优化

lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/controller/InboundPlanController.java

@@ -33,7 +33,7 @@ public class InboundPlanController {
 
     /** 按入仓计划明细分页查询可预约的入库订单行。 */
     @GetMapping
-    @PreAuthorize("hasAuthority('" + OverseasPermissions.INBOUND_ORDER_CREATE + "')")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.INBOUND_ORDER_LIST + "')")
     @Operation(summary = "分页查询入库订单", description = "Required authority: " + OverseasPermissions.INBOUND_ORDER_LIST)
     public ApiResponse<PageResult<InboundPlanListResponse>> page(
         @AuthenticationPrincipal AuthenticatedUser user,
@@ -43,7 +43,7 @@ public class InboundPlanController {
     }
 
     @PostMapping("/convert")
-    @PreAuthorize("hasAuthority('" + OverseasPermissions.INBOUND_ORDER_LIST + "')")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.INBOUND_ORDER_CREATE + "')")
     /** 将入仓单转换为入仓计划。 */
     @Operation(summary = "入仓单转入仓计划", description = "Required authority: " + OverseasPermissions.INBOUND_ORDER_CREATE)
     public ApiResponse<InboundPlanResponse> convert(@AuthenticationPrincipal AuthenticatedUser user,

lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/controller/InboundPlanPermissionContractTest.java

@@ -13,6 +13,7 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
 
 class InboundPlanPermissionContractTest {
     private static final String LIST = "platform:overseas-warehouse:inbound-order:list";
+    private static final String CREATE = "platform:overseas-warehouse:inbound-order:create";
     private static final String FBA_APPOINTMENT =
         "platform:overseas-warehouse:inbound-order:fba-appointment";
 
@@ -28,6 +29,17 @@ class InboundPlanPermissionContractTest {
         }
     }
 
+    @Test
+    void conversionUsesCanonicalInboundOrderCreateAuthority() {
+        Method method = Arrays.stream(InboundPlanController.class.getDeclaredMethods())
+            .filter(candidate -> candidate.getName().equals("convert"))
+            .findFirst()
+            .orElseThrow();
+
+        assertEquals("hasAuthority('" + CREATE + "')", method.getAnnotation(PreAuthorize.class).value());
+        assertEquals("Required authority: " + CREATE, method.getAnnotation(Operation.class).description());
+    }
+
     @Test
     void fbaAppointmentWritesUseDedicatedAuthority() {
         Map<String, Method> methods = Arrays.stream(InboundPlanController.class.getDeclaredMethods())