[ysch-flow] S2.3 抄送接收人只读可见（F7 前置必修补丁）

requireInstanceVisible 此前只放行提交人/办理人/本校管理员，抄送接收人点开工作台
"抄送我的"行或抄送消息回落链接一律 403——"抄送中心自留、子应用零存储"因此不闭环。
新增 flw_cc 行命中判定（existsByInstanceIdAndUserId，按 instanceId 维度不泛化到本校），
只授予可见、办理权仍在 FlowTaskService 按 assigneeId 复核；中心用户面四处调用点
（详情/进度/出图）自动同口径。embed/url 签发侧 javadoc 同步可见性口径（oapi 层仍只认
schId，用户级判定在子应用后端，跨校与陌生人断言未放宽）。
守卫五态单测：提交人/办理人/管理员/抄送人/陌生人 + 抄送命中范围。

src/test/java/com/yunhai/flowcenter/service/FlowAccessGuardTest.java

@@ -2,6 +2,7 @@ package com.yunhai.flowcenter.service;
 
 import com.yunhai.flowcenter.entity.FlwInstance;
 import com.yunhai.flowcenter.entity.FlwTask;
+import com.yunhai.flowcenter.repository.FlwCcRepository;
 import com.yunhai.flowcenter.repository.FlwTaskRepository;
 import com.yunhai.platform.apistd.BizException;
 import com.yunhai.platform.utils.model.BoaUser;
@@ -15,6 +16,7 @@ import java.util.Collections;
 import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
@@ -26,15 +28,18 @@ import static org.mockito.Mockito.when;
 class FlowAccessGuardTest {
 
     private FlwTaskRepository taskRepository;
+    private FlwCcRepository ccRepository;
     private FlowAccessGuard guard;
     private FlwInstance instance;
 
     @BeforeEach
     void setUp() {
         taskRepository = mock(FlwTaskRepository.class);
-        guard = new FlowAccessGuard(taskRepository);
+        ccRepository = mock(FlwCcRepository.class);
+        guard = new FlowAccessGuard(taskRepository, ccRepository);
         when(taskRepository.findByInstanceIdOrderByIdAsc(anyLong()))
                 .thenReturn(Collections.emptyList());
+        when(ccRepository.existsByInstanceIdAndUserId(anyLong(), anyInt())).thenReturn(false);
 
         instance = new FlwInstance();
         ReflectionTestUtils.setField(instance, "id", 100L);
@@ -94,4 +99,29 @@ class FlowAccessGuardTest {
         assertThrows(BizException.class,
                 () -> guard.requireInstanceVisible(instance, user(37, 1, null)));
     }
+
+    /** F7 前置补丁：抄送接收人只读可见（工作台"抄送我的"行、抄送消息回落链接不再 403） */
+    @Test
+    void ccRecipientCanView() {
+        when(ccRepository.existsByInstanceIdAndUserId(100L, 44)).thenReturn(true);
+
+        assertDoesNotThrow(() -> guard.requireInstanceVisible(instance, user(44, 2, 990001, 9)));
+    }
+
+    /** 陌生人（非提交人/办理人/管理员/抄送人）仍 403——补丁不放大可见范围 */
+    @Test
+    void strangerSameSchoolIsStillDenied() {
+        BizException e = assertThrows(BizException.class,
+                () -> guard.requireInstanceVisible(instance, user(45, 2, 990001, 9)));
+        assertEquals("仅提交人/办理人/本校管理员可查看该办件", e.getMessage());
+    }
+
+    /** 跨校抄送接收人不存在即拒；抄送行必须命中本办件（instanceId 维度，不按 schId 泛化） */
+    @Test
+    void ccLookupIsScopedToInstance() {
+        when(ccRepository.existsByInstanceIdAndUserId(100L, 46)).thenReturn(false);
+
+        assertThrows(BizException.class,
+                () -> guard.requireInstanceVisible(instance, user(46, 2, 990001, 9)));
+    }
 }

src/test/java/com/yunhai/flowcenter/service/FlowDiagramServiceTest.java

@@ -389,8 +389,10 @@ class FlowDiagramServiceTest {
             taskService = mock(FlowTaskService.class);
             instanceService = mock(FlowInstanceService.class);
             diagramService = mock(FlowDiagramService.class);
-            // 真守卫（同 FlowAccessGuardTest 口径）：提交人/办理人/本校管理员
-            FlowAccessGuard accessGuard = new FlowAccessGuard(taskRepository);
+            // 真守卫（同 FlowAccessGuardTest 口径）：提交人/办理人/本校管理员/抄送接收人
+            // 抄送分支本组用例不覆盖，空 mock 即 false（陌生人仍 403 的断言不受影响）
+            FlowAccessGuard accessGuard = new FlowAccessGuard(taskRepository,
+                    mock(com.yunhai.flowcenter.repository.FlwCcRepository.class));
             controller = new FlowUserController(queryService, taskService, instanceService,
                     accessGuard, diagramService, mock(com.yunhai.flowcenter.service.DiagramImageService.class));
         }