feat: gate overseas receiving and harden phase4 workflows

2026-08-25 10:31:04 +08:00
parent cb78bc6b41
commit 52b9fc382f
93 changed files with 2779 additions and 201 deletions
@@ -113,6 +113,81 @@ DELIMITER ;
 CALL assert_overseas_pda_picker_permission();
 DROP PROCEDURE assert_overseas_pda_picker_permission;

+-- 四期仓库后台角色严格最小授权：list 同时覆盖列表与详情，只读角色不得获得任何写权限。
+DROP TEMPORARY TABLE IF EXISTS tmp_phase4_warehouse_role_permission;
+CREATE TEMPORARY TABLE tmp_phase4_warehouse_role_permission (
+  role_code VARCHAR(64) NOT NULL,
+  permission_code VARCHAR(160) NOT NULL,
+  PRIMARY KEY (role_code, permission_code)
+);
+INSERT INTO tmp_phase4_warehouse_role_permission (role_code, permission_code) VALUES
+  ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:last-mile-order:list'),
+  ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:inbound-order:list'),
+  ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:relabel-order:list'),
+  ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:inventory:list'),
+  ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:warehouse:list'),
+  ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:location:list'),
+  ('WAREHOUSE_OPERATOR','platform:overseas-warehouse:pallet:list'),
+  ('WAREHOUSE_OPERATOR','platform:overseas-business:purchase:list'),
+  ('WAREHOUSE_OPERATOR','platform:overseas-business:truck:list'),
+  ('WAREHOUSE_OPERATOR','platform:overseas-business:looseboard:list'),
+  ('WAREHOUSE_TALLY','platform:overseas-warehouse:last-mile-order:list'),
+  ('WAREHOUSE_TALLY','platform:overseas-warehouse:inbound-order:list'),
+  ('WAREHOUSE_TALLY','platform:overseas-warehouse:relabel-order:list'),
+  ('WAREHOUSE_TALLY','platform:overseas-warehouse:inventory:list'),
+  ('WAREHOUSE_TALLY','platform:overseas-warehouse:warehouse:list'),
+  ('WAREHOUSE_TALLY','platform:overseas-warehouse:location:list'),
+  ('WAREHOUSE_TALLY','platform:overseas-warehouse:pallet:list'),
+  ('WAREHOUSE_TALLY','platform:overseas-business:purchase:list'),
+  ('WAREHOUSE_TALLY','platform:overseas-business:truck:list'),
+  ('WAREHOUSE_TALLY','platform:overseas-business:looseboard:list');
+
+DELETE grant_row FROM iam_role_permission grant_row
+JOIN iam_role role ON role.id=grant_row.role_id AND role.tenant_id=grant_row.tenant_id
+JOIN iam_permission permission ON permission.id=grant_row.permission_id AND permission.tenant_id=grant_row.tenant_id
+LEFT JOIN tmp_phase4_warehouse_role_permission expected
+  ON expected.role_code=role.role_code AND expected.permission_code=permission.permission_code
+WHERE role.tenant_id=0 AND role.app_code='PLATFORM'
+  AND role.role_code IN ('WAREHOUSE_OPERATOR','WAREHOUSE_PICKER','WAREHOUSE_TALLY')
+  AND permission.permission_code LIKE 'platform:overseas-%'
+  AND expected.permission_code IS NULL;
+
+INSERT IGNORE INTO iam_role_permission (tenant_id, role_id, permission_id, created_at)
+SELECT 0, role.id, permission.id, NOW(3)
+FROM tmp_phase4_warehouse_role_permission expected
+JOIN iam_role role ON role.tenant_id=0 AND role.app_code='PLATFORM'
+  AND role.role_code=expected.role_code AND role.status='ACTIVE' AND role.deleted=0
+JOIN iam_permission permission ON permission.tenant_id=0 AND permission.app_code='PLATFORM'
+  AND permission.permission_code=expected.permission_code
+  AND permission.status='ACTIVE' AND permission.deleted=0;
+
+DROP PROCEDURE IF EXISTS assert_phase4_warehouse_role_minimum;
+DELIMITER $$
+CREATE PROCEDURE assert_phase4_warehouse_role_minimum()
+BEGIN
+  IF (SELECT COUNT(*) FROM tmp_phase4_warehouse_role_permission) <> 20 THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='四期仓库角色最小权限矩阵数量异常';
+  END IF;
+  IF EXISTS (SELECT 1 FROM tmp_phase4_warehouse_role_permission
+      WHERE permission_code REGEXP ':(create|edit|status|export|adjust|delete|review)$') THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='四期仓库只读角色错误获得写权限';
+  END IF;
+  IF EXISTS (SELECT 1 FROM tmp_phase4_warehouse_role_permission expected
+      LEFT JOIN iam_role role ON role.tenant_id=0 AND role.app_code='PLATFORM'
+        AND role.role_code=expected.role_code AND role.status='ACTIVE' AND role.deleted=0
+      LEFT JOIN iam_permission permission ON permission.tenant_id=0 AND permission.app_code='PLATFORM'
+        AND permission.permission_code=expected.permission_code AND permission.status='ACTIVE' AND permission.deleted=0
+      LEFT JOIN iam_role_permission grant_row ON grant_row.tenant_id=0
+        AND grant_row.role_id=role.id AND grant_row.permission_id=permission.id
+      WHERE grant_row.role_id IS NULL) THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='四期仓库角色最小权限授权不完整';
+  END IF;
+END$$
+DELIMITER ;
+CALL assert_phase4_warehouse_role_minimum();
+DROP PROCEDURE assert_phase4_warehouse_role_minimum;
+DROP TEMPORARY TABLE tmp_phase4_warehouse_role_permission;
+
 INSERT IGNORE INTO iam_role_permission (tenant_id, role_id, permission_id, created_at)
 SELECT 0, role.id, permission.id, NOW(3)
 FROM iam_role role