优化

2026-08-12 09:25:53 +08:00
parent b2af5739c8
commit 1cb4fba276
29 changed files with 1311 additions and 109 deletions
@@ -0,0 +1,78 @@
+-- Finance G3/G4 permissions exposed by the frozen reconciliation and settlement controllers.
+-- These resources are assignable to custom platform roles; this migration never grants them by default.
+USE baiyue_iam;
+SET NAMES utf8mb4;
+
+DROP PROCEDURE IF EXISTS migrate_finance_g3_g4_permissions;
+DELIMITER $$
+CREATE PROCEDURE migrate_finance_g3_g4_permissions()
+BEGIN
+IF EXISTS (
+  SELECT 1
+  FROM iam_permission
+  WHERE (id = 5105026 AND permission_code <> 'platform:finance:reconciliation:create')
+     OR (id = 5105027 AND permission_code <> 'platform:finance:reconciliation:review')
+     OR (id = 5105028 AND permission_code <> 'platform:finance:reconciliation:issue')
+     OR (id = 5105029 AND permission_code <> 'platform:finance:reconciliation:adjust')
+     OR (id = 5105030 AND permission_code <> 'platform:finance:reconciliation:void')
+     OR (id = 5105031 AND permission_code <> 'platform:finance:settlement-ar:create')
+     OR (id = 5105032 AND permission_code <> 'platform:finance:settlement-ap:create')
+     OR (id = 5105033 AND permission_code <> 'platform:finance:settlement-ar:view')
+     OR (id = 5105034 AND permission_code <> 'platform:finance:settlement-ap:view')
+     OR (id = 5105035 AND permission_code <> 'platform:finance:payment:create')
+     OR (permission_code = 'platform:finance:reconciliation:create' AND id <> 5105026)
+     OR (permission_code = 'platform:finance:reconciliation:review' AND id <> 5105027)
+     OR (permission_code = 'platform:finance:reconciliation:issue' AND id <> 5105028)
+     OR (permission_code = 'platform:finance:reconciliation:adjust' AND id <> 5105029)
+     OR (permission_code = 'platform:finance:reconciliation:void' AND id <> 5105030)
+     OR (permission_code = 'platform:finance:settlement-ar:create' AND id <> 5105031)
+     OR (permission_code = 'platform:finance:settlement-ap:create' AND id <> 5105032)
+     OR (permission_code = 'platform:finance:settlement-ar:view' AND id <> 5105033)
+     OR (permission_code = 'platform:finance:settlement-ap:view' AND id <> 5105034)
+     OR (permission_code = 'platform:finance:payment:create' AND id <> 5105035)
+     OR (id BETWEEN 5105026 AND 5105035 AND (tenant_id <> 0 OR app_code <> 'PLATFORM'))
+) THEN
+  SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='finance G3/G4 permission id/code conflict';
+END IF;
+
+INSERT INTO iam_permission
+  (id, tenant_id, app_code, permission_type, parent_id, permission_code,
+   permission_name, route_path, http_method, sort_no, status, built_in, deleted)
+VALUES
+  (5105026, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:reconciliation:create', '生成和提交客户对账单', NULL, 'POST', 170, 'ACTIVE', 1, 0),
+  (5105027, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:reconciliation:review', '审核客户对账单', NULL, 'POST', 180, 'ACTIVE', 1, 0),
+  (5105028, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:reconciliation:issue', '出账客户对账单', NULL, 'POST', 190, 'ACTIVE', 1, 0),
+  (5105029, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:reconciliation:adjust', '调整客户对账单', NULL, 'POST', 200, 'ACTIVE', 1, 0),
+  (5105030, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:reconciliation:void', '作废或重开客户对账单', NULL, 'POST', 210, 'ACTIVE', 1, 0),
+  (5105031, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:settlement-ar:create', '生成应收结算单', NULL, 'POST', 220, 'ACTIVE', 1, 0),
+  (5105032, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:settlement-ap:create', '生成应付结算单', NULL, 'POST', 230, 'ACTIVE', 1, 0),
+  (5105033, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:settlement-ar:view', '查看应收结算单', NULL, 'GET', 240, 'ACTIVE', 1, 0),
+  (5105034, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:settlement-ap:view', '查看应付结算单', NULL, 'GET', 250, 'ACTIVE', 1, 0),
+  (5105035, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:payment:create', '登记应付付款', NULL, 'POST', 260, 'ACTIVE', 1, 0)
+ON DUPLICATE KEY UPDATE
+  permission_type = VALUES(permission_type), parent_id = VALUES(parent_id),
+  permission_name = VALUES(permission_name), route_path = VALUES(route_path),
+  http_method = VALUES(http_method), sort_no = VALUES(sort_no),
+  status = 'ACTIVE', built_in = 1, deleted = 0;
+
+IF (SELECT COUNT(*) FROM iam_permission
+    WHERE tenant_id=0 AND app_code='PLATFORM' AND parent_id=5105000
+      AND permission_code IN ('platform:finance:reconciliation:create','platform:finance:reconciliation:review',
+        'platform:finance:reconciliation:issue','platform:finance:reconciliation:adjust','platform:finance:reconciliation:void',
+        'platform:finance:settlement-ar:create','platform:finance:settlement-ap:create',
+        'platform:finance:settlement-ar:view','platform:finance:settlement-ap:view','platform:finance:payment:create')
