fix(file): require Firstleg for PDA evidence access

file/src/test/java/com/baiyue/file/config/LoadingEvidenceFileContractTest.java

@@ -20,7 +20,10 @@ class LoadingEvidenceFileContractTest {
             .contains("description: 物理containerBookingId")
             .contains("LOADING_PHOTO_STEP_1", "LOADING_PHOTO_STEP_2", "LOADING_PHOTO_STEP_3",
                 "LOADING_PHOTO_STEP_4", "LOADING_SEAL")
-            .contains("x-required-any-permission:", "platform:firstleg:pda:work", "Cache-Control固定no-store")
+            .contains("x-required-permission: platform:firstleg:inbound:loading:edit")
+            .contains("x-required-permission: platform:firstleg:inbound:loading:view")
+            .contains("国内PDA禁止直连File", "Cache-Control固定no-store")
+            .doesNotContain("platform:firstleg:pda:work")
             .doesNotContain("/{tenantId}/{inboundId}", "businessId=inboundId");
     }
 }

file/src/test/java/com/baiyue/file/controller/PlatformLoadingEvidenceControllerTest.java

@@ -5,6 +5,8 @@ import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.file.service.LoadingEvidenceService;
 import org.junit.jupiter.api.Test;
 import org.springframework.mock.web.MockMultipartFile;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.multipart.MultipartFile;
 
 import java.util.Set;
 
@@ -45,6 +47,21 @@ class PlatformLoadingEvidenceControllerTest {
             .isInstanceOf(BizException.class).hasMessageContaining("平台端身份");
     }
 
+    @Test
+    void platformEndpointsExcludePdaWorkPermission() throws Exception {
+        var upload = PlatformLoadingEvidenceController.class.getMethod("upload", AuthenticatedUser.class,
+            long.class, String.class, MultipartFile.class);
+        var download = PlatformLoadingEvidenceController.class.getMethod("download", AuthenticatedUser.class,
+            long.class, long.class);
+
+        assertThat(upload.getAnnotation(PreAuthorize.class).value())
+            .isEqualTo("hasAuthority('platform:firstleg:inbound:loading:edit')")
+            .doesNotContain("pda:work");
+        assertThat(download.getAnnotation(PreAuthorize.class).value())
+            .isEqualTo("hasAuthority('platform:firstleg:inbound:loading:view')")
+            .doesNotContain("pda:work");
+    }
+
     private static AuthenticatedUser platform() {
         return new AuthenticatedUser(7L, 0L, 0L, 7L, "operator", "PLATFORM", "PDA", Set.of());
     }

file/src/test/java/com/baiyue/file/service/LoadingEvidenceServiceTest.java

@@ -61,4 +61,10 @@ class LoadingEvidenceServiceTest {
         assertThat(metadata.tenantId()).isZero();
         assertThat(metadata.businessId()).isEqualTo("20");
     }
+
+    @Test
+    void rejectsFileWhenContainerBookingDoesNotMatch() {
+        assertThatThrownBy(() -> service.validate(21, 30))
+            .isInstanceOf(BizException.class).hasMessageContaining("装柜证据文件不存在");
+    }
 }