优化

lastleg-service/src/main/java/com/baiyue/lastleg/trucking/controller/MerchantUsTruckOrderController.java

@@ -45,7 +45,7 @@ public class MerchantUsTruckOrderController {
     @PatchMapping("/{orderNo}")
     public ApiResponse<UsTruckOrderResponses.Detail> update(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String orderNo, @Valid @RequestBody UsTruckOrderRequests.Update request) {
-        return ApiResponse.success(service.update(customer(user), orderNo, request));
+        return ApiResponse.success(service.update(customer(user), orderNo, operator(user), request));
     }
 
     private String customer(AuthenticatedUser user) {

lastleg-service/src/main/java/com/baiyue/lastleg/trucking/controller/PlatformUsTruckOrderController.java

@@ -6,10 +6,13 @@ import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.trucking.dto.UsTruckOrderRequests;
 import com.baiyue.lastleg.trucking.dto.UsTruckOrderResponses;
 import com.baiyue.lastleg.trucking.service.UsTruckOrderService;
+import com.baiyue.lastleg.security.OverseasPermissions;
+import io.swagger.v3.oas.annotations.Operation;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PatchMapping;
 import org.springframework.web.bind.annotation.PathVariable;
@@ -26,32 +29,59 @@ public class PlatformUsTruckOrderController {
     @Resource private UsTruckOrderService service;
 
     @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.TRUCK_LIST + "')")
+    @Operation(summary = "Page local truck orders", description = "Required authority: " + OverseasPermissions.TRUCK_LIST)
     public ApiResponse<PageResult<UsTruckOrderResponses.Summary>> page(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid UsTruckOrderRequests.Query query) {
         requirePlatform(user);
         return ApiResponse.success(service.page(null, query));
     }
 
+    @PostMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.TRUCK_CREATE + "')")
+    @Operation(summary = "Create a local truck order", description = "Required authority: " + OverseasPermissions.TRUCK_CREATE)
+    public ApiResponse<UsTruckOrderResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
+        @RequestParam String customerId, @Valid @RequestBody UsTruckOrderRequests.Create request) {
+        requirePermission(user, OverseasPermissions.TRUCK_CREATE);
+        return ApiResponse.success(service.create(requiredCustomer(customerId), operator(user), request));
+    }
+
     @GetMapping("/{orderNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.TRUCK_LIST + "')")
+    @Operation(summary = "Get a local truck order", description = "Required authority: " + OverseasPermissions.TRUCK_LIST)
     public ApiResponse<UsTruckOrderResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @RequestParam String customerId, @PathVariable String orderNo) {
         requirePlatform(user);
         return ApiResponse.success(service.detail(requiredCustomer(customerId), orderNo));
     }
 
+    @PatchMapping("/{orderNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.TRUCK_EDIT + "')")
+    @Operation(summary = "Update a local truck order", description = "Required authority: " + OverseasPermissions.TRUCK_EDIT)
+    public ApiResponse<UsTruckOrderResponses.Detail> update(@AuthenticationPrincipal AuthenticatedUser user,
+        @RequestParam String customerId, @PathVariable String orderNo,
+        @Valid @RequestBody UsTruckOrderRequests.Update request) {
+        requirePermission(user, OverseasPermissions.TRUCK_EDIT);
+        return ApiResponse.success(service.update(requiredCustomer(customerId), orderNo, operator(user), request));
+    }
+
     @PatchMapping("/{orderNo}/status")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.TRUCK_STATUS + "')")
+    @Operation(summary = "Change local truck order status", description = "Required authority: " + OverseasPermissions.TRUCK_STATUS)
     public ApiResponse<UsTruckOrderResponses.Detail> changeStatus(@AuthenticationPrincipal AuthenticatedUser user,
         @RequestParam String customerId, @PathVariable String orderNo,
         @Valid @RequestBody UsTruckOrderRequests.ChangeStatus request) {
-        requirePermission(user);
+        requirePermission(user, OverseasPermissions.TRUCK_STATUS);
         return ApiResponse.success(service.changeStatus(requiredCustomer(customerId), orderNo, operator(user), request));
     }
 
     @PostMapping("/{orderNo}/receive-pallets")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.TRUCK_STATUS + "')")
+    @Operation(summary = "Receive pallets for a local truck order", description = "Required authority: " + OverseasPermissions.TRUCK_STATUS)
     public ApiResponse<UsTruckOrderResponses.Detail> receivePallets(@AuthenticationPrincipal AuthenticatedUser user,
         @RequestParam String customerId, @PathVariable String orderNo,
         @Valid @RequestBody UsTruckOrderRequests.ReceivePallets request) {
-        requirePermission(user);
+        requirePermission(user, OverseasPermissions.TRUCK_STATUS);
         return ApiResponse.success(service.receivePallets(requiredCustomer(customerId), orderNo, operator(user), request));
     }
 
@@ -62,11 +92,10 @@ public class PlatformUsTruckOrderController {
         }
     }
 
-    private void requirePermission(AuthenticatedUser user) {
+    private void requirePermission(AuthenticatedUser user, String permission) {
         requirePlatform(user);
-        if (user.permissions() == null || !user.permissions().contains(UsTruckOrderService.MANAGE_PERMISSION)) {
-            throw new ResponseStatusException(HttpStatus.FORBIDDEN,
-                UsTruckOrderService.MANAGE_PERMISSION + " permission is required");
+        if (user.permissions() == null || !user.permissions().contains(permission)) {
+            throw new ResponseStatusException(HttpStatus.FORBIDDEN, permission + " permission is required");
         }
     }