优化

iam/src/test/java/com/baiyue/iam/repository/FinanceG1G2PermissionSqlContractTest.java

@@ -66,10 +66,10 @@ class FinanceG1G2PermissionSqlContractTest {
                 .contains("NULL, 'POST', 150, 'ACTIVE', 1, 0")
                 .contains("NULL, 'PUT', 160, 'ACTIVE', 1, 0")
                 .contains("permission_code IN (\n   'platform:finance',")
-                .contains("permission_code LIKE 'platform:finance:%' AND status='ACTIVE' AND deleted=0) <> 16")
-                .contains("p.permission_code IN ('platform:finance:account:view','platform:finance:fee-source:view','platform:finance:fee-source:review','platform:finance:fee-source:settlement')) <> 0")
+                .contains("permission_code LIKE 'platform:finance:%' AND status='ACTIVE' AND deleted=0) <> 26")
+                .contains("p.id BETWEEN 5105022 AND 5105035) <> 0")
                 .contains("平台管理员 Finance 授权不完整")
-                .contains("Finance G1/G2 新权限不得默认授予平台管理员");
+                .contains("Finance G1-G4 新权限不得默认授予平台管理员");
         assertThat(platformAdminGrant)
                 .contains("'platform:finance'")
                 .contains("'platform:finance:customer-terms:update'")

iam/src/test/java/com/baiyue/iam/repository/FinanceG3G4PermissionSqlContractTest.java

@@ -0,0 +1,61 @@
+package com.baiyue.iam.repository;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.core.io.ClassPathResource;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class FinanceG3G4PermissionSqlContractTest {
+    private static final String[] CODES = {
+        "platform:finance:reconciliation:create", "platform:finance:reconciliation:review",
+        "platform:finance:reconciliation:issue", "platform:finance:reconciliation:adjust",
+        "platform:finance:reconciliation:void", "platform:finance:settlement-ar:create",
+        "platform:finance:settlement-ap:create", "platform:finance:settlement-ar:view",
+        "platform:finance:settlement-ap:view", "platform:finance:payment:create"
+    };
+
+    @Test
+    void declaresAllFrozenControllerPermissionsWithoutDefaultRoleGrants() throws Exception {
+        String sql = new ClassPathResource("db/finance-g3-g4-permissions.sql")
+            .getContentAsString(StandardCharsets.UTF_8);
+
+        for (int index = 0; index < CODES.length; index++) {
+            assertThat(sql).contains("(" + (5105026 + index) + ", 0, 'PLATFORM', 'BUTTON', 5105000, '" + CODES[index] + "'");
+        }
+        assertThat(sql).contains("SIGNAL SQLSTATE '45000'")
+            .contains("id = 5105026 AND permission_code <> 'platform:finance:reconciliation:create'")
+            .contains("permission_code = 'platform:finance:payment:create' AND id <> 5105035")
+            .contains("id BETWEEN 5105026 AND 5105035 AND (tenant_id <> 0 OR app_code <> 'PLATFORM')")
+            .contains("finance G3/G4 permission id/code conflict")
+            .contains("permission catalog is incomplete")
+            .contains("finance permission parent is invalid")
+            .contains("CALL migrate_finance_g3_g4_permissions()")
+            .doesNotContain("INSERT INTO iam_role_permission");
+    }
+
+    @Test
+    void unifiedSqlContainsCatalogAndDoesNotGrantItToPlatformAdmin() throws Exception {
+        String sql = Files.readString(resolveUnifiedSql(), StandardCharsets.UTF_8);
+        String financeSection = sql.substring(sql.indexOf("-- Finance F1 人工财务权限"),
+            sql.indexOf("CALL assert_unified_final_schema()"));
+        for (String code : CODES) assertThat(financeSection).contains(code);
+        assertThat(financeSection)
+            .contains("migrate_finance_g1_g4_permissions")
+            .contains("finance G1-G4 permission id/code conflict")
+            .contains("permission_code LIKE 'platform:finance:%' AND status='ACTIVE' AND deleted=0) <> 26")
+            .contains("p.id BETWEEN 5105022 AND 5105035");
+        String grant = financeSection.substring(
+            financeSection.indexOf("SELECT 4000001, id, 0 FROM baiyue_iam.iam_permission"),
+            financeSection.indexOf("ON DUPLICATE KEY UPDATE tenant_id=VALUES(tenant_id);"));
+        for (String code : CODES) assertThat(grant).doesNotContain(code);
+    }
+
+    private static Path resolveUnifiedSql() {
+        Path direct = Path.of("deploy", "sql", "头程数据库统一增量-MySQL8.sql");
+        return Files.exists(direct) ? direct : Path.of("..", "deploy", "sql", "头程数据库统一增量-MySQL8.sql");
+    }
+}