提交

lastleg-service/src/test/java/com/baiyue/lastleg/controller/LastlegOrderControllerTest.java

@@ -9,14 +9,15 @@ import com.baiyue.lastleg.security.InternalServiceTokenGuard;
 import com.baiyue.lastleg.service.LastlegOrderService;
 import com.baiyue.lastleg.service.LoadingCompletedConsumer;
 import org.junit.jupiter.api.Test;
-import org.springframework.web.server.ResponseStatusException;
 import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.web.server.ResponseStatusException;
 
 import java.util.Set;
 
-import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.isNull;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 
@@ -27,17 +28,15 @@ class LastlegOrderControllerTest {
         1, 20, null, null, null, null, null, null, null, null, null, null);
 
     @Test
-    void customerCannotOverrideItsTenantScope() {
-        ApiResponse<PageResult<LastlegOrderSummary>> response =
-            controller.list(user(100L, "MERCHANT"), "200", query);
-        assertNotNull(response);
-        verify(service).page(eq("100"), eq(query));
+    void platformEndpointRejectsMerchantIdentity() {
+        assertThrows(ResponseStatusException.class,
+            () -> controller.list(user(100L, "MERCHANT"), "200", query));
     }
 
     @Test
-    void platformOperatorMustExplicitlyChooseCustomerTenant() {
-        assertThrows(ResponseStatusException.class,
-            () -> controller.list(user(0L, "PLATFORM"), null, query));
+    void platformOperatorCanQueryAllCustomerTenantsWithoutCustomerId() {
+        controller.list(user(0L, "PLATFORM"), null, query);
+        verify(service).page(isNull(), eq(query));
     }
 
     @Test

lastleg-service/src/test/java/com/baiyue/lastleg/controller/MerchantLastlegOrderControllerTest.java

@@ -0,0 +1,50 @@
+package com.baiyue.lastleg.controller;
+
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.dto.LastlegOrderRequests;
+import com.baiyue.lastleg.service.LastlegOrderService;
+import org.junit.jupiter.api.Test;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.util.Set;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+
+class MerchantLastlegOrderControllerTest {
+    private final LastlegOrderService service = mock(LastlegOrderService.class);
+    private final MerchantLastlegOrderController controller = controller();
+    private final LastlegOrderRequests.Query query = new LastlegOrderRequests.Query(
+        1, 20, null, null, null, null, null, null, null, null, null, null);
+
+    @Test
+    void merchantListUsesOnlyAuthenticatedTenant() {
+        controller.list(user(100L, "MERCHANT"), query);
+        verify(service).page(eq("100"), eq(query));
+    }
+
+    @Test
+    void merchantDetailUsesOnlyAuthenticatedTenant() {
+        controller.detail(user(100L, "MERCHANT"), 11L);
+        verify(service).detail("100", 11L);
+    }
+
+    @Test
+    void merchantEndpointRejectsPlatformIdentity() {
+        assertThrows(ResponseStatusException.class,
+            () -> controller.list(user(0L, "PLATFORM"), query));
+    }
+
+    private static AuthenticatedUser user(long tenantId, String appCode) {
+        return new AuthenticatedUser(1L, tenantId, tenantId, 1L, "tester", appCode, "WEB", Set.of());
+    }
+
+    private MerchantLastlegOrderController controller() {
+        MerchantLastlegOrderController controller = new MerchantLastlegOrderController();
+        ReflectionTestUtils.setField(controller, "orderService", service);
+        return controller;
+    }
+}

lastleg-service/src/test/java/com/baiyue/lastleg/controller/Phase4BrowserApiBoundaryTest.java

@@ -2,6 +2,7 @@ package com.baiyue.lastleg.controller;
 
 import com.baiyue.lastleg.delivery.controller.DeliveryTransferController;
 import com.baiyue.lastleg.dispatch.controller.DispatchController;
+import com.baiyue.lastleg.dispatch.controller.DispatchQueryController;
 import com.baiyue.lastleg.dispatch.pda.controller.DispatchPdaController;
 import com.baiyue.lastleg.inboundplan.pda.controller.InboundPalletAssignmentController;
 import com.baiyue.lastleg.inboundplan.pda.controller.InboundPdaController;
@@ -9,6 +10,7 @@ import com.baiyue.lastleg.inventory.command.controller.InventoryCommandControlle
 import org.junit.jupiter.api.Test;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.GetMapping;
 
 import java.util.Arrays;
 import java.util.Set;
@@ -37,6 +39,20 @@ class Phase4BrowserApiBoundaryTest {
         }
     }
 
+    @Test
+    void dispatchQueryIsIndependentlyEnabledWithoutExposingOutboundCommands() {
+        ConditionalOnProperty condition = DispatchQueryController.class.getAnnotation(ConditionalOnProperty.class);
+        assertTrue(condition != null);
+        assertTrue(Arrays.asList(condition.name()).contains("lastleg.dispatch-query-api.enabled"));
+        assertFalse(condition.matchIfMissing());
+        assertTrue(Arrays.stream(DispatchQueryController.class.getDeclaredMethods())
+            .filter(method -> method.isAnnotationPresent(GetMapping.class)).count() == 2);
+        assertFalse(Arrays.stream(DispatchQueryController.class.getDeclaredMethods())
+            .flatMap(method -> Arrays.stream(method.getAnnotations()))
+            .anyMatch(annotation -> Set.of("PostMapping", "PutMapping", "DeleteMapping")
+                .contains(annotation.annotationType().getSimpleName())));
+    }
+
     @Test
     void platformInventoryCommandsDoNotMapOutboundAllocationPickingOrShipping() {
         Set<String> paths = Arrays.stream(InventoryCommandController.class.getDeclaredMethods())