提交

lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/controller/InboundPlanController.java

@@ -15,6 +15,7 @@ import jakarta.validation.Valid;
 import jakarta.annotation.Resource;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.server.ResponseStatusException;
 
@@ -26,6 +27,7 @@ public class InboundPlanController {
     @Resource private InboundFbaAppointmentService appointmentService;
 
     @PostMapping("/convert")
+    @PreAuthorize("hasAuthority('platform:lastleg:inbound-plan:create')")
     /** 将入仓单转换为入仓计划。 */
     @Operation(summary = "入仓单转入仓计划")
     public ApiResponse<InboundPlanResponse> convert(@AuthenticationPrincipal AuthenticatedUser user,
@@ -34,6 +36,7 @@ public class InboundPlanController {
     }
 
     @GetMapping("/{planNo}")
+    @PreAuthorize("hasAuthority('platform:lastleg:inbound-plan:list')")
     /** 查询入仓计划及其明细、托盘和分配信息。 */
     @Operation(summary = "查询入仓计划详情")
     public ApiResponse<InboundPlanResponse> detail(@AuthenticationPrincipal AuthenticatedUser user,
@@ -43,6 +46,7 @@ public class InboundPlanController {
     }
 
     @PostMapping("/{planNo}/pallets/supplement")
+    @PreAuthorize("hasAuthority('platform:lastleg:inbound-plan:edit')")
     /** 为计划目标仓新增一个可打印的补充托盘。 */
     @Operation(summary = "新增补充托盘")
     public ApiResponse<InboundPlanResponse.Pallet> supplementPallet(@AuthenticationPrincipal AuthenticatedUser user,
@@ -52,6 +56,7 @@ public class InboundPlanController {
     }
 
     @PostMapping("/fba-appointments/batch")
+    @PreAuthorize("hasAuthority('platform:lastleg:inbound-plan:appointment')")
     /** 为选中的入仓明细创建 FBA 预约。 */
     @Operation(summary = "创建 FBA 预约")
     public ApiResponse<FbaAppointmentResponse> batchFbaAppointment(
@@ -63,6 +68,7 @@ public class InboundPlanController {
     }
 
     @GetMapping("/fba-appointments/{appointmentNo}")
+    @PreAuthorize("hasAuthority('platform:lastleg:inbound-plan:list')")
     /** 查询 FBA 预约及其选中的入仓明细。 */
     @Operation(summary = "查询 FBA 预约详情")
     public ApiResponse<FbaAppointmentResponse> fbaAppointmentDetail(