优化

file/src/test/java/com/baiyue/file/config/QualificationAndOrderFileOpenApiContractTest.java

@@ -27,6 +27,8 @@ class QualificationAndOrderFileOpenApiContractTest {
 
         assertThat(yaml)
             .contains("ORDER_BATCH_IMPORT_SOURCE", "ORDER_BATCH_IMPORT_ERROR_REPORT")
+            .contains("/api/merchant/v1/files/order-batch-imports/{batchNo}/error-reports/{fileId}:")
+            .contains("需要merchant:order:create")
             .contains("ownerScope: {type: string, enum: [CUSTOMER]}")
             .contains("pattern: '^OBI-[0-9A-F]{20}$'")
             .contains("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet")

file/src/test/java/com/baiyue/file/controller/MerchantOrderBatchImportFileControllerTest.java

@@ -0,0 +1,63 @@
+package com.baiyue.file.controller;
+
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.file.service.InternalBusinessFileService;
+import org.junit.jupiter.api.Test;
+import org.springframework.http.MediaType;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import java.util.Set;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+class MerchantOrderBatchImportFileControllerTest {
+    @Test
+    void downloadsOnlyTheAuthenticatedCustomersErrorReportAsNoStoreXlsx() {
+        var files = mock(InternalBusinessFileService.class);
+        var controller = new MerchantOrderBatchImportFileController();
+        ReflectionTestUtils.setField(controller, "files", files);
+        String batchNo = "OBI-0123456789ABCDEF0123";
+        byte[] content = {0x50, 0x4b, 0x03, 0x04};
+        when(files.download(10001L, "ORDER_BATCH_IMPORT_ERROR_REPORT", batchNo, 81L))
+            .thenReturn(new InternalBusinessFileService.Download("order-batch-errors.xlsx",
+                "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", content));
+
+        var response = controller.downloadErrorReport(merchant(), batchNo, 81L);
+
+        assertThat(response.getBody()).containsExactly(content);
+        assertThat(response.getHeaders().getContentType()).isEqualTo(MediaType.parseMediaType(
+            "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"));
+        assertThat(response.getHeaders().getCacheControl()).contains("no-store");
+        assertThat(response.getHeaders().getContentDisposition().getType()).isEqualTo("attachment");
+        assertThat(response.getHeaders().getContentDisposition().getFilename()).isEqualTo("order-batch-errors.xlsx");
+        verify(files).download(10001L, "ORDER_BATCH_IMPORT_ERROR_REPORT", batchNo, 81L);
+    }
+
+    @Test
+    void routeRequiresOrderCreateAndRejectsPlatformIdentity() throws Exception {
+        var method = MerchantOrderBatchImportFileController.class.getMethod("downloadErrorReport",
+            AuthenticatedUser.class, String.class, long.class);
+        assertThat(method.getAnnotation(PreAuthorize.class).value())
+            .isEqualTo("hasAuthority('merchant:order:create')");
+
+        var files = mock(InternalBusinessFileService.class);
+        var controller = new MerchantOrderBatchImportFileController();
+        ReflectionTestUtils.setField(controller, "files", files);
+        var platform = new AuthenticatedUser(1L, 0L, 0L, 1L, "admin", "PLATFORM", "WEB", Set.of());
+
+        assertThatThrownBy(() -> controller.downloadErrorReport(platform,
+            "OBI-0123456789ABCDEF0123", 81L)).isInstanceOf(BizException.class);
+        verifyNoInteractions(files);
+    }
+
+    private static AuthenticatedUser merchant() {
+        return new AuthenticatedUser(2L, 10001L, 10001L, 2L, "merchant", "MERCHANT", "WEB", Set.of());
+    }
+}