提交

lastleg-service/src/main/java/com/baiyue/lastleg/delivery/controller/DeliveryTransferController.java

@@ -6,6 +6,7 @@ import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.delivery.dto.DeliveryRequests;
 import com.baiyue.lastleg.delivery.dto.DeliveryResponses;
 import com.baiyue.lastleg.delivery.service.DeliveryTransferService;
+import com.baiyue.lastleg.security.OverseasPermissions;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.annotation.Resource;
@@ -13,6 +14,7 @@ import jakarta.validation.Valid;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.server.ResponseStatusException;
 
@@ -65,6 +67,7 @@ public class DeliveryTransferController {
     }
 
     @GetMapping("/delivery-orders")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.DELIVERY_LIST + "')")
     public ApiResponse<PageResult<DeliveryResponses.DeliveryRow>> deliveryPage(
         @AuthenticationPrincipal AuthenticatedUser user, @RequestParam(required = false) String customerId,
         @Valid DeliveryRequests.Query query) {
@@ -72,6 +75,7 @@ public class DeliveryTransferController {
     }
 
     @GetMapping("/delivery-orders/{deliveryNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.DELIVERY_LIST + "')")
     public ApiResponse<DeliveryResponses.DeliveryDetail> deliveryDetail(
         @AuthenticationPrincipal AuthenticatedUser user, @RequestParam(required = false) String customerId,
         @PathVariable String deliveryNo, @Valid DeliveryRequests.PalletQuery query) {