@steedos-labs/plugin-workflow 3.0.103 → 3.0.105

package/main/default/test/test_retrieve_guards.js

@@ -0,0 +1,308 @@
+/**
+ * 回归测试：取回（/api/workflow/retrieve）的状态与资格校验。
+ *
+ * 背景（线上现象）：
+ *  1. 已结束（state=completed）的申请单，最后一步处理人调用取回接口，
+ *     实例会被重新打开（state 重置为 pending）——实例状态校验被注释掉了，
+ *     且结束 trace 没有 approves，已读校验形同虚设。
+ *  2. retrieve_type 判定为空（当前用户不是上一步唯一处理人、也没有可取回的
+ *     传阅记录）时，路由静默返回 {status: 0}，前端误报「取回成功」并刷新页面。
+ *
+ * 期望（修复后）：
+ *  - 非 pending 状态的申请单一律拒绝取回（含传阅取回），返回明确错误。
+ *  - retrieve_type 为空时返回明确错误，不再静默假成功。
+ *  - 正常取回、滑步取回、退回到开始步骤的已读豁免等既有行为不变。
+ *
+ * 用法：
+ *   node main/default/test/test_retrieve_guards.js
+ *   或 npm run test:retrieve-guards
+ */
+
+const assert = require('assert');
+const Module = require('module');
+
+// ---- 伪造无法在独立环境 resolve 的外部依赖（express / @steedos/*） ----
+const capturedRoutes = {};
+const objectqlUpdates = [];
+const fakeModules = {
+    'express': {
+        Router: function () {
+            return {
+                post: function (path) {
+                    capturedRoutes[path] = arguments[arguments.length - 1];
+                },
+            };
+        },
+    },
+    '@steedos/auth': {
+        requireAuthentication: function (req, res, next) { next(); },
+    },
+    '@steedos/objectql': {
+        getObject: function (name) {
+            return {
+                update: async function (id, doc) { objectqlUpdates.push({ name, id, doc }); return doc; },
+            };
+        },
+    },
+};
+const origResolve = Module._resolveFilename;
+Module._resolveFilename = function (request) {
+    if (fakeModules[request]) return 'fake:' + request;
+    return origResolve.apply(this, arguments);
+};
+Object.keys(fakeModules).forEach(function (name) {
+    require.cache['fake:' + name] = {
+        id: 'fake:' + name,
+        filename: 'fake:' + name,
+        loaded: true,
+        exports: fakeModules[name],
+    };
+});
+
+// ---- 伪造插件内部依赖 ----
+let instanceUpdateCalls = [];
+const dummyInstancesCollection = {
+    updateOne: async function (selector, modifier) {
+        instanceUpdateCalls.push({ selector: selector, modifier: modifier });
+        return { modifiedCount: 1 };
+    },
+};
+const dummyUsersCollection = {
+    findOne: async function (selector) { return { _id: selector._id, name: 'name_of_' + selector._id }; },
+};
+const dummyOrganizationsCollection = {
+    findOne: async function () { return { name: 'org', fullname: 'org' }; },
+};
+function seedCache(relPath, exportsObj) {
+    const p = require.resolve(relPath);
+    require.cache[p] = { id: p, filename: p, loaded: true, exports: exportsObj };
+}
+seedCache('../utils/collection.js', {
+    getCollection: async function (name) {
+        if (name === 'instances') return dummyInstancesCollection;
+        if (name === 'organizations') return dummyOrganizationsCollection;
+        return dummyUsersCollection;
+    },
+    _makeNewID: (function () { let n = 0; return function () { return 'new_id_' + (++n); }; })(),
+});
+seedCache('../manager/push_manager.js', {
+    send_message_current_user: async function () { },
+    send_message_to_specifyUser: async function () { },
+    triggerWebhook: async function () { },
+});
+seedCache('../manager/instance_tasks_manager.js', {
+    insert_instance_tasks: async function () { },
+    update_instance_tasks: async function () { },
+    update_many_instance_tasks: async function () { },
+});
+
