优化

finance/src/test/java/com/baiyue/finance/FinancePhase1PermissionContractTest.java

@@ -15,20 +15,20 @@ class FinancePhase1PermissionContractTest {
     @Test
     void freezesG1AndG2ControllerPermissionsAndHttpActions() throws Exception {
         assertEndpoint("listDerivedCustomerAccounts", GetMapping.class,
-                "platform:finance:customer-account:list", "platform:finance:account:view",
+                "platform:finance:customer-account:list",
                 int.class, int.class, String.class, String.class);
         assertEndpoint("listDerivedCustomerAccountLedger", GetMapping.class,
-                "platform:finance:customer-account:list", "platform:finance:account:view",
+                "platform:finance:customer-account:list",
                 long.class, int.class, int.class,
                 String.class, java.time.LocalDate.class, java.time.LocalDate.class);
         assertEndpoint("getFinanceFeeSource", GetMapping.class,
-                "platform:finance:customer-arap:list", "platform:finance:fee-source:view", long.class);
+                "platform:finance:customer-arap:list", long.class);
         assertEndpoint("reviewFinanceFeeSource", PostMapping.class,
-                "platform:finance:fee-source:review", null,
+                "platform:finance:fee-source:review",
                 com.baiyue.common.security.AuthenticatedUser.class, long.class, String.class,
                 com.baiyue.finance.dto.FinancePhase1Dtos.ReviewRequest.class);
         assertEndpoint("updateFeeSourceSettlementInclusion", PutMapping.class,
-                "platform:finance:fee-source:settlement", null,
+                "platform:finance:fee-source:settlement",
                 com.baiyue.common.security.AuthenticatedUser.class, long.class, String.class,
                 com.baiyue.finance.dto.FinancePhase1Dtos.SettlementInclusionRequest.class);
     }
@@ -36,13 +36,10 @@ class FinancePhase1PermissionContractTest {
     private static void assertEndpoint(String methodName,
                                        Class<? extends java.lang.annotation.Annotation> mapping,
                                        String authority,
-                                       String compatibleAuthority,
                                        Class<?>... parameterTypes) throws Exception {
         Method method = FinancePhase1OperationController.class.getMethod(methodName, parameterTypes);
         assertThat(method.isAnnotationPresent(mapping)).isTrue();
         assertThat(method.getAnnotation(PreAuthorize.class).value()).contains(authority);
-        if (compatibleAuthority != null) {
-            assertThat(method.getAnnotation(PreAuthorize.class).value()).contains(compatibleAuthority);
-        }
+        assertThat(method.getAnnotation(PreAuthorize.class).value()).doesNotContain(":view");
     }
 }

finance/src/test/java/com/baiyue/finance/FinancePlatformListContractTest.java

@@ -2,6 +2,8 @@ package com.baiyue.finance;
 
 import com.baiyue.finance.controller.PlatformFinanceController;
 import com.baiyue.finance.controller.FinanceSettlementController;
+import com.baiyue.finance.controller.FinancePhase1OperationController;
+import com.baiyue.finance.controller.ReconciliationStatementController;
 import io.swagger.v3.oas.annotations.Parameter;
 import org.junit.jupiter.api.Test;
 import org.springframework.security.access.prepost.PreAuthorize;
@@ -30,10 +32,35 @@ class FinancePlatformListContractTest {
         Map<String, String> expected = Map.of(
             "feePool", "platform:finance:customer-arap:list",
             "statements", "platform:finance:customer-statement:list",
-            "receivableSettlements", "platform:finance:settlement-ar:view",
-            "payableSettlements", "platform:finance:settlement-ap:view");
+            "receivableSettlements", "platform:finance:settlement-ar:list",
+            "payableSettlements", "platform:finance:settlement-ap:list");
         for (var entry : expected.entrySet()) {
-            assertThat(find(entry.getKey()).getAnnotation(PreAuthorize.class).value()).contains(entry.getValue());
+            assertThat(find(entry.getKey()).getAnnotation(PreAuthorize.class).value())
+                .contains(entry.getValue())
+                .doesNotContain(":view");
+        }
+    }
+
+    @Test
+    void platformReadEndpointsDoNotAcceptLegacyViewAuthorities() {
+        String[] legacyAuthorities = {
+            "platform:finance:account:view",
+            "platform:finance:fee-source:view",
+            "platform:finance:bill:view",
+            "platform:finance:settlement-ar:view",
+            "platform:finance:settlement-ap:view"
+        };
+        for (Class<?> controller : new Class<?>[]{
+            PlatformFinanceController.class,
+            FinancePhase1OperationController.class,
+            ReconciliationStatementController.class,
+            FinanceSettlementController.class
+        }) {
+            for (Method method : controller.getDeclaredMethods()) {
+                PreAuthorize permission = method.getAnnotation(PreAuthorize.class);
+                if (permission == null) continue;
+                assertThat(permission.value()).doesNotContain(legacyAuthorities);
+            }
         }
     }
 

finance/src/test/java/com/baiyue/finance/FinanceSettlementBehaviorTest.java

@@ -54,7 +54,7 @@ class FinanceSettlementBehaviorTest {
         FinanceSettlementController controller = new FinanceSettlementController(controllerService);
         SettlementDetail payable = detail("PAYABLE", "ISSUED", BigDecimal.ZERO, new BigDecimal("100.00"), 0);
         when(controllerService.getSettlement(88L)).thenReturn(payable);
-        AuthenticatedUser apViewer = user(Set.of("platform:finance:settlement-ap:view"));
+        AuthenticatedUser apViewer = user(Set.of("platform:finance:settlement-ap:list"));
 
         var response = controller.getSettlement(apViewer, 88L);
 
@@ -62,7 +62,7 @@ class FinanceSettlementBehaviorTest {
         assertThat(response.data()).isSameAs(payable);
         assertThat(response.requestId()).isNotBlank();
         assertThatThrownBy(() -> controller.getSettlement(
-            user(Set.of("platform:finance:settlement-ar:view")), 88L)).isInstanceOf(AccessDeniedException.class);
+            user(Set.of("platform:finance:settlement-ar:list")), 88L)).isInstanceOf(AccessDeniedException.class);
     }
 
     @Test