java-project/baiyue-firstleg
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(pda): 返回拆柜柜次号并限制司机证照上传格式

Browse Source
This commit is contained in:
ouyangxq
2026-11-06 21:02:53 +08:00
parent e132c3c80a
commit c71a065dda
16 changed files with 172 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
file/AGENTS.md
+1 -1
View File
@@ -22,7 +22,7 @@
| 财务付款凭证、海外卸柜照片 | 通用业务文件入口 `InternalBusinessFileController.java`、`InternalBusinessFileService.java`；`FINANCE_VOUCHER` 按客户与业务 ID 精确校验；`OVERSEAS_UNLOAD_PHOTO` 是允许同柜多客户的柜级物理证据，固定平台范围 `tenantId=0` 并按接柜会话 ID 精确校验 |
| 公司车辆付款凭证 | `src/main/resources/openapi/finance-vehicle-voucher-v1.yaml`；类型`FINANCE_VEHICLE_VOUCHER`，固定平台0和Finance费用ID，仅非空JPG/PNG、10MiB及签名校验；不复用客户凭证或维修照片 |
| 海外异常订单证据 | 通用内部业务文件入口；固定 `businessType=OVERSEAS_EXCEPTION_EVIDENCE`、`tenantId=异常订单所属客户ID`、`businessId=异常订单ID`，File 只校验文件复合归属，异常状态、完成门禁和证据引用归 Lastleg |
| 平台司机驾驶证 | 通用内部业务文件入口，契约 `src/main/resources/openapi/fleet-driver-license-v1.yaml`；`FLEET_DRIVER_LICENSE` 固定平台 `tenantId=0`、`businessId=driverId`，仅非空 PDF/JPG/PNG、最大 10MiB并校验签名；Lastleg维护审核、当前/历史附件关联及读取权限 |
| 平台司机驾驶证 | 通用内部业务文件入口，契约 `src/main/resources/openapi/fleet-driver-license-v1.yaml`；`FLEET_DRIVER_LICENSE` 固定平台 `tenantId=0`、`businessId=driverId`，上传仅非空 JPG/PNG、最大 10MiB并校验签名；Lastleg维护审核、当前/历史附件关联及读取权限 |
| 车辆保养加油照片 | 通用内部业务文件入口，契约 `src/main/resources/openapi/fleet-vehicle-record-photo-v1.yaml`；`FLEET_VEHICLE_RECORD_PHOTO` 固定平台0及运维记录ID，仅非空JPG/PNG、最大10MiB并校验签名；Lastleg校验车辆/记录/附件关联与权限，不使用车牌作为文件归属键 |
| 出车实测凭证 | 通用内部业务文件入口，契约 `src/main/resources/openapi/fleet-trip-operation-evidence-v1.yaml`；`FLEET_TRIP_OPERATION_EVIDENCE`固定平台0及车次ID，PDF/JPG/PNG、10MiB与签名校验；Lastleg管理实测版本引用及读写权限，附件选填 |
| 海外换标 PDF 资料 | 通用内部业务文件入口，契约 `src/main/resources/openapi/overseas-relabel-document-v1.yaml`；`OVERSEAS_RELABEL_TOTAL_DOCUMENT` 按 `application.id`、`OVERSEAS_RELABEL_ITEM_DOCUMENT` 按 `item.id` 归属，必须指定明确客户与正数业务 ID；仅非空 PDF、最大 10MiB，校验 MIME 和文件签名。File 按客户、类型、业务 ID、文件 ID 复合校验，Lastleg 校验申请/明细关系、客户归属、权限和业务状态 |
file/src/main/java/com/baiyue/file/service/BusinessFileCategory.java
+1 -1
View File
@@ -9,7 +9,7 @@ import java.util.Arrays;
enum BusinessFileCategory {
FLEET_VEHICLE_PHOTO(false, FormatPolicy.IMAGE, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
FLEET_DRIVER_PHOTO(false, FormatPolicy.IMAGE, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
FLEET_DRIVER_LICENSE(false, FormatPolicy.PDF_IMAGE, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
FLEET_DRIVER_LICENSE(false, FormatPolicy.IMAGE, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
FLEET_TRIP_OPERATION_EVIDENCE(false, FormatPolicy.PDF_IMAGE, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
OVERSEAS_DISPATCH_VEHICLE_EVIDENCE(false, FormatPolicy.PDF_IMAGE, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
OVERSEAS_DISPATCH_DRIVER_EVIDENCE(false, FormatPolicy.PDF_IMAGE, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
file/src/main/resources/openapi/fleet-driver-license-v1.yaml
+1 -1
View File
@@ -5,7 +5,7 @@ info:
