From 27d281d4b371c2da88b88a5b5039992ad638f7f5 Mon Sep 17 00:00:00 2001 From: ouyangxq <775153912@qq.com> Date: Thu, 17 Sep 2026 18:25:05 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BC=98=E5=8C=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../service/OverseasTokenServiceTest.java | 2 +- deploy/sql/README.md | 2 +- deploy/sql/头程数据库统一增量-MySQL8.sql | 50 ++++++-- gateway-overseas/AGENTS.md | 2 +- .../main/resources/application-overseas.yml | 2 +- .../main/resources/db/lastleg-permissions.sql | 108 ++++++++++++++--- iam/src/main/resources/openapi/iam-v1.yaml | 2 +- .../controller/IamOpenApiContractTest.java | 6 +- ...urnInventoryPermissionSqlContractTest.java | 2 +- ...seasCustomerPermissionSqlContractTest.java | 44 ++++--- .../AuthorizationSnapshotServiceTest.java | 14 ++- lastleg-service/AGENTS.md | 6 +- .../MerchantLastlegOrderController.java | 3 + .../MerchantCargoDiscardController.java | 7 ++ .../MerchantLocalLooseboardController.java | 5 +- ...MerchantOverseasProcurementController.java | 4 +- .../MerchantRelabelApplicationController.java | 12 ++ .../MerchantReturnOrderController.java | 17 ++- .../lastleg/security/OverseasPermissions.java | 26 ++++- .../MerchantWarehouseTransferController.java | 6 + .../MerchantUsTruckOrderController.java | 5 +- .../openapi/overseas-business-v1.yaml | 44 +++---- ...rchantOverseasCustomerApiContractTest.java | 80 +++++++++++-- .../MerchantOverseasOpenApiContractTest.java | 11 +- .../lastleg/relabel/RelabelContractTest.java | 5 +- .../initialization-baseline-contract.test.mjs | 2 +- scripts/agents-index-contract.ps1 | 3 +- warehouse-overseas-service/AGENTS.md | 2 +- .../MerchantWarehouseResourceController.java | 109 ------------------ .../WarehouseResourceControllerTest.java | 18 --- 30 files changed, 370 insertions(+), 229 deletions(-) delete mode 100644 warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/MerchantWarehouseResourceController.java diff --git a/auth/src/test/java/com/baiyue/auth/service/OverseasTokenServiceTest.java b/auth/src/test/java/com/baiyue/auth/service/OverseasTokenServiceTest.java index 65c0769af..cda05aa12 100644 --- a/auth/src/test/java/com/baiyue/auth/service/OverseasTokenServiceTest.java +++ b/auth/src/test/java/com/baiyue/auth/service/OverseasTokenServiceTest.java @@ -50,7 +50,7 @@ class OverseasTokenServiceTest { account.setDefaultMembershipId(84L); account.setDefaultAppCode("MERCHANT"); String authority = "platform:overseas-master-data:quote:list"; String merchantAuthority = "merchant:warehouse:delivery:list"; - String merchantCrossBorderAuthority = "merchant:cross-border:procurement"; + String merchantCrossBorderAuthority = "merchant:cross-border:procurement:list"; String lastlegAuthority = "lastleg:pda:operate"; String financeAuthority = "platform:finance:fee-source:edit"; String domesticAuthority = "platform:firstleg:order:list"; diff --git a/deploy/sql/README.md b/deploy/sql/README.md index d5fc094b2..5ecbc95e8 100644 --- a/deploy/sql/README.md +++ b/deploy/sql/README.md @@ -40,7 +40,7 @@ | 所属库 | 保留内容 | 不包含 | |---|---|---| -| Auth / IAM | 平台主体、唯一平台管理员、8 个系统角色及企业管理员模板、346 个权限、521 条角色权限、7 个数据范围、客户编号起点 | 测试客户、固定客户账号、额外扩权 | +| Auth / IAM | 平台主体、唯一平台管理员、8 个系统角色及企业管理员模板、364 个权限、539 条角色权限、7 个数据范围、客户编号起点 | 测试客户、固定客户账号、额外扩权 | | Warehouse | 既有公共仓目录 318 条及地址；义乌、东莞、洛杉矶、纽约 4 个作业仓收货能力 | 示例供应商、快递、往来单位、托盘、库位、预占、库存 | | Firstleg | 112 个费用项目、15 个渠道目录、7 个始发地别名、4 个公共仓映射 | 客户报价、订单、入库、实测或履约记录 | | File / Finance | 导出互斥键 `GLOBAL_CREATE`、默认平台财务主体 | 文件任务、资金、账单或交易流水 | diff --git a/deploy/sql/头程数据库统一增量-MySQL8.sql b/deploy/sql/头程数据库统一增量-MySQL8.sql index 82ba95643..680ecd368 100644 --- a/deploy/sql/头程数据库统一增量-MySQL8.sql +++ b/deploy/sql/头程数据库统一增量-MySQL8.sql @@ -5966,7 +5966,7 @@ INSERT INTO iam_membership_role (membership_id, role_id, tenant_id, created_at) -- 系统基线 iam_number_sequence：1 行。 INSERT INTO iam_number_sequence (sequence_key, next_value, updated_at) VALUES ('CUSTOMER_CODE',1,CURRENT_TIMESTAMP(3)); --- 系统基线 iam_permission：346 行。 +-- 系统基线 iam_permission：364 行。 INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5100000,0,'PLATFORM','MENU',0,'platform:customer','客户管理','/customers',NULL,10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5100010,0,'PLATFORM','MENU',5100000,'platform:customer:list','企业客户','/customers/list',NULL,10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5100011,0,'PLATFORM','BUTTON',5100010,'platform:customer:create','新增企业客户',NULL,NULL,10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); @@ -6307,12 +6307,30 @@ INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5305021,0,'MERCHANT','BUTTON',5305020,'merchant:finance:recharge:create','提交充值申请',NULL,'POST',10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306000,0,'MERCHANT','MENU',0,'merchant:warehouse:delivery:list','海外仓派送单','/orders/delivery','GET',60,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306001,0,'MERCHANT','BUTTON',5306000,'merchant:warehouse:delivery:create','创建海外仓派送单',NULL,'POST',10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); -INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306100,0,'MERCHANT','MENU',0,'merchant:cross-border:procurement','海外采购','/cross-border/procurement',NULL,70,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); -INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306110,0,'MERCHANT','MENU',0,'merchant:cross-border:domestic-trucking','美国本土卡','/cross-border/domestic-trucking',NULL,80,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); -INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306120,0,'MERCHANT','MENU',0,'merchant:cross-border:pallet-shipping','美本土散板','/cross-border/pallet-shipping',NULL,90,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306100,0,'MERCHANT','MENU',0,'merchant:cross-border:procurement:list','海外采购','/cross-border/procurement','GET',70,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306101,0,'MERCHANT','BUTTON',5306100,'merchant:cross-border:procurement:create','创建海外采购单',NULL,'POST',10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306110,0,'MERCHANT','MENU',0,'merchant:cross-border:domestic-trucking:list','美国本土卡','/cross-border/domestic-trucking','GET',80,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306111,0,'MERCHANT','BUTTON',5306110,'merchant:cross-border:domestic-trucking:create','创建美国本土卡订单',NULL,'POST',10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306112,0,'MERCHANT','BUTTON',5306110,'merchant:cross-border:domestic-trucking:edit','编辑美国本土卡订单',NULL,'PATCH',20,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306120,0,'MERCHANT','MENU',0,'merchant:cross-border:pallet-shipping:list','美本土散板','/cross-border/pallet-shipping','GET',90,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306121,0,'MERCHANT','BUTTON',5306120,'merchant:cross-border:pallet-shipping:create','创建美本土散板订单',NULL,'POST',10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306122,0,'MERCHANT','BUTTON',5306120,'merchant:cross-border:pallet-shipping:edit','编辑美本土散板订单',NULL,'PUT',20,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306130,0,'MERCHANT','MENU',0,'merchant:warehouse:inbound:list','海外仓入库订单','/orders/inbound',NULL,50,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306140,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:return-inventory:list','退货库存','/overseas-warehouse/return-inventory','GET',95,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); -INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306141,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:return-cartons:list','退货箱号管理','/overseas-warehouse/return-cartons','GET',96,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306150,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:last-mile-order:list','海外尾程订单','/overseas-warehouse/last-mile-orders','GET',100,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306160,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:relabel:list','贴标申请','/overseas-warehouse/labeling','GET',110,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306161,0,'MERCHANT','BUTTON',5306160,'merchant:overseas-warehouse:relabel:create','创建贴标申请',NULL,'POST',10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306162,0,'MERCHANT','BUTTON',5306160,'merchant:overseas-warehouse:relabel:files','管理贴标文件',NULL,'POST',20,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306163,0,'MERCHANT','BUTTON',5306160,'merchant:overseas-warehouse:relabel:confirm','确认贴标完成',NULL,'POST',30,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306170,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:transfer:list','仓储转运','/overseas-warehouse/storage-transfer','GET',120,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306171,0,'MERCHANT','BUTTON',5306170,'merchant:overseas-warehouse:transfer:create','创建仓储转运单',NULL,'POST',10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306172,0,'MERCHANT','BUTTON',5306170,'merchant:overseas-warehouse:transfer:confirm','确认仓储转运实测',NULL,'POST',20,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306180,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:discard:list','货物废弃','/overseas-warehouse/cargo-disposal','GET',130,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306181,0,'MERCHANT','BUTTON',5306180,'merchant:overseas-warehouse:discard:create','创建货物废弃申请',NULL,'POST',10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306182,0,'MERCHANT','BUTTON',5306180,'merchant:overseas-warehouse:discard:cancel','取消货物废弃申请',NULL,'POST',20,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306190,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:return-order:list','退货预报','/overseas-warehouse/return-relabel','GET',140,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306191,0,'MERCHANT','BUTTON',5306190,'merchant:overseas-warehouse:return-order:create','创建退货预报',NULL,'POST',10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); +INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306192,0,'MERCHANT','BUTTON',5306190,'merchant:overseas-warehouse:return-order:relabel','退货转换标申请',NULL,'POST',20,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0); -- 系统基线 iam_role：8 行。 INSERT INTO iam_role (id, tenant_id, app_code, role_code, role_name, role_type, status, description, created_by, created_at, updated_by, updated_at, deleted, version) VALUES (4000001,0,'PLATFORM','PLATFORM_ADMIN','平台超级管理员','SYSTEM','ACTIVE','一期平台全部菜单和按钮',NULL,CURRENT_TIMESTAMP(3),NULL,CURRENT_TIMESTAMP(3),0,0); @@ -6324,7 +6342,7 @@ INSERT INTO iam_role (id, tenant_id, app_code, role_code, role_name, role_type, INSERT INTO iam_role (id, tenant_id, app_code, role_code, role_name, role_type, status, description, created_by, created_at, updated_by, updated_at, deleted, version) VALUES (4000007,0,'PLATFORM','CN_FIRSTLEG_PDA_OPERATOR','国内头程 PDA 作业员','SYSTEM','ACTIVE','负责使用国内 PDA 执行柜次拣货、现场取证和装柜完成',NULL,CURRENT_TIMESTAMP(3),NULL,CURRENT_TIMESTAMP(3),0,0); INSERT INTO iam_role (id, tenant_id, app_code, role_code, role_name, role_type, status, description, created_by, created_at, updated_by, updated_at, deleted, version) VALUES (4000100,0,'MERCHANT','MERCHANT_OWNER','企业管理员','SYSTEM','ACTIVE','一期企业全部菜单和操作按钮模板',1000001,CURRENT_TIMESTAMP(3),1000001,CURRENT_TIMESTAMP(3),0,0); --- 系统基线 iam_role_permission：521 行。 +-- 系统基线 iam_role_permission：539 行。 