fix: align phase5 overseas permissions

lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/controller/DispatchQueryControllerTest.java

@@ -50,7 +50,7 @@ class DispatchQueryControllerTest {
     }
 
     @Test
-    void listAndDetailReuseInboundOrderListAuthority() throws Exception {
+    void listAndDetailUseDedicatedDispatchListAuthority() throws Exception {
         PreAuthorize page = DispatchQueryController.class
             .getMethod("page", AuthenticatedUser.class, DispatchRequests.Query.class)
             .getAnnotation(PreAuthorize.class);
@@ -58,8 +58,8 @@ class DispatchQueryControllerTest {
             .getMethod("detail", AuthenticatedUser.class, String.class)
             .getAnnotation(PreAuthorize.class);
 
-        assertThat(page.value()).contains(OverseasPermissions.INBOUND_ORDER_LIST);
-        assertThat(detail.value()).contains(OverseasPermissions.INBOUND_ORDER_LIST);
+        assertThat(page.value()).isEqualTo("hasAuthority('" + OverseasPermissions.DISPATCH_LIST + "')");
+        assertThat(detail.value()).isEqualTo("hasAuthority('" + OverseasPermissions.DISPATCH_LIST + "')");
     }
 
     private static AuthenticatedUser platform() {

lastleg-service/src/test/java/com/baiyue/lastleg/security/Phase5AdminPermissionContractTest.java

@@ -0,0 +1,81 @@
+package com.baiyue.lastleg.security;
+
+import com.baiyue.lastleg.customervisit.controller.CustomerVisitController;
+import com.baiyue.lastleg.exceptionorder.controller.ExceptionOrderController;
+import org.junit.jupiter.api.Test;
+import org.springframework.security.access.prepost.PreAuthorize;
+
+import java.lang.reflect.Method;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Arrays;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class Phase5AdminPermissionContractTest {
+    @Test
+    void exceptionAndDeliveryReturnEndpointsUseIndependentAuthorities() {
+        Map<String, String> permissions = permissions(ExceptionOrderController.class);
+
+        assertEquals(authority(OverseasPermissions.EXCEPTION_ORDER_LIST), permissions.get("page"));
+        assertEquals(authority(OverseasPermissions.EXCEPTION_ORDER_LIST), permissions.get("resolve"));
+        assertEquals(authority(OverseasPermissions.EXCEPTION_ORDER_CREATE), permissions.get("create"));
+        assertEquals(authority(OverseasPermissions.EXCEPTION_ORDER_LIST), permissions.get("returnOptions"));
+        assertEquals(authority(OverseasPermissions.DELIVERY_RETURN), permissions.get("markReturn"));
+    }
+
+    @Test
+    void customerVisitAndDeliveryStatusEndpointsUseIndependentAuthorities() {
+        Map<String, String> permissions = permissions(CustomerVisitController.class);
+
+        assertEquals(authority(OverseasPermissions.CUSTOMER_VISIT_LIST), permissions.get("page"));
+        assertEquals(authority(OverseasPermissions.CUSTOMER_VISIT_LIST), permissions.get("detail"));
+        assertEquals(authority(OverseasPermissions.CUSTOMER_VISIT_EDIT), permissions.get("save"));
+        assertEquals(authority(OverseasPermissions.CUSTOMER_VISIT_EDIT), permissions.get("upload"));
+        assertEquals(authority(OverseasPermissions.DELIVERY_STATUS), permissions.get("completeDelivery"));
+        assertEquals(authority(OverseasPermissions.DELIVERY_STATUS), permissions.get("updateDeliveryStatus"));
+    }
+
+    @Test
+    void openApiPublishesEveryFrozenPhase5AdminAuthorityAndPath() throws Exception {
+        String yaml = Files.readString(Path.of("src/main/resources/openapi/overseas-business-v1.yaml"),
+            StandardCharsets.UTF_8);
+
+        for (String permission : new String[] {
+            OverseasPermissions.DISPATCH_LIST,
+            OverseasPermissions.EXCEPTION_ORDER_LIST,
+            OverseasPermissions.EXCEPTION_ORDER_CREATE,
+            OverseasPermissions.DELIVERY_RETURN,
+            OverseasPermissions.DELIVERY_STATUS,
+            OverseasPermissions.CUSTOMER_VISIT_LIST,
+            OverseasPermissions.CUSTOMER_VISIT_EDIT
+        }) {
+            assertTrue(yaml.contains(permission), permission);
+        }
+        for (String path : new String[] {
+            "/api/platform/v1/last-leg/dispatches:",
+            "/api/platform/v1/last-leg/exception-orders:",
+            "/api/platform/v1/last-leg/delivery-orders/{deliveryNo}/mark-return:",
+            "/api/platform/v1/last-leg/delivery-orders/{deliveryNo}/status:",
+            "/api/platform/v1/last-leg/customer-visits:",
+            "/api/platform/v1/last-leg/customer-visits/{visitId}:"
+        }) {
+            assertTrue(yaml.contains(path), path);
+        }
+    }
+
+    private static Map<String, String> permissions(Class<?> controller) {
+        return Arrays.stream(controller.getDeclaredMethods())
+            .filter(method -> method.isAnnotationPresent(PreAuthorize.class))
+            .collect(Collectors.toMap(Method::getName,
+                method -> method.getAnnotation(PreAuthorize.class).value()));
+    }
+
+    private static String authority(String permission) {
+        return "hasAuthority('" + permission + "')";
+    }
+}