优化

lastleg-service/src/main/java/com/baiyue/lastleg/controller/MerchantLastlegOrderController.java

@@ -7,9 +7,11 @@ import com.baiyue.lastleg.dto.LastlegOrderDetailResponse;
 import com.baiyue.lastleg.dto.LastlegOrderRequests;
 import com.baiyue.lastleg.dto.LastlegOrderSummary;
 import com.baiyue.lastleg.service.LastlegOrderService;
+import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
@@ -19,6 +21,7 @@ import org.springframework.web.server.ResponseStatusException;
 
 @RestController
 @RequestMapping("/api/merchant/v1/last-leg/orders")
+@PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LAST_MILE_ORDER_LIST + "')")
 public class MerchantLastlegOrderController {
     @Resource private LastlegOrderService orderService;
 

lastleg-service/src/main/java/com/baiyue/lastleg/discard/controller/MerchantCargoDiscardController.java

@@ -6,9 +6,11 @@ import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.discard.dto.CargoDiscardRequests;
 import com.baiyue.lastleg.discard.dto.CargoDiscardResponses;
 import com.baiyue.lastleg.discard.service.CargoDiscardService;
+import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.server.ResponseStatusException;
@@ -19,18 +21,23 @@ import java.util.List;
 public class MerchantCargoDiscardController {
     @Resource private CargoDiscardService service;
     @GetMapping("/inventory-candidates")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_LIST + "')")
     public ApiResponse<List<CargoDiscardResponses.Candidate>> candidates(@AuthenticationPrincipal AuthenticatedUser user,
         @RequestParam(required = false) String inboundCode) { return ApiResponse.success(service.candidates(customer(user), inboundCode)); }
     @PostMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_CREATE + "')")
     public ApiResponse<CargoDiscardResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody CargoDiscardRequests.Create request) { return ApiResponse.success(service.create(customer(user), operator(user), request)); }
     @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_LIST + "')")
     public ApiResponse<PageResult<CargoDiscardResponses.Summary>> page(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid CargoDiscardRequests.Query query) { return ApiResponse.success(service.page(customer(user), query)); }
     @GetMapping("/{discardNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_LIST + "')")
     public ApiResponse<CargoDiscardResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String discardNo) { return ApiResponse.success(service.detail(customer(user), discardNo)); }
     @PostMapping("/{discardNo}/cancel")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_CANCEL + "')")
     public ApiResponse<CargoDiscardResponses.Detail> cancel(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String discardNo) { return ApiResponse.success(service.cancel(customer(user), discardNo, operator(user), false)); }
     private String customer(AuthenticatedUser user) {

lastleg-service/src/main/java/com/baiyue/lastleg/looseboard/controller/MerchantLocalLooseboardController.java

@@ -23,29 +23,32 @@ import org.springframework.web.server.ResponseStatusException;
 
 @RestController
 @RequestMapping("/api/merchant/v1/last-leg/local-looseboard-orders")
-@PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD + "')")
 public class MerchantLocalLooseboardController {
     @Resource private LocalLooseboardService service;
 
     @PostMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD_CREATE + "')")
     public ApiResponse<LocalLooseboardResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody LocalLooseboardRequests.Create request) {
         return ApiResponse.success(service.create(customer(user), operator(user), request));
     }
 
     @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD_LIST + "')")
     public ApiResponse<PageResult<LocalLooseboardResponses.Summary>> page(
         @AuthenticationPrincipal AuthenticatedUser user, @Valid LocalLooseboardRequests.MerchantQuery query) {
         return ApiResponse.success(service.page(customer(user), query));
     }
 
     @GetMapping("/{orderNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD_LIST + "')")
     public ApiResponse<LocalLooseboardResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String orderNo) {
         return ApiResponse.success(service.detail(customer(user), orderNo));
     }
 
     @PutMapping("/{orderNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD_EDIT + "')")
     public ApiResponse<LocalLooseboardResponses.Detail> update(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String orderNo, @Valid @RequestBody LocalLooseboardRequests.Update request) {
         return ApiResponse.success(service.update(customer(user), orderNo, operator(user), request));

lastleg-service/src/main/java/com/baiyue/lastleg/procurement/controller/MerchantOverseasProcurementController.java

@@ -22,11 +22,11 @@ import org.springframework.web.server.ResponseStatusException;
 
 @RestController
 @RequestMapping("/api/merchant/v1/last-leg/overseas-procurements")
-@PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_PROCUREMENT + "')")
 public class MerchantOverseasProcurementController {
     @Resource private OverseasProcurementService service;
 
     @PostMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_PROCUREMENT_CREATE + "')")
     public ApiResponse<OverseasProcurementResponses.Detail> create(
         @AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody OverseasProcurementRequests.Create request) {
@@ -34,12 +34,14 @@ public class MerchantOverseasProcurementController {
     }
 
     @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_PROCUREMENT_LIST + "')")
     public ApiResponse<PageResult<OverseasProcurementResponses.Summary>> page(
         @AuthenticationPrincipal AuthenticatedUser user, @Valid OverseasProcurementRequests.MerchantQuery query) {
         return ApiResponse.success(service.page(customer(user), query.scoped()));
     }
 
     @GetMapping("/{orderNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_PROCUREMENT_LIST + "')")
     public ApiResponse<OverseasProcurementResponses.Detail> detail(
         @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String orderNo) {
         return ApiResponse.success(service.detail(customer(user), orderNo));

lastleg-service/src/main/java/com/baiyue/lastleg/relabel/controller/MerchantRelabelApplicationController.java