+      AND status='ACTIVE' AND deleted=0) <> 10 THEN
+  SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='finance G3/G4 permission catalog is incomplete';
+END IF;
+
+IF (SELECT COUNT(*) FROM iam_permission
+    WHERE id=5105000 AND tenant_id=0 AND app_code='PLATFORM'
+      AND permission_type='MENU' AND permission_code='platform:finance'
+      AND status='ACTIVE' AND deleted=0) <> 1 THEN
+  SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='finance permission parent is invalid';
+END IF;
+END$$
+DELIMITER ;
+
+CALL migrate_finance_g3_g4_permissions();
+DROP PROCEDURE IF EXISTS migrate_finance_g3_g4_permissions;
@@ -66,10 +66,10 @@ class FinanceG1G2PermissionSqlContractTest {
                .contains("NULL, 'POST', 150, 'ACTIVE', 1, 0")
                .contains("NULL, 'PUT', 160, 'ACTIVE', 1, 0")
                .contains("permission_code IN (\n   'platform:finance',")
-                .contains("permission_code LIKE 'platform:finance:%' AND status='ACTIVE' AND deleted=0) <> 16")
-                .contains("p.permission_code IN ('platform:finance:account:view','platform:finance:fee-source:view','platform:finance:fee-source:review','platform:finance:fee-source:settlement')) <> 0")
+                .contains("permission_code LIKE 'platform:finance:%' AND status='ACTIVE' AND deleted=0) <> 26")
+                .contains("p.id BETWEEN 5105022 AND 5105035) <> 0")
                .contains("平台管理员 Finance 授权不完整")
-                .contains("Finance G1/G2 新权限不得默认授予平台管理员");
+                .contains("Finance G1-G4 新权限不得默认授予平台管理员");
        assertThat(platformAdminGrant)
                .contains("'platform:finance'")
                .contains("'platform:finance:customer-terms:update'")
@@ -0,0 +1,61 @@
+package com.baiyue.iam.repository;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.core.io.ClassPathResource;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class FinanceG3G4PermissionSqlContractTest {
+    private static final String[] CODES = {
+        "platform:finance:reconciliation:create", "platform:finance:reconciliation:review",
+        "platform:finance:reconciliation:issue", "platform:finance:reconciliation:adjust",
+        "platform:finance:reconciliation:void", "platform:finance:settlement-ar:create",
+        "platform:finance:settlement-ap:create", "platform:finance:settlement-ar:view",
+        "platform:finance:settlement-ap:view", "platform:finance:payment:create"
+    };
+
+    @Test
+    void declaresAllFrozenControllerPermissionsWithoutDefaultRoleGrants() throws Exception {
+        String sql = new ClassPathResource("db/finance-g3-g4-permissions.sql")
+            .getContentAsString(StandardCharsets.UTF_8);
+
+        for (int index = 0; index < CODES.length; index++) {
+            assertThat(sql).contains("(" + (5105026 + index) + ", 0, 'PLATFORM', 'BUTTON', 5105000, '" + CODES[index] + "'");
+        }
+        assertThat(sql).contains("SIGNAL SQLSTATE '45000'")
+            .contains("id = 5105026 AND permission_code <> 'platform:finance:reconciliation:create'")
+            .contains("permission_code = 'platform:finance:payment:create' AND id <> 5105035")
+            .contains("id BETWEEN 5105026 AND 5105035 AND (tenant_id <> 0 OR app_code <> 'PLATFORM')")
+            .contains("finance G3/G4 permission id/code conflict")
+            .contains("permission catalog is incomplete")
+            .contains("finance permission parent is invalid")
+            .contains("CALL migrate_finance_g3_g4_permissions()")
+            .doesNotContain("INSERT INTO iam_role_permission");
+    }
+
+    @Test
+    void unifiedSqlContainsCatalogAndDoesNotGrantItToPlatformAdmin() throws Exception {
+        String sql = Files.readString(resolveUnifiedSql(), StandardCharsets.UTF_8);
+        String financeSection = sql.substring(sql.indexOf("-- Finance F1 人工财务权限"),
+            sql.indexOf("CALL assert_unified_final_schema()"));
+        for (String code : CODES) assertThat(financeSection).contains(code);
+        assertThat(financeSection)
+            .contains("migrate_finance_g1_g4_permissions")
+            .contains("finance G1-G4 permission id/code conflict")
+            .contains("permission_code LIKE 'platform:finance:%' AND status='ACTIVE' AND deleted=0) <> 26")
+            .contains("p.id BETWEEN 5105022 AND 5105035");
+        String grant = financeSection.substring(
+            financeSection.indexOf("SELECT 4000001, id, 0 FROM baiyue_iam.iam_permission"),
+            financeSection.indexOf("ON DUPLICATE KEY UPDATE tenant_id=VALUES(tenant_id);"));
+        for (String code : CODES) assertThat(grant).doesNotContain(code);
+    }
+
+    private static Path resolveUnifiedSql() {
+        Path direct = Path.of("deploy", "sql", "头程数据库统一增量-MySQL8.sql");
+        return Files.exists(direct) ? direct : Path.of("..", "deploy", "sql", "头程数据库统一增量-MySQL8.sql");
+    }
+}