diff --git a/deploy/sql/README.md b/deploy/sql/README.md index 8d8cd4021..8990b1a2e 100644 --- a/deploy/sql/README.md +++ b/deploy/sql/README.md @@ -230,9 +230,10 @@ SELECT ## 海外排车、出库与派送权限 - 国内固定入口已在海外仓业务 `lastleg-permissions.sql` 权限段之后完整内联 `iam/src/main/resources/db/phase5-delivery-permissions.sql`；测试和部署只执行固定入口，不再单独执行模块脚本。 -- 平台端固定使用排车列表/编辑/取消/转派送、出库列表/创建/取消、派送列表/退回/状态、异常订单列表/创建/处理和客户回访列表/编辑十五项权限；列表权限包含详情及只读辅助接口，写操作保持独立授权。 +- 平台端固定使用排车列表/编辑/取消/转派送、出库列表/创建/取消、派送列表/退回/状态/资料管理、异常订单列表/创建/处理和客户回访列表/编辑十六项权限；列表权限包含详情及只读辅助接口，写操作保持独立授权。 +- 派送七类资料上传、替换、解绑和保存统一使用 `platform:overseas-warehouse:delivery:documents`，读取和下载仍使用 `platform:overseas-warehouse:delivery:list`；默认授予 `PLATFORM_ADMIN`、`PLATFORM_CUSTOM_ADMIN`、`WAREHOUSE_OPERATOR`。 - 客户端固定使用 `merchant:warehouse:delivery:list` 和 `merchant:warehouse:delivery:create`；客户默认管理员获得两项权限，其他客户角色不自动扩权。 -- `WAREHOUSE_OPERATOR` 获得十五项后台作业权限，`WAREHOUSE_TALLY` 只获得排车、出库、派送、异常订单和客户回访五项列表只读；国内、海外 PDA 岗位不得获得上述后台权限。 +- `WAREHOUSE_OPERATOR` 获得十六项后台作业权限，`WAREHOUSE_TALLY` 只获得排车、出库、派送、异常订单和客户回访五项列表只读；国内、海外 PDA 岗位不得获得上述后台权限。 ## 海外排车与出库结构升级 diff --git a/deploy/sql/头程数据库统一增量-MySQL8.sql b/deploy/sql/头程数据库统一增量-MySQL8.sql index d4dd91b6b..8b9913b04 100644 --- a/deploy/sql/头程数据库统一增量-MySQL8.sql +++ b/deploy/sql/头程数据库统一增量-MySQL8.sql @@ -17029,6 +17029,7 @@ BEGIN OR (id = 5107090 AND permission_code <> 'platform:overseas-warehouse:outbound:list') OR (id = 5107091 AND permission_code <> 'platform:overseas-warehouse:outbound:create') OR (id = 5107092 AND permission_code <> 'platform:overseas-warehouse:delivery:list') + OR (id = 5107094 AND permission_code <> 'platform:overseas-warehouse:delivery:documents') OR (id = 5107093 AND permission_code <> 'platform:overseas-warehouse:outbound:cancel') OR (id = 5107070 AND permission_code <> 'platform:overseas-warehouse:exception-order:list') OR (id = 5107071 AND permission_code <> 'platform:overseas-warehouse:exception-order:create') @@ -17048,6 +17049,7 @@ BEGIN OR (permission_code = 'platform:overseas-warehouse:outbound:list' AND id <> 5107090) OR (permission_code = 'platform:overseas-warehouse:outbound:create' AND id <> 5107091) OR (permission_code = 'platform:overseas-warehouse:delivery:list' AND id <> 5107092) + OR (permission_code = 'platform:overseas-warehouse:delivery:documents' AND id <> 5107094) OR (permission_code = 'platform:overseas-warehouse:outbound:cancel' AND id <> 5107093) OR (permission_code = 'platform:overseas-warehouse:exception-order:list' AND id <> 5107070) OR (permission_code = 'platform:overseas-warehouse:exception-order:create' AND id <> 5107071) @@ -17084,6 +17086,7 @@ VALUES (5107090,0,'PLATFORM','MENU',0,'platform:overseas-warehouse:outbound:list','海外出库单','/overseas-warehouse/outbounds','GET',765,'ACTIVE',1,0), (5107091,0,'PLATFORM','BUTTON',5107090,'platform:overseas-warehouse:outbound:create','创建海外出库单',NULL,'POST',766,'ACTIVE',1,0), (5107092,0,'PLATFORM','MENU',0,'platform:overseas-warehouse:delivery:list','海外派送单','/overseas-warehouse/delivery-orders','GET',767,'ACTIVE',1,0), + (5107094,0,'PLATFORM','BUTTON',5107092,'platform:overseas-warehouse:delivery:documents','管理派送资料',NULL,'POST',769,'ACTIVE',1,0), (5107093,0,'PLATFORM','BUTTON',5107090,'platform:overseas-warehouse:outbound:cancel','取消海外出库单',NULL,'POST',768,'ACTIVE',1,0), (5306000,0,'MERCHANT','MENU',0,'merchant:warehouse:delivery:list','海外仓派送单','/orders/delivery','GET',60,'ACTIVE',1,0), (5306001,0,'MERCHANT','BUTTON',5306000,'merchant:warehouse:delivery:create','创建海外仓派送单',NULL,'POST',10,'ACTIVE',1,0) @@ -17115,6 +17118,7 @@ SELECT 0, role.id, permission.id, CURRENT_TIMESTAMP(3) 'platform:overseas-warehouse:exception-order:process', 'platform:overseas-warehouse:delivery:return', 'platform:overseas-warehouse:delivery:status', + 'platform:overseas-warehouse:delivery:documents', 'platform:overseas-warehouse:customer-visit:list', 'platform:overseas-warehouse:customer-visit:edit') AND permission.status='ACTIVE' AND permission.deleted=0; @@ -17140,6 +17144,7 @@ INSERT INTO tmp_phase5_delivery_role_permission (role_code, permission_code) VAL ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:exception-order:process'), ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:delivery:return'), ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:delivery:status'), + ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:delivery:documents'), ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:customer-visit:list'), ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:customer-visit:edit'), ('WAREHOUSE_TALLY','platform:overseas-warehouse:dispatch:list'), @@ -17169,6 +17174,7 @@ WHERE role.tenant_id=0 AND role.app_code='PLATFORM' 'platform:overseas-warehouse:exception-order:process', 'platform:overseas-warehouse:delivery:return', 'platform:overseas-warehouse:delivery:status', + 'platform:overseas-warehouse:delivery:documents', 'platform:overseas-warehouse:customer-visit:list', 'platform:overseas-warehouse:customer-visit:edit') AND expected.permission_code IS NULL; @@ -17217,10 +17223,11 @@ BEGIN 'platform:overseas-warehouse:exception-order:process', 'platform:overseas-warehouse:delivery:return', 'platform:overseas-warehouse:delivery:status', + 'platform:overseas-warehouse:delivery:documents', 'platform:overseas-warehouse:customer-visit:list', 'platform:overseas-warehouse:customer-visit:edit', 'merchant:warehouse:delivery:list', - 'merchant:warehouse:delivery:create')) <> 17 THEN + 'merchant:warehouse:delivery:create')) <> 18 THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='五期海外派送权限初始化失败：权限目录不完整'; END IF; IF (SELECT COUNT(*) FROM iam_role_permission grant_row @@ -17241,8 +17248,9 @@ BEGIN 'platform:overseas-warehouse:exception-order:process', 'platform:overseas-warehouse:delivery:return', 'platform:overseas-warehouse:delivery:status', + 'platform:overseas-warehouse:delivery:documents', 'platform:overseas-warehouse:customer-visit:list', - 'platform:overseas-warehouse:customer-visit:edit')) <> 15 THEN + 'platform:overseas-warehouse:customer-visit:edit')) <> 16 THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='五期海外派送权限初始化失败：平台管理员授权不完整'; END IF; IF EXISTS (SELECT 1 FROM iam_role role @@ -17266,15 +17274,16 @@ BEGIN 'platform:overseas-warehouse:exception-order:process', 'platform:overseas-warehouse:delivery:return', 'platform:overseas-warehouse:delivery:status', + 'platform:overseas-warehouse:delivery:documents', 'platform:overseas-warehouse:customer-visit:list', - 'platform:overseas-warehouse:customer-visit:edit')) <> 15) THEN + 'platform:overseas-warehouse:customer-visit:edit')) <> 16) THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='五期海外派送权限初始化失败：平台自定义管理员授权不完整'; END IF; SELECT COALESCE(SUM(role_code='WAREHOUSE_OPERATOR'),0), COALESCE(SUM(role_code='WAREHOUSE_TALLY'),0) INTO