@@ -6,9 +6,11 @@ import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.relabel.dto.RelabelRequests;
 import com.baiyue.lastleg.relabel.dto.RelabelResponses;
 import com.baiyue.lastleg.relabel.service.RelabelApplicationService;
+import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.server.ResponseStatusException;
@@ -24,6 +26,7 @@ import java.util.List;
 public class MerchantRelabelApplicationController {
     @Resource private RelabelApplicationService service;
     @GetMapping("/inventory-candidates")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')")
     public ApiResponse<List<RelabelResponses.InventoryCandidate>> candidates(
         @AuthenticationPrincipal AuthenticatedUser user,
         @RequestParam String operationWarehouseId,
@@ -31,6 +34,7 @@ public class MerchantRelabelApplicationController {
         return ApiResponse.success(service.candidates(customer(user), operationWarehouseId, inboundCode));
     }
     @GetMapping("/historical-orders")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')")
     public ApiResponse<List<RelabelResponses.HistoricalOrder>> historicalOrders(
         @AuthenticationPrincipal AuthenticatedUser user,
         @RequestParam String operationWarehouseId,
@@ -38,20 +42,25 @@ public class MerchantRelabelApplicationController {
         return ApiResponse.success(service.historicalOrders(customer(user), operationWarehouseId, keyword));
     }
     @PostMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_CREATE + "')")
     public ApiResponse<RelabelResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody RelabelRequests.Create request) { return ApiResponse.success(service.create(customer(user), operator(user), request)); }
     @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')")
     public ApiResponse<PageResult<RelabelResponses.Summary>> page(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid RelabelRequests.Query query) { return ApiResponse.success(service.page(customer(user), query)); }
     @GetMapping("/{relabelNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')")
     public ApiResponse<RelabelResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String relabelNo) { return ApiResponse.success(service.detail(customer(user), relabelNo)); }
     @PostMapping(value = "/{relabelNo}/shipping-label", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_FILES + "')")
     public ApiResponse<RelabelResponses.Detail> uploadShippingLabel(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String relabelNo, @RequestPart("file") MultipartFile file) {
         return ApiResponse.success(service.uploadShippingLabel(customer(user), relabelNo, operatorLong(user), file));
     }
     @PostMapping(value = "/{relabelNo}/files", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_FILES + "')")
     public ApiResponse<RelabelResponses.Detail> uploadFile(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String relabelNo, @RequestParam String scope, @RequestParam(required = false) Long itemId,
         @RequestPart("file") MultipartFile file) {
@@ -60,18 +69,21 @@ public class MerchantRelabelApplicationController {
         return ApiResponse.success(service.uploadTotalFile(customer(user), relabelNo, operatorLong(user), file, kind));
     }
     @GetMapping("/{relabelNo}/shipping-label/{fileId}/download")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')")
     public ResponseEntity<byte[]> downloadShippingLabel(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String relabelNo, @PathVariable long fileId) {
         var file = service.downloadShippingLabel(customer(user), relabelNo, fileId);
         return download(file.content(), file.fileName(), file.contentType());
     }
     @GetMapping("/{relabelNo}/completion-photos/{fileId}/download")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')")
     public ResponseEntity<byte[]> downloadCompletionPhoto(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String relabelNo, @PathVariable long fileId) {
         var file = service.downloadCompletionPhoto(customer(user), relabelNo, fileId);
         return download(file.content(), file.fileName(), file.contentType());
     }
     @PostMapping("/{relabelNo}/confirm-completion")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_CONFIRM + "')")
     public ApiResponse<RelabelResponses.Detail> confirmCompletion(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String relabelNo, @Valid @RequestBody RelabelRequests.CustomerConfirm request) {
         return ApiResponse.success(service.confirmCompletion(customer(user), relabelNo, operator(user), request));

lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/controller/MerchantReturnOrderController.java

@@ -6,9 +6,11 @@ import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.returnreceipt.dto.ReturnOrderRequests;
 import com.baiyue.lastleg.returnreceipt.dto.ReturnOrderResponses;
 import com.baiyue.lastleg.returnreceipt.service.ReturnReceiptService;
+import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.server.ResponseStatusException;
@@ -17,17 +19,22 @@ import org.springframework.web.server.ResponseStatusException;
 @RequestMapping("/api/merchant/v1/last-leg/return-orders")
 public class MerchantReturnOrderController {
     @Resource private ReturnReceiptService service;
-    @PostMapping public ApiResponse<ReturnOrderResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
+    @PostMapping @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_CREATE + "')")
+    public ApiResponse<ReturnOrderResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody ReturnOrderRequests.Create request) { return ApiResponse.success(service.create(customer(user), operator(user), request)); }
-    @GetMapping public ApiResponse<PageResult<ReturnOrderResponses.Summary>> page(@AuthenticationPrincipal AuthenticatedUser user,
+    @GetMapping @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_LIST + "')")
+    public ApiResponse<PageResult<ReturnOrderResponses.Summary>> page(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid ReturnOrderRequests.Query query) { return ApiResponse.success(service.page(customer(user), query)); }
-    @GetMapping("/{returnNo}") public ApiResponse<ReturnOrderResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
+    @GetMapping("/{returnNo}") @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_LIST + "')")
+    public ApiResponse<ReturnOrderResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String returnNo) { return ApiResponse.success(service.detail(customer(user), returnNo)); }
-    @GetMapping("/{returnNo}/relabel-candidates") public ApiResponse<java.util.List<ReturnOrderResponses.RelabelCandidate>> relabelCandidates(
+    @GetMapping("/{returnNo}/relabel-candidates") @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_RELABEL + "')")
+    public ApiResponse<java.util.List<ReturnOrderResponses.RelabelCandidate>> relabelCandidates(
         @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String returnNo) {
         return ApiResponse.success(service.relabelCandidates(customer(user), returnNo));
     }
-    @PostMapping("/{returnNo}/relabel") public ApiResponse<ReturnOrderResponses.RelabelCreated> createRelabel(
+    @PostMapping("/{returnNo}/relabel") @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_RELABEL + "')")
+    public ApiResponse<ReturnOrderResponses.RelabelCreated> createRelabel(
         @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String returnNo,
         @Valid @RequestBody ReturnOrderRequests.RelabelCreate request) {
         return ApiResponse.success(service.createRelabel(customer(user), operator(user), returnNo, request));

