fix(firstleg): keep PDA photos accessible after departure

firstleg/src/test/java/com/baiyue/firstleg/controller/ContainerControllerContractTest.java

@@ -1,20 +1,52 @@
 package com.baiyue.firstleg.controller;
 
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.firstleg.service.ContainerOverviewService;
+import com.baiyue.firstleg.service.ContainerService;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
+import org.springframework.http.MediaType;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.core.io.ClassPathResource;
+import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RequestPart;
 
 import java.lang.reflect.Method;
 import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
+import java.util.Set;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
 
 @DisplayName("货柜基础资料接口契约")
 class ContainerControllerContractTest {
+    @Test
+    @DisplayName("PDA照片作为历史证据下载时不受国内工作台分区限制")
+    void downloadsPdaPhotoWithoutDomesticWorkbenchGate() {
+        ContainerService containers = mock(ContainerService.class);
+        ContainerOverviewService overview = mock(ContainerOverviewService.class);
+        PlatformContainerController controller = new PlatformContainerController();
+        ReflectionTestUtils.setField(controller, "service", containers);
+        ReflectionTestUtils.setField(controller, "overview", overview);
+        when(overview.downloadPhoto(41L, 101L)).thenReturn(new ContainerOverviewService.PhotoDownload(
+            "door.jpg", MediaType.IMAGE_JPEG, new byte[]{1, 2, 3}));
+        AuthenticatedUser user = new AuthenticatedUser(7L, 0L, 0L, 8L,
+            "admin", "PLATFORM", "WEB", Set.of("platform:firstleg:container:list"));
+
+        var response = controller.downloadPdaPhoto(user, 41L, 101L);
+
+        assertThat(response.getStatusCode().is2xxSuccessful()).isTrue();
+        assertThat(response.getHeaders().getContentType()).isEqualTo(MediaType.IMAGE_JPEG);
+        assertThat(response.getBody()).containsExactly(1, 2, 3);
+        verify(overview).downloadPhoto(41L, 101L);
+        verifyNoInteractions(containers);
+    }
+
     @Test
     @DisplayName("查询、新增和编辑按钮权限彼此独立")
     void separatesButtonPermissions() {
@@ -50,6 +82,7 @@ class ContainerControllerContractTest {
             "/pda/photos/{fileId}/download:", "downloadPath:", "workflowStatus:",
             "AWAITING_REVIEW", "version: {type: integer, minimum: 0}",
             "downloadPath: {type: string, nullable: true",
+            "PDA完成及国内离仓后仍可读取ACTIVE历史照片",
             "仅 ACTIVE 照片提供鉴权下载路径；VOID 历史照片为空")
             .doesNotContain("?containerNo", "containerNo in: query");
     }