v_warehouse_operator_permission_count, v_warehouse_tally_permission_count FROM tmp_phase5_delivery_role_permission; - IF v_warehouse_operator_permission_count <> 15 + IF v_warehouse_operator_permission_count <> 16 OR v_warehouse_tally_permission_count <> 5 THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='五期海外派送权限初始化失败：仓库岗位最小权限矩阵异常'; END IF; @@ -17296,6 +17305,7 @@ BEGIN 'platform:overseas-warehouse:exception-order:process', 'platform:overseas-warehouse:delivery:return', 'platform:overseas-warehouse:delivery:status', + 'platform:overseas-warehouse:delivery:documents', 'platform:overseas-warehouse:customer-visit:list', 'platform:overseas-warehouse:customer-visit:edit')) THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='五期海外派送权限初始化失败：PDA岗位错误获得后台权限'; diff --git a/iam/src/main/resources/db/phase5-delivery-permissions.sql b/iam/src/main/resources/db/phase5-delivery-permissions.sql index a39efd4a3..19557581f 100644 --- a/iam/src/main/resources/db/phase5-delivery-permissions.sql +++ b/iam/src/main/resources/db/phase5-delivery-permissions.sql @@ -15,6 +15,7 @@ BEGIN OR (id = 5107090 AND permission_code <> 'platform:overseas-warehouse:outbound:list') OR (id = 5107091 AND permission_code <> 'platform:overseas-warehouse:outbound:create') OR (id = 5107092 AND permission_code <> 'platform:overseas-warehouse:delivery:list') + OR (id = 5107094 AND permission_code <> 'platform:overseas-warehouse:delivery:documents') OR (id = 5107093 AND permission_code <> 'platform:overseas-warehouse:outbound:cancel') OR (id = 5107070 AND permission_code <> 'platform:overseas-warehouse:exception-order:list') OR (id = 5107071 AND permission_code <> 'platform:overseas-warehouse:exception-order:create') @@ -34,6 +35,7 @@ BEGIN OR (permission_code = 'platform:overseas-warehouse:outbound:list' AND id <> 5107090) OR (permission_code = 'platform:overseas-warehouse:outbound:create' AND id <> 5107091) OR (permission_code = 'platform:overseas-warehouse:delivery:list' AND id <> 5107092) + OR (permission_code = 'platform:overseas-warehouse:delivery:documents' AND id <> 5107094) OR (permission_code = 'platform:overseas-warehouse:outbound:cancel' AND id <> 5107093) OR (permission_code = 'platform:overseas-warehouse:exception-order:list' AND id <> 5107070) OR (permission_code = 'platform:overseas-warehouse:exception-order:create' AND id <> 5107071) @@ -70,6 +72,7 @@ VALUES (5107090,0,'PLATFORM','MENU',0,'platform:overseas-warehouse:outbound:list','海外出库单','/overseas-warehouse/outbounds','GET',765,'ACTIVE',1,0), (5107091,0,'PLATFORM','BUTTON',5107090,'platform:overseas-warehouse:outbound:create','创建海外出库单',NULL,'POST',766,'ACTIVE',1,0), (5107092,0,'PLATFORM','MENU',0,'platform:overseas-warehouse:delivery:list','海外派送单','/overseas-warehouse/delivery-orders','GET',767,'ACTIVE',1,0), + (5107094,0,'PLATFORM','BUTTON',5107092,'platform:overseas-warehouse:delivery:documents','管理派送资料',NULL,'POST',769,'ACTIVE',1,0), (5107093,0,'PLATFORM','BUTTON',5107090,'platform:overseas-warehouse:outbound:cancel','取消海外出库单',NULL,'POST',768,'ACTIVE',1,0), (5306000,0,'MERCHANT','MENU',0,'merchant:warehouse:delivery:list','海外仓派送单','/orders/delivery','GET',60,'ACTIVE',1,0), (5306001,0,'MERCHANT','BUTTON',5306000,'merchant:warehouse:delivery:create','创建海外仓派送单',NULL,'POST',10,'ACTIVE',1,0) @@ -101,6 +104,7 @@ SELECT 