description: >-
复用InternalBusinessFileController，固定平台tenantId=0、businessType=FLEET_DRIVER_LICENSE、
businessId=司机内部ID。Lastleg负责司机存在性、列表/上传权限、关联和历史可见性；
File校验内部服务令牌、平台复合归属、真实非空文件、MIME与签名。最大10MiB，仅PDF/JPG/PNG。
File校验内部服务令牌、平台复合归属、真实非空文件、MIME与签名。上传最大10MiB，仅JPG/PNG。
上传只生成不可变对象，不自动通过资质审核，不生成公开URL，旧附件通过Lastleg历史引用读取。
security:
- InternalServiceToken: []
file/src/test/java/com/baiyue/file/service/DriverLicenseFileTest.java
+20 -5
View File
@@ -24,15 +24,22 @@ class DriverLicenseFileTest {
assertThatThrownBy(() -> category.storageBusinessId("0")).isInstanceOf(BizException.class);
}
@Test void storesRealPdfAndRejectsWrongMimeAndSpoofedPdf() throws Exception {
/** 驾驶证上传接受有效 JPG/PNG，其他格式和伪装的图片均被拒绝。 */
@Test void storesImagesAndRejectsPdfWrongMimeAndSpoofedImages() throws Exception {
var storage = storage();
var pdf = new MockMultipartFile("file", "license.pdf", "application/pdf", "%PDF-1.7\nlicense".getBytes());
var result = storage.store(0, "71", pdf, BusinessFileCategory.FLEET_DRIVER_LICENSE);
assertThat(storage.read(result.objectKey())).isEqualTo(pdf.getBytes());
for (var format : new String[]{"jpg", "png"}) {
var type = format.equals("jpg") ? "image/jpeg" : "image/png";
var file = new MockMultipartFile("file", "license." + format, type, image(format));
var result = storage.store(0, "71", file, BusinessFileCategory.FLEET_DRIVER_LICENSE);
assertThat(storage.read(result.objectKey())).isEqualTo(file.getBytes());
}
assertThatThrownBy(() -> storage.store(0, "71", pdf, BusinessFileCategory.FLEET_DRIVER_LICENSE))
.isInstanceOf(BizException.class).hasMessageContaining("仅支持JPG、PNG");
assertThatThrownBy(() -> storage.store(0, "71", new MockMultipartFile("file", "license.txt", "text/plain", "text".getBytes()), BusinessFileCategory.FLEET_DRIVER_LICENSE))
.isInstanceOf(BizException.class).hasMessageContaining("仅支持");
assertThatThrownBy(() -> storage.store(0, "71", new MockMultipartFile("file", "license.pdf", "application/pdf", "not pdf".getBytes()), BusinessFileCategory.FLEET_DRIVER_LICENSE))
.isInstanceOf(BizException.class).hasMessageContaining("不是有效PDF");
assertThatThrownBy(() -> storage.store(0, "71", new MockMultipartFile("file", "license.png", "image/png", pdf.getBytes()), BusinessFileCategory.FLEET_DRIVER_LICENSE))
.isInstanceOf(BizException.class).hasMessageContaining("图片");
}
@Test void rejectsMoreThanTenMibBeforeReadingBytes() {
@@ -43,6 +50,14 @@ class DriverLicenseFileTest {
.isInstanceOf(BizException.class).hasMessageContaining("10MB");
}
/** 生成可解码的图片，覆盖文件格式与实际内容一致的上传路径。 */
private static byte[] image(String format) throws java.io.IOException {
var bytes = new java.io.ByteArrayOutputStream();
var image = new java.awt.image.BufferedImage(1, 1, java.awt.image.BufferedImage.TYPE_INT_RGB);
assertThat(javax.imageio.ImageIO.write(image, format, bytes)).isTrue();
return bytes.toByteArray();
}
private BusinessFileStorage storage() {
var storage = new BusinessFileStorage();
ReflectionTestUtils.setField(storage, "configuredRoot", root);