优化

lastleg-service/src/main/java/com/baiyue/lastleg/controller/MerchantLastlegOrderController.java

@@ -7,9 +7,11 @@ import com.baiyue.lastleg.dto.LastlegOrderDetailResponse;
 import com.baiyue.lastleg.dto.LastlegOrderRequests;
 import com.baiyue.lastleg.dto.LastlegOrderSummary;
 import com.baiyue.lastleg.service.LastlegOrderService;
+import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
@@ -19,6 +21,7 @@ import org.springframework.web.server.ResponseStatusException;
 
 @RestController
 @RequestMapping("/api/merchant/v1/last-leg/orders")
+@PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LAST_MILE_ORDER_LIST + "')")
 public class MerchantLastlegOrderController {
     @Resource private LastlegOrderService orderService;
 

lastleg-service/src/main/java/com/baiyue/lastleg/discard/controller/MerchantCargoDiscardController.java

@@ -6,9 +6,11 @@ import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.discard.dto.CargoDiscardRequests;
 import com.baiyue.lastleg.discard.dto.CargoDiscardResponses;
 import com.baiyue.lastleg.discard.service.CargoDiscardService;
+import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.server.ResponseStatusException;
@@ -19,18 +21,23 @@ import java.util.List;
 public class MerchantCargoDiscardController {
     @Resource private CargoDiscardService service;
     @GetMapping("/inventory-candidates")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_LIST + "')")
     public ApiResponse<List<CargoDiscardResponses.Candidate>> candidates(@AuthenticationPrincipal AuthenticatedUser user,
         @RequestParam(required = false) String inboundCode) { return ApiResponse.success(service.candidates(customer(user), inboundCode)); }
     @PostMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_CREATE + "')")
     public ApiResponse<CargoDiscardResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody CargoDiscardRequests.Create request) { return ApiResponse.success(service.create(customer(user), operator(user), request)); }
     @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_LIST + "')")
     public ApiResponse<PageResult<CargoDiscardResponses.Summary>> page(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid CargoDiscardRequests.Query query) { return ApiResponse.success(service.page(customer(user), query)); }
     @GetMapping("/{discardNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_LIST + "')")
     public ApiResponse<CargoDiscardResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String discardNo) { return ApiResponse.success(service.detail(customer(user), discardNo)); }
     @PostMapping("/{discardNo}/cancel")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_CANCEL + "')")
     public ApiResponse<CargoDiscardResponses.Detail> cancel(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String discardNo) { return ApiResponse.success(service.cancel(customer(user), discardNo, operator(user), false)); }
     private String customer(AuthenticatedUser user) {

lastleg-service/src/main/java/com/baiyue/lastleg/looseboard/controller/MerchantLocalLooseboardController.java

@@ -23,29 +23,32 @@ import org.springframework.web.server.ResponseStatusException;
 
 @RestController
 @RequestMapping("/api/merchant/v1/last-leg/local-looseboard-orders")
-@PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD + "')")
 public class MerchantLocalLooseboardController {
     @Resource private LocalLooseboardService service;
 
     @PostMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD_CREATE + "')")
     public ApiResponse<LocalLooseboardResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody LocalLooseboardRequests.Create request) {
         return ApiResponse.success(service.create(customer(user), operator(user), request));
     }
 
     @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD_LIST + "')")
     public ApiResponse<PageResult<LocalLooseboardResponses.Summary>> page(
         @AuthenticationPrincipal AuthenticatedUser user, @Valid LocalLooseboardRequests.MerchantQuery query) {
         return ApiResponse.success(service.page(customer(user), query));
     }
 
     @GetMapping("/{orderNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD_LIST + "')")
     public ApiResponse<LocalLooseboardResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String orderNo) {
         return ApiResponse.success(service.detail(customer(user), orderNo));
     }
 
     @PutMapping("/{orderNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD_EDIT + "')")
     public ApiResponse<LocalLooseboardResponses.Detail> update(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String orderNo, @Valid @RequestBody LocalLooseboardRequests.Update request) {
         return ApiResponse.success(service.update(customer(user), orderNo, operator(user), request));

lastleg-service/src/main/java/com/baiyue/lastleg/procurement/controller/MerchantOverseasProcurementController.java

@@ -22,11 +22,11 @@ import org.springframework.web.server.ResponseStatusException;
 
 @RestController
 @RequestMapping("/api/merchant/v1/last-leg/overseas-procurements")
-@PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_PROCUREMENT + "')")
 public class MerchantOverseasProcurementController {
     @Resource private OverseasProcurementService service;
 