0, role.id, permission.id, CURRENT_TIMESTAMP(3) 'platform:overseas-warehouse:exception-order:process', 'platform:overseas-warehouse:delivery:return', 'platform:overseas-warehouse:delivery:status', + 'platform:overseas-warehouse:delivery:documents', 'platform:overseas-warehouse:customer-visit:list', 'platform:overseas-warehouse:customer-visit:edit') AND permission.status='ACTIVE' AND permission.deleted=0; @@ -126,6 +130,7 @@ INSERT INTO tmp_phase5_delivery_role_permission (role_code, permission_code) VAL ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:exception-order:process'), ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:delivery:return'), ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:delivery:status'), + ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:delivery:documents'), ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:customer-visit:list'), ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:customer-visit:edit'), ('WAREHOUSE_TALLY','platform:overseas-warehouse:dispatch:list'), @@ -155,6 +160,7 @@ WHERE role.tenant_id=0 AND role.app_code='PLATFORM' 'platform:overseas-warehouse:exception-order:process', 'platform:overseas-warehouse:delivery:return', 'platform:overseas-warehouse:delivery:status', + 'platform:overseas-warehouse:delivery:documents', 'platform:overseas-warehouse:customer-visit:list', 'platform:overseas-warehouse:customer-visit:edit') AND expected.permission_code IS NULL; @@ -203,10 +209,11 @@ BEGIN 'platform:overseas-warehouse:exception-order:process', 'platform:overseas-warehouse:delivery:return', 'platform:overseas-warehouse:delivery:status', + 'platform:overseas-warehouse:delivery:documents', 'platform:overseas-warehouse:customer-visit:list', 'platform:overseas-warehouse:customer-visit:edit', 'merchant:warehouse:delivery:list', - 'merchant:warehouse:delivery:create')) <> 17 THEN + 'merchant:warehouse:delivery:create')) <> 18 THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='五期海外派送权限初始化失败：权限目录不完整'; END IF; IF (SELECT COUNT(*) FROM iam_role_permission grant_row @@ -227,8 +234,9 @@ BEGIN 'platform:overseas-warehouse:exception-order:process', 'platform:overseas-warehouse:delivery:return', 'platform:overseas-warehouse:delivery:status', + 'platform:overseas-warehouse:delivery:documents', 'platform:overseas-warehouse:customer-visit:list', - 'platform:overseas-warehouse:customer-visit:edit')) <> 15 THEN + 'platform:overseas-warehouse:customer-visit:edit')) <> 16 THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='五期海外派送权限初始化失败：平台管理员授权不完整'; END IF; IF EXISTS (SELECT 1 FROM iam_role role @@ -252,15 +260,16 @@ BEGIN 'platform:overseas-warehouse:exception-order:process', 'platform:overseas-warehouse:delivery:return', 'platform:overseas-warehouse:delivery:status', + 'platform:overseas-warehouse:delivery:documents', 'platform:overseas-warehouse:customer-visit:list', - 'platform:overseas-warehouse:customer-visit:edit')) <> 15) THEN + 'platform:overseas-warehouse:customer-visit:edit')) <> 16) THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='五期海外派送权限初始化失败：平台自定义管理员授权不完整'; END IF; SELECT COALESCE(SUM(role_code='WAREHOUSE_OPERATOR'),0), COALESCE(SUM(role_code='WAREHOUSE_TALLY'),0) INTO v_warehouse_operator_permission_count, v_warehouse_tally_permission_count FROM tmp_phase5_delivery_role_permission; - IF v_warehouse_operator_permission_count <> 15 + IF v_warehouse_operator_permission_count <> 16 OR v_warehouse_tally_permission_count <> 5 THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='五期海外派送权限初始化失败：仓库岗位最小权限矩阵异常'; END IF; @@ -282,6 +291,7 @@ BEGIN 'platform:overseas-warehouse:exception-order:process', 'platform:overseas-warehouse:delivery:return', 'platform:overseas-warehouse:delivery:status', + 'platform:overseas-warehouse:delivery:documents', 'platform:overseas-warehouse:customer-visit:list', 'platform:overseas-warehouse:customer-visit:edit')) THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='五期海外派送权限初始化失败：PDA岗位错误获得后台权限'; diff --git a/iam/src/main/resources/openapi/iam-v1.yaml b/iam/src/main/resources/openapi/iam-v1.yaml index a7783983a..537459834 100644 --- a/iam/src/main/resources/openapi/iam-v1.yaml +++ b/iam/src/main/resources/openapi/iam-v1.yaml @@ -124,7 +124,7 @@ paths: get: tags: [IAM Resources / IAM 资源] summary: 查询当前用户有效权限 - description: 返回当前有效平台成员权限编码；只要求有效 PLATFORM JWT，不依赖 `platform:role:list`。入库单扣货与解除扣货返回独立写权限 `platform:firstleg:inbound:hold`，不会由 `platform:firstleg:inbound:list` 查看权限自动获得。资金账户充值审核与手工调账分别返回 `platform:finance:recharge:review`、`platform:finance:customer-account:adjust`，并与 `platform:finance:customer-account:list` 只读权限分离。海外仓返回 `platform:overseas-warehouse:dispatch:list`、`platform:overseas-warehouse:dispatch:edit`、`platform:overseas-warehouse:dispatch:cancel`、`platform:overseas-warehouse:dispatch:transfer-delivery`、`platform:overseas-warehouse:outbound:list`、`platform:overseas-warehouse:outbound:create`、`platform:overseas-warehouse:outbound:cancel`、`platform:overseas-warehouse:delivery:list`、`platform:overseas-warehouse:delivery:return`、`platform:overseas-warehouse:delivery:status`、`platform:overseas-warehouse:exception-order:list`、`platform:overseas-warehouse:exception-order:create`、`platform:overseas-warehouse:exception-order:process`、`platform:overseas-warehouse:customer-visit:list`、`platform:overseas-warehouse:customer-visit:edit`；海外 PDA 盘点、移库、换标和现场查询统一返回 `lastleg:pda:operate`，且仅限 `OVERSEAS_WAREHOUSE_PDA_OPERATOR`。货柜双工作台以 `platform:firstleg:container:list/create/edit` 维护国内送柜报关，国外清关提柜独立返回 `platform:firstleg:terminal-drayage:list`、`platform:firstleg:terminal-drayage:document:edit`、`platform:firstleg:terminal-drayage:fleet:edit`、`platform:firstleg:terminal-drayage:pickup-appointment:edit`、`platform:firstleg:terminal-drayage:pickup:confirm`、`platform:firstleg:terminal-drayage:empty-return:confirm`，不以 `container:list/edit` 兼容放行国外操作。列表权限包含详情和只读辅助接口，写操作独立授权。 + description: 返回当前有效平台成员权限编码；只要求有效 PLATFORM JWT，不依赖 `platform:role:list`。入库单扣货与解除扣货返回独立写权限 `platform:firstleg:inbound:hold`，不会由 `platform:firstleg:inbound:list` 查看权限自动获得。资金账户充值审核与手工调账分别返回 `platform:finance:recharge:review`、`platform:finance:customer-account:adjust`，并与 `platform:finance:customer-account:list` 只读权限分离。海外仓返回 `platform:overseas-warehouse:dispatch:list`、`platform:overseas-warehouse:dispatch:edit`、`platform:overseas-warehouse:dispatch:cancel`、`platform:overseas-warehouse:dispatch:transfer-delivery`、`platform:overseas-warehouse:outbound:list`、`platform:overseas-warehouse:outbound:create`、`platform:overseas-warehouse:outbound:cancel`、`platform:overseas-warehouse:delivery:list`、`platform:overseas-warehouse:delivery:return`、`platform:overseas-warehouse:delivery:status`、`platform:overseas-warehouse:delivery:documents`、`platform:overseas-warehouse:exception-order:list`、`platform:overseas-warehouse:exception-order:create`、`platform:overseas-warehouse:exception-order:process`、`platform:overseas-warehouse:customer-visit:list`、`platform:overseas-warehouse:customer-visit:edit`；海外 PDA 盘点、移库、换标和现场查询统一返回 `lastleg:pda:operate`，且仅限 `OVERSEAS_WAREHOUSE_PDA_OPERATOR`。