优化

warehouse-overseas-service/src/test/java/com/baiyue/warehouse/controller/WarehouseResourceControllerTest.java

@@ -34,20 +34,29 @@ class WarehouseResourceControllerTest {
         PlatformWarehouseResourceController controller = platformController();
 
         assertThatThrownBy(() -> controller.location(user(10001L, "MERCHANT"),
-            10002L, 20001L, 30001L))
+            20001L, 30001L))
             .isInstanceOf(BizException.class)
             .hasMessageContaining("平台端");
     }
 
     @Test
-    void platformApiUsesExplicitTargetTenant() {
+    void platformApiUsesPublicResourceScope() {
         PlatformWarehouseResourceController controller = platformController();
         WarehouseLocationEntity expected = new WarehouseLocationEntity();
-        when(service.location(10002L, 20001L, 30001L)).thenReturn(expected);
+        when(service.location(0L, 20001L, 30001L)).thenReturn(expected);
 
-        controller.location(user(1L, "PLATFORM"), 10002L, 20001L, 30001L);
+        controller.location(user(0L, "PLATFORM"), 20001L, 30001L);
 
-        verify(service).location(10002L, 20001L, 30001L);
+        verify(service).location(0L, 20001L, 30001L);
+    }
+
+    @Test
+    void platformApiRejectsPlatformAppWithCustomerScope() {
+        PlatformWarehouseResourceController controller = platformController();
+
+        assertThatThrownBy(() -> controller.location(user(10001L, "PLATFORM"), 20001L, 30001L))
+            .isInstanceOf(BizException.class)
+            .hasMessageContaining("平台端");
     }
 
     private static AuthenticatedUser user(long customerId, String appCode) {

warehouse-overseas-service/src/test/java/com/baiyue/warehouse/controller/WarehouseResourcePermissionContractTest.java

@@ -0,0 +1,41 @@
+package com.baiyue.warehouse.controller;
+
+import io.swagger.v3.oas.annotations.Operation;
+import org.junit.jupiter.api.Test;
+import org.springframework.security.access.prepost.PreAuthorize;
+
+import java.lang.reflect.Method;
+import java.util.Arrays;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+class WarehouseResourcePermissionContractTest {
+    private static final String PREFIX = "platform:overseas-warehouse:";
+
+    @Test
+    void locationAndPalletEndpointsUseOnlyCanonicalAuthorities() {
+        Map<String, Method> methods = Arrays.stream(PlatformWarehouseResourceController.class.getDeclaredMethods())
+            .filter(method -> method.isAnnotationPresent(PreAuthorize.class))
+            .collect(Collectors.toMap(Method::getName, method -> method));
+
+        assertPermission(methods.get("locations"), PREFIX + "location:list");
+        assertPermission(methods.get("location"), PREFIX + "location:list");
+        assertPermission(methods.get("createLocation"), PREFIX + "location:create");
+        assertPermission(methods.get("updateLocation"), PREFIX + "location:edit");
+        assertPermission(methods.get("deleteLocation"), PREFIX + "location:delete");
+        assertPermission(methods.get("pallets"), PREFIX + "pallet:list");
+        assertPermission(methods.get("pallet"), PREFIX + "pallet:list");
+        assertPermission(methods.get("createPallet"), PREFIX + "pallet:create");
+        assertPermission(methods.get("updatePallet"), PREFIX + "pallet:edit");
+        assertPermission(methods.get("deletePallet"), PREFIX + "pallet:delete");
+    }
+
+    private static void assertPermission(Method method, String authority) {
+        PreAuthorize preAuthorize = method.getAnnotation(PreAuthorize.class);
+        Operation operation = method.getAnnotation(Operation.class);
+        assertEquals("hasAuthority('" + authority + "')", preAuthorize.value());
+        assertEquals("Required authority: " + authority, operation.description());
+    }
+}

warehouse-overseas-service/src/test/java/com/baiyue/warehouse/service/WarehouseResourceServiceTest.java

@@ -67,6 +67,23 @@ class WarehouseResourceServiceTest {
         assertThat(captor.getValue().getWarehouseId()).isEqualTo(WAREHOUSE);
     }
 
+    @Test
+    void platformPalletUsesPublicScopeAgainstAnyExistingWarehouse() {
+        WarehouseEntity warehouse = warehouse();
+        when(repository.findWarehouseById(WAREHOUSE)).thenReturn(warehouse);
+        WarehouseLocationEntity location = new WarehouseLocationEntity();
+        location.setId(30001L);
+        when(repository.findLocation(0L, WAREHOUSE, 30001L)).thenReturn(location);
+
+        service.createPallet(0L, WAREHOUSE, new PalletRequests.SaveRequest(
+            "PLT-PUBLIC", "STANDARD", null, BigDecimal.ONE, "IDLE", 30001L, null));
+
+        ArgumentCaptor<WarehousePalletEntity> captor = ArgumentCaptor.forClass(WarehousePalletEntity.class);
+        verify(repository).insertPallet(captor.capture());
+        assertThat(captor.getValue().getCustomerId()).isZero();
+        assertThat(captor.getValue().getWarehouseId()).isEqualTo(WAREHOUSE);
+    }
+
     @Test
     void rejectsResourceAccessWhenWarehouseDoesNotBelongToTenant() {
         when(repository.warehouseOwned(TENANT, WAREHOUSE)).thenReturn(false);