优化

lastleg-service/AGENTS.md

@@ -10,7 +10,8 @@
 
 | 功能 | 入口 |
 |---|---|
-| 事件接收、订单列表/详情/导出、目的仓调整 | `src/main/java/com/baiyue/lastleg/controller/LastlegOrderController.java` |
+| 事件接收、平台订单列表/详情/导出、目的仓调整 | `src/main/java/com/baiyue/lastleg/controller/LastlegOrderController.java` |
+| 客户尾程订单列表与详情 | `controller/MerchantLastlegOrderController.java`；客户范围只取认证身份，稳定类型/状态见 `model/LastlegOrderType.java`、`LastlegOrderStatus.java` |
 | 装柜完成事件消费 | `service/LoadingCompletedConsumer.java`；当前生产信封为 `FIRST_LEG_LOADING_PLAN_COMPLETED` V2，消费端按冻结字段校验后建单 |
 | 尾程单号生成 | `service/LastlegOrderNoGenerator.java` |
 | 订单查询与更新 | `service/LastlegOrderService.java` |
@@ -24,6 +25,7 @@
 | PDA 卸柜照片文件上传与归属校验 | `InboundPdaController.java` 的 `/unload-photos/files`、`inboundplan/pda/gateway/UnloadPhotoFileGateway.java`、`HttpUnloadPhotoFileGateway.java`；File 类型固定 `OVERSEAS_UNLOAD_PHOTO` |
 | 卸柜照片与海外卸柜完成 Outbox | `inboundplan/pda/controller/InboundPdaController.java`、`inboundplan/pda/service/InboundUnloadCompletedOutboxService.java`、`entity/LastlegEventOutbox.java`、`mapper/LastlegEventOutboxMapper.java`；事件模型见 `../common-event-contract/AGENTS.md` |
 | 入仓后 SKU 库存余额、库位和流水 | `inventory/`；平台只读查询与非出库库存命令分别从 `inventory/query/controller/InventoryQueryController.java`、`inventory/command/controller/InventoryCommandController.java` 进入 |
+| 平台排车列表/详情与智能预排 | `dispatch/controller/DispatchQueryController.java`、`SmartDispatchController.java`、`dispatch/mapper/DispatchCandidateMapper.java`、`dispatch/service/DispatchService.java`；入口 `/api/platform/v1/last-leg/dispatches`，范围开关与禁用写操作见“四期开发范围路由” |
 | 仓储资源调用 | `inboundplan/pda/gateway/WarehouseResourceGateway.java`、`HttpWarehouseResourceGateway.java` |
 | 仓储转运、历史订单/入仓绑定、可选换标联动 | `transfer/controller/WarehouseTransferController.java`、`transfer/service/WarehouseTransferService.java` |
 | 一件代发接收、SKU/箱唛库存 | `dropship/service/DropshipOrderService.java`、`dropship/entity/`、`dropship/mapper/` |

lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/controller/InboundPlanController.java

@@ -33,7 +33,7 @@ public class InboundPlanController {
 
     /** 按入仓计划明细分页查询可预约的入库订单行。 */
     @GetMapping
-    @PreAuthorize("hasAuthority('" + OverseasPermissions.INBOUND_ORDER_CREATE + "')")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.INBOUND_ORDER_LIST + "')")
     @Operation(summary = "分页查询入库订单", description = "Required authority: " + OverseasPermissions.INBOUND_ORDER_LIST)
     public ApiResponse<PageResult<InboundPlanListResponse>> page(
         @AuthenticationPrincipal AuthenticatedUser user,
@@ -43,7 +43,7 @@ public class InboundPlanController {
     }
 
     @PostMapping("/convert")
-    @PreAuthorize("hasAuthority('" + OverseasPermissions.INBOUND_ORDER_LIST + "')")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.INBOUND_ORDER_CREATE + "')")
     /** 将入仓单转换为入仓计划。 */
     @Operation(summary = "入仓单转入仓计划", description = "Required authority: " + OverseasPermissions.INBOUND_ORDER_CREATE)
     public ApiResponse<InboundPlanResponse> convert(@AuthenticationPrincipal AuthenticatedUser user,

lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/controller/InboundPlanPermissionContractTest.java

@@ -13,6 +13,7 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
 
 class InboundPlanPermissionContractTest {
     private static final String LIST = "platform:overseas-warehouse:inbound-order:list";
+    private static final String CREATE = "platform:overseas-warehouse:inbound-order:create";
     private static final String FBA_APPOINTMENT =
         "platform:overseas-warehouse:inbound-order:fba-appointment";
 
@@ -28,6 +29,17 @@ class InboundPlanPermissionContractTest {
         }
     }
 
+    @Test
+    void conversionUsesCanonicalInboundOrderCreateAuthority() {
+        Method method = Arrays.stream(InboundPlanController.class.getDeclaredMethods())
+            .filter(candidate -> candidate.getName().equals("convert"))
+            .findFirst()
+            .orElseThrow();
+
+        assertEquals("hasAuthority('" + CREATE + "')", method.getAnnotation(PreAuthorize.class).value());
+        assertEquals("Required authority: " + CREATE, method.getAnnotation(Operation.class).description());
+    }
+
     @Test
     void fbaAppointmentWritesUseDedicatedAuthority() {
         Map<String, Method> methods = Arrays.stream(InboundPlanController.class.getDeclaredMethods())