货柜双工作台以 `platform:firstleg:container:list/create/edit` 维护国内送柜报关，国外清关提柜独立返回 `platform:firstleg:terminal-drayage:list`、`platform:firstleg:terminal-drayage:document:edit`、`platform:firstleg:terminal-drayage:fleet:edit`、`platform:firstleg:terminal-drayage:pickup-appointment:edit`、`platform:firstleg:terminal-drayage:pickup:confirm`、`platform:firstleg:terminal-drayage:empty-return:confirm`，不以 `container:list/edit` 兼容放行国外操作。派送七类资料管理使用独立写权限 `platform:overseas-warehouse:delivery:documents`；读取和下载仍使用 `platform:overseas-warehouse:delivery:list`。列表权限包含详情和只读辅助接口，写操作独立授权。 responses: '200': description: 当前平台成员权限查询成功 diff --git a/iam/src/test/java/com/baiyue/iam/controller/IamOpenApiContractTest.java b/iam/src/test/java/com/baiyue/iam/controller/IamOpenApiContractTest.java index 84116ee8f..12d675ba8 100644 --- a/iam/src/test/java/com/baiyue/iam/controller/IamOpenApiContractTest.java +++ b/iam/src/test/java/com/baiyue/iam/controller/IamOpenApiContractTest.java @@ -29,6 +29,8 @@ class IamOpenApiContractTest { .contains("platform:overseas-warehouse:delivery:list") .contains("platform:overseas-warehouse:delivery:return") .contains("platform:overseas-warehouse:delivery:status") + .contains("platform:overseas-warehouse:delivery:documents") + .contains("读取和下载仍使用 `platform:overseas-warehouse:delivery:list`") .contains("platform:overseas-warehouse:exception-order:list") .contains("platform:overseas-warehouse:exception-order:create") .contains("platform:overseas-warehouse:exception-order:process") diff --git a/iam/src/test/java/com/baiyue/iam/repository/Phase5DeliveryPermissionSqlContractTest.java b/iam/src/test/java/com/baiyue/iam/repository/Phase5DeliveryPermissionSqlContractTest.java index f76aa3eaf..cf440e040 100644 --- a/iam/src/test/java/com/baiyue/iam/repository/Phase5DeliveryPermissionSqlContractTest.java +++ b/iam/src/test/java/com/baiyue/iam/repository/Phase5DeliveryPermissionSqlContractTest.java @@ -28,6 +28,7 @@ class Phase5DeliveryPermissionSqlContractTest { "platform:overseas-warehouse:exception-order:process", "platform:overseas-warehouse:delivery:return", "platform:overseas-warehouse:delivery:status", + "platform:overseas-warehouse:delivery:documents", "platform:overseas-warehouse:customer-visit:list", "platform:overseas-warehouse:customer-visit:edit", "merchant:warehouse:delivery:list", @@ -58,6 +59,7 @@ class Phase5DeliveryPermissionSqlContractTest { "'platform:overseas-warehouse:exception-order:process','处理海外异常订单',NULL,'POST'", "'platform:overseas-warehouse:delivery:return','派送单标记退货',NULL,'POST'", "'platform:overseas-warehouse:delivery:status','编辑派送单状态',NULL,'PUT'", + "(5107094,0,'PLATFORM','BUTTON',5107092,'platform:overseas-warehouse:delivery:documents','管理派送资料',NULL,'POST'", "'platform:overseas-warehouse:customer-visit:list','客户回访','/overseas-warehouse/customer-visits','GET'", "'platform:overseas-warehouse:customer-visit:edit','保存客户回访',NULL,'PUT'", "'merchant:warehouse:delivery:list','海外仓派送单','/orders/delivery','GET'"); @@ -80,6 +82,7 @@ class Phase5DeliveryPermissionSqlContractTest { "('WAREHOUSE_OPERATOR','platform:overseas-warehouse:exception-order:process')", "('WAREHOUSE_OPERATOR','platform:overseas-warehouse:delivery:return')", "('WAREHOUSE_OPERATOR','platform:overseas-warehouse:delivery:status')", + "('WAREHOUSE_OPERATOR','platform:overseas-warehouse:delivery:documents')", "('WAREHOUSE_OPERATOR','platform:overseas-warehouse:customer-visit:edit')", "('WAREHOUSE_TALLY','platform:overseas-warehouse:dispatch:list')", "('WAREHOUSE_TALLY','platform:overseas-warehouse:outbound:list')", @@ -95,6 +98,7 @@ class Phase5DeliveryPermissionSqlContractTest { "('WAREHOUSE_TALLY','platform:overseas-warehouse:exception-order:process')", "('WAREHOUSE_TALLY','platform:overseas-warehouse:delivery:return')", "('WAREHOUSE_TALLY','platform:overseas-warehouse:delivery:status')", + "('WAREHOUSE_TALLY','platform:overseas-warehouse:delivery:documents')", "('WAREHOUSE_TALLY','platform:overseas-warehouse:customer-visit:edit')", "('OVERSEAS_WAREHOUSE_PDA_OPERATOR','platform:overseas-warehouse:", "('CN_FIRSTLEG_PDA_OPERATOR','platform:overseas-warehouse:"); @@ -110,7 +114,7 @@ class Phase5DeliveryPermissionSqlContractTest { "SELECT COALESCE(SUM(role_code='WAREHOUSE_OPERATOR'),0)", "COALESCE(SUM(role_code='WAREHOUSE_TALLY'),0)", "INTO v_warehouse_operator_permission_count, v_warehouse_tally_permission_count", - "IF v_warehouse_operator_permission_count <> 15", + "IF v_warehouse_operator_permission_count <> 16", "OR v_warehouse_tally_permission_count <> 5 THEN", "IF EXISTS (SELECT 1 FROM iam_role role", "AND UPPER(role.role_code)='PLATFORM_CUSTOM_ADMIN'", @@ -164,7 +168,7 @@ class Phase5DeliveryPermissionSqlContractTest { "海外排车、出库与派送权限", "测试和部署只执行固定入口，不再单独执行模块脚本", "排车列表/编辑/取消/转派送", - "异常订单列表/创建/处理和客户回访列表/编辑十五项权限", + "异常订单列表/创建/处理和客户回访列表/编辑十六项权限", "merchant:warehouse:delivery:list", "merchant:warehouse:delivery:create", "PDA 岗位不得获得上述后台权限"); diff --git a/iam/src/test/java/com/baiyue/iam/repository/Phase5DeliveryPermissionSqlExecutionTest.java b/iam/src/test/java/com/baiyue/iam/repository/Phase5DeliveryPermissionSqlExecutionTest.java index c3a8217d6..3d58e8216 100644 --- a/iam/src/test/java/com/baiyue/iam/repository/Phase5DeliveryPermissionSqlExecutionTest.java +++ b/iam/src/test/java/com/baiyue/iam/repository/Phase5DeliveryPermissionSqlExecutionTest.java @@ -37,12 +37,12 @@ class Phase5DeliveryPermissionSqlExecutionTest { assertThat(customAdministratorViolations(connection)).isEqualTo(1); executeGrant(connection); - assertThat(grantCount(connection, 11L)).isEqualTo(15); + assertThat(grantCount(connection, 11L)).isEqualTo(16); assertThat(customAdministratorViolations(connection)).isZero(); executeGrant(connection); - assertThat(grantCount(connection, 11L)).isEqualTo(15); - assertThat(totalGrantCount(connection)).isEqualTo(15); + assertThat(grantCount(connection, 11L)).isEqualTo(16); + assertThat(totalGrantCount(connection)).isEqualTo(16); } } @@ -51,14 +51,14 @@ class Phase5DeliveryPermissionSqlExecutionTest { try (Connection connection = database()) { insertRole(connection, 21L, "PLATFORM_CUSTOM_ADMIN"); insertRole(connection, 22L, "Platform_Custom_Admin"); - grantFirstPermissions(connection, 21L, 15); - grantFirstPermissions(connection, 22L, 14); + grantFirstPermissions(connection, 21L, 16); + grantFirstPermissions(connection, 22L, 