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000001,5100000,0,CURRENT_TIMESTAMP(3)); INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000001,5100010,0,CURRENT_TIMESTAMP(3)); INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000001,5100011,0,CURRENT_TIMESTAMP(3)); @@ -6841,11 +6859,29 @@ INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306000,0,CURRENT_TIMESTAMP(3)); INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306001,0,CURRENT_TIMESTAMP(3)); INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306100,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306101,0,CURRENT_TIMESTAMP(3)); INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306110,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306111,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306112,0,CURRENT_TIMESTAMP(3)); INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306120,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306121,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306122,0,CURRENT_TIMESTAMP(3)); INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306130,0,CURRENT_TIMESTAMP(3)); INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306140,0,CURRENT_TIMESTAMP(3)); -INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306141,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306150,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306160,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306161,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306162,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306163,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306170,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306171,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306172,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306180,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306181,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306182,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306190,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306191,0,CURRENT_TIMESTAMP(3)); +INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306192,0,CURRENT_TIMESTAMP(3)); -- 系统基线 iam_tenant：1 行。 INSERT INTO iam_tenant (id, tenant_code, tenant_name, customer_nickname, tenant_type, status, dimension_initialization_status, legal_name, legal_representative, unified_social_credit_code, contact_name, contact_phone, contact_email, service_package, contact_wechat, sales_owner_name, payment_term_days, enterprise_type, established_date, registered_capital, registered_capital_currency, registered_address, internal_remark, approved_at, approved_by, reject_reason, created_by, created_at, updated_by, updated_at, deleted, version) VALUES (0,'PLATFORM','虫虫出海平台','平台','PLATFORM','ACTIVE','READY','虫虫出海平台',NULL,NULL,'平台系统管理员',NULL,NULL,'基础版',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CURRENT_TIMESTAMP(3),1000001,NULL,1000001,CURRENT_TIMESTAMP(3),NULL,CURRENT_TIMESTAMP(3),0,0); diff --git a/gateway-overseas/AGENTS.md b/gateway-overseas/AGENTS.md index 94e97063a..14d35f248 100644 --- a/gateway-overseas/AGENTS.md +++ b/gateway-overseas/AGENTS.md @@ -18,7 +18,7 @@ | 安全配置项 | `config/GatewaySecurityProperties.java` | | 可信身份与授权头传递 | `filter/TrustedIdentityHeaderFilter.java`、`filter/OverseasSecurityProjectionFilter.java`；先清除外部伪造头，再以内部服务令牌保护投影快照 | | 环境配置 | `src/main/resources/application.yml`、`../config/nacos/` | -| 浏览器业务路由 | `src/main/resources/application-overseas.yml`；Lastleg 显式覆盖 `/api/merchant/v1/last-leg/**`、`/api/platform/v1/last-leg/**`，Warehouse 显式覆盖商户仓库与平台 `warehouse-admin` 路径 | +| 浏览器业务路由 | `src/main/resources/application-overseas.yml`；Lastleg 显式覆盖 `/api/merchant/v1/last-leg/**`、`/api/platform/v1/last-leg/**`，Warehouse 仅显式覆盖平台仓库资源路径 | | 海外 PDA 路由 | 设备端 `../../apps/pda-overseas-uniapp/`，服务端入口 `/api/pda/v1/last-leg/**`；必须在 Gateway 路由中显式声明并保持海外 Token/权限校验，不得让设备直连 Lastleg | | 测试 | `src/test/java/com/baiyue/gateway/config/` | diff --git a/gateway-overseas/src/main/resources/application-overseas.yml b/gateway-overseas/src/main/resources/application-overseas.yml index bdcda68d8..0cd871367 100644 --- a/gateway-overseas/src/main/resources/application-overseas.yml +++ b/gateway-overseas/src/main/resources/application-overseas.yml @@ -13,7 +13,7 @@ spring: predicates: ["Path=/api/merchant/v1/last-leg/**,/api/platform/v1/last-leg/**,/api/pda/v1/last-leg/**"] - id: warehouse-overseas-service uri: lb://warehouse-overseas-service - predicates: ["Path=/api/merchant/v1/warehouses/**,/api/platform/v1/warehouses/**,/api/platform/v1/warehouse-admin/**"] + predicates: ["Path=/api/platform/v1/warehouses/**,/api/platform/v1/warehouse-admin/**"] - id: file-service uri: lb://file-service predicates: ["Path=/api/merchant/v1/files/**,/api/platform/v1/files/**"] diff --git a/iam/src/main/resources/db/lastleg-permissions.sql b/iam/src/main/resources/db/lastleg-permissions.sql index 90f805f4f..69ba4426e 100644 --- a/iam/src/main/resources/db/lastleg-permissions.sql +++ b/iam/src/main/resources/db/lastleg-permissions.sql @@ -78,11 +78,30 @@ VALUES (5107222,0,'PLATFORM','BUTTON',5107220,'platform:overseas-master-data:vehicle:edit','编辑车辆主数据',NULL,'PUT',922,'ACTIVE',1,0), (5107223,0,'PLATFORM','BUTTON',5107220,'platform:overseas-master-data:vehicle:status','变更车辆状态',NULL,'PATCH',923,'ACTIVE',1,0), (5107224,0,'PLATFORM','BUTTON',5107220,'platform:overseas-master-data:vehicle:export','导出车辆主数据',NULL,'GET',924,'ACTIVE',1,0), - (5306100,0,'MERCHANT','MENU',0,'merchant:cross-border:procurement','海外采购','/cross-border/procurement',NULL,70,'ACTIVE',1,0), - (5306110,0,'MERCHANT','MENU',0,'merchant:cross-border:domestic-trucking','美国本土卡','/cross-border/domestic-trucking',NULL,80,'ACTIVE',1,0), - (5306120,0,'MERCHANT','MENU',0,'merchant:cross-border:pallet-shipping','美本土散板','/cross-border/pallet-shipping',NULL,90,'ACTIVE',1,0), + (5306100,0,'MERCHANT','MENU',0,'merchant:cross-border:procurement:list','海外采购','/cross-border/procurement','GET',70,'ACTIVE',1,0), + (5306101,0,'MERCHANT','BUTTON',5306100,'merchant:cross-border:procurement:create','创建海外采购单',NULL,'POST',10,'ACTIVE',1,0), + (5306110,0,'MERCHANT','MENU',0,'merchant:cross-border:domestic-trucking:list','美国本土卡','/cross-border/domestic-trucking','GET',80,'ACTIVE',1,0), + (5306111,0,'MERCHANT','BUTTON',5306110,'merchant:cross-border:domestic-trucking:create','创建美国本土卡订单',NULL,'POST',10,'ACTIVE',1,0), + (5306112,0,'MERCHANT','BUTTON',5306110,'merchant:cross-border:domestic-trucking:edit','编辑美国本土卡订单',NULL,'PATCH',20,'ACTIVE',1,0), + (5306120,0,'MERCHANT','MENU',0,'merchant:cross-border:pallet-shipping:list','美本土散板','/cross-border/pallet-shipping','GET',90,'ACTIVE',1,0), + (5306121,0,'MERCHANT','BUTTON',5306120,'merchant:cross-border:pallet-shipping:create','创建美本土散板订单',NULL,'POST',10,'ACTIVE',1,0), + (5306122,0,'MERCHANT','BUTTON',5306120,'merchant:cross-border:pallet-shipping:edit','编辑美本土散板订单',NULL,'PUT',20,'ACTIVE',1,0), (5306130,0,'MERCHANT','MENU',0,'merchant:warehouse:inbound:list','海外仓入库订单','/orders/inbound',NULL,50,'ACTIVE',1,0), - (5306140,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:return-inventory:list','退货库存','/overseas-warehouse/return-inventory','GET',95,'ACTIVE',1,0) + (5306140,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:return-inventory:list','退货库存','/overseas-warehouse/return-inventory','GET',95,'ACTIVE',1,0), + (5306150,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:last-mile-order:list','海外尾程订单','/overseas-warehouse/last-mile-orders','GET',100,'ACTIVE',1,0), + (5306160,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:relabel:list','贴标申请','/overseas-warehouse/labeling','GET',110,'ACTIVE',1,0), + (5306161,0,'MERCHANT','BUTTON',5306160,'merchant:overseas-warehouse:relabel:create','创建贴标申请',NULL,'POST',10,'ACTIVE',1,0), + (5306162,0,'MERCHANT','BUTTON',5306160,'merchant:overseas-warehouse:relabel:files','管理贴标文件',NULL,'POST',20,'ACTIVE',1,0), + (5306163,0,'MERCHANT','BUTTON',5306160,'merchant:overseas-warehouse:relabel:confirm','确认贴标完成',NULL,'POST',30,'ACTIVE',1,0), + (5306170,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:transfer:list','仓储转运','/overseas-warehouse/storage-transfer','GET',120,'ACTIVE',1,0), + (5306171,0,'MERCHANT','BUTTON',5306170,'merchant:overseas-warehouse:transfer:create','创建仓储转运单',NULL,'POST',10,'ACTIVE',1,0), + (5306172,0,'MERCHANT','BUTTON',5306170,'merchant:overseas-warehouse:transfer:confirm','确认仓储转运实测',NULL,'POST',20,'ACTIVE',1,0), + (5306180,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:discard:list','货物废弃','/overseas-warehouse/cargo-disposal','GET',130,'ACTIVE',1,0), + (5306181,0,'MERCHANT','BUTTON',5306180,'merchant:overseas-warehouse:discard:create','创建货物废弃申请',NULL,'POST',10,'ACTIVE',1,0), + (5306182,0,'MERCHANT','BUTTON',5306180,'merchant:overseas-warehouse:discard:cancel','取消货物废弃申请',NULL,'POST',20,'ACTIVE',1,0), + (5306190,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:return-order:list','退货预报','/overseas-warehouse/return-relabel','GET',140,'ACTIVE',1,0), + (5306191,0,'MERCHANT','BUTTON',5306190,'merchant:overseas-warehouse:return-order:create','创建退货预报',NULL,'POST',10,'ACTIVE',1,0), + (5306192,0,'MERCHANT','BUTTON',5306190,'merchant:overseas-warehouse:return-order:relabel','退货转换标申请',NULL,'POST',20,'ACTIVE',1,0) ON DUPLICATE KEY UPDATE permission_type=VALUES(permission_type), parent_id=VALUES(parent_id), permission_name=VALUES(permission_name), route_path=VALUES(route_path), http_method=VALUES(http_method), sort_no=VALUES(sort_no), status='ACTIVE', built_in=1, deleted=0; @@ -225,11 +244,30 @@ SELECT 0, role.id, permission.id, NOW(3) FROM iam_role role JOIN iam_permission permission ON permission.tenant_id=0 AND permission.app_code='MERCHANT' AND permission.permission_code IN ( - 'merchant:cross-border:procurement', - 'merchant:cross-border:domestic-trucking', - 'merchant:cross-border:pallet-shipping', + 'merchant:cross-border:procurement:list', + 'merchant:cross-border:procurement:create', + 'merchant:cross-border:domestic-trucking:list', + 'merchant:cross-border:domestic-trucking:create', + 'merchant:cross-border:domestic-trucking:edit', + 'merchant:cross-border:pallet-shipping:list', + 'merchant:cross-border:pallet-shipping:create', + 'merchant:cross-border:pallet-shipping:edit', 'merchant:warehouse:inbound:list', - 'merchant:overseas-warehouse:return-inventory:list' + 'merchant:overseas-warehouse:return-inventory:list', + 'merchant:overseas-warehouse:last-mile-order:list', + 'merchant:overseas-warehouse:relabel:list', + 'merchant:overseas-warehouse:relabel:create', + 'merchant:overseas-warehouse:relabel:files', + 'merchant:overseas-warehouse:relabel:confirm', + 'merchant:overseas-warehouse:transfer:list', + 'merchant:overseas-warehouse:transfer:create', + 'merchant:overseas-warehouse:transfer:confirm', + 'merchant:overseas-warehouse:discard:list', + 'merchant:overseas-warehouse:discard:create', + 'merchant:overseas-warehouse:discard:cancel', + 'merchant:overseas-warehouse:return-order:list', + 'merchant:overseas-warehouse:return-order:create', + 'merchant:overseas-warehouse:return-order:relabel' ) WHERE role.tenant_id=0 AND role.app_code='MERCHANT' AND role.role_code='MERCHANT_OWNER' AND role.status='ACTIVE' AND role.deleted=0 AND permission.status='ACTIVE' AND permission.deleted=0; @@ -241,11 +279,30 @@ BEGIN IF (SELECT COUNT(*) FROM iam_permission WHERE tenant_id=0 AND app_code='MERCHANT' AND status='ACTIVE' AND deleted=0 AND permission_code IN ( - 'merchant:cross-border:procurement', - 'merchant:cross-border:domestic-trucking', - 'merchant:cross-border:pallet-shipping', + 'merchant:cross-border:procurement:list', + 'merchant:cross-border:procurement:create', + 'merchant:cross-border:domestic-trucking:list', + 'merchant:cross-border:domestic-trucking:create', + 'merchant:cross-border:domestic-trucking:edit', + 'merchant:cross-border:pallet-shipping:list', + 'merchant:cross-border:pallet-shipping:create', + 'merchant:cross-border:pallet-shipping:edit', 'merchant:warehouse:inbound:list', - 'merchant:overseas-warehouse:return-inventory:list')) <> 5 THEN + 'merchant:overseas-warehouse:return-inventory:list', + 