贴标申请，仓储转运

lastleg-service/src/test/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferControllerTest.java

@@ -31,6 +31,25 @@ class MerchantWarehouseTransferControllerTest {
         verify(service).detail("100", "TR001");
     }
 
+    @Test
+    void merchantSubmitUsesOnlyAuthenticatedTenant() {
+        controller.submit(user(100L, "MERCHANT"), "TR001");
+        verify(service).submit("100", "TR001", "1");
+    }
+
+    @Test
+    void merchantUpdateUsesOnlyAuthenticatedTenant() {
+        WarehouseTransferRequests.Create request = mock(WarehouseTransferRequests.Create.class);
+        controller.updateDraft(user(100L, "MERCHANT"), "TR001", request);
+        verify(service).updateDraft("100", "TR001", "1", request);
+    }
+
+    @Test
+    void merchantPrintsSubmittedCartonLabelsWithinAuthenticatedTenant() {
+        controller.cartonLabel(user(100L, "MERCHANT"), "TR001");
+        verify(service).cartonLabel("100", "TR001");
+    }
+
     @Test
     void merchantEndpointRejectsPlatformIdentity() {
         assertThrows(ResponseStatusException.class,

lastleg-service/src/test/java/com/baiyue/lastleg/transfer/controller/PdaWarehouseTransferControllerContractTest.java

@@ -0,0 +1,62 @@
+package com.baiyue.lastleg.transfer.controller;
+
+import com.baiyue.common.security.AuthenticatedUser;
+import org.junit.jupiter.api.Test;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import com.baiyue.lastleg.transfer.dto.WarehouseTransferRequests;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RequestHeader;
+import org.springframework.web.multipart.MultipartFile;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class PdaWarehouseTransferControllerContractTest {
+    @Test
+    void detailUsesOnlyAuthenticatedPdaWarehouseScopeAndTransferNumber() throws Exception {
+        var method = PdaWarehouseTransferController.class
+            .getMethod("detail", AuthenticatedUser.class, String.class);
+
+        assertThat(method.getAnnotation(GetMapping.class).value()).containsExactly("/{transferNo}");
+        assertThat(method.getParameterCount()).isEqualTo(2);
+    }
+
+    @Test
+    void measurementPhotoUploadUsesThePublicPdaRouteAndFileMultipartPart() throws Exception {
+        var method = PdaWarehouseTransferController.class.getMethod("uploadMeasurementPhoto",
+            AuthenticatedUser.class, String.class, MultipartFile.class);
+
+        var mapping = method.getAnnotation(PostMapping.class);
+        assertThat(mapping.value()).containsExactly("/{transferNo}/measurement-photos/files");
+        assertThat(mapping.consumes()).containsExactly("multipart/form-data");
+        assertThat(method.getParameters()[2].getAnnotation(RequestParam.class).value()).isEqualTo("file");
+    }
+
+    @Test
+    void palletLabelUsesThePdaScopedTransferAndGeneratedWarehousePallet() throws Exception {
+        var method = PdaWarehouseTransferController.class.getMethod("palletLabel",
+            AuthenticatedUser.class, String.class, long.class, String.class);
+
+        assertThat(method.getAnnotation(GetMapping.class).value())
+            .containsExactly("/{transferNo}/pallets/{warehousePalletId}/label");
+        assertThat(method.getParameters()[3].getAnnotation(RequestHeader.class).value()).isEqualTo("X-Request-Id");
+    }
+
+    @Test
+    void palletLifecycleExposesDraftGenerateBindAndDraftDeleteRoutes() throws Exception {
+        var draft = PdaWarehouseTransferController.class.getMethod("savePalletDraft",
+            AuthenticatedUser.class, String.class, WarehouseTransferRequests.PalletDraft.class);
+        var generate = PdaWarehouseTransferController.class.getMethod("generatePallet",
+            AuthenticatedUser.class, String.class, long.class, WarehouseTransferRequests.PalletAction.class);
+        var bind = PdaWarehouseTransferController.class.getMethod("bindPallet",
+            AuthenticatedUser.class, String.class, long.class, WarehouseTransferRequests.PalletBind.class);
+        var delete = PdaWarehouseTransferController.class.getMethod("deletePalletDraft",
+            AuthenticatedUser.class, String.class, long.class);
+
+        assertThat(draft.getAnnotation(PostMapping.class).value()).containsExactly("/{transferNo}/pallets/drafts");
+        assertThat(generate.getAnnotation(PostMapping.class).value()).containsExactly("/{transferNo}/pallets/{palletId}/generate");
+        assertThat(bind.getAnnotation(PostMapping.class).value()).containsExactly("/{transferNo}/pallets/{palletId}/bind");
+        assertThat(delete.getAnnotation(DeleteMapping.class).value()).containsExactly("/{transferNo}/pallets/{palletId}");
+    }
+}