15); assertThat(customAdministratorViolations(connection)).isEqualTo(1); executeGrant(connection); - assertThat(grantCount(connection, 21L)).isEqualTo(15); - assertThat(grantCount(connection, 22L)).isEqualTo(15); + assertThat(grantCount(connection, 21L)).isEqualTo(16); + assertThat(grantCount(connection, 22L)).isEqualTo(16); assertThat(customAdministratorViolations(connection)).isZero(); } } @@ -68,16 +68,50 @@ class Phase5DeliveryPermissionSqlExecutionTest { try (Connection connection = database()) { insertRole(connection, 31L, "PLATFORM_CUSTOM_ADMIN"); insertRole(connection, 32L, "platform_custom_admin"); - grantFirstPermissions(connection, 31L, 15); - grantFirstPermissions(connection, 32L, 15); + grantFirstPermissions(connection, 31L, 16); + grantFirstPermissions(connection, 32L, 16); assertThat(customAdministratorViolations(connection)).isZero(); executeGrant(connection); executeGrant(connection); - assertThat(grantCount(connection, 31L)).isEqualTo(15); - assertThat(grantCount(connection, 32L)).isEqualTo(15); - assertThat(totalGrantCount(connection)).isEqualTo(30); + assertThat(grantCount(connection, 31L)).isEqualTo(16); + assertThat(grantCount(connection, 32L)).isEqualTo(16); + assertThat(totalGrantCount(connection)).isEqualTo(32); + } + } + + @Test + void administratorGrantDoesNotEscalateAReadOnlyRoleOrDisabledAdministrator() throws Exception { + try (Connection connection = database()) { + insertRole(connection, 41L, "PLATFORM_ADMIN"); + insertRole(connection, 42L, "WAREHOUSE_TALLY"); + insertRole(connection, 43L, "PLATFORM_CUSTOM_ADMIN"); + try (Statement statement = connection.createStatement()) { + statement.executeUpdate("UPDATE iam_role SET status='INACTIVE' WHERE id=43"); + statement.executeUpdate(""" + INSERT INTO iam_role_permission + SELECT 0, 42, id, CURRENT_TIMESTAMP FROM iam_permission + WHERE permission_code='platform:overseas-warehouse:delivery:list' + """); + } + + executeGrant(connection); + executeGrant(connection); + + assertThat(grantCount(connection, 41L)).isEqualTo(16); + assertThat(grantCount(connection, 42L)).isEqualTo(1); + assertThat(grantCount(connection, 43L)).isZero(); + try (Statement statement = connection.createStatement(); + ResultSet result = statement.executeQuery(""" + SELECT role_id FROM iam_role_permission grant_row + JOIN iam_permission permission ON permission.id=grant_row.permission_id + WHERE permission.permission_code='platform:overseas-warehouse:delivery:documents' + """)) { + assertThat(result.next()).isTrue(); + assertThat(result.getLong(1)).isEqualTo(41L); + assertThat(result.next()).isFalse(); + } } } @@ -182,7 +216,7 @@ class Phase5DeliveryPermissionSqlExecutionTest { AND (SELECT COUNT(*) FROM iam_role_permission grant_row JOIN iam_permission permission ON permission.id=grant_row.permission_id WHERE grant_row.role_id=role.id AND grant_row.tenant_id=role.tenant_id - AND permission.permission_code IN (%s)) <> 15 + AND permission.permission_code IN (%s)) <> 16 """.formatted(placeholders); try (PreparedStatement query = connection.prepareStatement(sql)) { int index = 1; @@ -209,7 +243,7 @@ class Phase5DeliveryPermissionSqlExecutionTest { LinkedHashSet codes = new LinkedHashSet<>(); String grant = administratorGrantSql(); PLATFORM_CODE.matcher(grant).results().map(result -> result.group()).forEach(codes::add); - assertThat(codes).hasSize(15); + assertThat(codes).hasSize(16); return codes; }