From 756a6b13eb7ecc6b10d8a930b1419518403de220 Mon Sep 17 00:00:00 2001 From: ouyangxq <775153912@qq.com> Date: Thu, 13 Aug 2026 12:37:46 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BC=98=E5=8C=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- deploy/sql/头程数据库统一增量-MySQL8.sql | 2 +- .../controller/FinancePhase1OperationController.java | 6 +++--- .../controller/FinanceSettlementController.java | 11 +++++++---- .../controller/PlatformFinanceController.java | 12 ++++++------ .../ReconciliationStatementController.java | 2 +- .../finance/FinancePhase1PermissionContractTest.java | 6 +++--- .../finance/FinancePlatformListContractTest.java | 4 ++-- .../finance/FinanceSettlementBehaviorTest.java | 4 ++-- 8 files changed, 25 insertions(+), 22 deletions(-) diff --git a/deploy/sql/头程数据库统一增量-MySQL8.sql b/deploy/sql/头程数据库统一增量-MySQL8.sql index baca8e5ba..c408819a4 100644 --- a/deploy/sql/头程数据库统一增量-MySQL8.sql +++ b/deploy/sql/头程数据库统一增量-MySQL8.sql @@ -4344,7 +4344,7 @@ BEGIN WHERE tenant_id = 0 AND status = 'ACTIVE' AND deleted = 0 AND permission_code IN ( 'platform:overseas-storage-fee:list', 'platform:overseas-storage-fee:create', - 'platform:overseas-storage-fee:edit', 'platform:overseas-storage-fee:delete')) <> 2 THEN + 'platform:overseas-storage-fee:edit', 'platform:overseas-storage-fee:delete')) <> 4 THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = '统一迁移失败：海外仓阶梯费用列表/编辑权限未完整创建'; END IF; diff --git a/finance/src/main/java/com/baiyue/finance/controller/FinancePhase1OperationController.java b/finance/src/main/java/com/baiyue/finance/controller/FinancePhase1OperationController.java index a9fd3597f..bfd3616e7 100644 --- a/finance/src/main/java/com/baiyue/finance/controller/FinancePhase1OperationController.java +++ b/finance/src/main/java/com/baiyue/finance/controller/FinancePhase1OperationController.java @@ -27,7 +27,7 @@ public class FinancePhase1OperationController { public FinancePhase1OperationController(FinancePhase1OperationService service) { this.service = service; } @GetMapping("/accounts") - @PreAuthorize("hasAuthority('platform:finance:customer-account:list')") + @PreAuthorize("hasAnyAuthority('platform:finance:customer-account:list','platform:finance:account:view')") public Object listDerivedCustomerAccounts(@RequestParam(defaultValue = "1") int page, @RequestParam(defaultValue = "20") int pageSize, @RequestParam(required = false) String keyword, @@ -36,7 +36,7 @@ public class FinancePhase1OperationController { } @GetMapping("/accounts/{customerId}/ledger") - @PreAuthorize("hasAuthority('platform:finance:customer-account:list')") + @PreAuthorize("hasAnyAuthority('platform:finance:customer-account:list','platform:finance:account:view')") public Object listDerivedCustomerAccountLedger(@PathVariable long customerId, @RequestParam(defaultValue = "1") int page, @RequestParam(defaultValue = "20") int pageSize, @@ -47,7 +47,7 @@ public class FinancePhase1OperationController { } @GetMapping("/fee-sources/{feeSourceId}") - @PreAuthorize("hasAuthority('platform:finance:customer-arap:list')") + @PreAuthorize("hasAnyAuthority('platform:finance:customer-arap:list','platform:finance:fee-source:view')") public ApiResponse getFinanceFeeSource(@PathVariable long feeSourceId) { return FinanceResponses.success(service.getFinanceFeeSource(feeSourceId)); } diff --git a/finance/src/main/java/com/baiyue/finance/controller/FinanceSettlementController.java b/finance/src/main/java/com/baiyue/finance/controller/FinanceSettlementController.java index fd335a729..54fdb92af 100644 --- a/finance/src/main/java/com/baiyue/finance/controller/FinanceSettlementController.java +++ b/finance/src/main/java/com/baiyue/finance/controller/FinanceSettlementController.java @@ -41,7 +41,7 @@ public class FinanceSettlementController { } @GetMapping("/receivable-settlements") - @PreAuthorize("hasAuthority('platform:finance:settlement-ar:list')") + @PreAuthorize("hasAnyAuthority('platform:finance:settlement-ar:list','platform:finance:settlement-ar:view')") @Operation(summary = "查询正式应收结算单") public SettlementListEnvelope receivableSettlements( @Parameter(description = "可选客户筛选；省略时查询全部客户") @@ -50,7 +50,7 @@ public class FinanceSettlementController { } @GetMapping("/payable-settlements") - @PreAuthorize("hasAuthority('platform:finance:settlement-ap:list')") + @PreAuthorize("hasAnyAuthority('platform:finance:settlement-ap:list','platform:finance:settlement-ap:view')") @Operation(summary = "查询正式应付结算单") public SettlementListEnvelope