lastleg-service/src/main/java/com/baiyue/lastleg/security/OverseasPermissions.java

@@ -45,9 +45,29 @@ public final class OverseasPermissions {
     public static final String MERCHANT_INBOUND_LIST = "merchant:warehouse:inbound:list";
     public static final String MERCHANT_RETURN_INVENTORY_LIST =
         "merchant:overseas-warehouse:return-inventory:list";
-    public static final String MERCHANT_PROCUREMENT = "merchant:cross-border:procurement";
-    public static final String MERCHANT_TRUCKING = "merchant:cross-border:domestic-trucking";
-    public static final String MERCHANT_LOOSEBOARD = "merchant:cross-border:pallet-shipping";
+    public static final String MERCHANT_LAST_MILE_ORDER_LIST =
+        "merchant:overseas-warehouse:last-mile-order:list";
+    public static final String MERCHANT_RELABEL_LIST = "merchant:overseas-warehouse:relabel:list";
+    public static final String MERCHANT_RELABEL_CREATE = "merchant:overseas-warehouse:relabel:create";
+    public static final String MERCHANT_RELABEL_FILES = "merchant:overseas-warehouse:relabel:files";
+    public static final String MERCHANT_RELABEL_CONFIRM = "merchant:overseas-warehouse:relabel:confirm";
+    public static final String MERCHANT_TRANSFER_LIST = "merchant:overseas-warehouse:transfer:list";
+    public static final String MERCHANT_TRANSFER_CREATE = "merchant:overseas-warehouse:transfer:create";
+    public static final String MERCHANT_TRANSFER_CONFIRM = "merchant:overseas-warehouse:transfer:confirm";
+    public static final String MERCHANT_DISCARD_LIST = "merchant:overseas-warehouse:discard:list";
+    public static final String MERCHANT_DISCARD_CREATE = "merchant:overseas-warehouse:discard:create";
+    public static final String MERCHANT_DISCARD_CANCEL = "merchant:overseas-warehouse:discard:cancel";
+    public static final String MERCHANT_RETURN_ORDER_LIST = "merchant:overseas-warehouse:return-order:list";
+    public static final String MERCHANT_RETURN_ORDER_CREATE = "merchant:overseas-warehouse:return-order:create";
+    public static final String MERCHANT_RETURN_ORDER_RELABEL = "merchant:overseas-warehouse:return-order:relabel";
+    public static final String MERCHANT_PROCUREMENT_LIST = "merchant:cross-border:procurement:list";
+    public static final String MERCHANT_PROCUREMENT_CREATE = "merchant:cross-border:procurement:create";
+    public static final String MERCHANT_TRUCKING_LIST = "merchant:cross-border:domestic-trucking:list";
+    public static final String MERCHANT_TRUCKING_CREATE = "merchant:cross-border:domestic-trucking:create";
+    public static final String MERCHANT_TRUCKING_EDIT = "merchant:cross-border:domestic-trucking:edit";
+    public static final String MERCHANT_LOOSEBOARD_LIST = "merchant:cross-border:pallet-shipping:list";
+    public static final String MERCHANT_LOOSEBOARD_CREATE = "merchant:cross-border:pallet-shipping:create";
+    public static final String MERCHANT_LOOSEBOARD_EDIT = "merchant:cross-border:pallet-shipping:edit";
     public static final String PURCHASE_LIST = "platform:overseas-business:purchase:list";
     public static final String PURCHASE_EDIT = "platform:overseas-business:purchase:edit";
     public static final String PURCHASE_REVIEW = "platform:overseas-business:purchase:review";

lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferController.java

@@ -6,9 +6,11 @@ import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.transfer.dto.WarehouseTransferRequests;
 import com.baiyue.lastleg.transfer.dto.WarehouseTransferResponses;
 import com.baiyue.lastleg.transfer.service.WarehouseTransferService;
+import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.server.ResponseStatusException;
@@ -19,24 +21,28 @@ public class MerchantWarehouseTransferController {
     @Resource private WarehouseTransferService service;
 
     @PostMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_CREATE + "')")
     public ApiResponse<WarehouseTransferResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody WarehouseTransferRequests.Create request) {
         return ApiResponse.success(service.create(customer(user), operator(user), request));
     }
 
     @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_LIST + "')")
     public ApiResponse<PageResult<WarehouseTransferResponses.Summary>> page(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid WarehouseTransferRequests.Query query) {
         return ApiResponse.success(service.page(customer(user), query));
     }
 
     @GetMapping("/{transferNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_LIST + "')")
     public ApiResponse<WarehouseTransferResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String transferNo) {
         return ApiResponse.success(service.detail(customer(user), transferNo));
     }
 
