fix: include customer cross-border authorities overseas

auth/src/main/java/com/baiyue/auth/service/OverseasTokenService.java

@@ -32,6 +32,7 @@ public class OverseasTokenService {
         "platform:overseas-business:",
         "platform:overseas-master-data:",
         "merchant:warehouse:",
+        "merchant:cross-border:",
         "platform:finance:",
         "lastleg:"
     );

auth/src/test/java/com/baiyue/auth/service/OverseasTokenServiceTest.java

@@ -50,12 +50,14 @@ class OverseasTokenServiceTest {
         account.setDefaultMembershipId(84L); account.setDefaultAppCode("MERCHANT");
         String authority = "platform:overseas-master-data:quote:list";
         String merchantAuthority = "merchant:warehouse:delivery:list";
+        String merchantCrossBorderAuthority = "merchant:cross-border:procurement";
         String lastlegAuthority = "lastleg:pda:operate";
         String financeAuthority = "platform:finance:fee-source:edit";
         String domesticAuthority = "platform:firstleg:order:list";
         AuthorizationSnapshot snapshot = new AuthorizationSnapshot(42L, 0L, 84L, "PLATFORM", "WEB",
             Set.of("OVERSEAS_WAREHOUSE_PDA_OPERATOR"),
-            Set.of(authority, merchantAuthority, lastlegAuthority, financeAuthority, domesticAuthority), 7L, 900L);
+            Set.of(authority, merchantAuthority, merchantCrossBorderAuthority, lastlegAuthority,
+                financeAuthority, domesticAuthority), 7L, 900L);
         Jwt encoded = org.mockito.Mockito.mock(Jwt.class);
         when(accounts.findById(42L)).thenReturn(account);
         when(authorizationLoader.load(account)).thenReturn(snapshot);
@@ -78,7 +80,8 @@ class OverseasTokenServiceTest {
             .containsEntry("token_version", 0)
             .containsEntry("overseas_warehouse_id", 900L)
             .containsEntry("roles", Set.of("OVERSEAS_WAREHOUSE_PDA_OPERATOR"))
-            .containsEntry("authorities", Set.of(authority, merchantAuthority, lastlegAuthority, financeAuthority))
+            .containsEntry("authorities", Set.of(authority, merchantAuthority, merchantCrossBorderAuthority,
+                lastlegAuthority, financeAuthority))
             .doesNotContainKeys("userId", "tenantId", "appCode", "permissionVersion");
         assertThat(response.expiresIn()).isEqualTo(900);
     }