优化

file/src/test/java/com/baiyue/file/controller/PlatformMeasurementImageControllerContractTest.java

@@ -61,4 +61,14 @@ class PlatformMeasurementImageControllerContractTest {
 
         verify(images).download(10001L, 88L, 99L);
     }
+
+    @Test
+    void rejectsPlatformTokenWithCustomerTenantScope() {
+        var file = new MockMultipartFile("file", "weight.png", MediaType.IMAGE_PNG_VALUE, new byte[]{1});
+        var malformed = new AuthenticatedUser(1L, 10001L, 10001L, 1L,
+            "admin", "PLATFORM", "WEB", Set.of());
+
+        assertThatThrownBy(() -> controller.upload(malformed, 10001L, 88L, file))
+            .isInstanceOf(BizException.class);
+    }
 }

file/src/test/java/com/baiyue/file/controller/QualificationFileContractTest.java

@@ -89,6 +89,32 @@ class QualificationFileContractTest {
         assertEquals("hasAuthority('platform:customer:view')", method.getAnnotation(PreAuthorize.class).value());
     }
 
+    @Test
+    void platformQualificationRejectsCustomerScopedPlatformToken() {
+        var storage = mock(LocalQualificationStorage.class);
+        var controller = platformController(storage, mock(IamQualificationClient.class));
+        var file = new MockMultipartFile("file", "license.pdf", "application/pdf", "%PDF-1.4".getBytes());
+        var malformed = new AuthenticatedUser(1L, 10001L, 10001L, 1L,
+                "admin", "PLATFORM", "WEB", Set.of());
+
+        assertThrows(BizException.class,
+                () -> controller.upload(malformed, 10001L, file,
+                        "BANK_ACCOUNT_LICENSE", null, null, false));
+        verify(storage, never()).store(any(Long.class), any());
+    }
+
+    @Test
+    void platformQualificationRejectsPlatformScopeAsCustomerTarget() {
+        var storage = mock(LocalQualificationStorage.class);
+        var controller = platformController(storage, mock(IamQualificationClient.class));
+        var file = new MockMultipartFile("file", "license.pdf", "application/pdf", "%PDF-1.4".getBytes());
+
+        assertThrows(BizException.class,
+                () -> controller.upload(platformUser(), 0L, file,
+                        "BANK_ACCOUNT_LICENSE", null, null, false));
+        verify(storage, never()).store(any(Long.class), any());
+    }
+
     @Test
     void platformReplacementIsForwardedAndCleansThePreviousFileAfterIamSucceeds() {
         var storage = mock(LocalQualificationStorage.class);

file/src/test/java/com/baiyue/file/service/ExportTaskServiceTest.java

@@ -74,6 +74,16 @@ class ExportTaskServiceTest {
         assertEquals(ResultCode.VALIDATION_FAILED,error.getResultCode());
     }
 
+    @Test
+    void rejectsPlatformTokenWithCustomerTenantScope() {
+        var malformed = new AuthenticatedUser(1L, 10001L, 10001L, 1L,
+            "user1", "PLATFORM", "WEB", Set.of("platform:customer:export"));
+        assertEquals(ResultCode.FORBIDDEN, assertThrows(BizException.class,
+            () -> service.create(malformed,
+                new CreateExportTaskRequest("CUSTOMER_LIST", "XLSX", "客户列表", Map.of())))
+            .getResultCode());
+    }
+
     private AuthenticatedUser user(long id, Set<String> permissions) {
         return new AuthenticatedUser(id, 0L, 0L, id, "user" + id, "PLATFORM", "WEB", permissions);
     }

file/src/test/java/com/baiyue/file/service/MeasurementImageServiceEvidenceTest.java

@@ -3,6 +3,11 @@ package com.baiyue.file.service;
 import com.baiyue.file.client.WeightOcrClient;
 import com.baiyue.file.entity.FileObjectEntity;
 import com.baiyue.file.mapper.FileObjectMapper;
+import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.core.metadata.TableInfoHelper;
+import org.apache.ibatis.builder.MapperBuilderAssistant;
+import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.http.MediaType;
@@ -28,6 +33,14 @@ class MeasurementImageServiceEvidenceTest {
     @MockBean private FileObjectMapper files;
     @MockBean private WeightOcrClient ocr;
     @Resource private MeasurementImageService service;
+
+    @BeforeAll
+    static void initializeEntityMetadata() {
+        TableInfoHelper.initTableInfo(
+            new MapperBuilderAssistant(new MybatisConfiguration(), "measurement-image-test"),
+            FileObjectEntity.class);
+    }
+
     @Test
     void shouldHandleCase01() {
         var image = new MockMultipartFile("file", "measure.png", MediaType.IMAGE_PNG_VALUE,
@@ -62,4 +75,20 @@ class MeasurementImageServiceEvidenceTest {
             .hasMessageContaining("不执行重量OCR");
         verifyNoInteractions(ocr);
     }
+
+    @Test
+    void refusesAFileTupleFromAnotherCustomer() {
+        when(files.selectOne(any())).thenAnswer(invocation -> {
+            @SuppressWarnings("unchecked")
+            LambdaQueryWrapper<FileObjectEntity> query = invocation.getArgument(0);
+            query.getSqlSegment();
+            assertThat(query.getParamNameValuePairs().values())
+                .contains(11L, 41L, "21", false);
+            return null;
+        });
+
+        assertThatThrownBy(() -> service.download(11L, 21L, 41L))
+            .isInstanceOf(com.baiyue.common.core.exception.BizException.class);
+        verifyNoInteractions(storage);
+    }
 }