提交

warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/PlatformWarehouseController.java

@@ -17,6 +17,7 @@ import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import jakarta.validation.constraints.NotNull;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PatchMapping;
@@ -53,6 +54,7 @@ public class PlatformWarehouseController {
         @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "409", description = "Warehouse code already exists / 仓库编码已存在")
     })
     @PostMapping
+    @PreAuthorize("hasAuthority('platform:warehouse:create')")
     public ApiResponse<Long> create(@AuthenticationPrincipal AuthenticatedUser user,
                                     @Valid @RequestBody WarehouseRequests.SaveRequest request) {
         requirePlatform(user);
@@ -72,6 +74,7 @@ public class PlatformWarehouseController {
         @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "409", description = "Warehouse code already exists / 仓库编码已存在")
     })
     @PutMapping("/{id}")
+    @PreAuthorize("hasAuthority('platform:warehouse:edit')")
     public ApiResponse<Void> update(
         @AuthenticationPrincipal AuthenticatedUser user,
         @Parameter(description = "Target tenant ID / 目标租户 ID", example = "10001", required = true)
@@ -95,6 +98,7 @@ public class PlatformWarehouseController {
         @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "403", description = "Platform access required / 需要平台端权限")
     })
     @GetMapping
+    @PreAuthorize("hasAuthority('platform:warehouse:list')")
     public ApiResponse<PageResult<WarehouseEntity>> page(
         @AuthenticationPrincipal AuthenticatedUser user,
         @Parameter(description = "Target tenant ID / 目标租户 ID", example = "10001", required = true)
@@ -115,6 +119,7 @@ public class PlatformWarehouseController {
         @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "404", description = "Warehouse not found / 仓库不存在")
     })
     @GetMapping("/{id}")
+    @PreAuthorize("hasAuthority('platform:warehouse:list')")
     public ApiResponse<WarehouseDetailResponse> detail(
         @AuthenticationPrincipal AuthenticatedUser user,
         @Parameter(description = "Target tenant ID / 目标租户 ID", example = "10001", required = true)
@@ -137,6 +142,7 @@ public class PlatformWarehouseController {
         @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "404", description = "Warehouse not found / 仓库不存在")
     })
     @PatchMapping("/{id}/status")
+    @PreAuthorize("hasAuthority('platform:warehouse:status')")
     public ApiResponse<Void> status(
         @AuthenticationPrincipal AuthenticatedUser user,
         @Parameter(description = "Target tenant ID / 目标租户 ID", example = "10001", required = true)

warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/PlatformWarehouseResourceController.java

@@ -14,6 +14,7 @@ import jakarta.validation.Valid;
 import jakarta.annotation.Resource;
 import jakarta.validation.constraints.NotNull;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.DeleteMapping;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -32,6 +33,7 @@ public class PlatformWarehouseResourceController {
     @Resource private WarehouseResourceService service;
 
     @PostMapping("/locations")
+    @PreAuthorize("hasAuthority('platform:location:create')")
     public ApiResponse<Long> createLocation(@AuthenticationPrincipal AuthenticatedUser user,
                                             @RequestParam @NotNull Long customerId,
                                             @PathVariable long warehouseId,
@@ -41,6 +43,7 @@ public class PlatformWarehouseResourceController {
     }
 
     @PutMapping("/locations/{id}")
+    @PreAuthorize("hasAuthority('platform:location:edit')")
     public ApiResponse<Void> updateLocation(@AuthenticationPrincipal AuthenticatedUser user,
                                             @RequestParam @NotNull Long customerId,
                                             @PathVariable long warehouseId, @PathVariable long id,
@@ -51,6 +54,7 @@ public class PlatformWarehouseResourceController {
     }
 
     @GetMapping("/locations")
+    @PreAuthorize("hasAuthority('platform:location:list')")
     public ApiResponse<PageResult<WarehouseLocationEntity>> locations(
         @AuthenticationPrincipal AuthenticatedUser user, @RequestParam @NotNull Long customerId,
         @PathVariable long warehouseId, @Valid LocationRequests.QueryRequest query) {
@@ -59,6 +63,7 @@ public class PlatformWarehouseResourceController {
     }
 
     @GetMapping("/locations/{id}")
+    @PreAuthorize("hasAuthority('platform:location:list')")
     public ApiResponse<WarehouseLocationEntity> location(@AuthenticationPrincipal AuthenticatedUser user,
                                                          @RequestParam @NotNull Long customerId,
                                                          @PathVariable long warehouseId,
@@ -68,6 +73,7 @@ public class PlatformWarehouseResourceController {
     }
 
