优化

lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferController.java

@@ -6,9 +6,11 @@ import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.transfer.dto.WarehouseTransferRequests;
 import com.baiyue.lastleg.transfer.dto.WarehouseTransferResponses;
 import com.baiyue.lastleg.transfer.service.WarehouseTransferService;
+import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.server.ResponseStatusException;
@@ -19,24 +21,28 @@ public class MerchantWarehouseTransferController {
     @Resource private WarehouseTransferService service;
 
     @PostMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_CREATE + "')")
     public ApiResponse<WarehouseTransferResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody WarehouseTransferRequests.Create request) {
         return ApiResponse.success(service.create(customer(user), operator(user), request));
     }
 
     @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_LIST + "')")
     public ApiResponse<PageResult<WarehouseTransferResponses.Summary>> page(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid WarehouseTransferRequests.Query query) {
         return ApiResponse.success(service.page(customer(user), query));
     }
 
     @GetMapping("/{transferNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_LIST + "')")
     public ApiResponse<WarehouseTransferResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String transferNo) {
         return ApiResponse.success(service.detail(customer(user), transferNo));
     }
 
     @PostMapping("/{transferNo}/confirm-measurement")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_CONFIRM + "')")
     public ApiResponse<WarehouseTransferResponses.Detail> confirmMeasurement(
         @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String transferNo,
         @Valid @RequestBody WarehouseTransferRequests.CustomerConfirm request) {