'merchant:overseas-warehouse:last-mile-order:list', + 'merchant:overseas-warehouse:relabel:list', + 'merchant:overseas-warehouse:relabel:create', + 'merchant:overseas-warehouse:relabel:files', + 'merchant:overseas-warehouse:relabel:confirm', + 'merchant:overseas-warehouse:transfer:list', + 'merchant:overseas-warehouse:transfer:create', + 'merchant:overseas-warehouse:transfer:confirm', + 'merchant:overseas-warehouse:discard:list', + 'merchant:overseas-warehouse:discard:create', + 'merchant:overseas-warehouse:discard:cancel', + 'merchant:overseas-warehouse:return-order:list', + 'merchant:overseas-warehouse:return-order:create', + 'merchant:overseas-warehouse:return-order:relabel')) <> 24 THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='海外客户权限初始化失败：权限资源不完整'; END IF; IF (SELECT COUNT(*) FROM iam_role_permission grant_row @@ -256,11 +313,30 @@ BEGIN AND permission.tenant_id=0 AND permission.app_code='MERCHANT' AND permission.status='ACTIVE' AND permission.deleted=0 AND permission.permission_code IN ( - 'merchant:cross-border:procurement', - 'merchant:cross-border:domestic-trucking', - 'merchant:cross-border:pallet-shipping', + 'merchant:cross-border:procurement:list', + 'merchant:cross-border:procurement:create', + 'merchant:cross-border:domestic-trucking:list', + 'merchant:cross-border:domestic-trucking:create', + 'merchant:cross-border:domestic-trucking:edit', + 'merchant:cross-border:pallet-shipping:list', + 'merchant:cross-border:pallet-shipping:create', + 'merchant:cross-border:pallet-shipping:edit', 'merchant:warehouse:inbound:list', - 'merchant:overseas-warehouse:return-inventory:list')) <> 5 THEN + 'merchant:overseas-warehouse:return-inventory:list', + 'merchant:overseas-warehouse:last-mile-order:list', + 'merchant:overseas-warehouse:relabel:list', + 'merchant:overseas-warehouse:relabel:create', + 'merchant:overseas-warehouse:relabel:files', + 'merchant:overseas-warehouse:relabel:confirm', + 'merchant:overseas-warehouse:transfer:list', + 'merchant:overseas-warehouse:transfer:create', + 'merchant:overseas-warehouse:transfer:confirm', + 'merchant:overseas-warehouse:discard:list', + 'merchant:overseas-warehouse:discard:create', + 'merchant:overseas-warehouse:discard:cancel', + 'merchant:overseas-warehouse:return-order:list', + 'merchant:overseas-warehouse:return-order:create', + 'merchant:overseas-warehouse:return-order:relabel')) <> 24 THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='海外客户权限初始化失败：客户默认管理员授权不完整'; END IF; END$$ diff --git a/iam/src/main/resources/openapi/iam-v1.yaml b/iam/src/main/resources/openapi/iam-v1.yaml index 33640c020..69392d990 100644 --- a/iam/src/main/resources/openapi/iam-v1.yaml +++ b/iam/src/main/resources/openapi/iam-v1.yaml @@ -342,7 +342,7 @@ paths: get: tags: [IAM Resources / IAM 资源] summary: 查询当前用户有效权限 - description: 返回当前有效客户成员权限编码。资金账户和流水只读返回 `merchant:finance:account:view`，提交充值申请返回 `merchant:finance:recharge:create`，两者独立授权。海外采购、本土卡、本土散板和海外入库订单分别返回 `merchant:cross-border:procurement`、`merchant:cross-border:domestic-trucking`、`merchant:cross-border:pallet-shipping`、`merchant:warehouse:inbound:list`；客户派送返回 `merchant:warehouse:delivery:list` 和 `merchant:warehouse:delivery:create`。列表权限包含详情只读，创建权限独立授权。 + description: 返回当前有效客户成员权限编码。资金账户和流水只读返回 `merchant:finance:account:view`，提交充值申请返回 `merchant:finance:recharge:create`，两者独立授权。海外采购、本土卡、本土散板分别按 `:list`、`:create`（可编辑业务另有 `:edit`）拆分；海外仓入库、尾程订单、换标、转运、废弃、退货预报和退货库存均返回各自 `merchant:warehouse:*` 或 `merchant:overseas-warehouse:*` 权限。客户派送返回 `merchant:warehouse:delivery:list` 和 `merchant:warehouse:delivery:create`。列表权限包含详情只读，创建、文件、确认、取消和转换操作独立授权。 responses: '200': description: 当前商户成员权限查询成功 diff --git a/iam/src/test/java/com/baiyue/iam/controller/IamOpenApiContractTest.java b/iam/src/test/java/com/baiyue/iam/controller/IamOpenApiContractTest.java index 99e75072f..d23670498 100644 --- a/iam/src/test/java/com/baiyue/iam/controller/IamOpenApiContractTest.java +++ b/iam/src/test/java/com/baiyue/iam/controller/IamOpenApiContractTest.java @@ -46,9 +46,9 @@ class IamOpenApiContractTest { .contains("不以 `container:list/edit` 兼容放行国外操作") .contains("merchant:warehouse:delivery:list") .contains("merchant:warehouse:delivery:create") - .contains("merchant:cross-border:procurement") - .contains("merchant:cross-border:domestic-trucking") - .contains("merchant:cross-border:pallet-shipping") + .contains("merchant:cross-border:procurement:list") + .contains("merchant:cross-border:domestic-trucking:list") + .contains("merchant:cross-border:pallet-shipping:list") .contains("merchant:warehouse:inbound:list") .contains("lastleg:pda:operate") .contains("OVERSEAS_WAREHOUSE_PDA_OPERATOR") diff --git a/iam/src/test/java/com/baiyue/iam/repository/MerchantReturnInventoryPermissionSqlContractTest.java b/iam/src/test/java/com/baiyue/iam/repository/MerchantReturnInventoryPermissionSqlContractTest.java index 4cff5c013..51c01601b 100644 --- a/iam/src/test/java/com/baiyue/iam/repository/MerchantReturnInventoryPermissionSqlContractTest.java +++ b/iam/src/test/java/com/baiyue/iam/repository/MerchantReturnInventoryPermissionSqlContractTest.java @@ -20,7 +20,7 @@ class MerchantReturnInventoryPermissionSqlContractTest { assertThat(sql).contains( "(5306140,0,'MERCHANT','MENU',0,'" + PERMISSION + "','退货库存'", "role.role_code='MERCHANT_OWNER'", - "'" + PERMISSION + "')) <> 5", + "'" + PERMISSION + "')) <> 24", "客户默认管理员授权不完整"); int grantStart = sql.indexOf("-- 客户默认管理员获得当前客户海外业务入口"); diff --git a/iam/src/test/java/com/baiyue/iam/repository/OverseasCustomerPermissionSqlContractTest.java b/iam/src/test/java/com/baiyue/iam/repository/OverseasCustomerPermissionSqlContractTest.java index f65c809ef..fa9a64fc9 100644 --- a/iam/src/test/java/com/baiyue/iam/repository/OverseasCustomerPermissionSqlContractTest.java +++ b/iam/src/test/java/com/baiyue/iam/repository/OverseasCustomerPermissionSqlContractTest.java @@ -15,30 +15,48 @@ import static org.assertj.core.api.Assertions.assertThat; class OverseasCustomerPermissionSqlContractTest { private static final Pattern MERCHANT_CODE = Pattern.compile("merchant:[a-z0-9:-]+"); private static final Set CUSTOMER_OVERSEAS_PERMISSIONS = Set.of( - "merchant:cross-border:procurement", - "merchant:cross-border:domestic-trucking", - "merchant:cross-border:pallet-shipping", + "merchant:cross-border:procurement:list", + "merchant:cross-border:procurement:create", + "merchant:cross-border:domestic-trucking:list", + "merchant:cross-border:domestic-trucking:create", + "merchant:cross-border:domestic-trucking:edit", + "merchant:cross-border:pallet-shipping:list", + "merchant:cross-border:pallet-shipping:create", + "merchant:cross-border:pallet-shipping:edit", "merchant:warehouse:inbound:list", - "merchant:overseas-warehouse:return-inventory:list"); + "merchant:overseas-warehouse:return-inventory:list", + "merchant:overseas-warehouse:last-mile-order:list", + "merchant:overseas-warehouse:relabel:list", + "merchant:overseas-warehouse:relabel:create", + "merchant:overseas-warehouse:relabel:files", + "merchant:overseas-warehouse:relabel:confirm", + "merchant:overseas-warehouse:transfer:list", + "merchant:overseas-warehouse:transfer:create", + "merchant:overseas-warehouse:transfer:confirm", + "merchant:overseas-warehouse:discard:list", + "merchant:overseas-warehouse:discard:create", + "merchant:overseas-warehouse:discard:cancel", + "merchant:overseas-warehouse:return-order:list", + "merchant:overseas-warehouse:return-order:create", + "merchant:overseas-warehouse:return-order:relabel"); @Test void declaresTheFrozenCustomerOverseasPermissionCatalog() throws Exception { String sql = sql(); assertThat(merchantCodes(sql)).containsExactlyInAnyOrderElementsOf(CUSTOMER_OVERSEAS_PERMISSIONS); - for (String permission : CUSTOMER_OVERSEAS_PERMISSIONS) { - assertThat(sql).contains("0,'MERCHANT','MENU'", "'" + permission + "'"); - } assertThat(sql).contains( - "'merchant:cross-border:procurement','海外采购','/cross-border/procurement'", - "'merchant:cross-border:domestic-trucking','美国本土卡','/cross-border/domestic-trucking'", - "'merchant:cross-border:pallet-shipping','美本土散板','/cross-border/pallet-shipping'", + "'merchant:cross-border:procurement:list','海外采购','/cross-border/procurement'", + "'merchant:cross-border:domestic-trucking:list','美国本土卡','/cross-border/domestic-trucking'", + "'merchant:cross-border:pallet-shipping:list','美本土散板','/cross-border/pallet-shipping'", "'merchant:warehouse:inbound:list','海外仓入库订单','/orders/inbound'", - "'merchant:overseas-warehouse:return-inventory:list','退货库存','/overseas-warehouse/return-inventory'"); + "'merchant:overseas-warehouse:return-inventory:list','退货库存','/overseas-warehouse/return-inventory'", + "'merchant:overseas-warehouse:relabel:files','维护换标文件'", + "'merchant:overseas-warehouse:discard:cancel','取消货物废弃申请'"); } @Test - void grantsAllFivePermissionsOnlyToTheDefaultCustomerAdministrator() throws Exception { + void grantsAllPermissionsOnlyToTheDefaultCustomerAdministrator() throws Exception { String sql = sql(); int comment = sql.indexOf("-- 客户默认管理员获得当前客户海外业务入口"); int grantStart = sql.indexOf("INSERT IGNORE INTO iam_role_permission", comment); @@ -66,7 +84,7 @@ class OverseasCustomerPermissionSqlContractTest { "海外客户权限初始化失败：客户默认管理员授权不完整", "permission.app_code='MERCHANT'", "role.role_code='MERCHANT_OWNER'", - ")) <> 5 THEN"); + ")) <> 24 THEN"); } @Test diff --git a/iam/src/test/java/com/baiyue/iam/service/AuthorizationSnapshotServiceTest.java b/iam/src/test/java/com/baiyue/iam/service/AuthorizationSnapshotServiceTest.java index d9ffdae80..1c492f499 100644 --- a/iam/src/test/java/com/baiyue/iam/service/AuthorizationSnapshotServiceTest.java +++ b/iam/src/test/java/com/baiyue/iam/service/AuthorizationSnapshotServiceTest.java @@ -95,18 +95,20 @@ class AuthorizationSnapshotServiceTest { when(mapper.countActiveIdentity(42L, 7L, 9L)).thenReturn(1); when(mapper.findRoles(42L, 7L, 9L, "MERCHANT")).thenReturn(List.of("MERCHANT_OWNER")); when(mapper.findPermissions(42L, 7L, 9L, "MERCHANT")).thenReturn(List.of( - "merchant:cross-border:procurement", - "merchant:cross-border:domestic-trucking", - "merchant:cross-border:pallet-shipping", + "merchant:cross-border:procurement:list", + "merchant:cross-border:procurement:create", + "merchant:cross-border:domestic-trucking:list", + "merchant:cross-border:pallet-shipping:list", "merchant:warehouse:inbound:list")); var result = service.currentPermissions(new AuthenticatedUser(42L, 7L, 7L, 9L, "owner", "MERCHANT", "MERCHANT", java.util.Set.of()), "MERCHANT"); assertThat(result).containsExactlyInAnyOrder( - "merchant:cross-border:procurement", - "merchant:cross-border:domestic-trucking", - "merchant:cross-border:pallet-shipping", + "merchant:cross-border:procurement:list", + "merchant:cross-border:procurement:create", + "merchant:cross-border:domestic-trucking:list", + "merchant:cross-border:pallet-shipping:list", "merchant:warehouse:inbound:list"); } diff --git a/lastleg-service/AGENTS.md b/lastleg-service/AGENTS.md index 4a7c20eff..d3bd18a4a 100644 --- a/lastleg-service/AGENTS.md +++ b/lastleg-service/AGENTS.md @@ -61,11 +61,11 @@ | 客户拜访、派送状态与签收附件 | `customervisit/controller/CustomerVisitController.java`、`customervisit/service/CustomerVisitService.java`、`delivery/model/DeliveryStatusPolicy.java`；派送单返回服务端 `allowedActions/version`，状态只允许单调迁移，同状态幂等；人工动作不再提供完成派送，签收资料保存后自动完成当前目的FBA仓派送单 | | 派送三类资料、摘要与历史证据 | `delivery/controller/DeliveryDocumentController.java`、`delivery/service/DeliveryDocumentService.java`、`delivery/gateway/DeliveryDocumentFileGateway.java`、`src/main/resources/openapi/delivery-documents-v1.yaml`；固定装车照片 `LOADING_PHOTO`、BOL文件（含签名）`BOL`、签收文件（POD签收/快递签收）`RECEIPT`，按已保存类别计数 `x/3`。