@steedos-labs/plugin-workflow 3.0.104 → 3.0.105

package/main/default/client/flow2_render.client.js

@@ -1,5 +1,5 @@
 waitForThing(window, 'antd').then(function(){
-    var v = '3.0.104';
+    var v = '3.0.105';
     loadJs('/amis-renderer/amis-renderer.js?v=' + v);
     loadCss('/amis-renderer/amis-renderer.css?v=' + v)
 })

package/main/default/objects/instances/buttons/instance_delete.button.yml

@@ -128,7 +128,7 @@ amis_schema: |-
                       ]
                   }
               },
-              "hiddenOn": "(window.Builder && window.Builder.settings && window.Builder.settings.STEEDOS_PUBLIC_WORKFLOW_READONLY === 'true') || !(record.box == 'draft' || (record.box == 'monitor'  && context.user.is_space_admin) \n      || (_.includes(record.flow.perms.users_can_admin, context.user.userId) \n          || _.intersection(record.flow.perms.orgs_can_admin, context.user.organizations_parents) > 0)\n || (record.box == 'inbox' && record.state == 'draft' && record.forward_from_instance))"
+              "hiddenOn": "(window.Builder && window.Builder.settings && window.Builder.settings.STEEDOS_PUBLIC_WORKFLOW_READONLY === 'true') || !((record.box == 'draft' && record.state == 'draft') || (record.box == 'monitor'  && context.user.is_space_admin) \n      || (_.includes(record.flow.perms.users_can_admin, context.user.userId) \n          || _.intersection(record.flow.perms.orgs_can_admin, context.user.organizations_parents) > 0)\n || (record.box == 'inbox' && record.state == 'draft' && record.forward_from_instance))"
           }
       ],
       "regions": [

package/main/default/objects/instances/buttons/instance_retrieve.button.yml

@@ -39,11 +39,11 @@ amis_schema: |-
                                           "api": {
                                               "url": "${context.rootUrl}/api/workflow/retrieve",
                                               "method": "post",
+                                              "silent": true,
                                               "requestAdaptor": "api.data = {\n    \"_id\": api.body.record._id,\n    \"retrieve_comment\": api.body.retrieve_comment\n};\nreturn api;",
                                               "adaptor": "if (payload && payload.status === -1) {\n  return {...payload, status: 1, msg: payload.msg || '取回失败'};\n}\nreturn {...payload, status: 0, msg: payload && payload.msg ? payload.msg : '取回成功'};",
                                               "messages": {
-                                                  "success": "取回成功",
-                                                  "failed": "${msg}"
+                                                  "success": "取回成功"
                                               },
                                               "headers": {
                                                   "Authorization": "Bearer ${context.tenantId},${context.authToken}"
@@ -56,7 +56,34 @@ amis_schema: |-
                                           "onEvent": {
                                               "submitFail": {
                                                   "weight": 0,
-                                                  "actions": []
+                                                  "actions": [
+                                                      {
+                                                          "actionType": "dialog",
+                                                          "dialog": {
+                                                              "type": "dialog",
+                                                              "title": "无法取回",
+                                                              "data": {
+                                                                  "__errorMsg": "${event.data.error.msg || event.data.error.message || event.data.error.response.msg || '取回失败，请稍后重试'}"
+                                                              },
+                                                              "body": [
+                                                                  {
+                                                                      "type": "tpl",
+                                                                      "tpl": "${__errorMsg}"
+                                                                  }
+                                                              ],
+                                                              "actions": [
+                                                                  {
+                                                                      "type": "button",
+                                                                      "actionType": "cancel",
+                                                                      "label": "确定",
+                                                                      "primary": true
+                                                                  }
+                                                              ],
+                                                              "showCloseButton": true,
+                                                              "closeOnEsc": true
+                                                          }
+                                                      }
+                                                  ]
                                               },
                                               "submitSucc": {
                                                   "weight": 0,
@@ -127,7 +154,7 @@ amis_schema: |-
                       ]
                   }
               },
-              "hiddenOn": "(window.Builder && window.Builder.settings && window.Builder.settings.STEEDOS_PUBLIC_WORKFLOW_READONLY === 'true') || !( (record.box === 'outbox' || record.box === 'pending') && record.state === 'pending')"
+              "hiddenOn": "(window.Builder && window.Builder.settings && window.Builder.settings.STEEDOS_PUBLIC_WORKFLOW_READONLY === 'true') || !( (record.box === 'outbox' || record.box === 'pending') && record.state === 'pending') || (function(){ try { var ts = record.traces || []; if (!ts.length) { return false; } var last = ts[ts.length - 1]; var isRead = false; (last.approves || []).forEach(function(a){ if (a.is_read === true) { isRead = true; } }); if (!isRead) { return false; } var pid = (last.previous_trace_ids || [])[0]; var prev = null; var guard = 0; while (pid && guard < ts.length) { guard++; prev = null; for (var j = 0; j < ts.length; j++) { if (ts[j]._id === pid) { prev = ts[j]; break; } } if (!prev || prev.judge !== 'skipped' || !prev.previous_trace_ids || !prev.previous_trace_ids.length) { break; } pid = prev.previous_trace_ids[0]; } var prevIsStart = !!prev && (!prev.previous_trace_ids || prev.previous_trace_ids.length === 0); return !prevIsStart; } catch (e) { return false; } })()"
           }
       ],
       "regions": [

