fix(lastleg): restore dispatch returns from immutable pick source and expose customer receipts

lastleg-service/src/main/java/com/baiyue/lastleg/delivery/controller/MerchantDeliveryController.java

@@ -5,20 +5,24 @@ import com.baiyue.common.core.api.PageResult;
 import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.delivery.dto.DeliveryRequests;
 import com.baiyue.lastleg.delivery.dto.DeliveryResponses;
+import com.baiyue.lastleg.delivery.dto.DeliveryDocumentDtos;
+import com.baiyue.lastleg.delivery.service.DeliveryDocumentService;
 import com.baiyue.lastleg.delivery.service.DeliveryTransferService;
 import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
-import org.springframework.http.HttpStatus;
+import org.springframework.http.*;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.server.ResponseStatusException;
+import java.nio.charset.StandardCharsets;
 
 @RestController
 @RequestMapping("/api/merchant/v1/last-leg/delivery-orders")
 public class MerchantDeliveryController {
     @Resource private DeliveryTransferService service;
+    @Resource private DeliveryDocumentService documents;
 
     @GetMapping
     @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DELIVERY_LIST + "')")
@@ -42,9 +46,29 @@ public class MerchantDeliveryController {
         return ApiResponse.success(service.deliveryDetail(customer(user), deliveryNo));
     }
 
+    @GetMapping("/{deliveryNo}/documents/receipt")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DELIVERY_LIST + "')")
+    public ApiResponse<DeliveryDocumentDtos.MerchantReceipts> receipts(
+        @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String deliveryNo) {
+        return ApiResponse.success(documents.merchantReceipts(customer(user), deliveryNo));
+    }
+
+    @GetMapping("/{deliveryNo}/documents/receipt/files/{fileId}/download")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DELIVERY_LIST + "')")
+    public ResponseEntity<byte[]> receiptDownload(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String deliveryNo, @PathVariable long fileId) {
+        DeliveryDocumentService.Download downloaded = documents.merchantReceiptDownload(customer(user), deliveryNo, fileId);
+        return ResponseEntity.ok().cacheControl(CacheControl.noStore())
+            .contentType(MediaType.APPLICATION_OCTET_STREAM)
+            .header("X-Content-Type-Options", "nosniff")
+            .header(HttpHeaders.CONTENT_DISPOSITION, ContentDisposition.attachment()
+                .filename(downloaded.file().fileName(), StandardCharsets.UTF_8).build().toString())
+            .body(downloaded.content());
+    }
+
     private String customer(AuthenticatedUser user) {
         if (user == null || user.tenantId() == null) throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
-        if ("PLATFORM".equals(user.appCode()) || user.tenantId() == 0L) throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Merchant identity is required");
+        if (!"MERCHANT".equals(user.appCode()) || user.tenantId() <= 0L) throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Merchant identity is required");
         return String.valueOf(user.tenantId());
     }
     private String operator(AuthenticatedUser user) { return user.userId() == null ? user.username() : String.valueOf(user.userId()); }

lastleg-service/src/main/java/com/baiyue/lastleg/delivery/dto/DeliveryDocumentDtos.java

@@ -16,6 +16,7 @@ public final class DeliveryDocumentDtos {
                           @NotNull @Size(max=20) List<@NotNull @Min(1) Long> fileIds) { }
     public record File(Long fileId, String fileName, String contentType, long sizeBytes,
                        LocalDateTime uploadedAt) { }
+    public record MerchantReceipts(String deliveryNo, List<File> files) { }
     public record Category(DeliveryDocumentCategory category, String status, int fileCount, List<File> files) { }
     public record CategorySummary(DeliveryDocumentCategory category, String status, int fileCount) { }
     public record Summary(int uploadedCategoryCount, int totalCategoryCount, List<CategorySummary> categories) { }

lastleg-service/src/main/java/com/baiyue/lastleg/delivery/service/DeliveryDocumentService.java

@@ -37,6 +37,17 @@ public class DeliveryDocumentService {
 
     public Detail detail(String customerId, String deliveryNo) { return detail(require(customerId, deliveryNo), false); }
 