每类0至20文件，文件精确绑定客户、按目的FBA仓拆分的派送单和类别；全量保存共用派送版本并记录不可变历史，替换删除仅解绑，未保存上传不计数、不授权下载。`RECEIPT` 成功保存进权威快照时事务内自动完成当前派送单，单纯上传不触发完成 | | 异常订单与派送退回入仓 | `exceptionorder/controller/ExceptionOrderController.java`、`exceptionorder/service/ExceptionOrderService.java`、`exceptionorder/gateway/ExceptionEvidenceFileGateway.java`、`inventory/command/service/InventoryCommandService.java`；证据固定按客户、异常单 ID 和 `OVERSEAS_EXCEPTION_EVIDENCE` 校验。退回候选按原出库拣货事实冻结，不接受自由 SKU 或数量；异常按 `PENDING→PROCESSING→COMPLETED`（待处理可取消）、版本与幂等键流转。退回海外仓须把实收按原出库来源恢复到服务端校验的真实托盘/库位并写 `RETURN_STOCK_IN` 流水，库存恢复、异常完成与派送 `RETURNED` 在同一事务完成 | -| 海外采购、客户下单、采购审核、客户/采购仓候选与操作流水 | `procurement/controller/`、`procurement/service/OverseasProcurementService.java`；客户入口要求 `merchant:cross-border:procurement` 且只取 Token 客户范围；OpenAPI `src/main/resources/openapi/overseas-business-v1.yaml` | +| 海外采购、客户下单、采购审核、客户/采购仓候选与操作流水 | `procurement/controller/`、`procurement/service/OverseasProcurementService.java`；客户入口按 `merchant:cross-border:procurement:list/create` 拆分且只取 Token 客户范围；OpenAPI `src/main/resources/openapi/overseas-business-v1.yaml` | | 海外业务资金指令与结果 | `wallet/WalletCommandOutboxService.java`、`WalletCommandCompletedConsumer.java`、`WalletResultHandler.java`；采购和换标通过 `WALLET_COMMAND_REQUESTED` 请求国内 Finance 冻结、结算或释放，并以 `WALLET_COMMAND_COMPLETED` 幂等回写业务资金状态；不得跨区同步调用 Finance 钱包或在 Lastleg 自建余额账本 | | 海外业务费用来源 | `financefee/controller/PlatformOverseasFeeSourceController.java`、`financefee/service/OverseasFeeSourceService.java`、`OverseasFeeBusinessGuard.java`、`OverseasFeeOutboxService.java`、`OverseasFeeOutboxRelay.java`；海外入仓、采购、美国卡车、本土散板和海外仓服务费必须匹配当前客户的真实业务，入仓记录和入仓码按事实选填；审核通过、调整或作废后以版本化完整快照经 Outbox/Event Bridge 进入独立 Finance，OpenAPI `src/main/resources/openapi/overseas-finance-fees-v1.yaml` | -| 美国/本土卡车订单 | `trucking/controller/PlatformUsTruckOrderController.java`、`MerchantUsTruckOrderController.java` 及同子域 Service/DTO；客户入口要求 `merchant:cross-border:domestic-trucking` | -| 本土散板订单 | `looseboard/controller/PlatformLocalLooseboardController.java`、`MerchantLocalLooseboardController.java` 及同子域 Service/DTO/Entity/Mapper；客户入口要求 `merchant:cross-border:pallet-shipping`；OpenAPI `src/main/resources/openapi/overseas-business-v1.yaml` | +| 美国/本土卡车订单 | `trucking/controller/PlatformUsTruckOrderController.java`、`MerchantUsTruckOrderController.java` 及同子域 Service/DTO；客户入口按 `merchant:cross-border:domestic-trucking:list/create/edit` 拆分 | +| 本土散板订单 | `looseboard/controller/PlatformLocalLooseboardController.java`、`MerchantLocalLooseboardController.java` 及同子域 Service/DTO/Entity/Mapper；客户入口按 `merchant:cross-border:pallet-shipping:list/create/edit` 拆分；OpenAPI `src/main/resources/openapi/overseas-business-v1.yaml` | | 海外仓报价、月度汇率、车辆主数据 | 报价 `masterdata/quote/`、汇率 `masterdata/exchange/`；车辆入口 `masterdata/vehicle/adapter/in/web/PlatformVehicleController.java`，应用服务 `application/VehicleApplicationService.java`，持久化端口与适配器 `application/port/out/VehicleRepository.java`、`adapter/out/persistence/`；OpenAPI `src/main/resources/openapi/overseas-master-data-v1.yaml`，车辆档案不含派送履约历史 | | 跨服务 HTTP 客户端装配 | `config/LastlegRestClientFactory.java`、`config/LastlegRestClientProperties.java`；目标地址与内部服务令牌只来自配置，不在业务子域手工创建客户端 | | 数据库基线、表索引与中文注释契约 | `src/main/resources/db/lastleg.sql`、`src/test/java/com/baiyue/lastleg/schema/SchemaChineseCommentContractTest.java` | diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/controller/MerchantLastlegOrderController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/controller/MerchantLastlegOrderController.java index 69a04f882..e753e810d 100644 --- a/lastleg-service/src/main/java/com/baiyue/lastleg/controller/MerchantLastlegOrderController.java +++ b/lastleg-service/src/main/java/com/baiyue/lastleg/controller/MerchantLastlegOrderController.java @@ -7,9 +7,11 @@ import com.baiyue.lastleg.dto.LastlegOrderDetailResponse; import com.baiyue.lastleg.dto.LastlegOrderRequests; import com.baiyue.lastleg.dto.LastlegOrderSummary; import com.baiyue.lastleg.service.LastlegOrderService; +import com.baiyue.lastleg.security.OverseasPermissions; import jakarta.annotation.Resource; import jakarta.validation.Valid; import org.springframework.http.HttpStatus; +import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.security.core.annotation.AuthenticationPrincipal; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.PathVariable; @@ -19,6 +21,7 @@ import org.springframework.web.server.ResponseStatusException; @RestController @RequestMapping("/api/merchant/v1/last-leg/orders") +@PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LAST_MILE_ORDER_LIST + "')") public class MerchantLastlegOrderController { @Resource private LastlegOrderService orderService; diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/controller/MerchantCargoDiscardController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/controller/MerchantCargoDiscardController.java index c9f493b78..f49e899da 100644 --- a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/controller/MerchantCargoDiscardController.java +++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/controller/MerchantCargoDiscardController.java @@ -6,9 +6,11 @@ import com.baiyue.common.security.AuthenticatedUser; import com.baiyue.lastleg.discard.dto.CargoDiscardRequests; import com.baiyue.lastleg.discard.dto.CargoDiscardResponses; import com.baiyue.lastleg.discard.service.CargoDiscardService; +import com.baiyue.lastleg.security.OverseasPermissions; import jakarta.annotation.Resource; import jakarta.validation.Valid; import org.springframework.http.HttpStatus; +import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.security.core.annotation.AuthenticationPrincipal; import org.springframework.web.bind.annotation.*; import org.springframework.web.server.ResponseStatusException; @@ -19,18 +21,23 @@ import java.util.List; public class MerchantCargoDiscardController { @Resource private CargoDiscardService service; @GetMapping("/inventory-candidates") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_LIST + "')") public ApiResponse> candidates(@AuthenticationPrincipal AuthenticatedUser user, @RequestParam(required = false) String inboundCode) { return ApiResponse.success(service.candidates(customer(user), inboundCode)); } @PostMapping + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_CREATE + "')") public ApiResponse create(@AuthenticationPrincipal AuthenticatedUser user, @Valid @RequestBody CargoDiscardRequests.Create request) { return ApiResponse.success(service.create(customer(user), operator(user), request)); } @GetMapping + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_LIST + "')") public ApiResponse> page(@AuthenticationPrincipal AuthenticatedUser user, @Valid CargoDiscardRequests.Query query) { return ApiResponse.success(service.page(customer(user), query)); } @GetMapping("/{discardNo}") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_LIST + "')") public ApiResponse detail(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable String discardNo) { return ApiResponse.success(service.detail(customer(user), discardNo)); } @PostMapping("/{discardNo}/cancel") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_CANCEL + "')") public ApiResponse cancel(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable String discardNo) { return ApiResponse.success(service.cancel(customer(user), discardNo, operator(user), false)); } private String customer(AuthenticatedUser user) { diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/looseboard/controller/MerchantLocalLooseboardController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/looseboard/controller/MerchantLocalLooseboardController.java index 97c997a88..0793d2aeb 100644 --- a/lastleg-service/src/main/java/com/baiyue/lastleg/looseboard/controller/MerchantLocalLooseboardController.java +++ b/lastleg-service/src/main/java/com/baiyue/lastleg/looseboard/controller/MerchantLocalLooseboardController.java @@ -23,29 +23,32 @@ import org.springframework.web.server.ResponseStatusException; @RestController @RequestMapping("/api/merchant/v1/last-leg/local-looseboard-orders") -@PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD + "')") public class MerchantLocalLooseboardController { @Resource private LocalLooseboardService service; @PostMapping + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD_CREATE + "')") public ApiResponse create(@AuthenticationPrincipal AuthenticatedUser user, @Valid @RequestBody LocalLooseboardRequests.Create request) { return ApiResponse.success(service.create(customer(user), operator(user), request)); } @GetMapping + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD_LIST + "')") public ApiResponse> page( @AuthenticationPrincipal AuthenticatedUser user, @Valid LocalLooseboardRequests.MerchantQuery query) { return ApiResponse.success(service.page(customer(user), query)); } @GetMapping("/{orderNo}") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD_LIST + "')") public ApiResponse detail(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable String orderNo) { return ApiResponse.success(service.detail(customer(user), orderNo)); } @PutMapping("/{orderNo}") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD_EDIT + "')") public ApiResponse update(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable String orderNo, @Valid @RequestBody LocalLooseboardRequests.Update request) { return ApiResponse.success(service.update(customer(user), orderNo, operator(user), request)); diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/procurement/controller/MerchantOverseasProcurementController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/procurement/controller/MerchantOverseasProcurementController.java index e4a2c254a..e674063fd 100644 --- a/lastleg-service/src/main/java/com/baiyue/lastleg/procurement/controller/MerchantOverseasProcurementController.java +++ b/lastleg-service/src/main/java/com/baiyue/lastleg/procurement/controller/MerchantOverseasProcurementController.java @@ -22,11 +22,11 @@ import org.springframework.web.server.ResponseStatusException; @RestController @RequestMapping("/api/merchant/v1/last-leg/overseas-procurements") -@PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_PROCUREMENT + "')") public class MerchantOverseasProcurementController { @Resource private OverseasProcurementService service; @PostMapping + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_PROCUREMENT_CREATE + "')") public ApiResponse create( @AuthenticationPrincipal AuthenticatedUser user, @Valid @RequestBody OverseasProcurementRequests.Create request) { @@ -34,12 +34,14 @@ public class MerchantOverseasProcurementController { } @GetMapping + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_PROCUREMENT_LIST + "')") public ApiResponse> page( @AuthenticationPrincipal AuthenticatedUser user, @Valid OverseasProcurementRequests.MerchantQuery query) { return ApiResponse.success(service.page(customer(user), query.scoped())); } @GetMapping("/{orderNo}") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_PROCUREMENT_LIST + "')") public ApiResponse detail( @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String orderNo) { return ApiResponse.success(service.detail(customer(user), orderNo)); diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/controller/MerchantRelabelApplicationController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/controller/MerchantRelabelApplicationController.java index 8c15edf5f..56263ab90 100644 --- a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/controller/MerchantRelabelApplicationController.java +++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/controller/MerchantRelabelApplicationController.java @@ -6,9 +6,11 @@ import com.baiyue.common.security.AuthenticatedUser; import com.baiyue.lastleg.relabel.dto.RelabelRequests; import com.baiyue.lastleg.relabel.dto.RelabelResponses; import com.baiyue.lastleg.relabel.service.RelabelApplicationService; +import com.baiyue.lastleg.security.OverseasPermissions; import jakarta.annotation.Resource; import jakarta.validation.Valid; import org.springframework.http.HttpStatus; +import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.security.core.annotation.AuthenticationPrincipal; import org.springframework.web.bind.annotation.