fix: align phase5 overseas permissions

lastleg-service/src/main/java/com/baiyue/lastleg/customervisit/controller/CustomerVisitController.java

@@ -5,10 +5,12 @@ import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.customervisit.dto.CustomerVisitRequests;
 import com.baiyue.lastleg.customervisit.dto.CustomerVisitResponses;
 import com.baiyue.lastleg.customervisit.service.CustomerVisitService;
+import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.util.StringUtils;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -29,12 +31,14 @@ public class CustomerVisitController {
     @Resource private CustomerVisitService service;
 
     @GetMapping("/customer-visits")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.CUSTOMER_VISIT_LIST + "')")
     public ApiResponse<CustomerVisitResponses.Page> page(@AuthenticationPrincipal AuthenticatedUser user,
                                                           @Valid CustomerVisitRequests.Query query) {
         return ApiResponse.success(service.page(scope(user), query));
     }
 
     @GetMapping("/customer-visits/{visitId}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.CUSTOMER_VISIT_LIST + "')")
     public ApiResponse<CustomerVisitResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
                                                               @RequestParam(required = false) String customerId,
                                                               @PathVariable long visitId) {
@@ -42,6 +46,7 @@ public class CustomerVisitController {
     }
 
     @PutMapping("/customer-visits/{visitId}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.CUSTOMER_VISIT_EDIT + "')")
     public ApiResponse<CustomerVisitResponses.Detail> save(@AuthenticationPrincipal AuthenticatedUser user,
                                                             @RequestParam(required = false) String customerId,
                                                             @PathVariable long visitId,
@@ -50,6 +55,7 @@ public class CustomerVisitController {
     }
 
     @PostMapping(value = "/customer-visits/{visitId}/attachments", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.CUSTOMER_VISIT_EDIT + "')")
     public ApiResponse<CustomerVisitResponses.UploadedFile> upload(@AuthenticationPrincipal AuthenticatedUser user,
                                                                    @RequestParam(required = false) String customerId,
                                                                    @PathVariable long visitId,
@@ -59,6 +65,7 @@ public class CustomerVisitController {
     }
 
     @PostMapping("/delivery-orders/{deliveryNo}/complete")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.DELIVERY_STATUS + "')")
     public ApiResponse<CustomerVisitResponses.Completed> completeDelivery(
         @AuthenticationPrincipal AuthenticatedUser user, @RequestParam(required = false) String customerId,
         @PathVariable String deliveryNo) {
@@ -66,6 +73,7 @@ public class CustomerVisitController {
     }
 
     @PutMapping("/delivery-orders/{deliveryNo}/status")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.DELIVERY_STATUS + "')")
     public ApiResponse<CustomerVisitResponses.Completed> updateDeliveryStatus(
         @AuthenticationPrincipal AuthenticatedUser user, @RequestParam(required = false) String customerId,
         @PathVariable String deliveryNo, @Valid @RequestBody CustomerVisitRequests.DeliveryStatus request) {

lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/controller/DispatchQueryController.java

@@ -29,7 +29,7 @@ public class DispatchQueryController {
     @Resource private DispatchService service;
 
     @GetMapping
-    @PreAuthorize("hasAuthority('" + OverseasPermissions.INBOUND_ORDER_LIST + "')")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.DISPATCH_LIST + "')")
     @Operation(summary = "Page dispatch orders")
     public ApiResponse<PageResult<DispatchResponse>> page(
         @AuthenticationPrincipal AuthenticatedUser user,
@@ -39,7 +39,7 @@ public class DispatchQueryController {
     }
 
     @GetMapping("/{dispatchNo}")
-    @PreAuthorize("hasAuthority('" + OverseasPermissions.INBOUND_ORDER_LIST + "')")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.DISPATCH_LIST + "')")
     @Operation(summary = "Get dispatch details and all pallet destinations")
     public ApiResponse<DispatchResponse> detail(
         @AuthenticationPrincipal AuthenticatedUser user,

lastleg-service/src/main/java/com/baiyue/lastleg/exceptionorder/controller/ExceptionOrderController.java

@@ -6,9 +6,11 @@ import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.exceptionorder.dto.ExceptionOrderRequests;
 import com.baiyue.lastleg.exceptionorder.dto.ExceptionOrderResponses;
 import com.baiyue.lastleg.exceptionorder.service.ExceptionOrderService;
+import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.server.ResponseStatusException;
@@ -21,12 +23,14 @@ public class ExceptionOrderController {
     @Resource private ExceptionOrderService service;
 