+let fakeInstance = null;
+let stepTypes = {};
+seedCache('../manager/uuflow_manager.js', {
+    getInstance: async function () { return fakeInstance; },
+    getFlow: async function () { return { _id: 'flow1' }; },
+    getStep: function (ins, flow, stepId) {
+        return { _id: stepId, name: 'name_' + stepId, step_type: stepTypes[stepId] || 'sign' };
+    },
+    getDueDate: async function () { return null; },
+    getSpaceUser: async function () { return { organization: 'org1' }; },
+    getSpaceUserOrgInfo: async function () {
+        return { organization: 'org1', organization_name: 'org', organization_fullname: 'org' };
+    },
+    setRemindInfo: async function () { },
+    getCurrentStepAutoSubmit: async function () { return false; },
+});
+
+require('../routes/api_workflow_retrieve.router.js');
+const handler = capturedRoutes['/api/workflow/retrieve'];
+assert.ok(handler, '未捕获到取回路由 handler');
+
+// ---- 实例构造 ----
+// 默认结构：填写申请(t1, user_a) → 审批(t2, user_b 已审) → 当前步骤(t3, user_c 待审)
+function buildPendingInstance(opts) {
+    opts = opts || {};
+    const traces = [
+        {
+            _id: 't1', step: 'step_start', name: '填写申请单', is_finished: true, judge: 'submitted',
+            approves: [{ _id: 'a1', user: 'user_a', handler: 'user_a', type: 'draft', judge: 'submitted' }],
+        },
+        {
+            _id: 't2', step: 'step_real', name: '实际审批步骤', is_finished: true, judge: 'approved',
+            previous_trace_ids: ['t1'],
+            approves: [{ _id: 'a2', user: 'user_b', handler: 'user_b', judge: 'approved' }],
+        },
+        {
+            _id: 't3', step: 'step_current', name: '当前步骤', is_finished: false,
+            previous_trace_ids: ['t2'],
+            approves: [{ _id: 'a3', user: 'user_c', handler: 'user_c', is_finished: false, is_read: !!opts.nextStepRead }],
+        },
+    ];
+    return {
+        _id: 'ins1', space: 'space1', state: 'pending', applicant: 'user_a', submitter: 'user_a',
+        flow: 'flow1', form: 'form1', form_version: 'fv1',
+        inbox_users: ['user_c'], outbox_users: ['user_a', 'user_b'], cc_users: [],
+        values: {}, current_step_name: '当前步骤',
+        traces: traces,
+    };
+}
+
+// 已结束实例：填写申请(t1, user_a) → 审批(t2, user_b 已审) → 结束(t_end, 无 approves)
+function buildCompletedInstance(opts) {
+    opts = opts || {};
+    const t2Approves = [{ _id: 'a2', user: 'user_b', handler: 'user_b', judge: 'approved' }];
+    if (opts.withCC) {
+        t2Approves.push({ _id: 'a_cc', user: 'user_cc', handler: 'user_cc', type: 'cc', is_finished: true, judge: 'approved' });
+    }
+    return {
+        _id: 'ins2', space: 'space1', state: 'completed', applicant: 'user_a', submitter: 'user_a',
+        flow: 'flow1', form: 'form1', form_version: 'fv1',
+        inbox_users: [], outbox_users: ['user_a', 'user_b', 'user_cc'], cc_users: [],
+        values: {}, current_step_name: '结束', final_decision: 'approved',
+        traces: [
+            {
+                _id: 't1', step: 'step_start', name: '填写申请单', is_finished: true, judge: 'submitted',
+                approves: [{ _id: 'a1', user: 'user_a', handler: 'user_a', type: 'draft', judge: 'submitted' }],
+            },
+            {
+                _id: 't2', step: 'step_real', name: '实际审批步骤', is_finished: true, judge: 'approved',
+                previous_trace_ids: ['t1'],
+                approves: t2Approves,
+            },
+            {