payableSettlements( @Parameter(description = "可选客户筛选；省略时查询全部客户") @@ -77,14 +77,17 @@ public class FinanceSettlementController { } @GetMapping("/settlements/{settlementId}") - @PreAuthorize("hasAnyAuthority('platform:finance:settlement-ar:list','platform:finance:settlement-ap:list')") + @PreAuthorize("hasAnyAuthority('platform:finance:settlement-ar:list','platform:finance:settlement-ar:view','platform:finance:settlement-ap:list','platform:finance:settlement-ap:view')") public SettlementDetailEnvelope getSettlement(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable long settlementId) { SettlementDetail detail = service.getSettlement(settlementId); String direction = detail.summary().direction(); String listPermission = "RECEIVABLE".equals(direction) ? "platform:finance:settlement-ar:list" : "platform:finance:settlement-ap:list"; - if (user == null || !user.permissions().contains(listPermission)) { + String legacyViewPermission = "RECEIVABLE".equals(direction) + ? "platform:finance:settlement-ar:view" : "platform:finance:settlement-ap:view"; + if (user == null || (!user.permissions().contains(listPermission) + && !user.permissions().contains(legacyViewPermission))) { throw new AccessDeniedException("无权查看该方向结算单"); } return success(detail); diff --git a/finance/src/main/java/com/baiyue/finance/controller/PlatformFinanceController.java b/finance/src/main/java/com/baiyue/finance/controller/PlatformFinanceController.java index 9c9580fea..520d80be3 100644 --- a/finance/src/main/java/com/baiyue/finance/controller/PlatformFinanceController.java +++ b/finance/src/main/java/com/baiyue/finance/controller/PlatformFinanceController.java @@ -45,7 +45,7 @@ public class PlatformFinanceController { } @GetMapping("/customer-accounts/{customerId}") - @PreAuthorize("hasAuthority('platform:finance:customer-account:list')") + @PreAuthorize("hasAnyAuthority('platform:finance:customer-account:list','platform:finance:account:view','platform:finance:bill:view')") @Operation(summary = "客户人工应收账户及流水") public ApiResponse customerAccount(@PathVariable long customerId) { return FinanceResponses.success(queryService.customerAccount(customerId)); @@ -59,7 +59,7 @@ public class PlatformFinanceController { } @GetMapping("/fee-pool") - @PreAuthorize("hasAuthority('platform:finance:customer-arap:list')") + @PreAuthorize("hasAnyAuthority('platform:finance:customer-arap:list','platform:finance:bill:view')") @Operation(summary = "客户应收应付费用池") public ApiResponse feePool( @Parameter(description = "可选客户筛选；省略时查询全部客户") @@ -69,7 +69,7 @@ public class PlatformFinanceController { } @GetMapping("/statements") - @PreAuthorize("hasAuthority('platform:finance:customer-statement:list')") + @PreAuthorize("hasAnyAuthority('platform:finance:customer-statement:list','platform:finance:bill:view')") @Operation(summary = "客户对账单") public ApiResponse statements( @Parameter(description = "可选客户筛选；省略时查询全部客户") @@ -94,7 +94,7 @@ public class PlatformFinanceController { public ApiResponse terms(@PathVariable long tenantId) { return FinanceResponses.success(termsView(tenantId, service.customerTerms(tenantId))); } @GetMapping("/bills") - @PreAuthorize("hasAuthority('platform:finance:customer-statement:list')") + @PreAuthorize("hasAnyAuthority('platform:finance:customer-statement:list','platform:finance:bill:view')") @Operation(summary = "查询平台账单") public ApiResponse bills(@RequestParam long customerId) { return FinanceResponses.success(queryService.statements(customerId, false)); } @@ -122,11 +122,11 @@ public class PlatformFinanceController { } @GetMapping("/bills/{billId}") - @PreAuthorize("hasAuthority('platform:finance:customer-statement:list')") + @PreAuthorize("hasAnyAuthority('platform:finance:customer-statement:list','platform:finance:bill:view')") public ApiResponse bill(@PathVariable long billId) { return FinanceResponses.success(queryService.platformStatement(billId)); } @GetMapping("/bills/{billId}/revisions") - @PreAuthorize("hasAuthority('platform:finance:customer-statement:list')") + @PreAuthorize("hasAnyAuthority('platform:finance:customer-statement:list','platform:finance:bill:view')") public ApiResponse revisions(@PathVariable long billId, @RequestParam long customerId) { return FinanceResponses.success(queryService.billRevisions(customerId, billId)); } diff --git a/finance/src/main/java/com/baiyue/finance/controller/ReconciliationStatementController.java b/finance/src/main/java/com/baiyue/finance/controller/ReconciliationStatementController.java