feat(appointments): expose destination warehouse options

lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoServiceTest.java

@@ -8,6 +8,21 @@ import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.Mockito.*;
 
 class AppointmentCargoServiceTest {
+    /** 选项取完整权威美国FBA目录，不依赖当前页货物或新增仓库主档权限。 */
+    @Test void destinationOptionsUseTheSameAmericanFbaScopeWithoutQueryingCargoRows() {
+        var mapper = mock(AppointmentCargoMapper.class);
+        var warehouses = mock(AppointmentWarehouseClient.class);
+        when(warehouses.catalog("token")).thenReturn(ApiResponse.success(List.of(
+            new AppointmentWarehouseClient.Warehouse(1L,"US-WH","美国仓","OVERSEAS","US"),
+            new AppointmentWarehouseClient.Warehouse(2L,"ONT8","ONT8","FBA","US"),
+            new AppointmentWarehouseClient.Warehouse(3L,"ABE4","ABE4","FBA","US"),
+            new AppointmentWarehouseClient.Warehouse(4L,"YYZ1","YYZ1","FBA","CA"),
+            new AppointmentWarehouseClient.Warehouse(5L,"ONT8","ONT8","FBA","US"))));
+        assertEquals(List.of("ABE4","ONT8"),new AppointmentCargoService(mapper,warehouses,"token").destinations());
+        verifyNoInteractions(mapper);
+        when(warehouses.catalog("token")).thenThrow(new IllegalStateException("offline"));
+        assertEquals(503,assertThrows(ResponseStatusException.class,()->new AppointmentCargoService(mapper,warehouses,"token").destinations()).getStatusCode().value());
+    }
     @Test void authenticUsDirectoryScopesTheDatabaseQueryAndPreservesServerPagination() {
         var mapper = mock(AppointmentCargoMapper.class);
         var warehouses = mock(AppointmentWarehouseClient.class);

lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentPlanningAuthorizationTest.java

@@ -17,6 +17,20 @@ import static org.mockito.Mockito.*;
 
 class AppointmentPlanningAuthorizationTest {
     private static final String LIST="platform:appointment:list", CARGO="platform:overseas-warehouse:last-mile-order:list", WRITE="platform:appointment:followup";
+    /** 目的仓选项不要求仓库管理权限，但保留原两项读取权限和平台身份边界。 */
+    @Test void destinationOptionsRequireTheExistingCargoReadPermissionsAndPlatformIdentity() {
+        try(var context=new AnnotationConfigApplicationContext(Config.class)) {
+            var controller=context.getBean(AppointmentPlanningController.class);
+            var service=context.getBean(AppointmentCargoService.class);
+            login(LIST);assertThrows(AccessDeniedException.class,()->controller.destinations(user(0L,"PLATFORM")));
+            login(CARGO);assertThrows(AccessDeniedException.class,()->controller.destinations(user(0L,"PLATFORM")));
+            login(LIST,CARGO);
+            assertThrows(ResponseStatusException.class,()->controller.destinations(user(1L,"CLIENT")));
+            verifyNoInteractions(service);
+            when(service.destinations()).thenReturn(List.of("ABE4","ONT8"));
+            assertEquals(List.of("ABE4","ONT8"),controller.destinations(user(0L,"PLATFORM")).data());
+        } finally { SecurityContextHolder.clearContext(); }
+    }
     @Test void orderLookupUsesCanonicalBookingSourceAndEnforcesCustomerAndReadPermissions() {
         try(var context=new AnnotationConfigApplicationContext(Config.class)) {
             var controller=context.getBean(AppointmentPlanningController.class);