     @PostMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_PROCUREMENT_CREATE + "')")
     public ApiResponse<OverseasProcurementResponses.Detail> create(
         @AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody OverseasProcurementRequests.Create request) {
@@ -34,12 +34,14 @@ public class MerchantOverseasProcurementController {
     }
 
     @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_PROCUREMENT_LIST + "')")
     public ApiResponse<PageResult<OverseasProcurementResponses.Summary>> page(
         @AuthenticationPrincipal AuthenticatedUser user, @Valid OverseasProcurementRequests.MerchantQuery query) {
         return ApiResponse.success(service.page(customer(user), query.scoped()));
     }
 
     @GetMapping("/{orderNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_PROCUREMENT_LIST + "')")
     public ApiResponse<OverseasProcurementResponses.Detail> detail(
         @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String orderNo) {
         return ApiResponse.success(service.detail(customer(user), orderNo));

lastleg-service/src/main/java/com/baiyue/lastleg/relabel/controller/MerchantRelabelApplicationController.java

@@ -6,9 +6,11 @@ import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.relabel.dto.RelabelRequests;
 import com.baiyue.lastleg.relabel.dto.RelabelResponses;
 import com.baiyue.lastleg.relabel.service.RelabelApplicationService;
+import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.server.ResponseStatusException;
@@ -24,6 +26,7 @@ import java.util.List;
 public class MerchantRelabelApplicationController {
     @Resource private RelabelApplicationService service;
     @GetMapping("/inventory-candidates")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')")
     public ApiResponse<List<RelabelResponses.InventoryCandidate>> candidates(
         @AuthenticationPrincipal AuthenticatedUser user,
         @RequestParam String operationWarehouseId,
@@ -31,6 +34,7 @@ public class MerchantRelabelApplicationController {
         return ApiResponse.success(service.candidates(customer(user), operationWarehouseId, inboundCode));
     }
     @GetMapping("/historical-orders")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')")
     public ApiResponse<List<RelabelResponses.HistoricalOrder>> historicalOrders(
         @AuthenticationPrincipal AuthenticatedUser user,
         @RequestParam String operationWarehouseId,
@@ -38,20 +42,25 @@ public class MerchantRelabelApplicationController {
         return ApiResponse.success(service.historicalOrders(customer(user), operationWarehouseId, keyword));
     }
     @PostMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_CREATE + "')")
     public ApiResponse<RelabelResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody RelabelRequests.Create request) { return ApiResponse.success(service.create(customer(user), operator(user), request)); }
     @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')")
     public ApiResponse<PageResult<RelabelResponses.Summary>> page(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid RelabelRequests.Query query) { return ApiResponse.success(service.page(customer(user), query)); }
     @GetMapping("/{relabelNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')")
     public ApiResponse<RelabelResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String relabelNo) { return ApiResponse.success(service.detail(customer(user), relabelNo)); }
     @PostMapping(value = "/{relabelNo}/shipping-label", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_FILES + "')")
     public ApiResponse<RelabelResponses.Detail> uploadShippingLabel(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String relabelNo, @RequestPart("file") MultipartFile file) {
         return ApiResponse.success(service.uploadShippingLabel(customer(user), relabelNo, operatorLong(user), file));
     }
     @PostMapping(value = "/{relabelNo}/files", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_FILES + "')")
     public ApiResponse<RelabelResponses.Detail> uploadFile(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String relabelNo, @RequestParam String scope, @RequestParam(required = false) Long itemId,
         @RequestPart("file") MultipartFile file) {
@@ -60,18 +69,21 @@ public class MerchantRelabelApplicationController {
         return ApiResponse.success(service.uploadTotalFile(customer(user), relabelNo, operatorLong(user), file, kind));
     }
     @GetMapping("/{relabelNo}/shipping-label/{fileId}/download")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')")
     public ResponseEntity<byte[]> downloadShippingLabel(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String relabelNo, @PathVariable long fileId) {
         var file = service.downloadShippingLabel(customer(user), relabelNo, fileId);
         return download(file.content(), file.fileName(), file.contentType());
     }
     @GetMapping("/{relabelNo}/completion-photos/{fileId}/download")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')")
     public ResponseEntity<byte[]> downloadCompletionPhoto(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String relabelNo, @PathVariable long fileId) {
         var file = service.downloadCompletionPhoto(customer(user), relabelNo, fileId);
         return download(file.content(), file.fileName(), file.contentType());
     }
     @PostMapping("/{relabelNo}/confirm-completion")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_CONFIRM + "')")
     public ApiResponse<RelabelResponses.Detail> confirmCompletion(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String relabelNo, @Valid @RequestBody RelabelRequests.CustomerConfirm request) {
         return ApiResponse.success(service.confirmCompletion(customer(user), relabelNo, operator(user), request));

lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/controller/MerchantReturnOrderController.java