package/main/default/objects/instances/buttons/instance_save.button.yml

@@ -51,7 +51,7 @@ amis_schema: |-
                       "weight": 0
                   }
               },
-              "hiddenOn": "record.box != 'inbox' && record.box != 'draft'"
+              "hiddenOn": "record.box != 'inbox' && !(record.box == 'draft' && record.state == 'draft')"
           }
       ],
       "regions": [

package/main/default/objects/instances/buttons/instance_submit.button.yml

@@ -7,7 +7,7 @@ amis_schema: |-
         "label": "${'CustomAction.instances.instance_submit' | t}",
         "level": "primary",
         "id": "u:instance_submit",
-        "hiddenOn": "!(this.record.box === 'inbox' || this.record.box === 'draft')",
+        "hiddenOn": "!(this.record.box === 'inbox' || (this.record.box === 'draft' && this.record.state === 'draft'))",
         "onEvent": {
             "click": {
                 "weight": 0,

package/main/default/routes/api_workflow_remove.router.js

@@ -62,9 +62,14 @@ router.post('/api/workflow/remove', requireAuthentication, async function (req,
                             $in: space_user.organizations
                         }
                     }).fetch();
-                    if ((instance.submitter !== current_user) && (!space.admins.includes(current_user)) && !WorkflowManager.canAdmin(flow, space_user, spaceUserOrganizations)) {
+                    const isAdmin = space.admins.includes(current_user) || WorkflowManager.canAdmin(flow, space_user, spaceUserOrganizations);
+                    if ((instance.submitter !== current_user) && !isAdmin) {
                         throw new Error("您不能删除此申请单。");
                     }
+                    // 非草稿状态仅管理员可删（监控箱删单）：防止申请人绕过「取回/取消申请」直接删掉审批中的单子
+                    if (instance.state !== "draft" && !isAdmin) {
+                        throw new Error(instance.state === "pending" ? "申请单正在审批中，不能删除，请先取回或取消申请。" : "申请单已结束，不能删除。");
+                    }
                     delete_obj = db.instances.findOne(insId);
                     delete_obj.deleted = new Date;
                     delete_obj.deleted_by = current_user;

package/main/default/routes/api_workflow_retrieve.router.js

@@ -55,8 +55,11 @@ router.post('/api/workflow/retrieve', requireAuthentication, async function (req
         var cc_users, flow, handler_info, i, ins, instance, instance_id, last_trace, last_trace_id, newApprove, newTrace, now, old_inbox_users, org_info, previous_step, previous_trace, previous_trace_approves, previous_trace_id, previous_trace_name, previous_trace_step_id, r, retrieve_approve, retrieve_comment, retrieve_type, setObj, space_id, space_user, the_trace, traces;
         instance = await UUFlowManager.getInstance(hashData["_id"]);
         retrieve_comment = hashData['retrieve_comment'];
-        // 验证instance为审核中状态
-        // UUFlowManager.isInstancePending(instance)
+        // 验证instance为审核中状态：已结束/已终止的申请单不允许取回（含传阅取回），
+        // 否则取回会把 state 重置为 pending，导致已结束的申请单被重新打开
+        if (instance.state !== 'pending') {
+            throw new Error(instance.state === 'draft' ? '草稿状态的申请单不能取回' : '申请单已结束，不能取回');
+        }
         // 校验申请单是当前用户已审核过的单子或者当前用户是提交人或申请人
         if ((!instance.outbox_users.includes(current_user)) && (instance.submitter !== current_user && instance.applicant !== current_user)) {
             throw new Error('当前用户不符合取回条件');
@@ -328,6 +331,10 @@ router.post('/api/workflow/retrieve', requireAuthentication, async function (req
             ins = UUFlowManager.getInstance(instance_id);
             // 如果已经配置webhook并已激活则触发
             await pushManager.triggerWebhook(ins.flow, ins, {}, 'retrieve', current_user, [current_user]);
+        } else {
+            // 既不满足正常取回条件（上一步唯一处理人是当前用户），也没有可取回的传阅记录，
+            // 不能静默返回成功，否则前端只会刷新页面、用户误以为取回成功
+            throw new Error('仅上一步唯一处理人可以取回，当前用户不符合取回条件');
         }
 
