feat(oapi): 办件进度/流程图token出图/托管撤回 + CAS直嵌示意图（两会话产物合入）

2026-09-17 01:03:57 +08:00
parent b8441065d0
commit 6afc7d7b92
10 changed files with 978 additions and 1 deletions
@@ -169,6 +169,60 @@ class OapiFlowContractIT extends FlowTestSupport {
        assertNotEquals(0, badResp.getBody().get("code").asInt(), "不可达回调地址应被探活拦截");
    }

+    /**
+     * 撤回托管件契约（2026-09-16 补：此前只有 CAS 用户面端点，业务应用只能浏览器直调）：
+     * 提交人本人 → 200 + 办件 40 + 待办失效；非提交人 → 业务码拒绝（应用签名不替代身份）。
+     */
+    @Test
+    void withdraw_bySubmitter_whenApproving() {
+        mapDept("ybb", 101, "甲");
+        FlwDef def = saveAndPublishDef("t15", "撤回", linearDef("ybb", "审核"));
+        String body = "{"
+                + "\"flowGuid\":\"" + def.getFlowGuid() + "\","
+                + "\"bizType\":\"svc_item\",\"bizId\":\"apply-w1\",\"bizTitle\":\"张三的撤回件\","
+                + "\"submitterId\":201,\"submitterName\":\"张三\"}";
+        Long instanceId = unwrap(client.post("/oapi/flow/apply?schId=1", body, JsonNode.class)
+                .getBody()).get("instanceId").asLong();
+        assertEquals(1, taskRepository.findByInstanceIdAndStatus(instanceId, 0).size());
+
+        // 非提交人（202）代撤 → 拒绝
+        ResponseEntity<JsonNode> forged = client.post(
+                "/oapi/flow/instance/" + instanceId + "/withdraw?schId=1&submitterId=202", null, JsonNode.class);
+        assertNotEquals(0, forged.getBody().get("code").asInt(), "非提交人撤回应被拒绝");
+        assertEquals(10, instanceRepository.findById(instanceId).get().getStatus());
+
+        // 提交人本人（201）→ 撤回成功
+        ResponseEntity<JsonNode> ok = client.post(
+                "/oapi/flow/instance/" + instanceId + "/withdraw?schId=1&submitterId=201", null, JsonNode.class);
+        assertEquals(200, ok.getStatusCodeValue());
+        assertEquals(0, ok.getBody().get("code").asInt(), "撤回成功须返回业务成功码");
+        assertEquals(40, instanceRepository.findById(instanceId).get().getStatus());
+        assertEquals(0, taskRepository.findByInstanceIdAndStatus(instanceId, 0).size(), "待办任务须全部失效");
+
+        // 重复撤回（已 40）→ 拒绝
+        ResponseEntity<JsonNode> again = client.post(
+                "/oapi/flow/instance/" + instanceId + "/withdraw?schId=1&submitterId=201", null, JsonNode.class);
+        assertNotEquals(0, again.getBody().get("code").asInt(), "非审批中状态不可撤回");
+    }
+
+    /** 跨租户撤回：schId 不符 → 拒绝，且不得改动办件 */
+    @Test
+    void withdraw_crossTenant_rejected() {
+        mapDept("ybb", 101, "甲");
+        FlwDef def = saveAndPublishDef("t16", "跨租户撤回", linearDef("ybb", "审核"));
+        String body = "{"
+                + "\"flowGuid\":\"" + def.getFlowGuid() + "\","
+                + "\"bizType\":\"svc_item\",\"bizId\":\"apply-w2\",\"bizTitle\":\"跨租户\","
+                + "\"submitterId\":201,\"submitterName\":\"张三\"}";
+        Long instanceId = unwrap(client.post("/oapi/flow/apply?schId=1", body, JsonNode.class)
+                .getBody()).get("instanceId").asLong();
+
+        ResponseEntity<JsonNode> resp = client.post(
+                "/oapi/flow/instance/" + instanceId + "/withdraw?schId=2&submitterId=201", null, JsonNode.class);
+        assertNotEquals(0, resp.getBody().get("code").asInt(), "跨租户撤回应被拒绝");
+        assertEquals(10, instanceRepository.findById(instanceId).get().getStatus());
+    }
+
    private JsonNode unwrap(JsonNode body) {
        return body.get("data");
    }