baiyue-firstleg/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/controller/WarehouseResourcePermissionContractTest.java

package com.baiyue.warehouse.controller;

import io.swagger.v3.oas.annotations.Operation;
import org.junit.jupiter.api.Test;
import org.springframework.security.access.prepost.PreAuthorize;

import java.lang.reflect.Method;
import java.util.Arrays;
import java.util.Map;
import java.util.stream.Collectors;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNull;

class WarehouseResourcePermissionContractTest {
    private static final String PREFIX = "platform:overseas-warehouse:";

    @Test
    void locationAndPalletEndpointsUseOnlyCanonicalAuthorities() {
        Map<String, Method> methods = Arrays.stream(PlatformWarehouseResourceController.class.getDeclaredMethods())
            .filter(method -> method.isAnnotationPresent(PreAuthorize.class))
            .collect(Collectors.toMap(Method::getName, method -> method));

        assertPermission(methods.get("locations"), PREFIX + "location:list");
        assertPermission(methods.get("location"), PREFIX + "location:list");
        assertPermission(methods.get("createLocation"), PREFIX + "location:create");
        assertPermission(methods.get("updateLocation"), PREFIX + "location:edit");
        assertPermission(methods.get("deleteLocation"), PREFIX + "location:delete");
        assertPermission(methods.get("pallets"), PREFIX + "pallet:list");
        assertPermission(methods.get("pallet"), PREFIX + "pallet:list");
        assertPermission(methods.get("updatePallet"), PREFIX + "pallet:edit");
        assertPermission(methods.get("deletePallet"), PREFIX + "pallet:delete");

        Method createPallet = Arrays.stream(PlatformWarehouseResourceController.class.getDeclaredMethods())
            .filter(method -> "createPallet".equals(method.getName()))
            .findFirst()
            .orElseThrow();
        assertNull(createPallet.getAnnotation(PreAuthorize.class));
        assertEquals("Platform access required", createPallet.getAnnotation(Operation.class).description());
    }

    private static void assertPermission(Method method, String authority) {
        PreAuthorize preAuthorize = method.getAnnotation(PreAuthorize.class);
        Operation operation = method.getAnnotation(Operation.class);
        assertEquals("hasAuthority('" + authority + "')", preAuthorize.value());
        assertEquals("Required authority: " + authority, operation.description());
    }
}