优化

warehouse/src/main/java/com/baiyue/warehouse/controller/InternalWarehouseController.java

@@ -15,6 +15,8 @@ import java.security.MessageDigest;
 @RestController
 @RequestMapping("/internal/warehouses")
 public class InternalWarehouseController {
+    private static final long PLATFORM_TENANT_ID = 0L;
+
     @Resource
     private WarehouseApplicationService service;
 
@@ -30,8 +32,17 @@ public class InternalWarehouseController {
     public ApiResponse<WarehouseDetailResponse> active(
             @RequestHeader(value="X-Internal-Service-Token", required=false) String token,
             @PathVariable long tenantId, @PathVariable long id) {
-        if (token == null || !MessageDigest.isEqual(expected, token.getBytes(StandardCharsets.UTF_8)))
+        verifyToken(token);
+        if (tenantId != PLATFORM_TENANT_ID) {
+            throw new BizException(ResultCode.BAD_REQUEST, "平台公共仓库作用域必须为0");
+        }
+        return ApiResponse.success(service.activeDetail(PLATFORM_TENANT_ID, id));
+    }
+
+    private void verifyToken(String token) {
+        byte[] supplied = token == null ? new byte[0] : token.getBytes(StandardCharsets.UTF_8);
+        if (!MessageDigest.isEqual(expected, supplied)) {
             throw new BizException(ResultCode.FORBIDDEN, "内部服务凭证无效");
-        return ApiResponse.success(service.activeDetail(tenantId, id));
+        }
     }
 }

warehouse/src/test/java/com/baiyue/warehouse/controller/InternalWarehouseControllerTest.java

@@ -0,0 +1,74 @@
+package com.baiyue.warehouse.controller;
+
+import com.baiyue.common.core.api.ResultCode;
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.warehouse.dto.WarehouseDetailResponse;
+import com.baiyue.warehouse.entity.WarehouseEntity;
+import com.baiyue.warehouse.service.WarehouseApplicationService;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import java.util.List;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+class InternalWarehouseControllerTest {
+    private static final String INTERNAL_TOKEN = "test-internal-service-token";
+
+    private final WarehouseApplicationService service = mock(WarehouseApplicationService.class);
+    private final InternalWarehouseController controller = new InternalWarehouseController();
+
+    @BeforeEach
+    void setUp() {
+        ReflectionTestUtils.setField(controller, "service", service);
+        ReflectionTestUtils.setField(controller, "internalToken", INTERNAL_TOKEN);
+        controller.initializeToken();
+    }
+
+    @Test
+    void returnsOnlyAnActivePlatformWarehouseToInternalCallers() {
+        WarehouseEntity warehouse = new WarehouseEntity();
+        warehouse.setId(200001L);
+        warehouse.setTenantId(0L);
+        warehouse.setWarehouseCode("CN-DONGGUAN-01");
+        warehouse.setWarehouseName("东莞仓");
+        warehouse.setWarehouseType("DOMESTIC");
+        warehouse.setStatus("ACTIVE");
+        when(service.activeDetail(0L, 200001L))
+            .thenReturn(new WarehouseDetailResponse(warehouse, List.of(), List.of()));
+
+        var response = controller.active(INTERNAL_TOKEN, 0L, 200001L);
+
+        assertThat(response.data().warehouse().getTenantId()).isZero();
+        assertThat(response.data().warehouse().getWarehouseCode()).isEqualTo("CN-DONGGUAN-01");
+        assertThat(response.data().warehouse().getWarehouseType()).isEqualTo("DOMESTIC");
+        assertThat(response.data().warehouse().getStatus()).isEqualTo("ACTIVE");
+        verify(service).activeDetail(0L, 200001L);
+    }
+
+    @Test
+    void rejectsCustomerScopedWarehouseLookups() {
+        assertThatThrownBy(() -> controller.active(INTERNAL_TOKEN, 10001L, 200001L))
+            .isInstanceOf(BizException.class)
+            .extracting(exception -> ((BizException) exception).getResultCode())
+            .isEqualTo(ResultCode.BAD_REQUEST);
+
+        verifyNoInteractions(service);
+    }
+
+    @Test
+    void rejectsAnInvalidInternalTokenBeforeQueryingWarehouseData() {
+        assertThatThrownBy(() -> controller.active("invalid-token", 0L, 200001L))
+            .isInstanceOf(BizException.class)
+            .extracting(exception -> ((BizException) exception).getResultCode())
+            .isEqualTo(ResultCode.FORBIDDEN);
+
+        verifyNoInteractions(service);
+    }
+}