优化

iam/src/main/resources/db/order-declaration-planning-permission.sql

@@ -0,0 +1,20 @@
+-- 订单申报与运营预估权限模块来源。
+-- 只操作 IAM 权限资源和角色授权，不创建账号、客户或业务数据。
+USE baiyue_iam;
+SET NAMES utf8mb4;
+
+INSERT INTO iam_permission
+  (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name,
+   route_path, http_method, sort_no, status, deleted)
+VALUES
+  (5102027, 0, 'PLATFORM', 'BUTTON', 5102010, 'platform:order:declaration:edit',
+   '修改订单申报与运营预估', NULL, NULL, 130, 'ACTIVE', 0)
+ON DUPLICATE KEY UPDATE
+  permission_name = VALUES(permission_name), parent_id = VALUES(parent_id),
+  permission_type = VALUES(permission_type), app_code = VALUES(app_code),
+  sort_no = VALUES(sort_no), status = 'ACTIVE', deleted = 0;
+
+INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
+SELECT role_id, 5102027, 0
+FROM (SELECT 4000001 AS role_id UNION ALL SELECT 4000003 AS role_id) roles
+ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);

iam/src/main/resources/db/phase1-admin-rbac.sql

@@ -130,18 +130,19 @@ VALUES
   (5102019, 0, 'PLATFORM', 'BUTTON', 5102010, 'platform:order:create', '平台代客创建订单', NULL, NULL, 90, 'ACTIVE', 0),
   (5102024, 0, 'PLATFORM', 'BUTTON', 5102010, 'platform:order:edit', '平台编辑订单草稿', NULL, NULL, 100, 'ACTIVE', 0),
   (5102025, 0, 'PLATFORM', 'BUTTON', 5102010, 'platform:order:submit', '平台代客提交订单', NULL, NULL, 110, 'ACTIVE', 0),
-  (5102026, 0, 'PLATFORM', 'BUTTON', 5102010, 'platform:order:export', '导出订单列表', NULL, NULL, 120, 'ACTIVE', 0)
+  (5102026, 0, 'PLATFORM', 'BUTTON', 5102010, 'platform:order:export', '导出订单列表', NULL, NULL, 120, 'ACTIVE', 0),
+  (5102027, 0, 'PLATFORM', 'BUTTON', 5102010, 'platform:order:declaration:edit', '修改订单申报与运营预估', NULL, NULL, 130, 'ACTIVE', 0)
 ON DUPLICATE KEY UPDATE
   permission_name = VALUES(permission_name), parent_id = VALUES(parent_id), status = 'ACTIVE', deleted = 0;
 
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
 SELECT 4000001, id, 0 FROM iam_permission
-WHERE id IN (5102019, 5102024, 5102025, 5102026)
+WHERE id IN (5102019, 5102024, 5102025, 5102026, 5102027)
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
 
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
 SELECT 4000003, id, 0 FROM iam_permission
-WHERE id IN (5102019, 5102024, 5102025, 5102026)
+WHERE id IN (5102019, 5102024, 5102025, 5102026, 5102027)
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
 
 INSERT INTO iam_membership_role (membership_id, role_id, tenant_id) VALUES

iam/src/test/java/com/baiyue/iam/repository/PermissionInitializationSqlContractTest.java

@@ -0,0 +1,44 @@
+package com.baiyue.iam.repository;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.core.io.ClassPathResource;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class PermissionInitializationSqlContractTest {
+
+    @Test
+    void keepsSharedPermissionEntryFocusedAndAlignedWithFullBaseline() throws Exception {
+        String module = new ClassPathResource("db/order-declaration-planning-permission.sql")
+            .getContentAsString(StandardCharsets.UTF_8);
+        String permissionOnly = Files.readString(resolve("deploy/sql/权限点初始化-MySQL8.sql"),
+            StandardCharsets.UTF_8);
+        String unified = Files.readString(resolve("deploy/sql/头程数据库统一增量-MySQL8.sql"),
+            StandardCharsets.UTF_8);
+
+        for (String source : new String[] {module, permissionOnly, unified}) {
+            assertThat(source)
+                .contains("5102027")
+                .contains("platform:order:declaration:edit")
+                .contains("4000001")
+                .contains("4000003");
+        }
+        assertThat(permissionOnly)
+            .contains("START TRANSACTION")
+            .contains("permission_initialization_status")
+            .contains("SIGNAL SQLSTATE '45000'")
+            .contains("apply_permission_points")
+            .doesNotContain("apply_domestic_permission_points", "CREATE TABLE", "ALTER TABLE",
+                "INSERT INTO iam_tenant", "INSERT INTO iam_user", "INSERT INTO iam_membership",
+                "INSERT INTO auth_account");
+    }
+
+    private static Path resolve(String relative) {
+        Path direct = Path.of(relative);
+        return Files.exists(direct) ? direct : Path.of("..").resolve(relative);
+    }
+}

iam/src/test/resources/db/verify-phase1-admin-rbac.sql

@@ -38,6 +38,15 @@ SELECT 'platform_admin_not_fully_granted'
 WHERE (SELECT COUNT(*) FROM baiyue_iam.iam_role_permission WHERE role_id = 4000001)
    <> (SELECT COUNT(*) FROM baiyue_iam.iam_permission WHERE tenant_id = 0 AND app_code = 'PLATFORM' AND permission_type IN ('MENU', 'BUTTON'))
 UNION ALL
+SELECT 'missing_order_declaration_edit_permission'
+WHERE NOT EXISTS (
+  SELECT 1 FROM baiyue_iam.iam_permission
+  WHERE id = 5102027 AND tenant_id = 0 AND app_code = 'PLATFORM'
+    AND permission_code = 'platform:order:declaration:edit' AND status = 'ACTIVE' AND deleted = 0
+)
+   OR (SELECT COUNT(*) FROM baiyue_iam.iam_role_permission
+       WHERE tenant_id = 0 AND permission_id = 5102027 AND role_id IN (4000001, 4000003)) <> 2
+UNION ALL
 SELECT 'missing_global_merchant_owner_template'
 WHERE NOT EXISTS (
   SELECT 1 FROM baiyue_iam.iam_role