fix(iam): grant merchant return inventory permission

iam/src/test/java/com/baiyue/iam/repository/MerchantReturnInventoryPermissionSqlContractTest.java

@@ -0,0 +1,63 @@
+package com.baiyue.iam.repository;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.core.io.ClassPathResource;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class MerchantReturnInventoryPermissionSqlContractTest {
+    private static final String PERMISSION = "merchant:overseas-warehouse:return-inventory:list";
+
+    @Test
+    void moduleCatalogGrantsReturnInventoryToTheDefaultMerchantAdministrator() throws Exception {
+        String sql = new ClassPathResource("db/lastleg-permissions.sql")
+            .getContentAsString(StandardCharsets.UTF_8);
+
+        assertThat(sql).contains(
+            "(5306140,0,'MERCHANT','MENU',0,'" + PERMISSION + "','退货库存'",
+            "role.role_code='MERCHANT_OWNER'",
+            "'" + PERMISSION + "')) <> 5",
+            "客户默认管理员授权不完整");
+
+        int grantStart = sql.indexOf("-- 客户默认管理员获得当前客户海外业务入口");
+        int grantEnd = sql.indexOf("DROP PROCEDURE IF EXISTS assert_overseas_merchant_permissions", grantStart);
+        assertThat(grantStart).isGreaterThanOrEqualTo(0);
+        assertThat(grantEnd).isGreaterThan(grantStart);
+        assertThat(sql.substring(grantStart, grantEnd)).contains("'" + PERMISSION + "'");
+    }
+
+    @Test
+    void cleanInitializationKeepsThePermissionAndOwnerGrant() throws Exception {
+        String sql = repositoryFile("deploy/sql/头程数据库统一增量-MySQL8.sql");
+
+        assertThat(sql).contains(
+            "(5306140,0,'MERCHANT','MENU',0,'" + PERMISSION + "','退货库存'",
+            "(4000100,5306140,0,CURRENT_TIMESTAMP(3))");
+    }
+
+    @Test
+    void lastlegUsesTheCanonicalOverseasPermissionConstant() throws Exception {
+        String permissions = repositoryFile(
+            "lastleg-service/src/main/java/com/baiyue/lastleg/security/OverseasPermissions.java");
+        String controller = repositoryFile(
+            "lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/controller/MerchantReturnInventoryController.java");
+
+        assertThat(permissions).contains(
+            "MERCHANT_RETURN_INVENTORY_LIST =",
+            "\"" + PERMISSION + "\"");
+        assertThat(controller).contains(
+            "LIST_PERMISSION = OverseasPermissions.MERCHANT_RETURN_INVENTORY_LIST",
+            "@GetMapping(\"/summary\")",
+            "@PreAuthorize(\"hasAuthority('\" + LIST_PERMISSION + \"')\")");
+    }
+
+    private static String repositoryFile(String relativePath) throws Exception {
+        Path path = Path.of(relativePath);
+        if (!Files.exists(path)) path = Path.of("..").resolve(relativePath);
+        return Files.readString(path, StandardCharsets.UTF_8);
+    }
+}

iam/src/test/java/com/baiyue/iam/repository/OverseasCustomerPermissionSqlContractTest.java

@@ -18,7 +18,8 @@ class OverseasCustomerPermissionSqlContractTest {
         "merchant:cross-border:procurement",
         "merchant:cross-border:domestic-trucking",
         "merchant:cross-border:pallet-shipping",
-        "merchant:warehouse:inbound:list");
+        "merchant:warehouse:inbound:list",
+        "merchant:overseas-warehouse:return-inventory:list");
 
     @Test
     void declaresTheFrozenCustomerOverseasPermissionCatalog() throws Exception {
@@ -32,11 +33,12 @@ class OverseasCustomerPermissionSqlContractTest {
             "'merchant:cross-border:procurement','海外采购','/cross-border/procurement'",
             "'merchant:cross-border:domestic-trucking','美国本土卡','/cross-border/domestic-trucking'",
             "'merchant:cross-border:pallet-shipping','美本土散板','/cross-border/pallet-shipping'",
-            "'merchant:warehouse:inbound:list','海外仓入库订单','/orders/inbound'");
+            "'merchant:warehouse:inbound:list','海外仓入库订单','/orders/inbound'",
+            "'merchant:overseas-warehouse:return-inventory:list','退货库存','/overseas-warehouse/return-inventory'");
     }
 
     @Test
-    void grantsAllFourPermissionsOnlyToTheDefaultCustomerAdministrator() throws Exception {
+    void grantsAllFivePermissionsOnlyToTheDefaultCustomerAdministrator() throws Exception {
         String sql = sql();
         int comment = sql.indexOf("-- 客户默认管理员获得当前客户海外业务入口");
         int grantStart = sql.indexOf("INSERT IGNORE INTO iam_role_permission", comment);
@@ -64,7 +66,7 @@ class OverseasCustomerPermissionSqlContractTest {
             "海外客户权限初始化失败：客户默认管理员授权不完整",
             "permission.app_code='MERCHANT'",
             "role.role_code='MERCHANT_OWNER'",
-            ")) <> 4 THEN");
+            ")) <> 5 THEN");
     }
 
     @Test