+                _id: 't_end', step: 'step_end', name: '结束', is_finished: true,
+                previous_trace_ids: ['t2'],
+            },
+        ],
+    };
+}
+
+async function callRetrieve(userId) {
+    instanceUpdateCalls = [];
+    objectqlUpdates.length = 0;
+    const req = {
+        user: { userId: userId, spaceId: 'space1', name: 'name_of_' + userId },
+        body: { _id: fakeInstance._id, retrieve_comment: '取回测试' },
+    };
+    const res = {
+        statusCode: null, body: null,
+        status: function (c) { this.statusCode = c; return this; },
+        send: function (b) { this.body = b; return this; },
+    };
+    await handler(req, res);
+    return res;
+}
+
+let passed = 0;
+let failed = 0;
+async function run(name, fn) {
+    try {
+        await fn();
+        console.log(`  ✓ ${name}`);
+        passed++;
+    } catch (e) {
+        console.log(`  ✗ ${name}`);
+        console.log(`    ${e.message}`);
+        failed++;
+    }
+}
+
+(async () => {
+    console.log('取回接口状态与资格校验（retrieve guards）');
+
+    await run('正常取回：上一步唯一处理人取回，行为不变', async () => {
+        stepTypes = {};
+        fakeInstance = buildPendingInstance();
+        const res = await callRetrieve('user_b');
+        assert.strictEqual(res.body.status, 0, '应返回 status 0，实际：' + JSON.stringify(res.body));
+        const setCall = instanceUpdateCalls.find(c => c.modifier.$set && c.modifier.$set.traces);
+        assert.ok(setCall, '未更新实例 traces');
+        const newTraces = setCall.modifier.$set.traces;
+        const newTrace = newTraces[newTraces.length - 1];
+        assert.strictEqual(newTrace.step, 'step_real', '新 trace 应落在上一步');
+        assert.deepStrictEqual(setCall.modifier.$set.inbox_users, ['user_b']);
+        assert.strictEqual(setCall.modifier.$set.state, 'pending');
+    });
+
+    await run('下一步已读 → 报「下一步处理人已读，不能取回」', async () => {
+        stepTypes = {};
+        fakeInstance = buildPendingInstance({ nextStepRead: true });
+        const res = await callRetrieve('user_b');
+        assert.strictEqual(res.body.status, -1, '应返回 status -1，实际：' + JSON.stringify(res.body));
+        assert.ok(/已读/.test(res.body.msg), '应报已读错误，实际：' + res.body.msg);
+    });
+
+    await run('退回到开始步骤不受已读限制：申请人取回第一步已读的单子仍成功', async () => {
+        stepTypes = { step_start: 'start' };
+        fakeInstance = buildPendingInstance({ nextStepRead: true });
+        // 只保留 填写申请(t1) → 当前步骤(t2')，当前步骤已读，申请人 user_a 取回
+        fakeInstance.traces = [
+            fakeInstance.traces[0],
+            {
+                _id: 't2p', step: 'step_current', name: '当前步骤', is_finished: false,
+                previous_trace_ids: ['t1'],
+                approves: [{ _id: 'a9', user: 'user_c', handler: 'user_c', is_finished: false, is_read: true }],
+            },
+        ];
+        const res = await callRetrieve('user_a');
+        assert.strictEqual(res.body.status, 0, '应返回 status 0，实际：' + JSON.stringify(res.body));
+    });
+
+    await run('滑步后取回：回溯到实际处理过的步骤，中间 skipped trace 一并标记 retrieved', async () => {
+        stepTypes = {};
+        fakeInstance = buildPendingInstance();
+        // 在 t2 和 t3 之间插入被滑步跳过的 t_skip
+        fakeInstance.traces.splice(2, 0, {
+            _id: 't_skip', step: 'step_skipped', name: '被滑步跳过的步骤', is_finished: true, judge: 'skipped',
+            previous_trace_ids: ['t2'],
+            approves: [{ _id: 'a_skip', user: 'user_x', handler: 'user_x', judge: 'skipped' }],
