优化

finance/src/main/java/com/baiyue/finance/controller/FinancePhase1OperationController.java

@@ -27,7 +27,7 @@ public class FinancePhase1OperationController {
     public FinancePhase1OperationController(FinancePhase1OperationService service) { this.service = service; }
 
     @GetMapping("/accounts")
-    @PreAuthorize("hasAuthority('platform:finance:customer-account:list')")
+    @PreAuthorize("hasAnyAuthority('platform:finance:customer-account:list','platform:finance:account:view')")
     public Object listDerivedCustomerAccounts(@RequestParam(defaultValue = "1") int page,
                                               @RequestParam(defaultValue = "20") int pageSize,
                                               @RequestParam(required = false) String keyword,
@@ -36,7 +36,7 @@ public class FinancePhase1OperationController {
     }
 
     @GetMapping("/accounts/{customerId}/ledger")
-    @PreAuthorize("hasAuthority('platform:finance:customer-account:list')")
+    @PreAuthorize("hasAnyAuthority('platform:finance:customer-account:list','platform:finance:account:view')")
     public Object listDerivedCustomerAccountLedger(@PathVariable long customerId,
                                                     @RequestParam(defaultValue = "1") int page,
                                                     @RequestParam(defaultValue = "20") int pageSize,
@@ -47,7 +47,7 @@ public class FinancePhase1OperationController {
     }
 
     @GetMapping("/fee-sources/{feeSourceId}")
-    @PreAuthorize("hasAuthority('platform:finance:customer-arap:list')")
+    @PreAuthorize("hasAnyAuthority('platform:finance:customer-arap:list','platform:finance:fee-source:view')")
     public ApiResponse<?> getFinanceFeeSource(@PathVariable long feeSourceId) {
         return FinanceResponses.success(service.getFinanceFeeSource(feeSourceId));
     }

finance/src/main/java/com/baiyue/finance/controller/FinanceSettlementController.java

@@ -41,7 +41,7 @@ public class FinanceSettlementController {
     }
 
     @GetMapping("/receivable-settlements")
-    @PreAuthorize("hasAuthority('platform:finance:settlement-ar:list')")
+    @PreAuthorize("hasAnyAuthority('platform:finance:settlement-ar:list','platform:finance:settlement-ar:view')")
     @Operation(summary = "查询正式应收结算单")
     public SettlementListEnvelope receivableSettlements(
         @Parameter(description = "可选客户筛选；省略时查询全部客户")
@@ -50,7 +50,7 @@ public class FinanceSettlementController {
     }
 
     @GetMapping("/payable-settlements")
-    @PreAuthorize("hasAuthority('platform:finance:settlement-ap:list')")
+    @PreAuthorize("hasAnyAuthority('platform:finance:settlement-ap:list','platform:finance:settlement-ap:view')")
     @Operation(summary = "查询正式应付结算单")
     public SettlementListEnvelope payableSettlements(
         @Parameter(description = "可选客户筛选；省略时查询全部客户")
@@ -77,14 +77,17 @@ public class FinanceSettlementController {
     }
 
     @GetMapping("/settlements/{settlementId}")
-    @PreAuthorize("hasAnyAuthority('platform:finance:settlement-ar:list','platform:finance:settlement-ap:list')")
+    @PreAuthorize("hasAnyAuthority('platform:finance:settlement-ar:list','platform:finance:settlement-ar:view','platform:finance:settlement-ap:list','platform:finance:settlement-ap:view')")
     public SettlementDetailEnvelope getSettlement(@AuthenticationPrincipal AuthenticatedUser user,
                                                   @PathVariable long settlementId) {
         SettlementDetail detail = service.getSettlement(settlementId);
         String direction = detail.summary().direction();
         String listPermission = "RECEIVABLE".equals(direction)
             ? "platform:finance:settlement-ar:list" : "platform:finance:settlement-ap:list";
-        if (user == null || !user.permissions().contains(listPermission)) {
+        String legacyViewPermission = "RECEIVABLE".equals(direction)
+            ? "platform:finance:settlement-ar:view" : "platform:finance:settlement-ap:view";
+        if (user == null || (!user.permissions().contains(listPermission)
+            && !user.permissions().contains(legacyViewPermission))) {
             throw new AccessDeniedException("无权查看该方向结算单");
         }
         return success(detail);

finance/src/main/java/com/baiyue/finance/controller/PlatformFinanceController.java

@@ -45,7 +45,7 @@ public class PlatformFinanceController {
     }
 
     @GetMapping("/customer-accounts/{customerId}")
-    @PreAuthorize("hasAuthority('platform:finance:customer-account:list')")
+    @PreAuthorize("hasAnyAuthority('platform:finance:customer-account:list','platform:finance:account:view','platform:finance:bill:view')")
     @Operation(summary = "客户人工应收账户及流水")
     public ApiResponse<?> customerAccount(@PathVariable long customerId) {
         return FinanceResponses.success(queryService.customerAccount(customerId));
@@ -59,7 +59,7 @@ public class PlatformFinanceController {
     }
 
     @GetMapping("/fee-pool")
-    @PreAuthorize("hasAuthority('platform:finance:customer-arap:list')")
+    @PreAuthorize("hasAnyAuthority('platform:finance:customer-arap:list','platform:finance:bill:view')")
     @Operation(summary = "客户应收应付费用池")
     public ApiResponse<?> feePool(
                                   @Parameter(description = "可选客户筛选；省略时查询全部客户")
@@ -69,7 +69,7 @@ public class PlatformFinanceController {
     }
 