     @GetMapping("/exception-orders")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.EXCEPTION_ORDER_LIST + "')")
     public ApiResponse<PageResult<ExceptionOrderResponses.Row>> page(@AuthenticationPrincipal AuthenticatedUser user,
                                                                      @Valid ExceptionOrderRequests.Query query) {
         return ApiResponse.success(service.page(scope(user), query));
     }
 
     @GetMapping("/exception-orders/resolve")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.EXCEPTION_ORDER_LIST + "')")
     public ApiResponse<ExceptionOrderResponses.Relation> resolve(@AuthenticationPrincipal AuthenticatedUser user,
                                                                   @RequestParam(required = false) String customerId,
                                                                   @RequestParam(required = false) String inboundCode,
@@ -35,12 +39,14 @@ public class ExceptionOrderController {
     }
 
     @PostMapping("/exception-orders")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.EXCEPTION_ORDER_CREATE + "')")
     public ApiResponse<ExceptionOrderResponses.Created> create(@AuthenticationPrincipal AuthenticatedUser user,
                                                                 @Valid @RequestBody ExceptionOrderRequests.Create request) {
         return ApiResponse.success(service.create(scope(user), operator(user), request));
     }
 
     @GetMapping("/delivery-orders/{deliveryNo}/return-inbound-options")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.EXCEPTION_ORDER_LIST + "')")
     public ApiResponse<List<ExceptionOrderResponses.Relation>> returnOptions(@AuthenticationPrincipal AuthenticatedUser user,
                                                                               @RequestParam(required = false) String customerId,
                                                                               @PathVariable String deliveryNo) {
@@ -48,6 +54,7 @@ public class ExceptionOrderController {
     }
 
     @PostMapping("/delivery-orders/{deliveryNo}/mark-return")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.DELIVERY_RETURN + "')")
     public ApiResponse<ExceptionOrderResponses.Created> markReturn(@AuthenticationPrincipal AuthenticatedUser user,
                                                                    @RequestParam(required = false) String customerId,
                                                                    @PathVariable String deliveryNo,

lastleg-service/src/main/java/com/baiyue/lastleg/security/OverseasPermissions.java

@@ -20,6 +20,9 @@ public final class OverseasPermissions {
     public static final String INVENTORY_EDIT = "platform:overseas-warehouse:inventory:edit";
     public static final String INVENTORY_ADJUST = "platform:overseas-warehouse:inventory:adjust";
     public static final String DELIVERY_LIST = "platform:overseas-warehouse:delivery:list";
+    public static final String DELIVERY_RETURN = "platform:overseas-warehouse:delivery:return";
+    public static final String DELIVERY_STATUS = "platform:overseas-warehouse:delivery:status";
+    public static final String DISPATCH_LIST = "platform:overseas-warehouse:dispatch:list";
     public static final String DISPATCH_EDIT = "platform:overseas-warehouse:dispatch:edit";
     public static final String DISPATCH_CANCEL = "platform:overseas-warehouse:dispatch:cancel";
     public static final String DISPATCH_TRANSFER_DELIVERY =
@@ -27,6 +30,10 @@ public final class OverseasPermissions {
     public static final String OUTBOUND_LIST = "platform:overseas-warehouse:outbound:list";
     public static final String OUTBOUND_CREATE = "platform:overseas-warehouse:outbound:create";
     public static final String OUTBOUND_CANCEL = "platform:overseas-warehouse:outbound:cancel";
+    public static final String EXCEPTION_ORDER_LIST = "platform:overseas-warehouse:exception-order:list";
+    public static final String EXCEPTION_ORDER_CREATE = "platform:overseas-warehouse:exception-order:create";
+    public static final String CUSTOMER_VISIT_LIST = "platform:overseas-warehouse:customer-visit:list";
+    public static final String CUSTOMER_VISIT_EDIT = "platform:overseas-warehouse:customer-visit:edit";
     public static final String MERCHANT_DELIVERY_LIST = "merchant:warehouse:delivery:list";
     public static final String MERCHANT_DELIVERY_CREATE = "merchant:warehouse:delivery:create";
     public static final String PURCHASE_LIST = "platform:overseas-business:purchase:list";