提交

lastleg-service/src/main/java/com/baiyue/lastleg/inventory/command/controller/InventoryCommandController.java

@@ -11,6 +11,7 @@ import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -21,11 +22,12 @@ import org.springframework.web.server.ResponseStatusException;
 @RequestMapping("/api/platform/v1/last-leg/inventory")
 @Tag(name = "尾程入仓单库存操作")
 public class InventoryCommandController {
-    public static final String MANAGE_PERMISSION = "lastleg:inventory:manage";
-    public static final String ADJUST_PERMISSION = "lastleg:inventory:adjust";
+    public static final String MANAGE_PERMISSION = "platform:lastleg:inventory:manage";
+    public static final String ADJUST_PERMISSION = "platform:lastleg:inventory:adjust";
     @Resource private InventoryCommandService service;
 
     @PostMapping("/hold")
+    @PreAuthorize("hasAuthority('platform:lastleg:inventory:manage')")
     /** 将可用入仓单箱数转为冻结。 */
     @Operation(summary = "冻结入仓单库存")
     public ApiResponse<InventoryCommandResponse> hold(@AuthenticationPrincipal AuthenticatedUser user,
@@ -35,6 +37,7 @@ public class InventoryCommandController {
     }
 
     @PostMapping("/release")
+    @PreAuthorize("hasAuthority('platform:lastleg:inventory:manage')")
     /** 释放已冻结的入仓单箱数。 */
     @Operation(summary = "释放入仓单库存")
     public ApiResponse<InventoryCommandResponse> release(@AuthenticationPrincipal AuthenticatedUser user,
@@ -44,6 +47,7 @@ public class InventoryCommandController {
     }
 
     @PostMapping("/allocate")
+    @PreAuthorize("hasAuthority('platform:lastleg:inventory:manage')")
     /** 将可用入仓单箱数分配给出库单。 */
     @Operation(summary = "分配出库库存")
     public ApiResponse<InventoryCommandResponse> allocate(@AuthenticationPrincipal AuthenticatedUser user,
@@ -53,6 +57,7 @@ public class InventoryCommandController {
     }
 
     @PostMapping("/unallocate")
+    @PreAuthorize("hasAuthority('platform:lastleg:inventory:manage')")
     /** 取消出库库存分配。 */
     @Operation(summary = "取消出库分配")
     public ApiResponse<InventoryCommandResponse> unallocate(@AuthenticationPrincipal AuthenticatedUser user,
@@ -62,6 +67,7 @@ public class InventoryCommandController {
     }
 
     @PostMapping("/pick")
+    @PreAuthorize("hasAuthority('platform:lastleg:inventory:manage')")
     /** 确认入仓单箱数已拣货。 */
     @Operation(summary = "确认拣货")
     public ApiResponse<InventoryCommandResponse> pick(@AuthenticationPrincipal AuthenticatedUser user,
@@ -71,6 +77,7 @@ public class InventoryCommandController {
     }
 
     @PostMapping("/ship")
+    @PreAuthorize("hasAuthority('platform:lastleg:inventory:manage')")
     /** 出库已拣货箱数并返回托盘是否为空。 */
     @Operation(summary = "出库拣货库存")
     public ApiResponse<InventoryCommandResponse> ship(@AuthenticationPrincipal AuthenticatedUser user,
@@ -80,6 +87,7 @@ public class InventoryCommandController {
     }
 
     @PostMapping("/adjust")
+    @PreAuthorize("hasAuthority('platform:lastleg:inventory:adjust')")
     /** 根据实物盘点结果调整入仓单库存。 */
     @Operation(summary = "盘点调整库存")
     public ApiResponse<InventoryCommandResponse> adjust(@AuthenticationPrincipal AuthenticatedUser user,

lastleg-service/src/main/java/com/baiyue/lastleg/inventory/query/controller/InventoryQueryController.java

@@ -18,6 +18,7 @@ import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.RequestParam;
@@ -35,6 +36,7 @@ public class InventoryQueryController {
     @Resource private InventoryQueryService service;
 
     @GetMapping(BASE_PATH + "/summary")
+    @PreAuthorize("hasAuthority('platform:lastleg:inventory:list')")
     /** 查询入仓单库存汇总。 */
     @Operation(summary = "查询库存汇总")
     public ApiResponse<InventoryDashboardResponse> summary(
@@ -45,6 +47,7 @@ public class InventoryQueryController {
     }
 
     @GetMapping(BASE_PATH + "/balances")
+    @PreAuthorize("hasAuthority('platform:lastleg:inventory:list')")
     /** 按客户、仓库和入仓单分页查询库存。 */
     @Operation(summary = "分页查询库存余额")
     public ApiResponse<PageResult<InventoryBalanceView>> balances(
@@ -55,6 +58,7 @@ public class InventoryQueryController {
     }
 
     @GetMapping(BASE_PATH + "/balances/{balanceId}/positions")
+    @PreAuthorize("hasAuthority('platform:lastleg:inventory:list')")
     /** 查询库存余额对应的托盘和批次位置。 */
     @Operation(summary = "查询库存位置")
     public ApiResponse<List<InventoryPositionView>> positions(
@@ -66,6 +70,7 @@ public class InventoryQueryController {
     }
 
     @GetMapping(BASE_PATH + "/ledger")
+    @PreAuthorize("hasAuthority('platform:lastleg:inventory:list')")
     /** 分页查询只增不改的库存流水。 */
     @Operation(summary = "分页查询库存流水")
     public ApiResponse<PageResult<InventoryLedgerView>> ledgers(
@@ -76,6 +81,7 @@ public class InventoryQueryController {
     }
 
     @GetMapping(value = BASE_PATH + "/balances/export", produces = "text/csv")
+    @PreAuthorize("hasAuthority('platform:lastleg:inventory:export')")
     /** 导出筛选后的入仓单库存 CSV 文件。 */
     @Operation(summary = "导出库存余额")
     public ResponseEntity<byte[]> exportBalances(
@@ -86,6 +92,7 @@ public class InventoryQueryController {
     }
 
     @GetMapping(value = BASE_PATH + "/ledger/export", produces = "text/csv")
+    @PreAuthorize("hasAuthority('platform:lastleg:inventory:export')")
     /** 导出筛选后的库存流水 CSV 文件。 */
     @Operation(summary = "导出库存流水")
     public ResponseEntity<byte[]> exportLedgers(