         res.status(200).send({

package/main/default/routes/api_workflow_v2_remove.router.js

@@ -48,9 +48,14 @@ router.post('/api/workflow/v2/remove', requireAuthentication, async function (re
             $in: space_user.organizations
         }
         }).toArray();
-        if ((instance.submitter !== current_user) && (!space.admins.includes(current_user)) && !WorkflowManager.canAdmin(flow, space_user, spaceUserOrganizations)) {
+        const isAdmin = space.admins.includes(current_user) || WorkflowManager.canAdmin(flow, space_user, spaceUserOrganizations);
+        if ((instance.submitter !== current_user) && !isAdmin) {
         throw new Error("您不能删除此申请单。");
         }
+        // 非草稿状态仅管理员可删（监控箱删单）：防止申请人借「草稿」视图参数绕过「取回/取消申请」直接删掉审批中的单子
+        if (instance.state !== "draft" && !isAdmin) {
+        throw new Error(instance.state === "pending" ? "申请单正在审批中，不能删除，请先取回或取消申请。" : "申请单已结束，不能删除。");
+        }
         delete_obj = await db.instances.findOne({_id: data._id});
         delete_obj.deleted = new Date;
         delete_obj.deleted_by = current_user;

package/main/default/test/test_remove_guards.js

@@ -0,0 +1,231 @@
+/**
+ * 回归测试：删除申请单（/api/workflow/v2/remove）的状态校验。
+ *
+ * 背景（线上现象）：
+ *  已提交、审批中的单子，申请人从带 side_listview_id=draft 参数的地址打开后，
+ *  界面按草稿模式渲染出「删除」按钮，点删除真的能删掉——后端只校验了
+ *  「提交人/工作区管理员/流程管理员」身份，完全没有校验单据状态，
+ *  绕过了「取回/取消申请」的正规流程。
+ *
+ * 期望（修复后）：
+ *  - 草稿状态（state=draft）：提交人可删除，行为不变（含转发产生的草稿）。
+ *  - 非草稿状态（审批中/已结束）：仅工作区管理员或流程管理员可删除
+ *    （监控箱删单是设计内能力），普通提交人被明确拒绝，实例不被删除。
+ *  - 管理员删除非草稿单时，仍然给待办人/传阅人发送通知，行为不变。
+ *
+ * 用法：
+ *   node main/default/test/test_remove_guards.js
+ *   或 npm run test:remove-guards
+ */
+
+const assert = require('assert');
+const Module = require('module');
+
+// ---- 伪造无法在独立环境 resolve 的外部依赖（express / @steedos/*） ----
+const capturedRoutes = {};
+let removedInstanceIds = [];
+let insertedDeletedInstances = [];
+const dummyInstancesCollection = {
+    findOne: async function () { return Object.assign({}, fakeInstance); },
+    remove: async function (selector) { removedInstanceIds.push(selector._id); return 1; },
+};
+const dummyDeletedInstancesCollection = {
+    insert: async function (doc) { insertedDeletedInstances.push(doc); return doc; },
+};
+const dummyFlowsCollection = {
+    findOne: async function () { return { _id: 'flow1', perms: {} }; },
+};
+const dummyOrganizationsCollection = {
+    find: function () { return { toArray: async function () { return []; } }; },
+};
+const fakeModules = {
+    'express': {
+        Router: function () {
+            return {
+                post: function (path) {
+                    capturedRoutes[path] = arguments[arguments.length - 1];
+                },
+            };
+        },
+    },
+    '@steedos/auth': {
+        requireAuthentication: function (req, res, next) { next(); },
+    },
+    // 路由内通过包名路径引用 utils/collection，这里按请求串拦截
+    '@steedos-labs/plugin-workflow/main/default/utils/collection': {
+        getCollection: async function (name) {
+            if (name === 'instances') return dummyInstancesCollection;
+            if (name === 'deleted_instances') return dummyDeletedInstancesCollection;
+            if (name === 'flows') return dummyFlowsCollection;
+            if (name === 'organizations') return dummyOrganizationsCollection;
