提交

lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/controller/DispatchController.java

@@ -4,7 +4,6 @@ import com.baiyue.common.core.api.ApiResponse;
 import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.dispatch.dto.DispatchRequests;
 import com.baiyue.lastleg.dispatch.dto.DispatchResponse;
-import com.baiyue.lastleg.dispatch.model.DispatchPalletCandidate;
 import com.baiyue.lastleg.dispatch.pda.dto.DispatchPdaRequests;
 import com.baiyue.lastleg.dispatch.pda.dto.DispatchPdaResponses;
 import com.baiyue.lastleg.dispatch.pda.service.DispatchPdaWorkflowService;
@@ -18,7 +17,6 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.DeleteMapping;
-import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.PutMapping;
@@ -28,8 +26,6 @@ import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.server.ResponseStatusException;
 
-import java.util.List;
-
 @RestController
 @ConditionalOnProperty(name = "lastleg.future-outbound-api.enabled", havingValue = "true")
 @RequestMapping("/api/platform/v1/last-leg/dispatches")
@@ -38,28 +34,6 @@ public class DispatchController {
     @Resource private DispatchService service;
     @Resource private DispatchPdaWorkflowService pdaWorkflow;
 
-    @GetMapping("/candidates")
-    @Operation(summary = "List unlocked planned or received pallets for intelligent pre-dispatch")
-    public ApiResponse<List<DispatchPalletCandidate>> candidates(
-        @AuthenticationPrincipal AuthenticatedUser user,
-        @RequestParam(required = false) String customerId,
-        @RequestParam(required = false) String orderNo,
-        @RequestParam(required = false) String fbaWarehouseCode,
-        @RequestParam(required = false) String sourceStage) {
-        return ApiResponse.success(service.candidates(scope(user, customerId), orderNo, fbaWarehouseCode, sourceStage));
-    }
-
-    @PostMapping("/pre-arrange")
-    @Operation(summary = "Create a pending-departure dispatch and lock all selected pallets")
-    public ApiResponse<DispatchResponse> preArrange(
-        @AuthenticationPrincipal AuthenticatedUser user,
-        @RequestParam(required = false) String customerId,
-        @Valid @RequestBody DispatchRequests.PreArrange request) {
-        String scopedTenant = scope(user, customerId);
-        String operatorId = user.userId() == null ? user.username() : String.valueOf(user.userId());
-        return ApiResponse.success(service.preArrange(scopedTenant, operatorId, request));
-    }
-
     @PutMapping("/{dispatchNo}")
     @Operation(summary = "Edit vehicle, driver, appointment, route and departure data")
     public ApiResponse<DispatchResponse> update(

lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/controller/DispatchQueryController.java

@@ -6,12 +6,14 @@ import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.dispatch.dto.DispatchRequests;
 import com.baiyue.lastleg.dispatch.dto.DispatchResponse;
 import com.baiyue.lastleg.dispatch.service.DispatchService;
+import com.baiyue.lastleg.security.OverseasPermissions;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
@@ -27,21 +29,23 @@ public class DispatchQueryController {
     @Resource private DispatchService service;
 
     @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.INBOUND_ORDER_LIST + "')")
     @Operation(summary = "Page dispatch orders")
     public ApiResponse<PageResult<DispatchResponse>> page(
         @AuthenticationPrincipal AuthenticatedUser user,
         @Valid DispatchRequests.Query query) {
         requirePlatform(user);
-        return ApiResponse.success(service.page(null, query));
+        return ApiResponse.success(service.page(service.resolveSingleCustomerScope(), query));
     }
 
     @GetMapping("/{dispatchNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.INBOUND_ORDER_LIST + "')")
     @Operation(summary = "Get dispatch details and all pallet destinations")
     public ApiResponse<DispatchResponse> detail(
         @AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String dispatchNo) {
         requirePlatform(user);
-        return ApiResponse.success(service.detail(null, dispatchNo));
+        return ApiResponse.success(service.detail(service.resolveSingleCustomerScope(), dispatchNo));
     }
 
     private void requirePlatform(AuthenticatedUser user) {

lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/controller/SmartDispatchController.java

@@ -0,0 +1,70 @@
+package com.baiyue.lastleg.dispatch.controller;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.dispatch.dto.DispatchRequests;
+import com.baiyue.lastleg.dispatch.dto.DispatchResponse;
+import com.baiyue.lastleg.dispatch.model.DispatchPalletCandidate;
+import com.baiyue.lastleg.dispatch.service.DispatchService;
+import com.baiyue.lastleg.security.OverseasPermissions;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.annotation.Resource;
+import jakarta.validation.Valid;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.util.List;
+
+@RestController
+@ConditionalOnProperty(name = "lastleg.smart-dispatch-api.enabled", havingValue = "true")
+@RequestMapping("/api/platform/v1/last-leg/dispatches")
+@Tag(name = "Tail-leg smart dispatch")
+public class SmartDispatchController {
+    @Resource private DispatchService service;
+
+    @GetMapping("/candidates")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.INBOUND_ORDER_LIST + "')")
+    @Operation(summary = "List unlocked planned or received pallets for intelligent pre-dispatch",
+        description = "Required authority: " + OverseasPermissions.INBOUND_ORDER_LIST)
+    public ApiResponse<List<DispatchPalletCandidate>> candidates(
+        @AuthenticationPrincipal AuthenticatedUser user,
+        @RequestParam(required = false) String orderNo,
+        @RequestParam(required = false) String fbaWarehouseCode,
+        @RequestParam(required = false) String sourceStage) {
+        requirePlatform(user);
+        return ApiResponse.success(service.candidates(service.resolveSingleCustomerScope(), orderNo,
+            fbaWarehouseCode, sourceStage));
+    }
+
+    @PostMapping("/pre-arrange")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.INBOUND_ORDER_EDIT + "')")
+    @Operation(summary = "Create a pending-departure dispatch and lock all selected pallets",
+        description = "Required authority: " + OverseasPermissions.INBOUND_ORDER_EDIT)
+    public ApiResponse<DispatchResponse> preArrange(
+        @AuthenticationPrincipal AuthenticatedUser user,
+        @Valid @RequestBody DispatchRequests.PreArrange request) {
+        requirePlatform(user);
+        String scopedCustomer = service.resolveSingleCustomerScope();
+        String operatorId = user.userId() == null ? user.username() : String.valueOf(user.userId());
+        return ApiResponse.success(service.preArrange(scopedCustomer, operatorId, request));
+    }
+
+    private void requirePlatform(AuthenticatedUser user) {
+        if (user == null || user.tenantId() == null) {
+            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
+        }
+        if (!"PLATFORM".equals(user.appCode()) || user.tenantId() != 0L) {
+            throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Platform application required");
+        }
+    }
+}