fix: close phase4 overseas acceptance gaps

iam/src/main/resources/db/lastleg-permissions.sql

@@ -72,10 +72,47 @@ INSERT IGNORE INTO iam_role_permission (tenant_id, role_id, permission_id, creat
 SELECT 0, role.id, permission.id, NOW(3)
 FROM iam_role role
 JOIN iam_permission permission ON permission.tenant_id=0 AND permission.app_code='PLATFORM'
-  AND permission.id BETWEEN 5107000 AND 5107299
+  AND permission.id BETWEEN 5107000 AND 5107299 AND permission.permission_code<>'lastleg:pda:operate'
 WHERE role.tenant_id=0 AND role.app_code='PLATFORM' AND role.role_code='PLATFORM_ADMIN'
   AND role.status='ACTIVE' AND role.deleted=0 AND permission.status='ACTIVE' AND permission.deleted=0;
 
+DELETE role_permission FROM iam_role_permission role_permission
+JOIN iam_role role ON role.id=role_permission.role_id AND role.tenant_id=role_permission.tenant_id
+JOIN iam_permission permission ON permission.id=role_permission.permission_id AND permission.tenant_id=role_permission.tenant_id
+WHERE permission.permission_code='lastleg:pda:operate'
+  AND NOT (role.id=4000005 AND role.tenant_id=0 AND role.app_code='PLATFORM' AND role.role_code='WAREHOUSE_PICKER');
+
+INSERT IGNORE INTO iam_role_permission (tenant_id, role_id, permission_id, created_at)
+SELECT 0, role.id, permission.id, NOW(3)
+FROM iam_role role
+JOIN iam_permission permission ON permission.tenant_id=0 AND permission.app_code='PLATFORM'
+  AND permission.permission_code='lastleg:pda:operate'
+WHERE role.id=4000005 AND role.tenant_id=0 AND role.app_code='PLATFORM' AND role.role_code='WAREHOUSE_PICKER'
+  AND role.status='ACTIVE' AND role.deleted=0 AND permission.status='ACTIVE' AND permission.deleted=0;
+
+DROP PROCEDURE IF EXISTS assert_overseas_pda_picker_permission;
+DELIMITER $$
+CREATE PROCEDURE assert_overseas_pda_picker_permission()
+BEGIN
+  IF (SELECT COUNT(*) FROM iam_role_permission grant_row
+      JOIN iam_role role ON role.id=grant_row.role_id AND role.tenant_id=grant_row.tenant_id
+      JOIN iam_permission permission ON permission.id=grant_row.permission_id AND permission.tenant_id=grant_row.tenant_id
+      WHERE permission.permission_code='lastleg:pda:operate'
+        AND role.id=4000005 AND role.app_code='PLATFORM' AND role.role_code='WAREHOUSE_PICKER') <> 1 THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='海外PDA权限初始化失败：WAREHOUSE_PICKER未精确授权';
+  END IF;
+  IF EXISTS (SELECT 1 FROM iam_role_permission grant_row
+      JOIN iam_role role ON role.id=grant_row.role_id AND role.tenant_id=grant_row.tenant_id
+      JOIN iam_permission permission ON permission.id=grant_row.permission_id AND permission.tenant_id=grant_row.tenant_id
+      WHERE permission.permission_code='lastleg:pda:operate'
+        AND NOT (role.id=4000005 AND role.tenant_id=0 AND role.app_code='PLATFORM' AND role.role_code='WAREHOUSE_PICKER')) THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='海外PDA权限初始化失败：存在非仓库拣货员授权';
+  END IF;
+END$$
+DELIMITER ;
+CALL assert_overseas_pda_picker_permission();
+DROP PROCEDURE assert_overseas_pda_picker_permission;
+
 INSERT IGNORE INTO iam_role_permission (tenant_id, role_id, permission_id, created_at)
 SELECT 0, role.id, permission.id, NOW(3)
 FROM iam_role role

iam/src/main/resources/db/phase3-warehouse-roles.sql

@@ -140,6 +140,7 @@ DELETE role_permission
  WHERE role.tenant_id = 0
    AND role.app_code = 'PLATFORM'
    AND role.role_code IN ('WAREHOUSE_OPERATOR', 'WAREHOUSE_PICKER', 'WAREHOUSE_TALLY')
+   AND NOT (role.role_code = 'WAREHOUSE_PICKER' AND permission.permission_code = 'lastleg:pda:operate')
    AND expected.permission_code IS NULL;
 