+            throw new Error('unexpected collection: ' + name);
+        },
+    },
+};
+const origResolve = Module._resolveFilename;
+Module._resolveFilename = function (request) {
+    if (fakeModules[request]) return 'fake:' + request;
+    return origResolve.apply(this, arguments);
+};
+Object.keys(fakeModules).forEach(function (name) {
+    require.cache['fake:' + name] = {
+        id: 'fake:' + name,
+        filename: 'fake:' + name,
+        loaded: true,
+        exports: fakeModules[name],
+    };
+});
+
+// ---- 伪造插件内部依赖 ----
+function seedCache(relPath, exportsObj) {
+    const p = require.resolve(relPath);
+    require.cache[p] = { id: p, filename: p, loaded: true, exports: exportsObj };
+}
+let removedTaskInstanceIds = [];
+seedCache('../manager/instance_tasks_manager.js', {
+    remove_instance_tasks_by_instance_id: async function (insId) { removedTaskInstanceIds.push(insId); },
+});
+let terminateNotifiedUsers = [];
+let deleteNotifications = [];
+seedCache('../manager/push_manager.js', {
+    send_message_to_specifyUser: async function (msgName, userId) { terminateNotifiedUsers.push(userId); },
+    send_instance_notification: async function (msgName, ins) { deleteNotifications.push({ msgName: msgName, insId: ins._id }); },
+});
+let canAdminFlag = false;
+seedCache('../manager/workflow_manager.js', {
+    canAdmin: function () { return canAdminFlag; },
+});
+let fakeInstance = null;
+let spaceAdmins = [];
+seedCache('../manager/uuflow_manager.js', {
+    getInstance: async function () { return fakeInstance; },
+    getSpace: async function () { return { _id: 'space1', admins: spaceAdmins }; },
+    getSpaceUser: async function (spaceId, userId) { return { user: userId, organizations: ['org1'] }; },
+});
+
+require('../routes/api_workflow_v2_remove.router.js');
+const handler = capturedRoutes['/api/workflow/v2/remove'];
+assert.ok(handler, '未捕获到删除路由 handler');
+
+// ---- 实例构造 ----
+function buildInstance(state, opts) {
+    opts = opts || {};
+    return {
+        _id: 'ins1', space: 'space1', state: state,
+        applicant: 'user_a', submitter: opts.submitter || 'user_a',
+        flow: 'flow1',
+        inbox_users: opts.inbox_users || [], cc_users: opts.cc_users || [],
+        forward_from_instance: opts.forward_from_instance,
+        values: {},
+    };
+}
+
+async function callRemove(userId) {
+    removedInstanceIds = [];
+    insertedDeletedInstances = [];
+    removedTaskInstanceIds = [];
+    terminateNotifiedUsers = [];
+    deleteNotifications = [];
+    const req = {
+        user: { userId: userId, spaceId: 'space1', name: 'name_of_' + userId },
+        body: { instance: { _id: fakeInstance._id } },
+    };
+    const res = {
+        statusCode: null, body: null,
+        status: function (c) { this.statusCode = c; return this; },
+        send: function (b) { this.body = b; return this; },
+    };
+    await handler(req, res);
+    return res;
+}
+
+function assertNotDeleted(res, msgPattern) {
+    assert.ok(res.body.error, '应返回 error，实际：' + JSON.stringify(res.body));
+    assert.ok(msgPattern.test(res.body.error), '错误信息不符，实际：' + res.body.error);
+    assert.strictEqual(removedInstanceIds.length, 0, '实例不应被删除');
+    assert.strictEqual(insertedDeletedInstances.length, 0, '不应写入 deleted_instances');