*; import org.springframework.web.server.ResponseStatusException; @@ -24,6 +26,7 @@ import java.util.List; public class MerchantRelabelApplicationController { @Resource private RelabelApplicationService service; @GetMapping("/inventory-candidates") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')") public ApiResponse> candidates( @AuthenticationPrincipal AuthenticatedUser user, @RequestParam String operationWarehouseId, @@ -31,6 +34,7 @@ public class MerchantRelabelApplicationController { return ApiResponse.success(service.candidates(customer(user), operationWarehouseId, inboundCode)); } @GetMapping("/historical-orders") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')") public ApiResponse> historicalOrders( @AuthenticationPrincipal AuthenticatedUser user, @RequestParam String operationWarehouseId, @@ -38,20 +42,25 @@ public class MerchantRelabelApplicationController { return ApiResponse.success(service.historicalOrders(customer(user), operationWarehouseId, keyword)); } @PostMapping + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_CREATE + "')") public ApiResponse create(@AuthenticationPrincipal AuthenticatedUser user, @Valid @RequestBody RelabelRequests.Create request) { return ApiResponse.success(service.create(customer(user), operator(user), request)); } @GetMapping + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')") public ApiResponse> page(@AuthenticationPrincipal AuthenticatedUser user, @Valid RelabelRequests.Query query) { return ApiResponse.success(service.page(customer(user), query)); } @GetMapping("/{relabelNo}") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')") public ApiResponse detail(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable String relabelNo) { return ApiResponse.success(service.detail(customer(user), relabelNo)); } @PostMapping(value = "/{relabelNo}/shipping-label", consumes = MediaType.MULTIPART_FORM_DATA_VALUE) + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_FILES + "')") public ApiResponse uploadShippingLabel(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable String relabelNo, @RequestPart("file") MultipartFile file) { return ApiResponse.success(service.uploadShippingLabel(customer(user), relabelNo, operatorLong(user), file)); } @PostMapping(value = "/{relabelNo}/files", consumes = MediaType.MULTIPART_FORM_DATA_VALUE) + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_FILES + "')") public ApiResponse uploadFile(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable String relabelNo, @RequestParam String scope, @RequestParam(required = false) Long itemId, @RequestPart("file") MultipartFile file) { @@ -60,18 +69,21 @@ public class MerchantRelabelApplicationController { return ApiResponse.success(service.uploadTotalFile(customer(user), relabelNo, operatorLong(user), file, kind)); } @GetMapping("/{relabelNo}/shipping-label/{fileId}/download") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')") public ResponseEntity downloadShippingLabel(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable String relabelNo, @PathVariable long fileId) { var file = service.downloadShippingLabel(customer(user), relabelNo, fileId); return download(file.content(), file.fileName(), file.contentType()); } @GetMapping("/{relabelNo}/completion-photos/{fileId}/download") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')") public ResponseEntity downloadCompletionPhoto(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable String relabelNo, @PathVariable long fileId) { var file = service.downloadCompletionPhoto(customer(user), relabelNo, fileId); return download(file.content(), file.fileName(), file.contentType()); } @PostMapping("/{relabelNo}/confirm-completion") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_CONFIRM + "')") public ApiResponse confirmCompletion(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable String relabelNo, @Valid @RequestBody RelabelRequests.CustomerConfirm request) { return ApiResponse.success(service.confirmCompletion(customer(user), relabelNo, operator(user), request)); diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/controller/MerchantReturnOrderController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/controller/MerchantReturnOrderController.java index b014751d4..d5628de57 100644 --- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/controller/MerchantReturnOrderController.java +++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/controller/MerchantReturnOrderController.java @@ -6,9 +6,11 @@ import com.baiyue.common.security.AuthenticatedUser; import com.baiyue.lastleg.returnreceipt.dto.ReturnOrderRequests; import com.baiyue.lastleg.returnreceipt.dto.ReturnOrderResponses; import com.baiyue.lastleg.returnreceipt.service.ReturnReceiptService; +import com.baiyue.lastleg.security.OverseasPermissions; import jakarta.annotation.Resource; import jakarta.validation.Valid; import org.springframework.http.HttpStatus; +import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.security.core.annotation.AuthenticationPrincipal; import org.springframework.web.bind.annotation.*; import org.springframework.web.server.ResponseStatusException; @@ -17,17 +19,22 @@ import org.springframework.web.server.ResponseStatusException; @RequestMapping("/api/merchant/v1/last-leg/return-orders") public class MerchantReturnOrderController { @Resource private ReturnReceiptService service; - @PostMapping public ApiResponse create(@AuthenticationPrincipal AuthenticatedUser user, + @PostMapping @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_CREATE + "')") + public ApiResponse create(@AuthenticationPrincipal AuthenticatedUser user, @Valid @RequestBody ReturnOrderRequests.Create request) { return ApiResponse.success(service.create(customer(user), operator(user), request)); } - @GetMapping public ApiResponse> page(@AuthenticationPrincipal AuthenticatedUser user, + @GetMapping @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_LIST + "')") + public ApiResponse> page(@AuthenticationPrincipal AuthenticatedUser user, @Valid ReturnOrderRequests.Query query) { return ApiResponse.success(service.page(customer(user), query)); } - @GetMapping("/{returnNo}") public ApiResponse detail(@AuthenticationPrincipal AuthenticatedUser user, + @GetMapping("/{returnNo}") @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_LIST + "')") + public ApiResponse detail(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable String returnNo) { return ApiResponse.success(service.detail(customer(user), returnNo)); } - @GetMapping("/{returnNo}/relabel-candidates") public ApiResponse> relabelCandidates( + @GetMapping("/{returnNo}/relabel-candidates") @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_RELABEL + "')") + public ApiResponse> relabelCandidates( @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String returnNo) { return ApiResponse.success(service.relabelCandidates(customer(user), returnNo)); } - @PostMapping("/{returnNo}/relabel") public ApiResponse createRelabel( + @PostMapping("/{returnNo}/relabel") @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_RELABEL + "')") + public ApiResponse createRelabel( @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String returnNo, @Valid @RequestBody ReturnOrderRequests.RelabelCreate request) { return ApiResponse.success(service.createRelabel(customer(user), operator(user), returnNo, request)); diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/security/OverseasPermissions.java b/lastleg-service/src/main/java/com/baiyue/lastleg/security/OverseasPermissions.java index 3d4bf6ae0..609d90308 100644 --- a/lastleg-service/src/main/java/com/baiyue/lastleg/security/OverseasPermissions.java +++ b/lastleg-service/src/main/java/com/baiyue/lastleg/security/OverseasPermissions.java @@ -45,9 +45,29 @@ public final class OverseasPermissions { public static final String MERCHANT_INBOUND_LIST = "merchant:warehouse:inbound:list"; public static final String MERCHANT_RETURN_INVENTORY_LIST = "merchant:overseas-warehouse:return-inventory:list"; - public static final String MERCHANT_PROCUREMENT = "merchant:cross-border:procurement"; - public static final String MERCHANT_TRUCKING = "merchant:cross-border:domestic-trucking"; - public static final String MERCHANT_LOOSEBOARD = "merchant:cross-border:pallet-shipping"; + public static final String MERCHANT_LAST_MILE_ORDER_LIST = + "merchant:overseas-warehouse:last-mile-order:list"; + public static final String MERCHANT_RELABEL_LIST = "merchant:overseas-warehouse:relabel:list"; + public static final String MERCHANT_RELABEL_CREATE = "merchant:overseas-warehouse:relabel:create"; + public static final String MERCHANT_RELABEL_FILES = "merchant:overseas-warehouse:relabel:files"; + public static final String MERCHANT_RELABEL_CONFIRM = "merchant:overseas-warehouse:relabel:confirm"; + public static final String MERCHANT_TRANSFER_LIST = "merchant:overseas-warehouse:transfer:list"; + public static final String MERCHANT_TRANSFER_CREATE = "merchant:overseas-warehouse:transfer:create"; + public static final String MERCHANT_TRANSFER_CONFIRM = "merchant:overseas-warehouse:transfer:confirm"; + public static final String MERCHANT_DISCARD_LIST = "merchant:overseas-warehouse:discard:list"; + public static final String MERCHANT_DISCARD_CREATE = "merchant:overseas-warehouse:discard:create"; + public static final String MERCHANT_DISCARD_CANCEL = "merchant:overseas-warehouse:discard:cancel"; + public static final String MERCHANT_RETURN_ORDER_LIST = "merchant:overseas-warehouse:return-order:list"; + public static final String MERCHANT_RETURN_ORDER_CREATE = "merchant:overseas-warehouse:return-order:create"; + public static final String MERCHANT_RETURN_ORDER_RELABEL = "merchant:overseas-warehouse:return-order:relabel"; + public static final String MERCHANT_PROCUREMENT_LIST = "merchant:cross-border:procurement:list"; + public static final String MERCHANT_PROCUREMENT_CREATE = "merchant:cross-border:procurement:create"; + public static final String MERCHANT_TRUCKING_LIST = "merchant:cross-border:domestic-trucking:list"; + public static final String MERCHANT_TRUCKING_CREATE = "merchant:cross-border:domestic-trucking:create"; + public static final String MERCHANT_TRUCKING_EDIT = "merchant:cross-border:domestic-trucking:edit"; + public static final String MERCHANT_LOOSEBOARD_LIST = "merchant:cross-border:pallet-shipping:list"; + public static final String MERCHANT_LOOSEBOARD_CREATE = "merchant:cross-border:pallet-shipping:create"; + public static final String MERCHANT_LOOSEBOARD_EDIT = "merchant:cross-border:pallet-shipping:edit"; public static final String PURCHASE_LIST = "platform:overseas-business:purchase:list"; public static final String PURCHASE_EDIT = "platform:overseas-business:purchase:edit"; public static final String PURCHASE_REVIEW = "platform:overseas-business:purchase:review"; diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferController.java index 63f93c8c4..5bbe9cc43 100644 --- a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferController.java +++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferController.java @@ -6,9 +6,11 @@ import com.baiyue.common.security.AuthenticatedUser; import com.baiyue.lastleg.transfer.dto.WarehouseTransferRequests; import com.baiyue.lastleg.transfer.dto.WarehouseTransferResponses; import com.baiyue.lastleg.transfer.service.WarehouseTransferService; +import com.baiyue.lastleg.security.OverseasPermissions; import jakarta.annotation.Resource; import jakarta.validation.Valid; import org.springframework.http.HttpStatus; +import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.security.core.annotation.AuthenticationPrincipal; import org.springframework.web.bind.annotation.