fix(assets): expose full inventory for scoped users and stabilize previews

src/server/routes/asset-assistant/model.test.ts

@@ -40,14 +40,14 @@ const vehicles = ["Inventory", "Abnormal", "Pending", "Operating"].map(
     }) as Vehicle,
 );
 
-test("permissions and company filters apply before aggregation and detail generation", () => {
+test("public inventory and company filters apply before aggregation and detail generation", () => {
   const visible = visibleVehicles(vehicles, user, "甲公司");
   const result = assetResult(visible, validatePlan(plan));
-  assert.equal(result.metrics[0].value, 1);
+  assert.equal(result.metrics[0].value, 2);
   assert.equal(result.groups[0].count, result.rows.length);
   assert.deepEqual(
     result.rows.map((v) => v.id),
-    ["0"],
+    ["0", "1"],
   );
 });
 test("Shanghai counts include districts and preserve permission and company scope", () => {
@@ -59,8 +59,8 @@ test("Shanghai counts include districts and preserve permission and company scop
   assert.equal(all.groups.length, 1);
   assert.equal(all.groups[0].count, 4);
   const scoped = assetResult(visibleVehicles(input, user, "甲公司"), query);
-  assert.equal(scoped.metrics[0].value, 2);
-  assert.deepEqual(scoped.rows.map(v => v.id).sort(), ["0", "3"]);
+  assert.equal(scoped.metrics[0].value, 3);
+  assert.deepEqual(scoped.rows.map(v => v.id).sort(), ["0", "1", "3"]);
   assert.ok(scoped.rows.every(v => v.city === "上海市"));
 });
 
@@ -155,12 +155,12 @@ test("presentation receives authorized aggregates while vehicle rows stay in the
   const result = events.find((e) => e.type === "result").result;
   assert.deepEqual(
     result.rows.map((r: { id: string }) => r.id),
-    ["0", "2"],
+    ["0", "1", "2"],
   );
   assert.equal(prompts.length, 2);
   const presentationInput = JSON.parse(JSON.parse(prompts[1]).messages[1].content);
   assert.equal(presentationInput.stage, "presentation");
-  assert.equal(presentationInput.results[0].metrics[0].value, 2);
+  assert.equal(presentationInput.results[0].metrics[0].value, 3);
   assert.equal(presentationInput.results[0].rows, undefined);
   assert.ok(
     prompts.every(
@@ -180,3 +180,18 @@ test("inventory subsets do not inherit parent inventory metric cards", () => {
     assert.doesNotMatch(r.summary, /其中异动.*待交车/);
   }
 });
+
+test("personal and department scopes include all current stock subsets but keep operating vehicles restricted", () => {
+  const stock = vehicles.slice(0, 3).map(v => ({ ...v, subjectOrg: "甲公司", managerId: "other", departmentName: "乙部门" }));
+  const ownOperating = vehicles[3];
+  const foreignOperating = { ...ownOperating, id: "foreign-operating", managerId: "other", departmentName: "乙部门" };
+  const input = [...stock, ownOperating, foreignOperating];
+  for (const permissionLevel of ["personal", "department"] as const) {
+    const visible = visibleVehicles(input, { ...user, permissionLevel }, "甲公司");
+    assert.deepEqual(visible.map(v => v.id), ["0", "1", "2", "3"]);
+    for (const [category, expected] of [["inventory", ["0", "1", "2"]], ["abnormal", ["1"]], ["pending", ["2"]], ["operating", ["3"]]] as const) {
+      const result = assetResult(visible, validatePlan({ ...plan, category }));
+      assert.deepEqual(result.rows.map(v => v.id), expected);
+    }
+  }
+});