     @PostMapping("/{transferNo}/confirm-measurement")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_CONFIRM + "')")
     public ApiResponse<WarehouseTransferResponses.Detail> confirmMeasurement(
         @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String transferNo,
         @Valid @RequestBody WarehouseTransferRequests.CustomerConfirm request) {

lastleg-service/src/main/java/com/baiyue/lastleg/trucking/controller/MerchantUsTruckOrderController.java

@@ -23,29 +23,32 @@ import org.springframework.web.server.ResponseStatusException;
 
 @RestController
 @RequestMapping("/api/merchant/v1/last-leg/us-truck-orders")
-@PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRUCKING + "')")
 public class MerchantUsTruckOrderController {
     @Resource private UsTruckOrderService service;
 
     @PostMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRUCKING_CREATE + "')")
     public ApiResponse<UsTruckOrderResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody UsTruckOrderRequests.Create request) {
         return ApiResponse.success(service.create(customer(user), operator(user), request));
     }
 
     @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRUCKING_LIST + "')")
     public ApiResponse<PageResult<UsTruckOrderResponses.Summary>> page(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid UsTruckOrderRequests.MerchantQuery query) {
         return ApiResponse.success(service.page(customer(user), query.scoped()));
     }
 
     @GetMapping("/{orderNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRUCKING_LIST + "')")
     public ApiResponse<UsTruckOrderResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String orderNo) {
         return ApiResponse.success(service.detail(customer(user), orderNo));
     }
 
     @PatchMapping("/{orderNo}")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRUCKING_EDIT + "')")
     public ApiResponse<UsTruckOrderResponses.Detail> update(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String orderNo, @Valid @RequestBody UsTruckOrderRequests.Update request) {
         return ApiResponse.success(service.update(customer(user), orderNo, operator(user), request));

