Merge branch 'test' of http://8.163.30.128:10082/java-project/baiyue-firstleg into dev

file/src/main/java/com/baiyue/file/controller/PlatformProductImageController.java

@@ -0,0 +1,55 @@
+package com.baiyue.file.controller;
+
+import com.baiyue.common.core.api.ResultCode;
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.file.service.ProductImageService;
+import jakarta.annotation.Resource;
+import org.springframework.http.CacheControl;
+import org.springframework.http.ContentDisposition;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.nio.charset.StandardCharsets;
+
+/** 鐢ㄤ簬骞冲彴绔鍗曡鎯呮煡鐪嬪晢鎴峰晢鍝佸浘鐗囥€? */
+@RestController
+@RequestMapping("/api/platform/v1/files/product-images")
+public class PlatformProductImageController {
+    @Resource private ProductImageService images;
+
+    @GetMapping("/{tenantId}/{fileId}")
+    @PreAuthorize("hasAuthority('platform:order:list')")
+    public ResponseEntity<byte[]> download(
+        @AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable long tenantId,
+        @PathVariable long fileId) {
+        requirePlatform(user);
+        if (tenantId <= 0 || fileId <= 0) {
+            throw new BizException(ResultCode.BAD_REQUEST, "瀹㈡埛鍜屾枃浠禝D蹇呴』澶т簬0");
+        }
+        var image = images.download(tenantId, fileId);
+        return ResponseEntity.ok()
+            .cacheControl(CacheControl.noStore())
+            .contentType(MediaType.parseMediaType(image.contentType()))
+            .contentLength(image.content().length)
+            .header(HttpHeaders.CONTENT_DISPOSITION, ContentDisposition.inline()
+                .filename(image.fileName(), StandardCharsets.UTF_8).build().toString())
+            .body(image.content());
+    }
+
+    private static void requirePlatform(AuthenticatedUser user) {
+        if (user == null || !"PLATFORM".equalsIgnoreCase(user.appCode())
+            || user.tenantId() == null || user.tenantId() != 0L
+            || user.userId() == null || user.userId() <= 0) {
+            throw new BizException(ResultCode.FORBIDDEN, "闇€瑕佸钩鍙扮韬唤");
+        }
+    }
+}

file/src/test/java/com/baiyue/file/controller/ProductImageControllerContractTest.java

@@ -77,6 +77,26 @@ class ProductImageControllerContractTest {
         assertThatThrownBy(() -> controller.upload(platform, file)).isInstanceOf(BizException.class);
     }
 
+    @Test
+    void platformDownloadUsesTenantScopeAndOrderListPermission() throws Exception {
+        RequestMapping mapping = PlatformProductImageController.class.getAnnotation(RequestMapping.class);
+        assertThat(mapping.value()).contains("/api/platform/v1/files/product-images");
+        var download = PlatformProductImageController.class.getDeclaredMethod(
+            "download", AuthenticatedUser.class, long.class, long.class);
+        assertThat(download.getAnnotation(PreAuthorize.class).value())
+            .isEqualTo("hasAuthority('platform:order:list')");
+
+        ProductImageService service = mock(ProductImageService.class);
+        PlatformProductImageController controller = new PlatformProductImageController();
+        ReflectionTestUtils.setField(controller, "images", service);
+        when(service.download(10001L, 31L)).thenReturn(
+            new ProductImageService.Download("product.png", "image/png", new byte[] {1}));
+
+        var platform = new AuthenticatedUser(1L, 0L, 0L, 1L, "admin", "PLATFORM", "WEB", Set.of());
+        assertThat(controller.download(platform, 10001L, 31L).getBody()).containsExactly(1);
+        verify(service).download(10001L, 31L);
+    }
+
     private static AuthenticatedUser merchant(long tenantId) {
         return new AuthenticatedUser(2L, tenantId, tenantId, 2L, "merchant", "MERCHANT", "WEB", Set.of());
     }