     @DeleteMapping("/locations/{id}")
+    @PreAuthorize("hasAuthority('platform:location:delete')")
     public ApiResponse<Void> deleteLocation(@AuthenticationPrincipal AuthenticatedUser user,
                                             @RequestParam @NotNull Long customerId,
                                             @PathVariable long warehouseId, @PathVariable long id) {
@@ -77,6 +83,7 @@ public class PlatformWarehouseResourceController {
     }
 
     @PostMapping("/pallets")
+    @PreAuthorize("hasAuthority('platform:pallet:create')")
     public ApiResponse<Long> createPallet(@AuthenticationPrincipal AuthenticatedUser user,
                                           @RequestParam @NotNull Long customerId,
                                           @PathVariable long warehouseId,
@@ -86,6 +93,7 @@ public class PlatformWarehouseResourceController {
     }
 
     @PutMapping("/pallets/{id}")
+    @PreAuthorize("hasAuthority('platform:pallet:edit')")
     public ApiResponse<Void> updatePallet(@AuthenticationPrincipal AuthenticatedUser user,
                                           @RequestParam @NotNull Long customerId,
                                           @PathVariable long warehouseId, @PathVariable long id,
@@ -96,6 +104,7 @@ public class PlatformWarehouseResourceController {
     }
 
     @GetMapping("/pallets")
+    @PreAuthorize("hasAuthority('platform:pallet:list')")
     public ApiResponse<PageResult<WarehousePalletEntity>> pallets(
         @AuthenticationPrincipal AuthenticatedUser user, @RequestParam @NotNull Long customerId,
         @PathVariable long warehouseId, @Valid PalletRequests.QueryRequest query) {
@@ -104,6 +113,7 @@ public class PlatformWarehouseResourceController {
     }
 
     @GetMapping("/pallets/{id}")
+    @PreAuthorize("hasAuthority('platform:pallet:list')")
     public ApiResponse<WarehousePalletEntity> pallet(@AuthenticationPrincipal AuthenticatedUser user,
                                                      @RequestParam @NotNull Long customerId,
                                                      @PathVariable long warehouseId, @PathVariable long id) {
@@ -112,6 +122,7 @@ public class PlatformWarehouseResourceController {
     }
 
     @DeleteMapping("/pallets/{id}")
+    @PreAuthorize("hasAuthority('platform:pallet:delete')")
     public ApiResponse<Void> deletePallet(@AuthenticationPrincipal AuthenticatedUser user,
                                           @RequestParam @NotNull Long customerId,
                                           @PathVariable long warehouseId, @PathVariable long id) {

warehouse-overseas-service/src/test/java/com/baiyue/warehouse/controller/PlatformWarehousePermissionContractTest.java

@@ -0,0 +1,36 @@
+package com.baiyue.warehouse.controller;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.security.access.prepost.PreAuthorize;
+
+import java.lang.reflect.Method;
+import java.util.Arrays;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class PlatformWarehousePermissionContractTest {
+    @Test
+    void platformWarehouseReadsUseListAndWritesUseIndependentPermissions() {
+        assertPermission(PlatformWarehouseController.class, "page", "platform:warehouse:list");
+        assertPermission(PlatformWarehouseController.class, "detail", "platform:warehouse:list");
+        assertPermission(PlatformWarehouseController.class, "create", "platform:warehouse:create");
+        assertPermission(PlatformWarehouseController.class, "update", "platform:warehouse:edit");
+        assertPermission(PlatformWarehouseController.class, "status", "platform:warehouse:status");
+
+        assertPermission(PlatformWarehouseResourceController.class, "locations", "platform:location:list");
+        assertPermission(PlatformWarehouseResourceController.class, "location", "platform:location:list");
+        assertPermission(PlatformWarehouseResourceController.class, "createLocation", "platform:location:create");
+        assertPermission(PlatformWarehouseResourceController.class, "pallets", "platform:pallet:list");
+        assertPermission(PlatformWarehouseResourceController.class, "pallet", "platform:pallet:list");
+        assertPermission(PlatformWarehouseResourceController.class, "createPallet", "platform:pallet:create");
+    }
+
+    private static void assertPermission(Class<?> type, String methodName, String permission) {
+        Method method = Arrays.stream(type.getDeclaredMethods())
+            .filter(candidate -> candidate.getName().equals(methodName))
+            .findFirst().orElseThrow();
+        assertThat(method.getAnnotation(PreAuthorize.class)).isNotNull();
+        assertThat(method.getAnnotation(PreAuthorize.class).value())
+            .isEqualTo("hasAuthority('" + permission + "')");
+    }
+}