lastleg-service/src/main/resources/openapi/overseas-business-v1.yaml

@@ -962,13 +962,13 @@ paths:
   /api/merchant/v1/last-leg/overseas-procurements:
     post:
       summary: 客户创建海外采购订单
-      description: 权限 merchant:cross-border:procurement；客户 ID 只取认证身份且不接收 customerId；新单固定进入 PENDING_REVIEW。同幂等键同请求返回既有订单，异请求返回 A0409。
+      description: 权限 merchant:cross-border:procurement:create；客户 ID 只取认证身份且不接收 customerId；新单固定进入 PENDING_REVIEW。同幂等键同请求返回既有订单，异请求返回 A0409。
       security: [{ bearerAuth: [] }]
       requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/ProcurementCreate' } } } }
       responses: { '200': { description: 采购订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/ProcurementDetailResponse' } } } }, '409': { description: 幂等冲突 } }
     get:
       summary: 客户分页查询自己的海外采购订单
-      description: 权限 merchant:cross-border:procurement；客户范围只取认证 Token，不接收 customerId。
+      description: 权限 merchant:cross-border:procurement:list；客户范围只取认证 Token，不接收 customerId。
       security: [{ bearerAuth: [] }]
       parameters:
         - { name: page, in: query, schema: { type: integer, minimum: 1, default: 1 } }
@@ -984,14 +984,14 @@ paths:
   /api/merchant/v1/last-leg/overseas-procurements/{orderNo}:
     get:
       summary: 客户查询自己的海外采购订单详情及流水
-      description: 权限 merchant:cross-border:procurement；列表权限包含详情只读，客户范围只取认证 Token。
+      description: 权限 merchant:cross-border:procurement:list；列表权限包含详情只读，客户范围只取认证 Token。
       security: [{ bearerAuth: [] }]
       parameters: [{ name: orderNo, in: path, required: true, schema: { type: string } }]
       responses: { '200': { description: 当前客户采购订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/ProcurementDetailResponse' } } } }, '404': { description: 当前客户下订单不存在 } }
   /api/merchant/v1/last-leg/us-truck-orders:
     get:
       summary: 客户分页查询自己的美国本土卡订单
-      description: 权限 merchant:cross-border:domestic-trucking；客户范围只取认证 Token，不接收 customerId。
+      description: 权限 merchant:cross-border:domestic-trucking:list；客户范围只取认证 Token，不接收 customerId。
       security: [{ bearerAuth: [] }]
       parameters:
         - { name: page, in: query, schema: { type: integer, minimum: 1, default: 1 } }
@@ -1005,7 +1005,7 @@ paths:
       responses: { '200': { description: 当前客户本土卡订单分页, content: { application/json: { schema: { $ref: '#/components/schemas/TruckPageResponse' } } } } }
     post:
       summary: 客户创建美国本土卡订单
-      description: 权限 merchant:cross-border:domestic-trucking；新单固定进入 PENDING_REVIEW，客户不能调用平台审核或状态推进端点。
+      description: 权限 merchant:cross-border:domestic-trucking:create；新单固定进入 PENDING_REVIEW，客户不能调用平台审核或状态推进端点。
       security: [{ bearerAuth: [] }]
       requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/TruckCreate' } } } }
       responses: { '200': { description: 本土卡订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/TruckDetailResponse' } } } }, '409': { description: 幂等冲突 } }
@@ -1013,19 +1013,19 @@ paths:
     parameters: [{ name: orderNo, in: path, required: true, schema: { type: string } }]
     get:
       summary: 客户查询自己的美国本土卡订单详情
-      description: 权限 merchant:cross-border:domestic-trucking；不泄露其他客户订单。
+      description: 权限 merchant:cross-border:domestic-trucking:list；不泄露其他客户订单。
       security: [{ bearerAuth: [] }]
       responses: { '200': { description: 当前客户本土卡订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/TruckDetailResponse' } } } }, '404': { description: 当前客户下订单不存在 } }
     patch:
       summary: 客户编辑待审核的美国本土卡订单
-      description: 权限 merchant:cross-border:domestic-trucking；仅 PENDING_REVIEW 可编辑，version 必填；不能修改状态。
+      description: 权限 merchant:cross-border:domestic-trucking:edit；仅 PENDING_REVIEW 可编辑，version 必填；不能修改状态。
       security: [{ bearerAuth: [] }]
       requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/TruckUpdate' } } } }
       responses: { '200': { description: 更新后的订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/TruckDetailResponse' } } } }, '409': { description: 版本或状态冲突 } }
   /api/merchant/v1/last-leg/local-looseboard-orders:
     get:
       summary: 客户分页查询自己的本土散板订单
-      description: 权限 merchant:cross-border:pallet-shipping；客户范围只取认证 Token，不接收 customerId。
+      description: 权限 merchant:cross-border:pallet-shipping:list；客户范围只取认证 Token，不接收 customerId。
       security: [{ bearerAuth: [] }]
       parameters:
         - { name: page, in: query, schema: { type: integer, minimum: 1, default: 1 } }
@@ -1039,7 +1039,7 @@ paths:
       responses: { '200': { description: 当前客户本土散板订单分页, content: { application/json: { schema: { $ref: '#/components/schemas/LooseboardPageResponse' } } } } }
     post:
       summary: 客户创建本土散板订单
-      description: 权限 merchant:cross-border:pallet-shipping；新单固定进入 PENDING_ACCEPTANCE，客户不能调用平台状态推进端点。
+      description: 权限 merchant:cross-border:pallet-shipping:create；新单固定进入 PENDING_ACCEPTANCE，客户不能调用平台状态推进端点。
       security: [{ bearerAuth: [] }]
       requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/LooseboardCreate' } } } }
       responses: { '200': { description: 本土散板订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/LooseboardDetailResponse' } } } }, '409': { description: 幂等冲突 } }
@@ -1047,12 +1047,12 @@ paths:
     parameters: [{ name: orderNo, in: path, required: true, schema: { type: string } }]
     get:
       summary: 客户查询自己的本土散板订单详情
-      description: 权限 merchant:cross-border:pallet-shipping；不泄露其他客户订单。
+      description: 权限 merchant:cross-border:pallet-shipping:list；不泄露其他客户订单。
       security: [{ bearerAuth: [] }]
       responses: { '200': { description: 当前客户本土散板订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/LooseboardDetailResponse' } } } }, '404': { description: 当前客户下订单不存在 } }
     put:
       summary: 客户编辑待接单的本土散板订单
-      description: 权限 merchant:cross-border:pallet-shipping；仅 PENDING_ACCEPTANCE 可编辑，version 必填；不能修改状态。
+      description: 权限 merchant:cross-border:pallet-shipping:edit；仅 PENDING_ACCEPTANCE 可编辑，version 必填；不能修改状态。
       security: [{ bearerAuth: [] }]
       requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/LooseboardUpdate' } } } }
       responses: { '200': { description: 更新后的订单详情, content: { application/json: { schema: { $ref: '#/components/schemas/LooseboardDetailResponse' } } } }, '409': { description: 版本或状态冲突 } }