+        });
+        fakeInstance.traces[3].previous_trace_ids = ['t_skip'];
+        const res = await callRetrieve('user_b');
+        assert.strictEqual(res.body.status, 0, '应返回 status 0，实际：' + JSON.stringify(res.body));
+        const setCall = instanceUpdateCalls.find(c => c.modifier.$set && c.modifier.$set.traces);
+        const newTraces = setCall.modifier.$set.traces;
+        assert.strictEqual(newTraces[newTraces.length - 1].step, 'step_real', '新 trace 应落在实际处理过的步骤');
+        const skipTrace = newTraces.find(t => t._id === 't_skip');
+        assert.strictEqual(skipTrace.judge, 'retrieved', '滑步跳过的 trace 应标记为 retrieved');
+    });
+
+    await run('当前用户不是上一步唯一处理人 → 明确报错，不再静默假成功', async () => {
+        stepTypes = {};
+        fakeInstance = buildPendingInstance();
+        // user_a 是提交人且在 outbox_users 中，但上一步（t2）处理人是 user_b
+        const res = await callRetrieve('user_a');
+        assert.strictEqual(res.body.status, -1, '应返回 status -1，实际：' + JSON.stringify(res.body));
+        assert.ok(res.body.msg, '应返回错误信息');
+        assert.strictEqual(instanceUpdateCalls.length, 0, '不应更新实例');
+    });
+
+    await run('已结束实例 → 最后一步处理人取回被拒绝，实例不被重新打开', async () => {
+        stepTypes = {};
+        fakeInstance = buildCompletedInstance();
+        const res = await callRetrieve('user_b');
+        assert.strictEqual(res.body.status, -1, '应返回 status -1，实际：' + JSON.stringify(res.body));
+        assert.ok(/已结束/.test(res.body.msg), '应报申请单已结束，实际：' + res.body.msg);
+        assert.strictEqual(instanceUpdateCalls.length, 0, '不应更新实例（不能重新打开已结束的申请单）');
+    });
+
+    await run('已结束实例 → 传阅取回同样被拒绝', async () => {
+        stepTypes = {};
+        fakeInstance = buildCompletedInstance({ withCC: true });
+        const res = await callRetrieve('user_cc');
+        assert.strictEqual(res.body.status, -1, '应返回 status -1，实际：' + JSON.stringify(res.body));
+        assert.ok(/已结束/.test(res.body.msg), '应报申请单已结束，实际：' + res.body.msg);
+        assert.strictEqual(instanceUpdateCalls.length, 0, '不应更新实例');
+    });
+
+    await run('草稿状态 → 拒绝取回', async () => {
+        stepTypes = {};
+        fakeInstance = buildPendingInstance();
+        fakeInstance.state = 'draft';
+        const res = await callRetrieve('user_a');
+        assert.strictEqual(res.body.status, -1, '应返回 status -1，实际：' + JSON.stringify(res.body));
+        assert.ok(/草稿/.test(res.body.msg), '应报草稿不能取回，实际：' + res.body.msg);
+    });
+
+    console.log(`\n${passed} passed, ${failed} failed`);
+    process.exit(failed > 0 ? 1 : 0);
+})();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steedos-labs/plugin-workflow",
-  "version": "3.0.103",
+  "version": "3.0.105",
   "main": "package.service.js",
   "license": "MIT",
   "files": [
@@ -27,6 +27,8 @@
     "test:approve-values": "node main/default/test/test_getApproveValues.js",
     "test:skip-handler-error": "node main/default/test/test_handleSkipProcessed_handlerError.js",
     "test:return-after-skip": "node main/default/test/test_return_after_skip.js",
+    "test:retrieve-guards": "node main/default/test/test_retrieve_guards.js",
+    "test:remove-guards": "node main/default/test/test_remove_guards.js",
     "test:next-step-users-cc": "node main/default/test/test_next_step_users_value_cc.js",
     "test:flow-validator": "node main/default/test/test_flow_validator.js",
     "test:ajax-error-message": "node main/default/test/test_ajax_error_message.js",