@@ -6,9 +6,11 @@ import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.returnreceipt.dto.ReturnOrderRequests;
 import com.baiyue.lastleg.returnreceipt.dto.ReturnOrderResponses;
 import com.baiyue.lastleg.returnreceipt.service.ReturnReceiptService;
+import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.server.ResponseStatusException;
@@ -17,17 +19,22 @@ import org.springframework.web.server.ResponseStatusException;
 @RequestMapping("/api/merchant/v1/last-leg/return-orders")
 public class MerchantReturnOrderController {
     @Resource private ReturnReceiptService service;
-    @PostMapping public ApiResponse<ReturnOrderResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
+    @PostMapping @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_CREATE + "')")
+    public ApiResponse<ReturnOrderResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody ReturnOrderRequests.Create request) { return ApiResponse.success(service.create(customer(user), operator(user), request)); }
-    @GetMapping public ApiResponse<PageResult<ReturnOrderResponses.Summary>> page(@AuthenticationPrincipal AuthenticatedUser user,
+    @GetMapping @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_LIST + "')")
+    public ApiResponse<PageResult<ReturnOrderResponses.Summary>> page(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid ReturnOrderRequests.Query query) { return ApiResponse.success(service.page(customer(user), query)); }
-    @GetMapping("/{returnNo}") public ApiResponse<ReturnOrderResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
+    @GetMapping("/{returnNo}") @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_LIST + "')")
+    public ApiResponse<ReturnOrderResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String returnNo) { return ApiResponse.success(service.detail(customer(user), returnNo)); }
-    @GetMapping("/{returnNo}/relabel-candidates") public ApiResponse<java.util.List<ReturnOrderResponses.RelabelCandidate>> relabelCandidates(
+    @GetMapping("/{returnNo}/relabel-candidates") @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_RELABEL + "')")
+    public ApiResponse<java.util.List<ReturnOrderResponses.RelabelCandidate>> relabelCandidates(
         @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String returnNo) {
         return ApiResponse.success(service.relabelCandidates(customer(user), returnNo));
     }
-    @PostMapping("/{returnNo}/relabel") public ApiResponse<ReturnOrderResponses.RelabelCreated> createRelabel(
+    @PostMapping("/{returnNo}/relabel") @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_RELABEL + "')")
+    public ApiResponse<ReturnOrderResponses.RelabelCreated> createRelabel(
         @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String returnNo,
         @Valid @RequestBody ReturnOrderRequests.RelabelCreate request) {
         return ApiResponse.success(service.createRelabel(customer(user), operator(user), returnNo, request));

lastleg-service/src/main/java/com/baiyue/lastleg/security/OverseasPermissions.java

@@ -45,9 +45,29 @@ public final class OverseasPermissions {
     public static final String MERCHANT_INBOUND_LIST = "merchant:warehouse:inbound:list";
     public static final String MERCHANT_RETURN_INVENTORY_LIST =
         "merchant:overseas-warehouse:return-inventory:list";
-    public static final String MERCHANT_PROCUREMENT = "merchant:cross-border:procurement";
-    public static final String MERCHANT_TRUCKING = "merchant:cross-border:domestic-trucking";
-    public static final String MERCHANT_LOOSEBOARD = "merchant:cross-border:pallet-shipping";
+    public static final String MERCHANT_LAST_MILE_ORDER_LIST =
+        "merchant:overseas-warehouse:last-mile-order:list";
+    public static final String MERCHANT_RELABEL_LIST = "merchant:overseas-warehouse:relabel:list";
+    public static final String MERCHANT_RELABEL_CREATE = "merchant:overseas-warehouse:relabel:create";
+    public static final String MERCHANT_RELABEL_FILES = "merchant:overseas-warehouse:relabel:files";
+    public static final String MERCHANT_RELABEL_CONFIRM = "merchant:overseas-warehouse:relabel:confirm";
+    public static final String MERCHANT_TRANSFER_LIST = "merchant:overseas-warehouse:transfer:list";
+    public static final String MERCHANT_TRANSFER_CREATE = "merchant:overseas-warehouse:transfer:create";
+    public static final String MERCHANT_TRANSFER_CONFIRM = "merchant:overseas-warehouse:transfer:confirm";
+    public static final String MERCHANT_DISCARD_LIST = "merchant:overseas-warehouse:discard:list";
+    public static final String MERCHANT_DISCARD_CREATE = "merchant:overseas-warehouse:discard:create";
+    public static final String MERCHANT_DISCARD_CANCEL = "merchant:overseas-warehouse:discard:cancel";
+    public static final String MERCHANT_RETURN_ORDER_LIST = "merchant:overseas-warehouse:return-order:list";
+    public static final String MERCHANT_RETURN_ORDER_CREATE = "merchant:overseas-warehouse:return-order:create";
+    public static final String MERCHANT_RETURN_ORDER_RELABEL = "merchant:overseas-warehouse:return-order:relabel";
+    public static final String MERCHANT_PROCUREMENT_LIST = "merchant:cross-border:procurement:list";
+    public static final String MERCHANT_PROCUREMENT_CREATE = "merchant:cross-border:procurement:create";
+    public static final String MERCHANT_TRUCKING_LIST = "merchant:cross-border:domestic-trucking:list";
+    public static final String MERCHANT_TRUCKING_CREATE = "merchant:cross-border:domestic-trucking:create";
+    public static final String MERCHANT_TRUCKING_EDIT = "merchant:cross-border:domestic-trucking:edit";
+    public static final String MERCHANT_LOOSEBOARD_LIST = "merchant:cross-border:pallet-shipping:list";
+    public static final String MERCHANT_LOOSEBOARD_CREATE = "merchant:cross-border:pallet-shipping:create";
+    public static final String MERCHANT_LOOSEBOARD_EDIT = "merchant:cross-border:pallet-shipping:edit";
     public static final String PURCHASE_LIST = "platform:overseas-business:purchase:list";
     public static final String PURCHASE_EDIT = "platform:overseas-business:purchase:edit";
     public static final String PURCHASE_REVIEW = "platform:overseas-business:purchase:review";

lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferController.java

@@ -6,9 +6,11 @@ import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.transfer.dto.WarehouseTransferRequests;
 import com.baiyue.lastleg.transfer.dto.WarehouseTransferResponses;
 import com.baiyue.lastleg.transfer.service.WarehouseTransferService;
+import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.server.ResponseStatusException;
@@ -19,24 +21,28 @@ public class MerchantWarehouseTransferController {
     @Resource private WarehouseTransferService service;
 
     @PostMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_CREATE + "')")
     public ApiResponse<WarehouseTransferResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody WarehouseTransferRequests.Create request) {
         return ApiResponse.success(service.create(customer(user), operator(user), request));
     }
 
     @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_LIST + "')")
     public ApiResponse<PageResult<WarehouseTransferResponses.Summary>> page(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid WarehouseTransferRequests.Query query) {
         return ApiResponse.success(service.page(customer(user), query));
     }
 
     @GetMapping("/{transferNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_LIST + "')")
     public ApiResponse<WarehouseTransferResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String transferNo) {
         return ApiResponse.success(service.detail(customer(user), transferNo));
     }
 
     @PostMapping("/{transferNo}/confirm-measurement")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_CONFIRM + "')")
     public ApiResponse<WarehouseTransferResponses.Detail> confirmMeasurement(
         @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String transferNo,
         @Valid @RequestBody WarehouseTransferRequests.CustomerConfirm request) {

lastleg-service/src/main/java/com/baiyue/lastleg/trucking/controller/MerchantUsTruckOrderController.java

@@ -23,29 +23,32 @@ import org.springframework.web.server.ResponseStatusException;
 
 @RestController
 @RequestMapping("/api/merchant/v1/last-leg/us-truck-orders")
-@PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRUCKING + "')")
 public class MerchantUsTruckOrderController {
     @Resource private UsTruckOrderService service;
 
     @PostMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRUCKING_CREATE + "')")
     public ApiResponse<UsTruckOrderResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody UsTruckOrderRequests.Create request) {
         return ApiResponse.success(service.create(customer(user), operator(user), request));
     }
 
     @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRUCKING_LIST + "')")
     public ApiResponse<PageResult<UsTruckOrderResponses.Summary>> page(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid UsTruckOrderRequests.MerchantQuery query) {
         return ApiResponse.success(service.page(customer(user), query.scoped()));
     }
 
     @GetMapping("/{orderNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRUCKING_LIST + "')")
     public ApiResponse<UsTruckOrderResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String orderNo) {
         return ApiResponse.success(service.detail(customer(user), orderNo));
     }
 
     @PatchMapping("/{orderNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRUCKING_EDIT + "')")
     public ApiResponse<UsTruckOrderResponses.Detail> update(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String orderNo, @Valid @RequestBody UsTruckOrderRequests.Update request) {
         return ApiResponse.success(service.update(customer(user), orderNo, operator(user), request));