From 99f6992200eb92f908ea41f9acedf33066eeb3e9 Mon Sep 17 00:00:00 2001
From: weicw <weicw@websoft.top>
Date: Sat, 31 Oct 2026 07:04:11 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E4=BB=B7=E6=A0=BC=E8=A1=A8=E6=9F=A5?=
 =?UTF-8?q?=E7=9C=8B=E6=9D=83=E9=99=90=E9=9A=94=E7=A6=BB=E7=94=A8=E4=BE=8B?=
 =?UTF-8?q?=EF=BC=88#58=EF=BC=89=EF=BC=9B=E5=BA=94=E7=94=A8=E8=8F=9C?=
 =?UTF-8?q?=E5=8D=95=E4=B8=8E=E6=8E=88=E4=BA=88=E7=A7=8D=E5=AD=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../approval/ApprovalPriceViewIT.java         | 87 +++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 src/test/java/com/gxwebsoft/approval/ApprovalPriceViewIT.java

diff --git a/src/test/java/com/gxwebsoft/approval/ApprovalPriceViewIT.java b/src/test/java/com/gxwebsoft/approval/ApprovalPriceViewIT.java
new file mode 100644
index 0000000..6e29d54
--- /dev/null
+++ b/src/test/java/com/gxwebsoft/approval/ApprovalPriceViewIT.java
@@ -0,0 +1,87 @@
+package com.gxwebsoft.approval;
+
+import com.gxwebsoft.support.ApprovalTestData;
+import com.gxwebsoft.support.TestAuthentication;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.test.context.ActiveProfiles;
+import org.springframework.test.web.servlet.MockMvc;
+
+import javax.sql.DataSource;
+
+import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.authentication;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+/**
+ * 价格表只读接口（#58）：权限点独立于审批列表权限。
+ *
+ * <p>当前生效版本/历史版本的排序与「未来生效不切换」由价格表实现的 IT 覆盖；
+ * 本类只验证权限边界与该接口在任何数据下都返回可用空态结构。</p>
+ */
+@SpringBootTest
+@AutoConfigureMockMvc
+@ActiveProfiles({"gxtyzx-test", "test"})
+class ApprovalPriceViewIT {
+
+  private static final int TENANT = TestAuthentication.TENANT_ID;
+  private static final String PRICE_VIEW = "approval:price:view";
+
+  @Autowired
+  private MockMvc mockMvc;
+  @Autowired
+  private DataSource dataSource;
+
+  private ApprovalTestData data;
+  private Integer organizationId;
+  private ApprovalTestData.TestUser employee;
+
+  @BeforeEach
+  void setUp() {
+    data = new ApprovalTestData(dataSource);
+    organizationId = data.createOrganization("价格查看部门" + data.uniqueSuffix(), 136);
+    employee = data.createUser("价格查看员工" + data.uniqueSuffix(), organizationId);
+  }
+
+  @AfterEach
+  void tearDown() {
+    data.cleanup();
+  }
+
+  @Test
+  void employeeWithPriceViewPermissionCanReadPage() throws Exception {
+    mockMvc.perform(get("/api/approval/price")
+        .header("tenantId", TENANT)
+        .with(authentication(TestAuthentication.user(employee.userId, employee.username,
+          organizationId, TENANT, PRICE_VIEW))))
+      .andExpect(status().isOk())
+      .andExpect(jsonPath("$.code").value(0))
+      .andExpect(jsonPath("$.data.history").isArray());
+  }
+
+  @Test
+  void listPermissionAloneDoesNotGrantPriceView() throws Exception {
+    // 本仓库约定：业务失败也是 HTTP 200，判定只看 code（403 表示无权限）
+    mockMvc.perform(get("/api/approval/price")
+        .header("tenantId", TENANT)
+        .with(authentication(TestAuthentication.user(employee.userId, employee.username,
+          organizationId, TENANT, "approval:instance:list"))))
+      .andExpect(status().isOk())
+      .andExpect(jsonPath("$.code").value(403));
+  }
+
+  @Test
+  void priceViewAloneDoesNotGrantApprovalList() throws Exception {
+    mockMvc.perform(get("/api/approval/instance/page")
+        .header("tenantId", TENANT)
+        .with(authentication(TestAuthentication.user(employee.userId, employee.username,
+          organizationId, TENANT, PRICE_VIEW))))
+      .andExpect(status().isOk())
+      .andExpect(jsonPath("$.code").value(403));
+  }
+}