@steedos-labs/plugin-workflow 3.0.66 → 3.0.67

package/main/default/routes/api_workflow_instance_hide.router.js

@@ -0,0 +1,93 @@
+/*
+ * @Description: 隐藏/显示审批单
+ */
+'use strict';
+const express = require('express');
+const router = express.Router();
+const { requireAuthentication } = require("@steedos/auth");
+const PermissionManager = require('../manager/permission_manager');
+const { getCollection } = require('../utils/collection');
+
+/**
+ * 隐藏或显示审批单
+ * body {
+ *   instance_id: string,
+ *   is_hidden: boolean
+ * }
+ */
+router.post('/api/workflow/instance/hide', requireAuthentication, async function (req, res) {
+    try {
+        const userSession = req.user;
+        const userId = userSession.userId;
+        const spaceId = userSession.spaceId;
+        const { instance_id, is_hidden } = req.body;
+
+        if (!instance_id) {
+            throw new Error("instance_id is required");
+        }
+
+        const instancesColl = await getCollection('instances');
+        const instance = await instancesColl.findOne(
+            { _id: instance_id },
+            { projection: { state: 1, space: 1, flow: 1, is_hidden: 1 } }
+        );
+
+        if (!instance) {
+            throw new Error("未找到申请单");
+        }
+
+        if (instance.state !== 'completed') {
+            throw new Error("只能对已完成的申请单执行此操作");
+        }
+
+        // 检查权限：space admin 或 flow admin
+        const spacesColl = await getCollection('spaces');
+        const space = await spacesColl.findOne(
+            { _id: instance.space },
+            { projection: { admins: 1 } }
+        );
+
+        const isSpaceAdmin = space && space.admins && space.admins.includes(userId);
+
+        let hasFlowAdmin = false;
+        if (!isSpaceAdmin) {
+            const permissions = await PermissionManager.getFlowPermissions(instance.flow, userId);
+            hasFlowAdmin = permissions.includes('admin');
+        }
+
+        if (!isSpaceAdmin && !hasFlowAdmin) {
+            throw new Error("无权执行此操作");
+        }
+
+        const now = new Date();
+        const setObj = {
+            is_hidden: !!is_hidden,
+            modified: now,
+            modified_by: userId
+        };
+
+        await instancesColl.updateOne(
+            { _id: instance_id },
+            { $set: setObj }
+        );
+
+        // 同步更新 instance_tasks 的 is_hidden
+        const instanceTasksColl = await getCollection('instance_tasks');
+        await instanceTasksColl.updateMany(
+            { instance: instance_id },
+            { $set: { is_hidden: !!is_hidden, modified: now, modified_by: userId } }
+        );
+
+        res.status(200).json({
+            success: true,
+            message: is_hidden ? "隐藏审批单成功" : "显示审批单成功"
+        });
+    } catch (e) {
+        console.error('api_workflow_instance_hide error:', e);
+        res.status(200).json({
+            errors: [{ errorMessage: e.message }]
+        });
+    }
+});
+
+exports.default = router;

package/main/default/routes/api_workflow_next_step_users.router.js

@@ -300,9 +300,24 @@ router.post('/api/workflow/v2/nextStepUsersValue', requireAuthentication, async
             newNextUsers = step_approve[nextStepId] || [];
         }
 
+        // 校验 newNextUsers 中的用户是否存在于 space_users 中
+        let uniqueNextUsers = _.isArray(newNextUsers) ? _.uniq(newNextUsers) : [newNextUsers];
+        if (uniqueNextUsers.length > 0) {
+            const existingUsers = await objectql.getObject('space_users').find({
+                filters: [['space', '=', spaceId], ['user', 'in', uniqueNextUsers]],
+                fields: ['user']
+            });
+            const existingUserIds = _.map(existingUsers, 'user');
+            const missingUserIds = _.difference(uniqueNextUsers, existingUserIds);
+            if (missingUserIds.length > 0) {
+                error = `下一步处理人不存在或已离职: ${missingUserIds.join(', ')}`;
+            }
+        }
+
         res.status(200).send({
-            'value': _.isArray(newNextUsers) ? _.uniq(newNextUsers) : newNextUsers,
-            'error': error
+            'value': uniqueNextUsers,
+            '_error': error,
+            status: 0
         });
     } catch (error) {
         console.error(error);