feat(lastleg): manage three delivery document categories

2026-09-09 11:22:47 +08:00
parent f37e9ce555
commit 465d9dfc10
26 changed files with 967 additions and 4 deletions
@@ -0,0 +1,82 @@
+package com.baiyue.lastleg.delivery.controller;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.delivery.dto.DeliveryDocumentDtos.*;
+import com.baiyue.lastleg.delivery.model.DeliveryDocumentCategory;
+import com.baiyue.lastleg.delivery.service.DeliveryDocumentService;
+import com.baiyue.lastleg.security.OverseasPermissions;
+import jakarta.annotation.Resource;
+import jakarta.validation.Valid;
+import org.springframework.http.*;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.server.ResponseStatusException;
+import java.nio.charset.StandardCharsets;
+import java.util.List;
+
+@RestController
+@RequestMapping("/api/platform/v1/last-leg/delivery-orders/{deliveryNo}/documents")
+public class DeliveryDocumentController {
+    @Resource private DeliveryDocumentService service;
+    @GetMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.DELIVERY_LIST + "')")
+    public ApiResponse<Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
+                                      @PathVariable String deliveryNo, @RequestParam String customerId) {
+        scope(user, customerId); return ApiResponse.success(authorized(service.detail(customerId, deliveryNo)));
+    }
+    @PutMapping
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.DELIVERY_DOCUMENTS + "')")
+    public ApiResponse<Detail> save(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String deliveryNo, @RequestParam String customerId, @Valid @RequestBody Save request) {
+        scope(user, customerId); return ApiResponse.success(authorized(service.save(customerId, deliveryNo, operator(user), request)));
+    }
+    @PostMapping(value="/{category}/files", consumes=MediaType.MULTIPART_FORM_DATA_VALUE)
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.DELIVERY_DOCUMENTS + "')")
+    public ApiResponse<File> upload(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String deliveryNo, @RequestParam String customerId,
+        @PathVariable DeliveryDocumentCategory category, @RequestPart("file") MultipartFile file) {
+        scope(user, customerId); return ApiResponse.success(service.upload(customerId, deliveryNo, category, operator(user), file));
+    }
+    @GetMapping("/history")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.DELIVERY_LIST + "')")
+    public ApiResponse<List<History>> history(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String deliveryNo, @RequestParam String customerId) {
+        scope(user, customerId); return ApiResponse.success(service.history(customerId, deliveryNo).stream()
+            .map(h -> new History(h.version(), h.operatorId(), h.savedAt(), authorized(h.snapshot()))).toList());
+    }
+    @GetMapping("/{category}/files/{fileId}/download")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.DELIVERY_LIST + "')")
+    public ResponseEntity<byte[]> download(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String deliveryNo, @RequestParam String customerId,
+        @PathVariable DeliveryDocumentCategory category, @PathVariable long fileId,
+        @RequestParam(required=false) Long revisionVersion) {
+        scope(user, customerId);
+        DeliveryDocumentService.Download downloaded = service.download(customerId, deliveryNo, category, fileId, revisionVersion);
+        return ResponseEntity.ok().cacheControl(CacheControl.noStore())
+            .contentType(MediaType.APPLICATION_OCTET_STREAM)
+            .header("X-Content-Type-Options", "nosniff")
+            .header(HttpHeaders.CONTENT_DISPOSITION, ContentDisposition.attachment()
+                .filename(downloaded.file().fileName(), StandardCharsets.UTF_8).build().toString())
+            .body(downloaded.content());
+    }
+    private static Detail authorized(Detail detail) {
+        var authentication = SecurityContextHolder.getContext().getAuthentication();
+        boolean canManage = authentication != null && authentication.isAuthenticated()
+            && authentication.getAuthorities().stream().anyMatch(a -> OverseasPermissions.DELIVERY_DOCUMENTS.equals(a.getAuthority()));
+        return new Detail(detail.deliveryNo(), detail.customerId(), detail.version(), detail.bolNo(),
+            detail.uploadedCategoryCount(), detail.totalCategoryCount(), detail.categories(),
+            canManage ? detail.allowedActions() : List.of(), detail.replayed());
+    }
+    private static void scope(AuthenticatedUser user, String customerId) {
+        if (user == null) throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
+        if (!"PLATFORM".equals(user.appCode()) || !Long.valueOf(0).equals(user.tenantId()))
+            throw new ResponseStatusException(HttpStatus.FORBIDDEN, "仅平台可管理派送资料");
+        try { if (Long.parseLong(customerId) <= 0) throw new NumberFormatException(); }
+        catch (NumberFormatException e) { throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "请指定有效客户"); }
+    }
+    private static String operator(AuthenticatedUser user) { return user.userId() == null ? user.username() : user.userId().toString(); }
+}