts, ['住宿费超标，请先按标准调整。'])
+  assert.equal(submitBusy.value, false)
+})
+
+test('structured pre-review 409 requests detail refresh so backend risks are refilled', async () => {
+  const emitted = []
+  const toasts = []
+  const structuredError = Object.assign(new Error('提交前预审已失效。'), {
+    code: 'PRE_REVIEW_NEEDS_FIX',
+    review: {
+      decision: 'needs_fix',
+      message: '发票抬头不匹配，请重新上传。',
+      findings: [{ risk_id: 'risk-001', severity: 'high' }]
+    }
+  })
+  const { run, submitBusy } = createSubmitRunner({
+    preReviewExpenseClaim: async () => ({
+      claim_risk_flags: [],
+      pre_review: {
+        decision: 'ready',
+        review_id: 'review-stale',
+        input_fingerprint: 'sha256:stale'
+      }
+    }),
+    submitExpenseClaim: async () => {
+      throw structuredError
+    },
+    toast: (message) => toasts.push(message),
+    emit: (...args) => emitted.push(args)
+  })
+
+  await run('claim-001', 'BX-001', false, 1)
+
+  assert.deepEqual(toasts, ['发票抬头不匹配，请重新上传。'])
+  assert.deepEqual(emitted, [['request-updated', { claimId: 'claim-001' }]])
+  assert.equal(submitBusy.value, false)
+})
+
 test('detail submit warns on missing risk explanation and supports standard adjustment', () => {
   assert.match(detailViewTemplate, /:open="riskOverrideDialogOpen"/)
   assert.match(detailViewTemplate, /:open="riskOverrideDialogOpen"[\s\S]*size="review"/)