@@ -1310,7 +1310,7 @@ paths:
   /api/merchant/v1/last-leg/relabel-applications/inventory-candidates:
     get:
       summary: 查询客户可换标库存候选
-      description: 权限 merchant:warehouse:relabel；仅返回当前客户在指定海外中转仓仍有可用箱数的历史入仓单和库位摘要。候选按客户 Token 隔离，不接收 customerId；inboundCode 可选精确筛选。
+      description: 权限 merchant:overseas-warehouse:relabel:list；仅返回当前客户在指定海外中转仓仍有可用箱数的历史入仓单和库位摘要。候选按客户 Token 隔离，不接收 customerId；inboundCode 可选精确筛选。
       security: [{ bearerAuth: [] }]
       parameters:
         - { name: operationWarehouseId, in: query, required: true, schema: { type: string, maxLength: 128 } }
@@ -1321,7 +1321,7 @@ paths:
   /api/merchant/v1/last-leg/relabel-applications:
     get:
       summary: 分页查询客户换标申请
-      description: 权限 merchant:warehouse:relabel；客户范围只取认证 Token，不接收 customerId。
+      description: 权限 merchant:overseas-warehouse:relabel:list；客户范围只取认证 Token，不接收 customerId。
       security: [{ bearerAuth: [] }]
       parameters:
         - { name: page, in: query, schema: { type: integer, minimum: 1, default: 1 } }
@@ -1337,7 +1337,7 @@ paths:
         '200': { description: 客户换标申请分页, content: { application/json: { schema: { $ref: '#/components/schemas/RelabelMerchantPageResponse' } } } }
     post:
       summary: 创建客户换标申请
-      description: 权限 merchant:warehouse:relabel；申请创建即冻结对应库存。SKU_LABEL 不要求派送方式；CARTON_LABEL/CARTON_AND_SKU 必须指定 TRUCK、PICKUP 或 EXPRESS。
+      description: 权限 merchant:overseas-warehouse:relabel:create；申请创建即冻结对应库存。SKU_LABEL 不要求派送方式；CARTON_LABEL/CARTON_AND_SKU 必须指定 TRUCK、PICKUP 或 EXPRESS。
       security: [{ bearerAuth: [] }]
       requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/RelabelCreate' } } } }
       responses:
@@ -1357,7 +1357,7 @@ paths:
   /api/merchant/v1/last-leg/relabel-applications/{relabelNo}:
     get:
       summary: 查询客户换标申请详情
-      description: 权限 merchant:warehouse:relabel；客户范围只取认证 Token。
+      description: 权限 merchant:overseas-warehouse:relabel:list；客户范围只取认证 Token。
       security: [{ bearerAuth: [] }]
       parameters: [{ name: relabelNo, in: path, required: true, schema: { type: string, maxLength: 64 } }]
       responses:
@@ -1366,7 +1366,7 @@ paths:
   /api/merchant/v1/last-leg/relabel-applications/{relabelNo}/shipping-label:
     post:
       summary: 上传换标快递面单
-      description: 权限 merchant:warehouse:relabel；仅 EXPRESS 且申请尚未客户确认时允许上传，文件由服务端绑定到申请单。
+      description: 权限 merchant:overseas-warehouse:relabel:files；仅 EXPRESS 且申请尚未客户确认时允许上传，文件由服务端绑定到申请单。
       security: [{ bearerAuth: [] }]
       parameters: [{ name: relabelNo, in: path, required: true, schema: { type: string, maxLength: 64 } }]
       requestBody: { required: true, content: { multipart/form-data: { schema: { type: object, required: [file], properties: { file: { type: string, format: binary } } } } } }
@@ -1377,7 +1377,7 @@ paths:
   /api/merchant/v1/last-leg/relabel-applications/{relabelNo}/shipping-label/{fileId}/download:
     get:
       summary: 下载换标快递面单
-      description: 权限 merchant:warehouse:relabel；仅允许下载当前申请已绑定的面单文件。
+      description: 权限 merchant:overseas-warehouse:relabel:list；仅允许下载当前申请已绑定的面单文件。
       security: [{ bearerAuth: [] }]
       parameters:
         - { name: relabelNo, in: path, required: true, schema: { type: string, maxLength: 64 } }
@@ -1388,7 +1388,7 @@ paths:
   /api/merchant/v1/last-leg/relabel-applications/{relabelNo}/completion-photos/{fileId}/download:
     get:
       summary: 下载换标完成照片
-      description: 权限 merchant:warehouse:relabel；仅允许下载该申请 PDA 完工证据中的照片。
+      description: 权限 merchant:overseas-warehouse:relabel:list；仅允许下载该申请 PDA 完工证据中的照片。
       security: [{ bearerAuth: [] }]
       parameters:
         - { name: relabelNo, in: path, required: true, schema: { type: string, maxLength: 64 } }
@@ -1399,7 +1399,7 @@ paths:
   /api/merchant/v1/last-leg/relabel-applications/{relabelNo}/confirm-completion:
     post:
       summary: 客户确认换标完成
-      description: 权限 merchant:warehouse:relabel；仅 CUSTOMER_CONFIRM_PENDING 可确认。TRUCK 进入 WAIT_PRE_DISPATCH，PICKUP/EXPRESS 幂等生成 RELABEL_OUTBOUND 出库单；EXPRESS 且要求打印面单时必须先上传面单。
+      description: 权限 merchant:overseas-warehouse:relabel:confirm；仅 CUSTOMER_CONFIRM_PENDING 可确认。TRUCK 进入 WAIT_PRE_DISPATCH，PICKUP/EXPRESS 幂等生成 RELABEL_OUTBOUND 出库单；EXPRESS 且要求打印面单时必须先上传面单。
       security: [{ bearerAuth: [] }]
       parameters: [{ name: relabelNo, in: path, required: true, schema: { type: string, maxLength: 64 } }]
       requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/RelabelCustomerConfirm' } } } }
@@ -1409,7 +1409,7 @@ paths:
   /api/merchant/v1/last-leg/return-orders:
     get:
       summary: 客户分页查询退货签收订单
-      description: 客户范围只取认证 Token。可按退货单号、快递单号、SKU 和签收状态过滤；实收数量以仓库 PDA 签收为准。
+      description: 权限 merchant:overseas-warehouse:return-order:list；客户范围只取认证 Token。可按退货单号、快递单号、SKU 和签收状态过滤；实收数量以仓库 PDA 签收为准。
       security: [{ bearerAuth: [] }]
       parameters:
         - { name: page, in: query, schema: { type: integer, minimum: 1, default: 1 } }
@@ -1421,14 +1421,14 @@ paths:
       responses: { '200': { description: 当前客户退货订单分页 } }
     post:
       summary: 客户创建退货预报订单
-      description: 客户只预报不重复的 SKU 和预计数量，不要求提前知道快递单号；仓库 PDA 实收数量才是实际入库事实。系统退货编号由业务前缀和25位大写Base36完整随机UUID编码组成，退货单RT、签收单RR、批次RB、箱唛RC及退货主单RETU均独立生成，不编码内部ID、仓库或日期。幂等重放返回已保存的编号，不重新生成。
+      description: 权限 merchant:overseas-warehouse:return-order:create；客户只预报不重复的 SKU 和预计数量，不要求提前知道快递单号；仓库 PDA 实收数量才是实际入库事实。系统退货编号由业务前缀和25位大写Base36完整随机UUID编码组成，退货单RT、签收单RR、批次RB、箱唛RC及退货主单RETU均独立生成，不编码内部ID、仓库或日期。幂等重放返回已保存的编号，不重新生成。
       security: [{ bearerAuth: [] }]
       requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/ReturnOrderCreate' } } } }
       responses: { '200': { description: 创建后的退货订单详情 }, '409': { description: 幂等键冲突 } }
   /api/merchant/v1/last-leg/return-orders/{returnNo}:
     get:
       summary: 客户查询退货订单与签收批次
-      description: 返回各 SKU 的预报和实收数量，以及每次 PDA 签收产生的批次号和可选快递单号。
+      description: 权限 merchant:overseas-warehouse:return-order:list；返回各 SKU 的预报和实收数量，以及每次 PDA 签收产生的批次号和可选快递单号。
       security: [{ bearerAuth: [] }]
       parameters: [{ name: returnNo, in: path, required: true, schema: { type: string } }]
       responses: { '200': { description: 当前客户退货订单详情 }, '404': { description: 当前客户下退货订单不存在 } }