+    assert.strictEqual(removedTaskInstanceIds.length, 0, '不应删除 instance_tasks');
+}
+
+function assertDeleted(res) {
+    assert.strictEqual(res.body.status, 0, '应返回 status 0，实际：' + JSON.stringify(res.body));
+    assert.deepStrictEqual(removedInstanceIds, ['ins1'], '实例应被删除');
+    assert.strictEqual(insertedDeletedInstances.length, 1, '应写入 deleted_instances');
+    assert.strictEqual(insertedDeletedInstances[0].deleted_by !== undefined, true, '应记录 deleted_by');
+    assert.deepStrictEqual(removedTaskInstanceIds, ['ins1'], '应删除 instance_tasks');
+}
+
+let passed = 0;
+let failed = 0;
+async function run(name, fn) {
+    try {
+        await fn();
+        console.log(`  ✓ ${name}`);
+        passed++;
+    } catch (e) {
+        console.log(`  ✗ ${name}`);
+        console.log(`    ${e.message}`);
+        failed++;
+    }
+}
+
+(async () => {
+    console.log('删除接口状态校验（remove guards）');
+
+    await run('草稿 + 提交人 → 删除成功，不发终止通知', async () => {
+        canAdminFlag = false; spaceAdmins = [];
+        fakeInstance = buildInstance('draft');
+        const res = await callRemove('user_a');
+        assertDeleted(res);
+        assert.strictEqual(terminateNotifiedUsers.length, 0, '草稿删除不应发终止通知');
+        assert.strictEqual(deleteNotifications.length, 0, '草稿删除不应发删除通知');
+    });
+
+    await run('转发产生的草稿 + 被转发人（提交人）→ 删除成功', async () => {
+        canAdminFlag = false; spaceAdmins = [];
+        fakeInstance = buildInstance('draft', { submitter: 'user_b', forward_from_instance: 'ins0' });
+        const res = await callRemove('user_b');
+        assertDeleted(res);
+    });
+
+    await run('审批中 + 提交人（非管理员）→ 拒绝删除', async () => {
+        canAdminFlag = false; spaceAdmins = [];
+        fakeInstance = buildInstance('pending', { inbox_users: ['user_c'] });
+        const res = await callRemove('user_a');
+        assertNotDeleted(res, /审批中/);
+    });
+
+    await run('已结束 + 提交人（非管理员）→ 拒绝删除', async () => {
+        canAdminFlag = false; spaceAdmins = [];
+        fakeInstance = buildInstance('completed');
+        const res = await callRemove('user_a');
+        assertNotDeleted(res, /已结束/);
+    });
+
+    await run('审批中 + 工作区管理员 → 删除成功，通知待办人和传阅人', async () => {
+        canAdminFlag = false; spaceAdmins = ['user_admin'];
+        fakeInstance = buildInstance('pending', { inbox_users: ['user_c'], cc_users: ['user_d'] });
+        const res = await callRemove('user_admin');
+        assertDeleted(res);
+        assert.deepStrictEqual(terminateNotifiedUsers.sort(), ['user_c', 'user_d'], '应通知待办人和传阅人');
+        assert.strictEqual(deleteNotifications.length, 1, '应给申请人发删除通知');
+        assert.strictEqual(deleteNotifications[0].msgName, 'monitor_delete_applicant');
+    });
+
+    await run('审批中 + 流程管理员 → 删除成功', async () => {
+        canAdminFlag = true; spaceAdmins = [];
+        fakeInstance = buildInstance('pending', { inbox_users: ['user_c'] });
+        const res = await callRemove('user_x');
+        assertDeleted(res);
+    });
+
+    await run('非提交人且非管理员 → 拒绝删除（既有行为回归）', async () => {
+        canAdminFlag = false; spaceAdmins = [];
+        fakeInstance = buildInstance('draft');
+        const res = await callRemove('user_z');
+        assertNotDeleted(res, /不能删除/);
+    });
+
+    console.log(`\n${passed} passed, ${failed} failed`);
+    process.exit(failed > 0 ? 1 : 0);
+})();

