feat: complete overseas customer and PDA workflows

lastleg-service/src/main/java/com/baiyue/lastleg/looseboard/controller/MerchantLocalLooseboardController.java

@@ -0,0 +1,67 @@
+package com.baiyue.lastleg.looseboard.controller;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.core.api.PageResult;
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.looseboard.dto.LocalLooseboardRequests;
+import com.baiyue.lastleg.looseboard.dto.LocalLooseboardResponses;
+import com.baiyue.lastleg.looseboard.service.LocalLooseboardService;
+import com.baiyue.lastleg.security.OverseasPermissions;
+import jakarta.annotation.Resource;
+import jakarta.validation.Valid;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.server.ResponseStatusException;
+
+@RestController
+@RequestMapping("/api/merchant/v1/last-leg/local-looseboard-orders")
+@PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_LOOSEBOARD + "')")
+public class MerchantLocalLooseboardController {
+    @Resource private LocalLooseboardService service;
+
+    @PostMapping
+    public ApiResponse<LocalLooseboardResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
+        @Valid @RequestBody LocalLooseboardRequests.Create request) {
+        return ApiResponse.success(service.create(customer(user), operator(user), request));
+    }
+
+    @GetMapping
+    public ApiResponse<PageResult<LocalLooseboardResponses.Summary>> page(
+        @AuthenticationPrincipal AuthenticatedUser user, @Valid LocalLooseboardRequests.MerchantQuery query) {
+        return ApiResponse.success(service.page(customer(user), query));
+    }
+
+    @GetMapping("/{orderNo}")
+    public ApiResponse<LocalLooseboardResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String orderNo) {
+        return ApiResponse.success(service.detail(customer(user), orderNo));
+    }
+
+    @PutMapping("/{orderNo}")
+    public ApiResponse<LocalLooseboardResponses.Detail> update(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String orderNo, @Valid @RequestBody LocalLooseboardRequests.Update request) {
+        return ApiResponse.success(service.update(customer(user), orderNo, operator(user), request));
+    }
+
+    private String customer(AuthenticatedUser user) {
+        if (user == null || user.tenantId() == null) {
+            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
+        }
+        if ("PLATFORM".equals(user.appCode()) || user.tenantId() == 0L) {
+            throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Merchant identity is required");
+        }
+        return String.valueOf(user.tenantId());
+    }
+
+    private String operator(AuthenticatedUser user) {
+        return user.userId() == null ? user.username() : String.valueOf(user.userId());
+    }
+}

lastleg-service/src/main/java/com/baiyue/lastleg/looseboard/dto/LocalLooseboardRequests.java

@@ -65,6 +65,16 @@ public final class LocalLooseboardRequests {
         LocalDate requestedFrom,
         LocalDate requestedTo) { }
 
+    public record MerchantQuery(
+        @Min(1) long page,
+        @Min(1) @Max(200) long size,
+        String orderNo,
+        String routeKeyword,
+        String status,
+        String transportMode,
+        LocalDate requestedFrom,
+        LocalDate requestedTo) { }
+
     public record ChangeStatus(
         @NotNull @Min(0) Long version,
         @NotBlank @Size(max = 32) String status,

lastleg-service/src/main/java/com/baiyue/lastleg/looseboard/service/LocalLooseboardService.java

@@ -118,6 +118,14 @@ public class LocalLooseboardService {
             result.getSize(), result.getTotal(), result.getPages());
     }
 
+    /** Customer-scoped query that ignores any client-supplied customer filter. */
+    public PageResult<LocalLooseboardResponses.Summary> page(String customerId,
+                                                              LocalLooseboardRequests.MerchantQuery query) {
+        return page(new LocalLooseboardRequests.Query(query.page(), query.size(), customerId,
+            query.orderNo(), query.routeKeyword(), query.status(), query.transportMode(),
+            query.requestedFrom(), query.requestedTo()));
+    }
+
     public LocalLooseboardResponses.Detail detail(String customerId, String orderNo) {
         LocalLooseboardOrder order = orders.findNo(customerId, orderNo);
         if (order == null) throw notFound();