fix(lastleg): unblock inbound plan handoff

lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/controller/InboundPlanControllerTest.java

@@ -3,6 +3,7 @@ package com.baiyue.lastleg.inboundplan.controller;
 import com.baiyue.common.core.api.PageResult;
 import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.inboundplan.dto.InboundPlanRequests;
+import com.baiyue.lastleg.inboundplan.dto.ConvertInboundPlanRequest;
 import com.baiyue.lastleg.inboundplan.dto.UpdateFbaAppointmentRequest;
 import com.baiyue.lastleg.inboundplan.service.InboundFbaAppointmentService;
 import com.baiyue.lastleg.inboundplan.service.InboundPlanService;
@@ -20,6 +21,7 @@ import java.time.LocalDateTime;
 
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.when;
 
 @ExtendWith(MockitoExtension.class)
@@ -57,6 +59,34 @@ class InboundPlanControllerTest {
         verify(appointmentService).update("100", "APT-1", request);
     }
 
+    @Test
+    void platformConversionRequiresAnExplicitCustomer() {
+        assertThatThrownBy(() -> controller.convert(platform(), new ConvertInboundPlanRequest(2L, null)))
+            .isInstanceOf(ResponseStatusException.class)
+            .hasMessageContaining("平台生成入库计划必须指定客户");
+        verify(service, never()).convert(org.mockito.ArgumentMatchers.any(), org.mockito.ArgumentMatchers.any());
+    }
+
+    @Test
+    void platformConversionPassesTheProvidedLongCustomerId() {
+        ConvertInboundPlanRequest request = new ConvertInboundPlanRequest(9223372036854775807L,
+            "193000000000200003");
+
+        controller.convert(platform(), request);
+
+        verify(service).convert("193000000000200003", 9223372036854775807L);
+    }
+
+    @Test
+    void customerConversionIgnoresRequestedCustomerAndUsesAuthenticatedScope() {
+        AuthenticatedUser customer = new AuthenticatedUser(8L, 100L, 100L, 9L, "customer", "MERCHANT", "WEB", Set.of());
+        ConvertInboundPlanRequest request = new ConvertInboundPlanRequest(2L, "200");
+
+        controller.convert(customer, request);
+
+        verify(service).convert("100", 2L);
+    }
+
     private static AuthenticatedUser platform() {
         return new AuthenticatedUser(7L, 0L, 0L, 8L, "operator", "PLATFORM", "WEB",
             Set.of("platform:overseas-warehouse:inbound-order:list"));

lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/InboundPlanServiceTest.java

@@ -161,6 +161,26 @@ class InboundPlanServiceTest {
         verify(planMapper, never()).insert(any(InboundPlan.class));
     }
 
+    @Test
+    void refusesMissingCustomerScopeBeforeLookingUpAnOrder() {
+        ResponseStatusException error = assertThrows(ResponseStatusException.class, () -> service.convert(null, 2L));
+
+        assertEquals(400, error.getStatusCode().value());
+        assertEquals("平台生成入库计划必须指定客户", error.getReason());
+        verify(orderMapper, never()).lockOrder(any(), any());
+    }
+
+    @Test
+    void wrongCustomerCannotResolveAnOrderOutsideItsScope() {
+        when(orderMapper.lockOrder("200", 2L)).thenReturn(List.of());
+
+        ResponseStatusException error = assertThrows(ResponseStatusException.class, () -> service.convert("200", 2L));
+
+        assertEquals(404, error.getStatusCode().value());
+        verify(orderMapper).lockOrder("200", 2L);
+        verify(planMapper, never()).insert(any(InboundPlan.class));
+    }
+
     @Test
     void rejectsTransferWarehouseThatDiffersFromCargoSnapshots() {
         SourceOrderSnapshot invalid = new SourceOrderSnapshot(1L, "100", "CONT-1", "RK-1",