index a799e61ea..8280e06fe 100644 --- a/finance/src/main/java/com/baiyue/finance/controller/ReconciliationStatementController.java +++ b/finance/src/main/java/com/baiyue/finance/controller/ReconciliationStatementController.java @@ -36,7 +36,7 @@ public class ReconciliationStatementController { } @GetMapping("/reconciliation-statements/{statementId}") - @PreAuthorize("hasAuthority('platform:finance:customer-statement:list')") + @PreAuthorize("hasAnyAuthority('platform:finance:customer-statement:list','platform:finance:bill:view')") public ApiResponse getReconciliationStatement(@PathVariable long statementId) { return FinanceResponses.success(service.detailForPlatform(statementId)); } diff --git a/finance/src/test/java/com/baiyue/finance/FinancePhase1PermissionContractTest.java b/finance/src/test/java/com/baiyue/finance/FinancePhase1PermissionContractTest.java index 1f55643de..b85ef3c7c 100644 --- a/finance/src/test/java/com/baiyue/finance/FinancePhase1PermissionContractTest.java +++ b/finance/src/test/java/com/baiyue/finance/FinancePhase1PermissionContractTest.java @@ -15,14 +15,14 @@ class FinancePhase1PermissionContractTest { @Test void freezesG1AndG2ControllerPermissionsAndHttpActions() throws Exception { assertEndpoint("listDerivedCustomerAccounts", GetMapping.class, - "platform:finance:customer-account:list", null, + "platform:finance:customer-account:list", "platform:finance:account:view", int.class, int.class, String.class, String.class); assertEndpoint("listDerivedCustomerAccountLedger", GetMapping.class, - "platform:finance:customer-account:list", null, + "platform:finance:customer-account:list", "platform:finance:account:view", long.class, int.class, int.class, String.class, java.time.LocalDate.class, java.time.LocalDate.class); assertEndpoint("getFinanceFeeSource", GetMapping.class, - "platform:finance:customer-arap:list", null, long.class); + "platform:finance:customer-arap:list", "platform:finance:fee-source:view", long.class); assertEndpoint("reviewFinanceFeeSource", PostMapping.class, "platform:finance:fee-source:review", null, com.baiyue.common.security.AuthenticatedUser.class, long.class, String.class, diff --git a/finance/src/test/java/com/baiyue/finance/FinancePlatformListContractTest.java b/finance/src/test/java/com/baiyue/finance/FinancePlatformListContractTest.java index 76e3d41b0..3da8cea2d 100644 --- a/finance/src/test/java/com/baiyue/finance/FinancePlatformListContractTest.java +++ b/finance/src/test/java/com/baiyue/finance/FinancePlatformListContractTest.java @@ -30,8 +30,8 @@ class FinancePlatformListContractTest { Map expected = Map.of( "feePool", "platform:finance:customer-arap:list", "statements", "platform:finance:customer-statement:list", - "receivableSettlements", "platform:finance:settlement-ar:list", - "payableSettlements", "platform:finance:settlement-ap:list"); + "receivableSettlements", "platform:finance:settlement-ar:view", + "payableSettlements", "platform:finance:settlement-ap:view"); for (var entry : expected.entrySet()) { assertThat(find(entry.getKey()).getAnnotation(PreAuthorize.class).value()).contains(entry.getValue()); } diff --git a/finance/src/test/java/com/baiyue/finance/FinanceSettlementBehaviorTest.java b/finance/src/test/java/com/baiyue/finance/FinanceSettlementBehaviorTest.java index ef9417176..26f185f47 100644 --- a/finance/src/test/java/com/baiyue/finance/FinanceSettlementBehaviorTest.java +++ b/finance/src/test/java/com/baiyue/finance/FinanceSettlementBehaviorTest.java @@ -54,7 +54,7 @@ class FinanceSettlementBehaviorTest { FinanceSettlementController controller = new FinanceSettlementController(controllerService); SettlementDetail payable = detail("PAYABLE", "ISSUED", BigDecimal.ZERO, new BigDecimal("100.00"), 0); when(controllerService.getSettlement(88L)).thenReturn(payable); - AuthenticatedUser apViewer = user(Set.of("platform:finance:settlement-ap:list")); + AuthenticatedUser apViewer = user(Set.of("platform:finance:settlement-ap:view")); var response = controller.getSettlement(apViewer, 88L); @@ -62,7 +62,7 @@ class FinanceSettlementBehaviorTest { assertThat(response.data()).isSameAs(payable); assertThat(response.requestId()).isNotBlank(); assertThatThrownBy(() -> controller.getSettlement( - user(Set.of("platform:finance:settlement-ar:list")), 88L)).isInstanceOf(AccessDeniedException.class); + user(Set.of("platform:finance:settlement-ar:view")), 88L)).isInstanceOf(AccessDeniedException.class); } @Test