 INSERT IGNORE INTO iam_role_permission (role_id, permission_id, tenant_id)

iam/src/test/java/com/baiyue/iam/repository/OverseasPhase4PermissionSqlContractTest.java

@@ -40,6 +40,7 @@ class OverseasPhase4PermissionSqlContractTest {
         Set<String> catalog = codes(sql);
         assertThat(sql).contains(REQUIRED.toArray(String[]::new));
         assertThat(sql).contains("'lastleg:pda:operate'");
+        assertPdaPickerGrant(sql);
         assertThat(catalog).hasSize(53).noneMatch(code -> code.endsWith(":view"));
         assertThat(sql).contains("permission_code LIKE 'platform:lastleg:%'", "status='INACTIVE'", "deleted=1");
         assertThat(sql).doesNotContain(":carton:", ":product:", ":outbound:", ":delivery:");
@@ -55,6 +56,7 @@ class OverseasPhase4PermissionSqlContractTest {
             .getContentAsString(StandardCharsets.UTF_8));
         assertThat(codes(sql)).containsAll(moduleCatalog);
         assertThat(sql).contains("baiyue_iam.iam_permission", "baiyue_iam.iam_role_permission", "'lastleg:pda:operate'");
+        assertPdaPickerGrant(sql);
         assertCustomAdminGrant(sql);
     }
 
@@ -89,6 +91,24 @@ class OverseasPhase4PermissionSqlContractTest {
             .containsExactlyInAnyOrderElementsOf(CUSTOM_ADMIN_PERMISSIONS);
     }
 
+    private static void assertPdaPickerGrant(String sql) {
+        assertThat(sql).contains(
+            "permission.permission_code<>'lastleg:pda:operate'",
+            "role.id=4000005",
+            "assert_overseas_pda_picker_permission",
+            "存在非仓库拣货员授权",
+            "role.role_code='WAREHOUSE_PICKER'",
+            "permission.permission_code='lastleg:pda:operate'",
+            "role.role_code='PLATFORM_ADMIN'",
+            "DELETE role_permission FROM");
+        int picker = sql.indexOf("role.role_code='WAREHOUSE_PICKER'");
+        int grantStart = sql.lastIndexOf("INSERT IGNORE INTO", picker);
+        int grantEnd = sql.indexOf(';', picker);
+        assertThat(grantStart).isGreaterThanOrEqualTo(0);
+        assertThat(grantEnd).isGreaterThan(picker);
+        assertThat(sql.substring(grantStart, grantEnd)).contains("lastleg:pda:operate");
+    }
+
     private static String repositoryFile(String relativePath) throws Exception {
         Path path = Path.of(relativePath);
         if (!Files.exists(path)) path = Path.of("..").resolve(relativePath);

iam/src/test/java/com/baiyue/iam/repository/WarehouseRoleSqlContractTest.java

@@ -45,6 +45,7 @@ class WarehouseRoleSqlContractTest {
             .contains("依赖的三期平台权限尚未完整部署")
             .contains("DELETE role_permission")
             .contains("expected.permission_code IS NULL")
+            .contains("role.role_code = 'WAREHOUSE_PICKER' AND permission.permission_code = 'lastleg:pda:operate'")
             .contains("最小权限授权未完整写入")
             .contains("grant_row.tenant_id = 0) <> 19")
             .contains("(6000004, 4000004, 0, 'TENANT', NULL)")