+    public MerchantReceipts merchantReceipts(String customerId, String deliveryNo) {
+        Detail snapshot = detail(customerId, deliveryNo);
+        return new MerchantReceipts(snapshot.deliveryNo(), snapshot.categories().stream()
+            .filter(category -> category.category() == DeliveryDocumentCategory.RECEIPT)
+            .flatMap(category -> category.files().stream()).toList());
+    }
+
+    public Download merchantReceiptDownload(String customerId, String deliveryNo, long fileId) {
+        return download(customerId, deliveryNo, DeliveryDocumentCategory.RECEIPT, fileId, null);
+    }
+
     public DeliveryDocumentDtos.File upload(String customerId, String deliveryNo, DeliveryDocumentCategory category,
                                             String operatorId, MultipartFile file) {
         DeliveryOrder order = require(customerId, deliveryNo);

lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/pda/service/DispatchPdaWorkflowService.java

@@ -82,8 +82,11 @@ public class DispatchPdaWorkflowService {
     public DispatchPdaResponses.Picked pick(String warehouseId, String dispatchNo, long itemId,
                                              String operatorId, String operatorName,
                                              DispatchPdaRequests.Pick request) {
-        DispatchOrder order = requireWarehouseOrder(warehouseId, dispatchNo);
-        String customerId = order.getCustomerId();
+        DispatchOrder found = requireWarehouseOrder(warehouseId, dispatchNo);
+        String customerId = found.getCustomerId();
+        // Transfer and picking serialize on the same dispatch before taking task/inventory locks.
+        DispatchOrder order = orders.lockById(customerId, found.getId());
+        if (order == null) throw notFound("Dispatch order not found");
         DispatchPdaTask task = tasks.lockByDispatch(customerId, order.getId());
         if (task == null) throw conflict("Dispatch PDA task is not available for picking");
         if (!warehouseId.equals(task.getWarehouseId())) throw conflict("PDA pick warehouse does not match task warehouse");

lastleg-service/src/main/java/com/baiyue/lastleg/inventory/command/mapper/InventoryCommandMapper.java

@@ -47,12 +47,24 @@ public interface InventoryCommandMapper {
         "AND NOT EXISTS (SELECT 1 FROM ll_inventory_position p WHERE p.balance_id=ll_inventory_balance.id)")
     int deleteEmptyBalance(@Param("customerId") String customerId, @Param("balanceId") Long balanceId);
 
-    @Select("SELECT COALESCE(-SUM(delta_packages),0) FROM ll_inventory_ledger " +
-        "WHERE customer_id=#{customerId} AND position_id=#{positionId} AND outbound_order_no=#{outboundNo} " +
-        "AND sku_code=#{skuCode} AND business_type='SHIP' AND delta_packages<0")
+    @Select("SELECT COALESCE(-SUM(l.delta_packages),0) FROM ll_inventory_ledger l " +
+        "JOIN ll_outbound_order o ON o.customer_id=l.customer_id AND o.outbound_no=#{outboundNo} " +
+        "AND o.overseas_warehouse_id=l.overseas_warehouse_id AND o.status='OUTBOUNDED' " +
+        "WHERE l.customer_id=#{customerId} AND l.position_id=#{positionId} " +
+        "AND l.sku_code=#{skuCode} AND l.business_type='SHIP' AND l.delta_packages<0 " +
+        "AND ((o.outbound_type='DISPATCH_DELIVERY' AND l.business_order_no=o.dispatch_no " +
+        "AND l.outbound_order_no=o.dispatch_no AND EXISTS (" +
+        "SELECT 1 FROM ll_dispatch_pda_task t JOIN ll_dispatch_pda_pick p " +
+        "ON p.customer_id=t.customer_id AND p.task_id=t.id " +
+        "WHERE t.customer_id=o.customer_id AND t.dispatch_order_id=o.dispatch_order_id " +
+        "AND t.warehouse_id=o.overseas_warehouse_id AND p.inventory_position_id=l.position_id " +
+        "AND p.packages=-l.delta_packages AND l.idempotency_key=CONCAT('DISPATCH:',o.dispatch_no,':'," +
+        "p.dispatch_item_id,':',p.idempotency_key,':SHIP'))) " +
+        "OR (o.outbound_type<>'DISPATCH_DELIVERY' AND l.outbound_order_no=o.outbound_no))")
     long shippedPackages(@Param("customerId") String customerId, @Param("positionId") Long positionId,
                          @Param("outboundNo") String outboundNo, @Param("skuCode") String skuCode);
 
+
     @Select("SELECT COALESCE(SUM(delta_packages),0) FROM ll_inventory_ledger " +
         "WHERE customer_id=#{customerId} AND source_event_id=#{sourceIdentity} " +
         "AND sku_code=#{skuCode} AND business_type='RETURN_STOCK_IN' AND delta_packages>0")