package/main/default/test/test_retrieve_guards.js

@@ -0,0 +1,308 @@
+/**
+ * 回归测试：取回（/api/workflow/retrieve）的状态与资格校验。
+ *
+ * 背景（线上现象）：
+ *  1. 已结束（state=completed）的申请单，最后一步处理人调用取回接口，
+ *     实例会被重新打开（state 重置为 pending）——实例状态校验被注释掉了，
+ *     且结束 trace 没有 approves，已读校验形同虚设。
+ *  2. retrieve_type 判定为空（当前用户不是上一步唯一处理人、也没有可取回的
+ *     传阅记录）时，路由静默返回 {status: 0}，前端误报「取回成功」并刷新页面。
+ *
+ * 期望（修复后）：
+ *  - 非 pending 状态的申请单一律拒绝取回（含传阅取回），返回明确错误。
+ *  - retrieve_type 为空时返回明确错误，不再静默假成功。
+ *  - 正常取回、滑步取回、退回到开始步骤的已读豁免等既有行为不变。
+ *
+ * 用法：
+ *   node main/default/test/test_retrieve_guards.js
+ *   或 npm run test:retrieve-guards
+ */
+
+const assert = require('assert');
+const Module = require('module');
+
+// ---- 伪造无法在独立环境 resolve 的外部依赖（express / @steedos/*） ----
+const capturedRoutes = {};
+const objectqlUpdates = [];
+const fakeModules = {
+    'express': {
+        Router: function () {
+            return {
+                post: function (path) {
+                    capturedRoutes[path] = arguments[arguments.length - 1];
+                },
+            };
+        },
+    },
+    '@steedos/auth': {
+        requireAuthentication: function (req, res, next) { next(); },
+    },
+    '@steedos/objectql': {
+        getObject: function (name) {
+            return {
+                update: async function (id, doc) { objectqlUpdates.push({ name, id, doc }); return doc; },
+            };
+        },
+    },
+};
+const origResolve = Module._resolveFilename;
+Module._resolveFilename = function (request) {
+    if (fakeModules[request]) return 'fake:' + request;
+    return origResolve.apply(this, arguments);
+};
+Object.keys(fakeModules).forEach(function (name) {
+    require.cache['fake:' + name] = {
+        id: 'fake:' + name,
+        filename: 'fake:' + name,
+        loaded: true,
+        exports: fakeModules[name],
+    };
+});
+
+// ---- 伪造插件内部依赖 ----
+let instanceUpdateCalls = [];
+const dummyInstancesCollection = {
+    updateOne: async function (selector, modifier) {
+        instanceUpdateCalls.push({ selector: selector, modifier: modifier });
+        return { modifiedCount: 1 };
+    },
+};
+const dummyUsersCollection = {
+    findOne: async function (selector) { return { _id: selector._id, name: 'name_of_' + selector._id }; },
+};
+const dummyOrganizationsCollection = {
+    findOne: async function () { return { name: 'org', fullname: 'org' }; },
+};
+function seedCache(relPath, exportsObj) {
+    const p = require.resolve(relPath);
+    require.cache[p] = { id: p, filename: p, loaded: true, exports: exportsObj };
+}
+seedCache('../utils/collection.js', {
+    getCollection: async function (name) {
+        if (name === 'instances') return dummyInstancesCollection;
+        if (name === 'organizations') return dummyOrganizationsCollection;
+        return dummyUsersCollection;
+    },
+    _makeNewID: (function () { let n = 0; return function () { return 'new_id_' + (++n); }; })(),
+});
+seedCache('../manager/push_manager.js', {
+    send_message_current_user: async function () { },
+    send_message_to_specifyUser: async function () { },
+    triggerWebhook: async function () { },
+});
+seedCache('../manager/instance_tasks_manager.js', {
+    insert_instance_tasks: async function () { },
+    update_instance_tasks: async function () { },
+    update_many_instance_tasks: async function () { },
+});
+
+let fakeInstance = null;
+let stepTypes = {};
+seedCache('../manager/uuflow_manager.js', {
+    getInstance: async function () { return fakeInstance; },
+    getFlow: async function () { return { _id: 'flow1' }; },
+    getStep: function (ins, flow, stepId) {
+        return { _id: stepId, name: 'name_' + stepId, step_type: stepTypes[stepId] || 'sign' };
+    },
+    getDueDate: async function () { return null; },
+    getSpaceUser: async function () { return { organization: 'org1' }; },
+    getSpaceUserOrgInfo: async function () {
+        return { organization: 'org1', organization_name: 'org', organization_fullname: 'org' };
+    },
+    setRemindInfo: async function () { },
+    getCurrentStepAutoSubmit: async function () { return false; },
+});
+
+require('../routes/api_workflow_retrieve.router.js');
+const handler = capturedRoutes['/api/workflow/retrieve'];
+assert.ok(handler, '未捕获到取回路由 handler');
+
+// ---- 实例构造 ----
+// 默认结构：填写申请(t1, user_a) → 审批(t2, user_b 已审) → 当前步骤(t3, user_c 待审)
+function buildPendingInstance(opts) {
+    opts = opts || {};
+    const traces = [
+        {
+            _id: 't1', step: 'step_start', name: '填写申请单', is_finished: true, judge: 'submitted',