*; import org.springframework.web.server.ResponseStatusException; @@ -19,24 +21,28 @@ public class MerchantWarehouseTransferController { @Resource private WarehouseTransferService service; @PostMapping + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_CREATE + "')") public ApiResponse create(@AuthenticationPrincipal AuthenticatedUser user, @Valid @RequestBody WarehouseTransferRequests.Create request) { return ApiResponse.success(service.create(customer(user), operator(user), request)); } @GetMapping + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_LIST + "')") public ApiResponse> page(@AuthenticationPrincipal AuthenticatedUser user, @Valid WarehouseTransferRequests.Query query) { return ApiResponse.success(service.page(customer(user), query)); } @GetMapping("/{transferNo}") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_LIST + "')") public ApiResponse detail(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable String transferNo) { return ApiResponse.success(service.detail(customer(user), transferNo)); } @PostMapping("/{transferNo}/confirm-measurement") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_CONFIRM + "')") public ApiResponse confirmMeasurement( @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String transferNo, @Valid @RequestBody WarehouseTransferRequests.CustomerConfirm request) { diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/trucking/controller/MerchantUsTruckOrderController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/trucking/controller/MerchantUsTruckOrderController.java index a33e914af..ad70a8558 100644 --- a/lastleg-service/src/main/java/com/baiyue/lastleg/trucking/controller/MerchantUsTruckOrderController.java +++ b/lastleg-service/src/main/java/com/baiyue/lastleg/trucking/controller/MerchantUsTruckOrderController.java @@ -23,29 +23,32 @@ import org.springframework.web.server.ResponseStatusException; @RestController @RequestMapping("/api/merchant/v1/last-leg/us-truck-orders") -@PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRUCKING + "')") public class MerchantUsTruckOrderController { @Resource private UsTruckOrderService service; @PostMapping + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRUCKING_CREATE + "')") public ApiResponse create(@AuthenticationPrincipal AuthenticatedUser user, @Valid @RequestBody UsTruckOrderRequests.Create request) { return ApiResponse.success(service.create(customer(user), operator(user), request)); } @GetMapping + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRUCKING_LIST + "')") public ApiResponse> page(@AuthenticationPrincipal AuthenticatedUser user, @Valid UsTruckOrderRequests.MerchantQuery query) { return ApiResponse.success(service.page(customer(user), query.scoped())); } @GetMapping("/{orderNo}") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRUCKING_LIST + "')") public ApiResponse detail(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable String orderNo) { return ApiResponse.success(service.detail(customer(user), orderNo)); } @PatchMapping("/{orderNo}") + @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRUCKING_EDIT + "')") public ApiResponse update(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable String orderNo, @Valid @RequestBody UsTruckOrderRequests.Update request) { return ApiResponse.success(service.update(customer(user), orderNo, operator(user), request)); diff --git a/lastleg-service/src/main/resources/openapi/overseas-business-v1.yaml b/lastleg-service/src/main/resources/openapi/overseas-business-v1.yaml index 16fea794d..9d749f55a 100644 --- a/lastleg-service/src/main/resources/openapi/overseas-business-v1.yaml +++ b/lastleg-service/src/main/resources/openapi/overseas-business-v1.yaml @@ -962,13 +962,13 @@ paths: /api/merchant/v1/last-leg/overseas-procurements: post: summary: 客户创建海外采购订单 - description: 权限 merchant:cross-border:procurement；客户 ID 只取认证身份且不接收 customerId；新单固定进入 PENDING_REVIEW。同幂等键同请求返回既有订单，异请求返回 A0409。 + description: 权限 merchant:cross-border:procurement:create；客户 ID 只取认证身份且不接收 customerId；新单固定进入 PENDING_REVIEW。同幂等键同请求返回既有订单，异请求返回 A0409。 security: [{ bearerAuth: [] }] requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/ProcurementCreate' } } } } responses: { '200': { description: 采购订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/ProcurementDetailResponse' } } } }, '409': { description: 幂等冲突 } } get: summary: 客户分页查询自己的海外采购订单 - description: 权限 merchant:cross-border:procurement；客户范围只取认证 Token，不接收 customerId。 + description: 权限 merchant:cross-border:procurement:list；客户范围只取认证 Token，不接收 customerId。 security: [{ bearerAuth: [] }] parameters: - { name: page, in: query, schema: { type: integer, minimum: 1, default: 1 } } @@ -984,14 +984,14 @@ paths: /api/merchant/v1/last-leg/overseas-procurements/{orderNo}: get: summary: 客户查询自己的海外采购订单详情及流水 - description: 权限 merchant:cross-border:procurement；列表权限包含详情只读，客户范围只取认证 Token。 + description: 权限 merchant:cross-border:procurement:list；列表权限包含详情只读，客户范围只取认证 Token。 security: [{ bearerAuth: [] }] parameters: [{ name: orderNo, in: path, required: true, schema: { type: string } }] responses: { '200': { description: 当前客户采购订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/ProcurementDetailResponse' } } } }, '404': { description: 当前客户下订单不存在 } } /api/merchant/v1/last-leg/us-truck-orders: get: summary: 客户分页查询自己的美国本土卡订单 - description: 权限 merchant:cross-border:domestic-trucking；客户范围只取认证 Token，不接收 customerId。 + description: 权限 merchant:cross-border:domestic-trucking:list；客户范围只取认证 Token，不接收 customerId。 security: [{ bearerAuth: [] }] parameters: - { name: page, in: query, schema: { type: integer, minimum: 1, default: 1 } } @@ -1005,7 +1005,7 @@ paths: responses: { '200': { description: 当前客户本土卡订单分页, content: { application/json: { schema: { $ref: '#/components/schemas/TruckPageResponse' } } } } } post: summary: 客户创建美国本土卡订单 - description: 权限 merchant:cross-border:domestic-trucking；新单固定进入 PENDING_REVIEW，客户不能调用平台审核或状态推进端点。 + description: 权限 merchant:cross-border:domestic-trucking:create；新单固定进入 PENDING_REVIEW，客户不能调用平台审核或状态推进端点。 security: [{ bearerAuth: [] }] requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/TruckCreate' } } } } responses: { '200': { description: 本土卡订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/TruckDetailResponse' } } } }, '409': { description: 幂等冲突 } } @@ -1013,19 +1013,19 @@ paths: parameters: [{ name: orderNo, in: path, required: true, schema: { type: string } }] get: summary: 客户查询自己的美国本土卡订单详情 - description: 权限 merchant:cross-border:domestic-trucking；不泄露其他客户订单。 + description: 权限 merchant:cross-border:domestic-trucking:list；不泄露其他客户订单。 security: [{ bearerAuth: [] }] responses: { '200': { description: 当前客户本土卡订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/TruckDetailResponse' } } } }, '404': { description: 当前客户下订单不存在 } } patch: summary: 客户编辑待审核的美国本土卡订单 - description: 权限 merchant:cross-border:domestic-trucking；仅 PENDING_REVIEW 可编辑，version 必填；不能修改状态。 + description: 权限 merchant:cross-border:domestic-trucking:edit；仅 PENDING_REVIEW 可编辑，version 必填；不能修改状态。 security: [{ bearerAuth: [] }] requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/TruckUpdate' } } } } responses: { '200': { description: 更新后的订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/TruckDetailResponse' } } } }, '409': { description: 版本或状态冲突 } } /api/merchant/v1/last-leg/local-looseboard-orders: get: summary: 客户分页查询自己的本土散板订单 - description: 权限 merchant:cross-border:pallet-shipping；客户范围只取认证 Token，不接收 customerId。 + description: 权限 merchant:cross-border:pallet-shipping:list；客户范围只取认证 Token，不接收 customerId。 security: [{ bearerAuth: [] }] parameters: - { name: page, in: query, schema: { type: integer, minimum: 1, default: 1 } } @@ -1039,7 +1039,7 @@ paths: responses: { '200': { description: 当前客户本土散板订单分页, content: { application/json: { schema: { $ref: '#/components/schemas/LooseboardPageResponse' } } } } } post: summary: 客户创建本土散板订单 - description: 权限 merchant:cross-border:pallet-shipping；新单固定进入 PENDING_ACCEPTANCE，客户不能调用平台状态推进端点。 + description: 权限 merchant:cross-border:pallet-shipping:create；新单固定进入 PENDING_ACCEPTANCE，客户不能调用平台状态推进端点。 security: [{ bearerAuth: [] }] requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/LooseboardCreate' } } } } responses: { '200': { description: 本土散板订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/LooseboardDetailResponse' } } } }, '409': { description: 幂等冲突 } } @@ -1047,12 +1047,12 @@ paths: parameters: [{ name: orderNo, in: path, required: true, schema: { type: string } }] get: summary: 客户查询自己的本土散板订单详情 - description: 权限 merchant:cross-border:pallet-shipping；不泄露其他客户订单。 + description: 权限 merchant:cross-border:pallet-shipping:list；不泄露其他客户订单。 security: [{ bearerAuth: [] }] responses: { '200': { description: 当前客户本土散板订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/LooseboardDetailResponse' } } } }, '404': { description: 当前客户下订单不存在 } } put: summary: 客户编辑待接单的本土散板订单 - description: 权限 merchant:cross-border:pallet-shipping；仅 PENDING_ACCEPTANCE 可编辑，version 必填；不能修改状态。 + description: 权限 merchant:cross-border:pallet-shipping:edit；仅 PENDING_ACCEPTANCE 可编辑，version 必填；不能修改状态。 security: [{ bearerAuth: [] }] requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/LooseboardUpdate' } } } } responses: { '200': { description: 更新后的订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/LooseboardDetailResponse' } } } }, '409': { description: 版本或状态冲突 } } @@ -1310,7 +1310,7 @@ paths: /api/merchant/v1/last-leg/relabel-applications/inventory-candidates: get: summary: 查询客户可换标库存候选 - description: 权限 merchant:warehouse:relabel；仅返回当前客户在指定海外中转仓仍有可用箱数的历史入仓单和库位摘要。候选按客户 Token 隔离，不接收 customerId；inboundCode 可选精确筛选。 + description: 权限 merchant:overseas-warehouse:relabel:list；仅返回当前客户在指定海外中转仓仍有可用箱数的历史入仓单和库位摘要。候选按客户 Token 隔离，不接收 customerId；inboundCode 可选精确筛选。 security: [{ bearerAuth: [] }] parameters: - { name: operationWarehouseId, in: query, required: true, schema: { type: string, maxLength: 128 } } @@ -1321,7 +1321,7 @@ paths: /api/merchant/v1/last-leg/relabel-applications: get: summary: 分页查询客户换标申请 - description: 权限 merchant:warehouse:relabel；客户范围只取认证 Token，不接收 customerId。 + description: 权限 merchant:overseas-warehouse:relabel:list；客户范围只取认证 Token，不接收 customerId。 security: [{ bearerAuth: [] }] parameters: - { name: page, in: query, schema: { type: integer, minimum: 1, default: 1 } } @@ -1337,7 +1337,7 @@ paths: '200': { description: 客户换标申请分页, content: { application/json: { schema: { $ref: '#/components/schemas/RelabelMerchantPageResponse' } } } } post: summary: 创建客户换标申请 - description: 权限 merchant:warehouse:relabel；申请创建即冻结对应库存。SKU_LABEL 不要求派送方式；CARTON_LABEL/CARTON_AND_SKU 必须指定 TRUCK、PICKUP 或 EXPRESS。 + description: 权限 merchant:overseas-warehouse:relabel:create；申请创建即冻结对应库存。SKU_LABEL 不要求派送方式；CARTON_LABEL/CARTON_AND_SKU 必须指定 TRUCK、PICKUP 或 EXPRESS。 security: [{ bearerAuth: [] }] requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/RelabelCreate' } } } } responses: @@ -1357,7 +1357,7 @@ paths: /api/merchant/v1/last-leg/relabel-applications/{relabelNo}: get: summary: 查询客户换标申请详情 - description: 权限 merchant:warehouse:relabel；客户范围只取认证 Token。 + description: 权限 merchant:overseas-warehouse:relabel:list；客户范围只取认证 Token。 