feat: add inbound hold lifecycle

iam/src/test/java/com/baiyue/iam/controller/IamOpenApiContractTest.java

@@ -46,6 +46,8 @@ class IamOpenApiContractTest {
                 .contains("merchant:finance:recharge:create")
                 .contains("platform:finance:recharge:review")
                 .contains("platform:finance:customer-account:adjust")
+                .contains("platform:firstleg:inbound:hold")
+                .contains("不会由 `platform:firstleg:inbound:list` 查看权限自动获得")
                 .contains("两者独立授权")
                 .contains("列表权限包含详情只读")
                 .contains("PermissionCodesApiResponse:")

iam/src/test/java/com/baiyue/iam/repository/InboundHoldPermissionSqlContractTest.java

@@ -0,0 +1,67 @@
+package com.baiyue.iam.repository;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.core.io.ClassPathResource;
+
+import java.nio.charset.StandardCharsets;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class InboundHoldPermissionSqlContractTest {
+    @Test
+    void registersHoldAsASeparateWritePermissionUnderInboundList() throws Exception {
+        String sql = sql();
+
+        assertThat(sql).contains(
+                "(5102032, 0, 'PLATFORM', 'BUTTON', 5102030, 'platform:firstleg:inbound:hold'",
+                "'扣货与解除扣货', NULL, 'POST'",
+                "permission_type='BUTTON'",
+                "parent_id=5102030",
+                "http_method='POST'");
+        assertThat(sql).doesNotContain(
+                "permission_code IN ('platform:firstleg:inbound:list', 'platform:firstleg:inbound:hold')",
+                "permission_code IN ('platform:firstleg:inbound:view', 'platform:firstleg:inbound:hold')");
+    }
+
+    @Test
+    void failsClosedWhenTheFixedIdentityIsOccupied() throws Exception {
+        assertThat(sql()).contains(
+                "migrate_inbound_hold_permission",
+                "id = 5102032",
+                "permission_type <> 'BUTTON'",
+                "permission_code = 'platform:firstleg:inbound:hold'",
+                "SIGNAL SQLSTATE '45000'",
+                "权限ID、编码或类型冲突");
+    }
+
+    @Test
+    void grantsHoldOnlyToPlatformAdminByDefault() throws Exception {
+        String sql = sql();
+        int grantStart = sql.indexOf("INSERT IGNORE INTO iam_role_permission");
+        int grantEnd = sql.indexOf(';', grantStart);
+        String grant = sql.substring(grantStart, grantEnd);
+
+        assertThat(grant).contains(
+                "role.app_code='PLATFORM'",
+                "role.role_code='PLATFORM_ADMIN'",
+                "permission.permission_code='platform:firstleg:inbound:hold'");
+        assertThat(grant).doesNotContain(
+                "ORDER_OPERATOR",
+                "WAREHOUSE_OPERATOR",
+                "WAREHOUSE_TALLY",
+                "PLATFORM_CUSTOM_ADMIN");
+    }
+
+    @Test
+    void assertsTheResourceAndDefaultGrant() throws Exception {
+        assertThat(sql()).contains(
+                "入库单扣货权限初始化失败：权限资源不完整",
+                "入库单扣货权限初始化失败：平台超级管理员授权不完整",
+                ") <> 1 THEN");
+    }
+
+    private static String sql() throws Exception {
+        return new ClassPathResource("db/inbound-hold-permission.sql")
+                .getContentAsString(StandardCharsets.UTF_8);
+    }
+}

iam/src/test/java/com/baiyue/iam/service/AuthorizationSnapshotServiceTest.java

@@ -139,6 +139,22 @@ class AuthorizationSnapshotServiceTest {
                 "platform:finance:customer-account:adjust");
     }
 
+    @Test
+    void exposesInboundHoldIndependentlyFromReadPermissions() {
+        when(mapper.countActiveIdentity(51L, 0L, 19L)).thenReturn(1);
+        when(mapper.findRoles(51L, 0L, 19L, "PLATFORM")).thenReturn(List.of("PLATFORM_ADMIN"));
+        when(mapper.findPermissions(51L, 0L, 19L, "PLATFORM")).thenReturn(List.of(
+                "platform:firstleg:inbound:list",
+                "platform:firstleg:inbound:hold"));
+
+        var permissions = service.currentPermissions(new AuthenticatedUser(51L, 0L, 0L, 19L,
+                "platform-admin", "PLATFORM", "PLATFORM", java.util.Set.of()), "PLATFORM");
+
+        assertThat(permissions).containsExactlyInAnyOrder(
+                "platform:firstleg:inbound:list",
+                "platform:firstleg:inbound:hold");
+    }
+
     @Test
     void rejectsIncompleteCurrentIdentityAsBusinessError() {
         assertThatThrownBy(() -> service