+            approves: [{ _id: 'a1', user: 'user_a', handler: 'user_a', type: 'draft', judge: 'submitted' }],
+        },
+        {
+            _id: 't2', step: 'step_real', name: '实际审批步骤', is_finished: true, judge: 'approved',
+            previous_trace_ids: ['t1'],
+            approves: [{ _id: 'a2', user: 'user_b', handler: 'user_b', judge: 'approved' }],
+        },
+        {
+            _id: 't3', step: 'step_current', name: '当前步骤', is_finished: false,
+            previous_trace_ids: ['t2'],
+            approves: [{ _id: 'a3', user: 'user_c', handler: 'user_c', is_finished: false, is_read: !!opts.nextStepRead }],
+        },
+    ];
+    return {
+        _id: 'ins1', space: 'space1', state: 'pending', applicant: 'user_a', submitter: 'user_a',
+        flow: 'flow1', form: 'form1', form_version: 'fv1',
+        inbox_users: ['user_c'], outbox_users: ['user_a', 'user_b'], cc_users: [],
+        values: {}, current_step_name: '当前步骤',
+        traces: traces,
+    };
+}
+
+// 已结束实例：填写申请(t1, user_a) → 审批(t2, user_b 已审) → 结束(t_end, 无 approves)
+function buildCompletedInstance(opts) {
+    opts = opts || {};
+    const t2Approves = [{ _id: 'a2', user: 'user_b', handler: 'user_b', judge: 'approved' }];
+    if (opts.withCC) {
+        t2Approves.push({ _id: 'a_cc', user: 'user_cc', handler: 'user_cc', type: 'cc', is_finished: true, judge: 'approved' });
+    }
+    return {
+        _id: 'ins2', space: 'space1', state: 'completed', applicant: 'user_a', submitter: 'user_a',
+        flow: 'flow1', form: 'form1', form_version: 'fv1',
+        inbox_users: [], outbox_users: ['user_a', 'user_b', 'user_cc'], cc_users: [],
+        values: {}, current_step_name: '结束', final_decision: 'approved',
+        traces: [
+            {
+                _id: 't1', step: 'step_start', name: '填写申请单', is_finished: true, judge: 'submitted',
+                approves: [{ _id: 'a1', user: 'user_a', handler: 'user_a', type: 'draft', judge: 'submitted' }],
+            },
+            {
+                _id: 't2', step: 'step_real', name: '实际审批步骤', is_finished: true, judge: 'approved',
+                previous_trace_ids: ['t1'],
+                approves: t2Approves,
+            },
+            {
+                _id: 't_end', step: 'step_end', name: '结束', is_finished: true,
+                previous_trace_ids: ['t2'],
+            },
+        ],
+    };
+}
+
+async function callRetrieve(userId) {
+    instanceUpdateCalls = [];
+    objectqlUpdates.length = 0;
+    const req = {
+        user: { userId: userId, spaceId: 'space1', name: 'name_of_' + userId },
+        body: { _id: fakeInstance._id, retrieve_comment: '取回测试' },
+    };
+    const res = {
+        statusCode: null, body: null,
+        status: function (c) { this.statusCode = c; return this; },
+        send: function (b) { this.body = b; return this; },
+    };
+    await handler(req, res);
+    return res;
+}
+
+let passed = 0;
+let failed = 0;
+async function run(name, fn) {
+    try {
+        await fn();
+        console.log(`  ✓ ${name}`);
+        passed++;
+    } catch (e) {
+        console.log(`  ✗ ${name}`);
+        console.log(`    ${e.message}`);
+        failed++;
+    }
+}
+
+(async () => {
+    console.log('取回接口状态与资格校验（retrieve guards）');
+
+    await run('正常取回：上一步唯一处理人取回，行为不变', async () => {
+        stepTypes = {};
+        fakeInstance = buildPendingInstance();
+        const res = await callRetrieve('user_b');
+        assert.strictEqual(res.body.status, 0, '应返回 status 0，实际：' + JSON.stringify(res.body));
+        const setCall = instanceUpdateCalls.find(c => c.modifier.$set && c.modifier.$set.traces);
+        assert.ok(setCall, '未更新实例 traces');
+        const newTraces = setCall.modifier.$set.traces;
+        const newTrace = newTraces[newTraces.length - 1];
+        assert.strictEqual(newTrace.step, 'step_real', '新 trace 应落在上一步');
+        assert.deepStrictEqual(setCall.modifier.$set.inbox_users, ['user_b']);
+        assert.strictEqual(setCall.modifier.$set.state, 'pending');
+    });
+
+    await run('下一步已读 → 报「下一步处理人已读，不能取回」', async () => {
+        stepTypes = {};
+        fakeInstance = buildPendingInstance({ nextStepRead: true });
+        const res = await callRetrieve('user_b');
+        assert.strictEqual(res.body.status, -1, '应返回 status -1，实际：' + JSON.stringify(res.body));
+        assert.ok(/已读/.test(res.body.msg), '应报已读错误，实际：' + res.body.msg);
+    });
+
+    await run('退回到开始步骤不受已读限制：申请人取回第一步已读的单子仍成功', async () => {
+        stepTypes = { step_start: 'start' };