     @GetMapping("/statements")
-    @PreAuthorize("hasAuthority('platform:finance:customer-statement:list')")
+    @PreAuthorize("hasAnyAuthority('platform:finance:customer-statement:list','platform:finance:bill:view')")
     @Operation(summary = "客户对账单")
     public ApiResponse<?> statements(
         @Parameter(description = "可选客户筛选；省略时查询全部客户")
@@ -94,7 +94,7 @@ public class PlatformFinanceController {
     public ApiResponse<?> terms(@PathVariable long tenantId) { return FinanceResponses.success(termsView(tenantId, service.customerTerms(tenantId))); }
 
     @GetMapping("/bills")
-    @PreAuthorize("hasAuthority('platform:finance:customer-statement:list')")
+    @PreAuthorize("hasAnyAuthority('platform:finance:customer-statement:list','platform:finance:bill:view')")
     @Operation(summary = "查询平台账单")
     public ApiResponse<?> bills(@RequestParam long customerId) { return FinanceResponses.success(queryService.statements(customerId, false)); }
 
@@ -122,11 +122,11 @@ public class PlatformFinanceController {
     }
 
     @GetMapping("/bills/{billId}")
-    @PreAuthorize("hasAuthority('platform:finance:customer-statement:list')")
+    @PreAuthorize("hasAnyAuthority('platform:finance:customer-statement:list','platform:finance:bill:view')")
     public ApiResponse<?> bill(@PathVariable long billId) { return FinanceResponses.success(queryService.platformStatement(billId)); }
 
     @GetMapping("/bills/{billId}/revisions")
-    @PreAuthorize("hasAuthority('platform:finance:customer-statement:list')")
+    @PreAuthorize("hasAnyAuthority('platform:finance:customer-statement:list','platform:finance:bill:view')")
     public ApiResponse<?> revisions(@PathVariable long billId, @RequestParam long customerId) {
         return FinanceResponses.success(queryService.billRevisions(customerId, billId));
     }

finance/src/main/java/com/baiyue/finance/controller/ReconciliationStatementController.java

@@ -36,7 +36,7 @@ public class ReconciliationStatementController {
     }
 
     @GetMapping("/reconciliation-statements/{statementId}")
-    @PreAuthorize("hasAuthority('platform:finance:customer-statement:list')")
+    @PreAuthorize("hasAnyAuthority('platform:finance:customer-statement:list','platform:finance:bill:view')")
     public ApiResponse<ReconciliationDetail> getReconciliationStatement(@PathVariable long statementId) {
         return FinanceResponses.success(service.detailForPlatform(statementId));
     }

finance/src/test/java/com/baiyue/finance/FinancePhase1PermissionContractTest.java

@@ -15,14 +15,14 @@ class FinancePhase1PermissionContractTest {
     @Test
     void freezesG1AndG2ControllerPermissionsAndHttpActions() throws Exception {
         assertEndpoint("listDerivedCustomerAccounts", GetMapping.class,
-                "platform:finance:customer-account:list", null,
+                "platform:finance:customer-account:list", "platform:finance:account:view",
                 int.class, int.class, String.class, String.class);
         assertEndpoint("listDerivedCustomerAccountLedger", GetMapping.class,
-                "platform:finance:customer-account:list", null,
+                "platform:finance:customer-account:list", "platform:finance:account:view",
                 long.class, int.class, int.class,
                 String.class, java.time.LocalDate.class, java.time.LocalDate.class);
         assertEndpoint("getFinanceFeeSource", GetMapping.class,
-                "platform:finance:customer-arap:list", null, long.class);
+                "platform:finance:customer-arap:list", "platform:finance:fee-source:view", long.class);
         assertEndpoint("reviewFinanceFeeSource", PostMapping.class,
                 "platform:finance:fee-source:review", null,
                 com.baiyue.common.security.AuthenticatedUser.class, long.class, String.class,

finance/src/test/java/com/baiyue/finance/FinancePlatformListContractTest.java

@@ -30,8 +30,8 @@ class FinancePlatformListContractTest {
         Map<String, String> expected = Map.of(
             "feePool", "platform:finance:customer-arap:list",
             "statements", "platform:finance:customer-statement:list",
-            "receivableSettlements", "platform:finance:settlement-ar:list",
-            "payableSettlements", "platform:finance:settlement-ap:list");
+            "receivableSettlements", "platform:finance:settlement-ar:view",
+            "payableSettlements", "platform:finance:settlement-ap:view");
         for (var entry : expected.entrySet()) {
             assertThat(find(entry.getKey()).getAnnotation(PreAuthorize.class).value()).contains(entry.getValue());
         }

finance/src/test/java/com/baiyue/finance/FinanceSettlementBehaviorTest.java

@@ -54,7 +54,7 @@ class FinanceSettlementBehaviorTest {
         FinanceSettlementController controller = new FinanceSettlementController(controllerService);
         SettlementDetail payable = detail("PAYABLE", "ISSUED", BigDecimal.ZERO, new BigDecimal("100.00"), 0);
         when(controllerService.getSettlement(88L)).thenReturn(payable);
-        AuthenticatedUser apViewer = user(Set.of("platform:finance:settlement-ap:list"));
+        AuthenticatedUser apViewer = user(Set.of("platform:finance:settlement-ap:view"));
 
         var response = controller.getSettlement(apViewer, 88L);
 
@@ -62,7 +62,7 @@ class FinanceSettlementBehaviorTest {
         assertThat(response.data()).isSameAs(payable);
         assertThat(response.requestId()).isNotBlank();
         assertThatThrownBy(() -> controller.getSettlement(
-            user(Set.of("platform:finance:settlement-ar:list")), 88L)).isInstanceOf(AccessDeniedException.class);
+            user(Set.of("platform:finance:settlement-ar:view")), 88L)).isInstanceOf(AccessDeniedException.class);
     }
 
     @Test