security: [{ bearerAuth: [] }] parameters: [{ name: relabelNo, in: path, required: true, schema: { type: string, maxLength: 64 } }] responses: @@ -1366,7 +1366,7 @@ paths: /api/merchant/v1/last-leg/relabel-applications/{relabelNo}/shipping-label: post: summary: 上传换标快递面单 - description: 权限 merchant:warehouse:relabel；仅 EXPRESS 且申请尚未客户确认时允许上传，文件由服务端绑定到申请单。 + description: 权限 merchant:overseas-warehouse:relabel:files；仅 EXPRESS 且申请尚未客户确认时允许上传，文件由服务端绑定到申请单。 security: [{ bearerAuth: [] }] parameters: [{ name: relabelNo, in: path, required: true, schema: { type: string, maxLength: 64 } }] requestBody: { required: true, content: { multipart/form-data: { schema: { type: object, required: [file], properties: { file: { type: string, format: binary } } } } } } @@ -1377,7 +1377,7 @@ paths: /api/merchant/v1/last-leg/relabel-applications/{relabelNo}/shipping-label/{fileId}/download: get: summary: 下载换标快递面单 - description: 权限 merchant:warehouse:relabel；仅允许下载当前申请已绑定的面单文件。 + description: 权限 merchant:overseas-warehouse:relabel:list；仅允许下载当前申请已绑定的面单文件。 security: [{ bearerAuth: [] }] parameters: - { name: relabelNo, in: path, required: true, schema: { type: string, maxLength: 64 } } @@ -1388,7 +1388,7 @@ paths: /api/merchant/v1/last-leg/relabel-applications/{relabelNo}/completion-photos/{fileId}/download: get: summary: 下载换标完成照片 - description: 权限 merchant:warehouse:relabel；仅允许下载该申请 PDA 完工证据中的照片。 + description: 权限 merchant:overseas-warehouse:relabel:list；仅允许下载该申请 PDA 完工证据中的照片。 security: [{ bearerAuth: [] }] parameters: - { name: relabelNo, in: path, required: true, schema: { type: string, maxLength: 64 } } @@ -1399,7 +1399,7 @@ paths: /api/merchant/v1/last-leg/relabel-applications/{relabelNo}/confirm-completion: post: summary: 客户确认换标完成 - description: 权限 merchant:warehouse:relabel；仅 CUSTOMER_CONFIRM_PENDING 可确认。TRUCK 进入 WAIT_PRE_DISPATCH，PICKUP/EXPRESS 幂等生成 RELABEL_OUTBOUND 出库单；EXPRESS 且要求打印面单时必须先上传面单。 + description: 权限 merchant:overseas-warehouse:relabel:confirm；仅 CUSTOMER_CONFIRM_PENDING 可确认。TRUCK 进入 WAIT_PRE_DISPATCH，PICKUP/EXPRESS 幂等生成 RELABEL_OUTBOUND 出库单；EXPRESS 且要求打印面单时必须先上传面单。 security: [{ bearerAuth: [] }] parameters: [{ name: relabelNo, in: path, required: true, schema: { type: string, maxLength: 64 } }] requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/RelabelCustomerConfirm' } } } } @@ -1409,7 +1409,7 @@ paths: /api/merchant/v1/last-leg/return-orders: get: summary: 客户分页查询退货签收订单 - description: 客户范围只取认证 Token。可按退货单号、快递单号、SKU 和签收状态过滤；实收数量以仓库 PDA 签收为准。 + description: 权限 merchant:overseas-warehouse:return-order:list；客户范围只取认证 Token。可按退货单号、快递单号、SKU 和签收状态过滤；实收数量以仓库 PDA 签收为准。 security: [{ bearerAuth: [] }] parameters: - { name: page, in: query, schema: { type: integer, minimum: 1, default: 1 } } @@ -1421,14 +1421,14 @@ paths: responses: { '200': { description: 当前客户退货订单分页 } } post: summary: 客户创建退货预报订单 - description: 客户只预报不重复的 SKU 和预计数量，不要求提前知道快递单号；仓库 PDA 实收数量才是实际入库事实。系统退货编号由业务前缀和25位大写Base36完整随机UUID编码组成，退货单RT、签收单RR、批次RB、箱唛RC及退货主单RETU均独立生成，不编码内部ID、仓库或日期。幂等重放返回已保存的编号，不重新生成。 + description: 权限 merchant:overseas-warehouse:return-order:create；客户只预报不重复的 SKU 和预计数量，不要求提前知道快递单号；仓库 PDA 实收数量才是实际入库事实。系统退货编号由业务前缀和25位大写Base36完整随机UUID编码组成，退货单RT、签收单RR、批次RB、箱唛RC及退货主单RETU均独立生成，不编码内部ID、仓库或日期。幂等重放返回已保存的编号，不重新生成。 security: [{ bearerAuth: [] }] requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/ReturnOrderCreate' } } } } responses: { '200': { description: 创建后的退货订单详情 }, '409': { description: 幂等键冲突 } } /api/merchant/v1/last-leg/return-orders/{returnNo}: get: summary: 客户查询退货订单与签收批次 - description: 返回各 SKU 的预报和实收数量，以及每次 PDA 签收产生的批次号和可选快递单号。 + description: 权限 merchant:overseas-warehouse:return-order:list；返回各 SKU 的预报和实收数量，以及每次 PDA 签收产生的批次号和可选快递单号。 security: [{ bearerAuth: [] }] parameters: [{ name: returnNo, in: path, required: true, schema: { type: string } }] responses: { '200': { description: 当前客户退货订单详情 }, '404': { description: 当前客户下退货订单不存在 } } diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/merchant/MerchantOverseasCustomerApiContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/merchant/MerchantOverseasCustomerApiContractTest.java index affa0f795..c9092655e 100644 --- a/lastleg-service/src/test/java/com/baiyue/lastleg/merchant/MerchantOverseasCustomerApiContractTest.java +++ b/lastleg-service/src/test/java/com/baiyue/lastleg/merchant/MerchantOverseasCustomerApiContractTest.java @@ -1,14 +1,19 @@ package com.baiyue.lastleg.merchant; import com.baiyue.common.security.AuthenticatedUser; +import com.baiyue.lastleg.controller.MerchantLastlegOrderController; import com.baiyue.lastleg.inboundplan.controller.MerchantInboundPlanController; import com.baiyue.lastleg.inboundplan.dto.InboundPlanRequests; import com.baiyue.lastleg.inboundplan.service.InboundPlanService; +import com.baiyue.lastleg.discard.controller.MerchantCargoDiscardController; import com.baiyue.lastleg.looseboard.controller.MerchantLocalLooseboardController; import com.baiyue.lastleg.looseboard.dto.LocalLooseboardRequests; import com.baiyue.lastleg.looseboard.service.LocalLooseboardService; import com.baiyue.lastleg.procurement.controller.MerchantOverseasProcurementController; +import com.baiyue.lastleg.relabel.controller.MerchantRelabelApplicationController; +import com.baiyue.lastleg.returnreceipt.controller.MerchantReturnOrderController; import com.baiyue.lastleg.security.OverseasPermissions; +import com.baiyue.lastleg.transfer.controller.MerchantWarehouseTransferController; import com.baiyue.lastleg.trucking.controller.MerchantUsTruckOrderController; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; @@ -21,6 +26,7 @@ import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.server.ResponseStatusException; import java.util.Arrays; +import java.util.Map; import java.util.Set; import static org.assertj.core.api.Assertions.assertThat; @@ -43,15 +49,57 @@ class MerchantOverseasCustomerApiContractTest { } @Test - void merchantControllersUseFrozenPathsAndExistingClientPermissionCodes() { - assertController(MerchantOverseasProcurementController.class, - "/api/merchant/v1/last-leg/overseas-procurements", OverseasPermissions.MERCHANT_PROCUREMENT); - assertController(MerchantUsTruckOrderController.class, - "/api/merchant/v1/last-leg/us-truck-orders", OverseasPermissions.MERCHANT_TRUCKING); - assertController(MerchantLocalLooseboardController.class, - "/api/merchant/v1/last-leg/local-looseboard-orders", OverseasPermissions.MERCHANT_LOOSEBOARD); + void merchantControllersUseFrozenPathsAndOperationPermissions() { + assertPath(MerchantOverseasProcurementController.class, "/api/merchant/v1/last-leg/overseas-procurements"); + assertPermissions(MerchantOverseasProcurementController.class, Map.of( + "create", OverseasPermissions.MERCHANT_PROCUREMENT_CREATE, + "page", OverseasPermissions.MERCHANT_PROCUREMENT_LIST, + "detail", OverseasPermissions.MERCHANT_PROCUREMENT_LIST)); + assertPath(MerchantUsTruckOrderController.class, "/api/merchant/v1/last-leg/us-truck-orders"); + assertPermissions(MerchantUsTruckOrderController.class, Map.of( + "create", OverseasPermissions.MERCHANT_TRUCKING_CREATE, + "page", OverseasPermissions.MERCHANT_TRUCKING_LIST, + "detail", OverseasPermissions.MERCHANT_TRUCKING_LIST, + "update", OverseasPermissions.MERCHANT_TRUCKING_EDIT)); + assertPath(MerchantLocalLooseboardController.class, "/api/merchant/v1/last-leg/local-looseboard-orders"); + assertPermissions(MerchantLocalLooseboardController.class, Map.of( + "create", OverseasPermissions.MERCHANT_LOOSEBOARD_CREATE, + "page", OverseasPermissions.MERCHANT_LOOSEBOARD_LIST, + "detail", OverseasPermissions.MERCHANT_LOOSEBOARD_LIST, + "update", OverseasPermissions.MERCHANT_LOOSEBOARD_EDIT)); assertController(MerchantInboundPlanController.class, "/api/merchant/v1/last-leg/inbound-plans", OverseasPermissions.MERCHANT_INBOUND_LIST); + assertController(MerchantLastlegOrderController.class, + "/api/merchant/v1/last-leg/orders", OverseasPermissions.MERCHANT_LAST_MILE_ORDER_LIST); + + assertPermissions(MerchantWarehouseTransferController.class, Map.of( + "create", OverseasPermissions.MERCHANT_TRANSFER_CREATE, + "page", OverseasPermissions.MERCHANT_TRANSFER_LIST, + "detail", OverseasPermissions.MERCHANT_TRANSFER_LIST, + "confirmMeasurement", OverseasPermissions.MERCHANT_TRANSFER_CONFIRM)); + assertPermissions(MerchantCargoDiscardController.class, Map.of( + "candidates", OverseasPermissions.MERCHANT_DISCARD_LIST, + "create", OverseasPermissions.MERCHANT_DISCARD_CREATE, + "page", OverseasPermissions.MERCHANT_DISCARD_LIST, + "detail", OverseasPermissions.MERCHANT_DISCARD_LIST, + "cancel", OverseasPermissions.MERCHANT_DISCARD_CANCEL)); + assertPermissions(MerchantReturnOrderController.class, Map.of( + "create", OverseasPermissions.MERCHANT_RETURN_ORDER_CREATE, + "page", OverseasPermissions.MERCHANT_RETURN_ORDER_LIST, + "detail", OverseasPermissions.MERCHANT_RETURN_ORDER_LIST, + "relabelCandidates", OverseasPermissions.MERCHANT_RETURN_ORDER_RELABEL, + "createRelabel", OverseasPermissions.MERCHANT_RETURN_ORDER_RELABEL)); + assertPermissions(MerchantRelabelApplicationController.class, Map.of( + "candidates", OverseasPermissions.MERCHANT_RELABEL_LIST, + "historicalOrders", OverseasPermissions.MERCHANT_RELABEL_LIST, + "create", OverseasPermissions.MERCHANT_RELABEL_CREATE, + "page", OverseasPermissions.MERCHANT_RELABEL_LIST, + "detail", OverseasPermissions.MERCHANT_RELABEL_LIST, + "uploadShippingLabel", OverseasPermissions.MERCHANT_RELABEL_FILES, + "uploadFile", OverseasPermissions.MERCHANT_RELABEL_FILES, + "downloadShippingLabel", OverseasPermissions.MERCHANT_RELABEL_LIST, + "downloadCompletionPhoto", OverseasPermissions.MERCHANT_RELABEL_LIST, + "confirmCompletion", OverseasPermissions.MERCHANT_RELABEL_CONFIRM)); } @Test @@ -90,11 +138,27 @@ class MerchantOverseasCustomerApiContractTest { } private static void assertController(Class type, String path, String permission) { - assertThat(type.getAnnotation(RequestMapping.class).value()).containsExactly(path); + assertPath(type, path); assertThat(type.getAnnotation(PreAuthorize.class).value()) .isEqualTo("hasAuthority('" + permission + "')"); } + private static void assertPath(Class type, String path) { + assertThat(type.getAnnotation(RequestMapping.class).value()).containsExactly(path); + } + + private static void assertPermissions(Class type, Map permissions) { + for (var entry : permissions.entrySet()) { + var method = Arrays.stream(type.getDeclaredMethods()) + .filter(candidate -> candidate.getName().equals(entry.getKey())) + .findFirst().orElseThrow(); + assertThat(method.getAnnotation(PreAuthorize.class)) + .as(type.getSimpleName() + "." + entry.getKey()).isNotNull(); + assertThat(method.getAnnotation(PreAuthorize.class).value()) + .isEqualTo("hasAuthority('" + entry.getValue() + "')"); + } + } + private static AuthenticatedUser user(long customerId, String appCode) { return new AuthenticatedUser(7L, customerId, customerId, 8L, "operator", appCode, "WEB", Set.of()); } diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/merchant/MerchantOverseasOpenApiContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/merchant/MerchantOverseasOpenApiContractTest.java index e89d8d07d..6582c0396 100644 --- a/lastleg-service/src/test/java/com/baiyue/lastleg/merchant/MerchantOverseasOpenApiContractTest.java +++ b/lastleg-service/src/test/java/com/baiyue/lastleg/merchant/MerchantOverseasOpenApiContractTest.java @@ -27,9 +27,14 @@ class MerchantOverseasOpenApiContractTest { assertThat(yaml).contains(path); assertThat(pathBlock(yaml, path)).doesNotContain("name: customerId"); } - assertThat(yaml).contains("merchant:cross-border:procurement") - .contains("merchant:cross-border:domestic-trucking") - .contains("merchant:cross-border:pallet-shipping") + assertThat(yaml).contains("merchant:cross-border:procurement:list") + .contains("merchant:cross-border:procurement:create") + .contains("merchant:cross-border:domestic-trucking:list") + .contains("merchant:cross-border:domestic-trucking:create") + .contains("merchant:cross-border:domestic-trucking:edit") + .contains("merchant:cross-border:pallet-shipping:list") + .contains("merchant:cross-border:pallet-shipping:create") + .contains("merchant:cross-border:pallet-shipping:edit") .contains("merchant:warehouse:inbound:list") .contains("#/components/schemas/ProcurementDetailResponse") .contains("#/components/schemas/TruckDetailResponse") diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/RelabelContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/RelabelContractTest.java index f6ab20500..2d9995cf6 100644 --- a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/RelabelContractTest.java +++ b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/RelabelContractTest.java @@ -96,7 +96,10 @@ class RelabelContractTest { } assertTrue(openApi.contains("RelabelMerchantPageResponse")); assertTrue(openApi.contains("RelabelCustomerConfirm")); - assertTrue(openApi.contains("merchant:warehouse:relabel")); + assertTrue(openApi.contains("merchant:overseas-warehouse:relabel:list")); + assertTrue(openApi.contains("merchant:overseas-warehouse:relabel:create")); + assertTrue(openApi.contains("merchant:overseas-warehouse:relabel:files")); + assertTrue(openApi.contains("merchant:overseas-warehouse:relabel:confirm")); String relabelPaths = openApi.substring(openApi.indexOf("/api/platform/v1/last-leg/relabel-applications:"), openApi.indexOf("components:")); assertTrue(relabelPaths.contains("name: customerId, in: query, required: true")); diff --git a/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs b/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs index 8b139fde4..c9b861312 100644 --- a/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs +++ b/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs @@ -47,7 +47,7 @@ test('平台管理员由外部bcrypt引导，强制首登改密且不创建客 }) test('必要系统种子完整保留，但不写入示例资源与业务事实', () => { - for (const [name, count] of Object.entries({ iam_role: 8, iam_permission: 346, iam_role_permission: 521, + for (const [name, count] of Object.entries({ iam_role: 8, iam_permission: 364, iam_role_permission: 539, iam_data_scope: 7, wh_warehouse: 318, wh_warehouse_address: 318, wh_service_capability: 4, fl_fee_item: 112, fl_price_channel_catalog: 15, fl_price_origin_alias: 7, fl_price_warehouse_mapping: 4, file_export_task_guard: 1, fin_subject: 1 })) assert.equal(seedRows(cn, name).length, count, name) diff --git a/scripts/agents-index-contract.ps1 b/scripts/agents-index-contract.ps1 index 1b89c166a..ab5303ff7 100644 --- a/scripts/agents-index-contract.ps1 +++ b/scripts/agents-index-contract.ps1 @@ -589,7 +589,7 @@ foreach ($gatewayPath in @( '/api/merchant/v1/last-leg/**', '/api/platform/v1/last-leg/**', '/api/pda/v1/last-leg/**', - '/api/merchant/v1/warehouses/**', + '/api/platform/v1/warehouses/**', '/api/platform/v1/warehouse-admin/**' )) { Assert-Contains $overseasGatewayConfig $gatewayPath 'Overseas Gateway 路由' @@ -1136,6 +1136,7 @@ $criticalPaths | ForEach-Object { Assert-Path $_ } foreach ($removedOverseasWarehouseMasterPath in @( 'baiyue-firstleg/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/PlatformWarehouseController.java', 'baiyue-firstleg/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/MerchantWarehouseController.java', + 'baiyue-firstleg/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/MerchantWarehouseResourceController.java', 'baiyue-firstleg/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/entity/WarehouseEntity.java', 'baiyue-firstleg/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/entity/WarehouseAddressEntity.java', 'baiyue-firstleg/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/entity/ServiceCapabilityEntity.java' diff --git a/warehouse-overseas-service/AGENTS.md b/warehouse-overseas-service/AGENTS.md index 95a4c29b2..7bfb080eb 100644 --- a/warehouse-overseas-service/AGENTS.md +++ b/warehouse-overseas-service/AGENTS.md @@ -11,7 +11,7 @@ | 功能 | 入口 | |---|---| | 国内仓库只读目录 | `client/DomesticWarehouseDirectoryClient.java`、`service/DomesticWarehouseDirectory.java`；正结果缓存 30 分钟，空值和不存在不得长缓存 | -| 平台/商户库位与托盘 | `controller/PlatformWarehouseResourceController.java`、`MerchantWarehouseResourceController.java` | +| 平台库位与托盘 | `controller/PlatformWarehouseResourceController.java`；企业端不得直接维护物理库位与托盘 | | 内部资源锁定、释放、报废 | `controller/InternalWarehouseResourceLockController.java` | | PDA 托盘状态流转与补偿 | `controller/InternalPdaPalletTransitionController.java`、`service/WarehousePalletTransitionService.java`、`mapper/WarehousePalletTransitionMapper.java`；内部前缀 `/internal/v1/pda-pallet-transitions` | | 托盘解析与业务绑定 | `controller/InternalWarehousePalletController.java`、`dto/WarehousePalletResolveResponse.java`、`entity/WarehousePalletBindingEntity.java` | diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/MerchantWarehouseResourceController.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/MerchantWarehouseResourceController.java deleted file mode 100644 index 0ba243967..000000000 --- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/MerchantWarehouseResourceController.java +++ /dev/null @@ -1,109 +0,0 @@ -package com.baiyue.warehouse.controller; - -import com.baiyue.common.core.api.ApiResponse; -import com.baiyue.common.core.api.PageResult; -import com.baiyue.common.core.api.ResultCode; -import com.baiyue.common.core.exception.BizException; -import com.baiyue.common.security.AuthenticatedUser; -import com.baiyue.warehouse.dto.LocationRequests; -import com.baiyue.warehouse.dto.PalletRequests; -import com.baiyue.warehouse.entity.WarehouseLocationEntity; -import com.baiyue.warehouse.entity.WarehousePalletEntity; -import com.baiyue.warehouse.service.WarehouseResourceService; -import jakarta.validation.Valid; -import jakarta.annotation.Resource; -import org.springframework.security.core.annotation.AuthenticationPrincipal; -import org.springframework.validation.annotation.Validated; -import org.springframework.web.bind.annotation.DeleteMapping; -import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.PathVariable; -import org.springframework.web.bind.annotation.PostMapping; -import org.springframework.web.bind.annotation.PutMapping; -import org.springframework.web.bind.annotation.RequestBody; -import org.springframework.web.bind.annotation.RequestMapping; -import org.springframework.web.bind.annotation.RestController; - -@Validated -@RestController -@RequestMapping("/api/merchant/v1/warehouses/{warehouseId}") -public class MerchantWarehouseResourceController { - @Resource private WarehouseResourceService service; - - @PostMapping("/locations") - public ApiResponse createLocation(@AuthenticationPrincipal AuthenticatedUser user, - @PathVariable long warehouseId, - @Valid @RequestBody LocationRequests.SaveRequest request) { - return ApiResponse.success(service.createLocation(tenant(user), warehouseId, request)); - } - - @PutMapping("/locations/{id}") - public ApiResponse updateLocation(@AuthenticationPrincipal AuthenticatedUser user, - @PathVariable long warehouseId, @PathVariable long id, - @Valid @RequestBody LocationRequests.SaveRequest request) { - service.updateLocation(tenant(user), warehouseId, id, request); - return ApiResponse.success(null); - } - - @GetMapping("/locations") - public ApiResponse> locations( - @AuthenticationPrincipal AuthenticatedUser user, @PathVariable long warehouseId, - @Valid LocationRequests.QueryRequest query) { - return ApiResponse.success(service.locations(tenant(user), warehouseId, query)); - } - - @GetMapping("/locations/{id}") - public ApiResponse location(@AuthenticationPrincipal AuthenticatedUser user, - @PathVariable long warehouseId, - @PathVariable long id) { - return ApiResponse.success(service.location(tenant(user), warehouseId, id)); - } - - @DeleteMapping("/locations/{id}") - public ApiResponse deleteLocation(@AuthenticationPrincipal AuthenticatedUser user, - @PathVariable long warehouseId, @PathVariable long id) { - service.deleteLocation(tenant(user), warehouseId, id); - return ApiResponse.success(null); - } - - @PostMapping("/pallets") - public ApiResponse createPallet(@AuthenticationPrincipal AuthenticatedUser user, - @PathVariable long warehouseId, - @Valid @RequestBody PalletRequests.SaveRequest request) { - return ApiResponse.success(service.createPallet(tenant(user), warehouseId, request)); - } - - @PutMapping("/pallets/{id}") - public ApiResponse updatePallet(@AuthenticationPrincipal AuthenticatedUser user, - @PathVariable long warehouseId, @PathVariable long id, - @Valid @RequestBody PalletRequests.SaveRequest request) { - service.updatePallet(tenant(user), warehouseId, id, request); - return ApiResponse.success(null); - } - - @GetMapping("/pallets") - public ApiResponse> pallets( - @AuthenticationPrincipal AuthenticatedUser user, @PathVariable long warehouseId, - @Valid PalletRequests.QueryRequest query) { - return ApiResponse.success(service.pallets(tenant(user), warehouseId, query)); - } - - @GetMapping("/pallets/{id}") - public ApiResponse pallet(@AuthenticationPrincipal AuthenticatedUser user, - @PathVariable long warehouseId, @PathVariable long id) { - return ApiResponse.success(service.pallet(tenant(user), warehouseId, id)); - } - - @DeleteMapping("/pallets/{id}") - public ApiResponse deletePallet(@AuthenticationPrincipal AuthenticatedUser user, - @PathVariable long warehouseId, @PathVariable long id) { - service.deletePallet(tenant(user), warehouseId, id); - return ApiResponse.success(null); - } - - private static long tenant(AuthenticatedUser user) { - if (user == null || user.tenantId() == null || user.tenantId() <= 0) { - throw new BizException(ResultCode.UNAUTHORIZED, "认证租户缺失"); - } - return user.tenantId(); - } -} diff --git a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/controller/WarehouseResourceControllerTest.java b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/controller/WarehouseResourceControllerTest.java index 3fb778ee7..728fd6a5c 100644 --- a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/controller/WarehouseResourceControllerTest.java +++ b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/controller/WarehouseResourceControllerTest.java @@ -32,18 +32,6 @@ class WarehouseResourceControllerTest { verify(labels).print(200L, 9L, "r1"); } - @Test - void merchantTenantAlwaysComesFromAuthenticatedUser() { - MerchantWarehouseResourceController controller = merchantController(); - AuthenticatedUser merchant = user(10001L, "MERCHANT"); - WarehouseLocationEntity expected = new WarehouseLocationEntity(); - when(service.location(10001L, 20001L, 30001L)).thenReturn(expected); - - controller.location(merchant, 20001L, 30001L); - - verify(service).location(10001L, 20001L, 30001L); - } - @Test void platformApiRejectsNonPlatformIdentity() { PlatformWarehouseResourceController controller = platformController(); @@ -79,12 +67,6 @@ class WarehouseResourceControllerTest { "tester", appCode, "WEB", Set.of()); } - private MerchantWarehouseResourceController merchantController() { - MerchantWarehouseResourceController controller = new MerchantWarehouseResourceController(); - ReflectionTestUtils.setField(controller, "service", service); - return controller; - } - private PlatformWarehouseResourceController platformController() { PlatformWarehouseResourceController controller = new PlatformWarehouseResourceController(); ReflectionTestUtils.setField(controller, "service", service);