+        fakeInstance = buildPendingInstance({ nextStepRead: true });
+        // 只保留 填写申请(t1) → 当前步骤(t2')，当前步骤已读，申请人 user_a 取回
+        fakeInstance.traces = [
+            fakeInstance.traces[0],
+            {
+                _id: 't2p', step: 'step_current', name: '当前步骤', is_finished: false,
+                previous_trace_ids: ['t1'],
+                approves: [{ _id: 'a9', user: 'user_c', handler: 'user_c', is_finished: false, is_read: true }],
+            },
+        ];
+        const res = await callRetrieve('user_a');
+        assert.strictEqual(res.body.status, 0, '应返回 status 0，实际：' + JSON.stringify(res.body));
+    });
+
+    await run('滑步后取回：回溯到实际处理过的步骤，中间 skipped trace 一并标记 retrieved', async () => {
+        stepTypes = {};
+        fakeInstance = buildPendingInstance();
+        // 在 t2 和 t3 之间插入被滑步跳过的 t_skip
+        fakeInstance.traces.splice(2, 0, {
+            _id: 't_skip', step: 'step_skipped', name: '被滑步跳过的步骤', is_finished: true, judge: 'skipped',
+            previous_trace_ids: ['t2'],
+            approves: [{ _id: 'a_skip', user: 'user_x', handler: 'user_x', judge: 'skipped' }],
+        });
+        fakeInstance.traces[3].previous_trace_ids = ['t_skip'];
+        const res = await callRetrieve('user_b');
+        assert.strictEqual(res.body.status, 0, '应返回 status 0，实际：' + JSON.stringify(res.body));
+        const setCall = instanceUpdateCalls.find(c => c.modifier.$set && c.modifier.$set.traces);
+        const newTraces = setCall.modifier.$set.traces;
+        assert.strictEqual(newTraces[newTraces.length - 1].step, 'step_real', '新 trace 应落在实际处理过的步骤');
+        const skipTrace = newTraces.find(t => t._id === 't_skip');
+        assert.strictEqual(skipTrace.judge, 'retrieved', '滑步跳过的 trace 应标记为 retrieved');
+    });
+
+    await run('当前用户不是上一步唯一处理人 → 明确报错，不再静默假成功', async () => {
+        stepTypes = {};
+        fakeInstance = buildPendingInstance();
+        // user_a 是提交人且在 outbox_users 中，但上一步（t2）处理人是 user_b
+        const res = await callRetrieve('user_a');
+        assert.strictEqual(res.body.status, -1, '应返回 status -1，实际：' + JSON.stringify(res.body));
+        assert.ok(res.body.msg, '应返回错误信息');
+        assert.strictEqual(instanceUpdateCalls.length, 0, '不应更新实例');
+    });
+
+    await run('已结束实例 → 最后一步处理人取回被拒绝，实例不被重新打开', async () => {
+        stepTypes = {};
+        fakeInstance = buildCompletedInstance();
+        const res = await callRetrieve('user_b');
+        assert.strictEqual(res.body.status, -1, '应返回 status -1，实际：' + JSON.stringify(res.body));
+        assert.ok(/已结束/.test(res.body.msg), '应报申请单已结束，实际：' + res.body.msg);
+        assert.strictEqual(instanceUpdateCalls.length, 0, '不应更新实例（不能重新打开已结束的申请单）');
+    });
+
+    await run('已结束实例 → 传阅取回同样被拒绝', async () => {
+        stepTypes = {};
+        fakeInstance = buildCompletedInstance({ withCC: true });
+        const res = await callRetrieve('user_cc');
+        assert.strictEqual(res.body.status, -1, '应返回 status -1，实际：' + JSON.stringify(res.body));
+        assert.ok(/已结束/.test(res.body.msg), '应报申请单已结束，实际：' + res.body.msg);
+        assert.strictEqual(instanceUpdateCalls.length, 0, '不应更新实例');
+    });
+
+    await run('草稿状态 → 拒绝取回', async () => {
+        stepTypes = {};
+        fakeInstance = buildPendingInstance();
+        fakeInstance.state = 'draft';
+        const res = await callRetrieve('user_a');
+        assert.strictEqual(res.body.status, -1, '应返回 status -1，实际：' + JSON.stringify(res.body));
+        assert.ok(/草稿/.test(res.body.msg), '应报草稿不能取回，实际：' + res.body.msg);
+    });
+
+    console.log(`\n${passed} passed, ${failed} failed`);
+    process.exit(failed > 0 ? 1 : 0);
+})();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steedos-labs/plugin-workflow",
-  "version": "3.0.104",
+  "version": "3.0.105",
   "main": "package.service.js",
   "license": "MIT",
   "files": [
@@ -27,6 +27,8 @@
     "test:approve-values": "node main/default/test/test_getApproveValues.js",
     "test:skip-handler-error": "node main/default/test/test_handleSkipProcessed_handlerError.js",
     "test:return-after-skip": "node main/default/test/test_return_after_skip.js",
+    "test:retrieve-guards": "node main/default/test/test_retrieve_guards.js",
+    "test:remove-guards": "node main/default/test/test_remove_guards.js",
     "test:next-step-users-cc": "node main/default/test/test_next_step_users_value_cc.js",
     "test:flow-validator": "node main/default/test/test_flow_validator.js",
     "test:ajax-error-message": "node main/default/test/test_ajax_error_message.js",