lastleg-service/src/test/java/com/baiyue/lastleg/merchant/MerchantOverseasCustomerApiContractTest.java

@@ -1,14 +1,19 @@
 package com.baiyue.lastleg.merchant;
 
 import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.controller.MerchantLastlegOrderController;
 import com.baiyue.lastleg.inboundplan.controller.MerchantInboundPlanController;
 import com.baiyue.lastleg.inboundplan.dto.InboundPlanRequests;
 import com.baiyue.lastleg.inboundplan.service.InboundPlanService;
+import com.baiyue.lastleg.discard.controller.MerchantCargoDiscardController;
 import com.baiyue.lastleg.looseboard.controller.MerchantLocalLooseboardController;
 import com.baiyue.lastleg.looseboard.dto.LocalLooseboardRequests;
 import com.baiyue.lastleg.looseboard.service.LocalLooseboardService;
 import com.baiyue.lastleg.procurement.controller.MerchantOverseasProcurementController;
+import com.baiyue.lastleg.relabel.controller.MerchantRelabelApplicationController;
+import com.baiyue.lastleg.returnreceipt.controller.MerchantReturnOrderController;
 import com.baiyue.lastleg.security.OverseasPermissions;
+import com.baiyue.lastleg.transfer.controller.MerchantWarehouseTransferController;
 import com.baiyue.lastleg.trucking.controller.MerchantUsTruckOrderController;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -21,6 +26,7 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.server.ResponseStatusException;
 
 import java.util.Arrays;
+import java.util.Map;
 import java.util.Set;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -43,15 +49,57 @@ class MerchantOverseasCustomerApiContractTest {
     }
 
     @Test
-    void merchantControllersUseFrozenPathsAndExistingClientPermissionCodes() {
-        assertController(MerchantOverseasProcurementController.class,
-            "/api/merchant/v1/last-leg/overseas-procurements", OverseasPermissions.MERCHANT_PROCUREMENT);
-        assertController(MerchantUsTruckOrderController.class,
-            "/api/merchant/v1/last-leg/us-truck-orders", OverseasPermissions.MERCHANT_TRUCKING);
-        assertController(MerchantLocalLooseboardController.class,
-            "/api/merchant/v1/last-leg/local-looseboard-orders", OverseasPermissions.MERCHANT_LOOSEBOARD);
+    void merchantControllersUseFrozenPathsAndOperationPermissions() {
+        assertPath(MerchantOverseasProcurementController.class, "/api/merchant/v1/last-leg/overseas-procurements");
+        assertPermissions(MerchantOverseasProcurementController.class, Map.of(
+            "create", OverseasPermissions.MERCHANT_PROCUREMENT_CREATE,
+            "page", OverseasPermissions.MERCHANT_PROCUREMENT_LIST,
+            "detail", OverseasPermissions.MERCHANT_PROCUREMENT_LIST));
+        assertPath(MerchantUsTruckOrderController.class, "/api/merchant/v1/last-leg/us-truck-orders");
+        assertPermissions(MerchantUsTruckOrderController.class, Map.of(
+            "create", OverseasPermissions.MERCHANT_TRUCKING_CREATE,
+            "page", OverseasPermissions.MERCHANT_TRUCKING_LIST,
+            "detail", OverseasPermissions.MERCHANT_TRUCKING_LIST,
+            "update", OverseasPermissions.MERCHANT_TRUCKING_EDIT));
+        assertPath(MerchantLocalLooseboardController.class, "/api/merchant/v1/last-leg/local-looseboard-orders");
+        assertPermissions(MerchantLocalLooseboardController.class, Map.of(
+            "create", OverseasPermissions.MERCHANT_LOOSEBOARD_CREATE,
+            "page", OverseasPermissions.MERCHANT_LOOSEBOARD_LIST,
+            "detail", OverseasPermissions.MERCHANT_LOOSEBOARD_LIST,
+            "update", OverseasPermissions.MERCHANT_LOOSEBOARD_EDIT));
         assertController(MerchantInboundPlanController.class,
             "/api/merchant/v1/last-leg/inbound-plans", OverseasPermissions.MERCHANT_INBOUND_LIST);
+        assertController(MerchantLastlegOrderController.class,
+            "/api/merchant/v1/last-leg/orders", OverseasPermissions.MERCHANT_LAST_MILE_ORDER_LIST);
+
+        assertPermissions(MerchantWarehouseTransferController.class, Map.of(
+            "create", OverseasPermissions.MERCHANT_TRANSFER_CREATE,
+            "page", OverseasPermissions.MERCHANT_TRANSFER_LIST,
+            "detail", OverseasPermissions.MERCHANT_TRANSFER_LIST,
+            "confirmMeasurement", OverseasPermissions.MERCHANT_TRANSFER_CONFIRM));
+        assertPermissions(MerchantCargoDiscardController.class, Map.of(
+            "candidates", OverseasPermissions.MERCHANT_DISCARD_LIST,
+            "create", OverseasPermissions.MERCHANT_DISCARD_CREATE,
+            "page", OverseasPermissions.MERCHANT_DISCARD_LIST,
+            "detail", OverseasPermissions.MERCHANT_DISCARD_LIST,
+            "cancel", OverseasPermissions.MERCHANT_DISCARD_CANCEL));
+        assertPermissions(MerchantReturnOrderController.class, Map.of(
+            "create", OverseasPermissions.MERCHANT_RETURN_ORDER_CREATE,
+            "page", OverseasPermissions.MERCHANT_RETURN_ORDER_LIST,
+            "detail", OverseasPermissions.MERCHANT_RETURN_ORDER_LIST,
+            "relabelCandidates", OverseasPermissions.MERCHANT_RETURN_ORDER_RELABEL,
+            "createRelabel", OverseasPermissions.MERCHANT_RETURN_ORDER_RELABEL));
+        assertPermissions(MerchantRelabelApplicationController.class, Map.of(
+            "candidates", OverseasPermissions.MERCHANT_RELABEL_LIST,
+            "historicalOrders", OverseasPermissions.MERCHANT_RELABEL_LIST,
+            "create", OverseasPermissions.MERCHANT_RELABEL_CREATE,
+            "page", OverseasPermissions.MERCHANT_RELABEL_LIST,
+            "detail", OverseasPermissions.MERCHANT_RELABEL_LIST,
+            "uploadShippingLabel", OverseasPermissions.MERCHANT_RELABEL_FILES,
+            "uploadFile", OverseasPermissions.MERCHANT_RELABEL_FILES,
+            "downloadShippingLabel", OverseasPermissions.MERCHANT_RELABEL_LIST,
+            "downloadCompletionPhoto", OverseasPermissions.MERCHANT_RELABEL_LIST,
+            "confirmCompletion", OverseasPermissions.MERCHANT_RELABEL_CONFIRM));
     }
 
