贴标申请，仓储转运

lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/controller/MerchantReturnOrderController.java

@@ -10,6 +10,8 @@ import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
@@ -28,6 +30,14 @@ public class MerchantReturnOrderController {
     @GetMapping("/{returnNo}") @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_LIST + "')")
     public ApiResponse<ReturnOrderResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String returnNo) { return ApiResponse.success(service.detail(customer(user), returnNo)); }
+    @GetMapping("/{returnNo}/photos/files/{fileId}/download")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_LIST + "')")
+    public ResponseEntity<byte[]> downloadPhoto(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String returnNo, @PathVariable long fileId) {
+        var file = service.downloadPhoto(customer(user), returnNo, fileId);
+        return ResponseEntity.ok().contentType(MediaType.parseMediaType(file.contentType()))
+            .header("Cache-Control", "no-store").body(file.content());
+    }
     @GetMapping("/{returnNo}/relabel-candidates") @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RETURN_ORDER_RELABEL + "')")
     public ApiResponse<java.util.List<ReturnOrderResponses.RelabelCandidate>> relabelCandidates(
         @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String returnNo) {

lastleg-service/src/main/resources/openapi/overseas-business-v1.yaml

@@ -1516,6 +1516,17 @@ paths:
       security: [{ bearerAuth: [] }]
       parameters: [{ name: returnNo, in: path, required: true, schema: { type: string } }]
       responses: { '200': { description: 当前客户退货订单详情 }, '404': { description: 当前客户下退货订单不存在 } }
+  /api/merchant/v1/last-leg/return-orders/{returnNo}/photos/files/{fileId}/download:
+    get:
+      summary: 客户下载退货签收打托照片
+      description: 权限 merchant:overseas-warehouse:return-order:list；仅允许下载当前客户、当前退货单关联的签收照片，响应为原始文件且禁止缓存。
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - { name: returnNo, in: path, required: true, schema: { type: string } }
+        - { name: fileId, in: path, required: true, schema: { type: integer, format: int64 } }
+      responses:
+        '200': { description: 照片文件, content: { image/*: { schema: { type: string, format: binary } } } }
+        '404': { description: 当前客户下退货单或关联照片不存在 }
   /api/merchant/v1/last-leg/return-orders/{returnNo}/relabel-candidates:
     get:
       summary: 查询退货单可转换标候选