     @Test
@@ -90,11 +138,27 @@ class MerchantOverseasCustomerApiContractTest {
     }
 
     private static void assertController(Class<?> type, String path, String permission) {
-        assertThat(type.getAnnotation(RequestMapping.class).value()).containsExactly(path);
+        assertPath(type, path);
         assertThat(type.getAnnotation(PreAuthorize.class).value())
             .isEqualTo("hasAuthority('" + permission + "')");
     }
 
+    private static void assertPath(Class<?> type, String path) {
+        assertThat(type.getAnnotation(RequestMapping.class).value()).containsExactly(path);
+    }
+
+    private static void assertPermissions(Class<?> type, Map<String, String> permissions) {
+        for (var entry : permissions.entrySet()) {
+            var method = Arrays.stream(type.getDeclaredMethods())
+                .filter(candidate -> candidate.getName().equals(entry.getKey()))
+                .findFirst().orElseThrow();
+            assertThat(method.getAnnotation(PreAuthorize.class))
+                .as(type.getSimpleName() + "." + entry.getKey()).isNotNull();
+            assertThat(method.getAnnotation(PreAuthorize.class).value())
+                .isEqualTo("hasAuthority('" + entry.getValue() + "')");
+        }
+    }
+
     private static AuthenticatedUser user(long customerId, String appCode) {
         return new AuthenticatedUser(7L, customerId, customerId, 8L, "operator", appCode, "WEB", Set.of());
     }

lastleg-service/src/test/java/com/baiyue/lastleg/merchant/MerchantOverseasOpenApiContractTest.java

@@ -27,9 +27,14 @@ class MerchantOverseasOpenApiContractTest {
             assertThat(yaml).contains(path);
             assertThat(pathBlock(yaml, path)).doesNotContain("name: customerId");
         }
-        assertThat(yaml).contains("merchant:cross-border:procurement")
-            .contains("merchant:cross-border:domestic-trucking")
-            .contains("merchant:cross-border:pallet-shipping")
+        assertThat(yaml).contains("merchant:cross-border:procurement:list")
+            .contains("merchant:cross-border:procurement:create")
+            .contains("merchant:cross-border:domestic-trucking:list")
+            .contains("merchant:cross-border:domestic-trucking:create")
+            .contains("merchant:cross-border:domestic-trucking:edit")
+            .contains("merchant:cross-border:pallet-shipping:list")
+            .contains("merchant:cross-border:pallet-shipping:create")
+            .contains("merchant:cross-border:pallet-shipping:edit")
             .contains("merchant:warehouse:inbound:list")
             .contains("#/components/schemas/ProcurementDetailResponse")
             .contains("#/components/schemas/TruckDetailResponse")

lastleg-service/src/test/java/com/baiyue/lastleg/relabel/RelabelContractTest.java

@@ -96,7 +96,10 @@ class RelabelContractTest {
         }
         assertTrue(openApi.contains("RelabelMerchantPageResponse"));
         assertTrue(openApi.contains("RelabelCustomerConfirm"));
-        assertTrue(openApi.contains("merchant:warehouse:relabel"));
+        assertTrue(openApi.contains("merchant:overseas-warehouse:relabel:list"));
+        assertTrue(openApi.contains("merchant:overseas-warehouse:relabel:create"));
+        assertTrue(openApi.contains("merchant:overseas-warehouse:relabel:files"));
+        assertTrue(openApi.contains("merchant:overseas-warehouse:relabel:confirm"));
         String relabelPaths = openApi.substring(openApi.indexOf("/api/platform/v1/last-leg/relabel-applications:"),
             openApi.indexOf("components:"));
         assertTrue(relabelPaths.contains("name: customerId, in: query, required: true"));