Merge remote-tracking branch 'origin/test' into test

file/src/main/java/com/baiyue/file/service/BusinessFileCategory.java

@@ -9,8 +9,6 @@ import java.util.Arrays;
 enum BusinessFileCategory {
     FLEET_DRIVER_LICENSE(false, FormatPolicy.PDF_IMAGE, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
     FLEET_TRIP_OPERATION_EVIDENCE(false, FormatPolicy.PDF_IMAGE, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
-    OVERSEAS_DISPATCH_VEHICLE_EVIDENCE(false, FormatPolicy.PDF_IMAGE, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
-    OVERSEAS_DISPATCH_DRIVER_EVIDENCE(false, FormatPolicy.PDF_IMAGE, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
     FLEET_VEHICLE_RECORD_PHOTO(false, FormatPolicy.IMAGE, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
     DELIVERY_LOADING_PHOTO(true, FormatPolicy.ARBITRARY, Limits.CUSTOMS, BusinessIdPolicy.POSITIVE_LONG),
     DELIVERY_BOL(true, FormatPolicy.ARBITRARY, Limits.CUSTOMS, BusinessIdPolicy.POSITIVE_LONG),
@@ -69,12 +67,7 @@ enum BusinessFileCategory {
             .orElseThrow(() -> new BizException(ResultCode.BAD_REQUEST, "不支持的附件业务类型"));
     }
 
-    /** 校验文件归属；跨客户排车证据固定为平台所有，不随货物客户变化。 */
     void validateOwner(long tenantId) {
-        if ((this == OVERSEAS_DISPATCH_VEHICLE_EVIDENCE || this == OVERSEAS_DISPATCH_DRIVER_EVIDENCE)
-                && tenantId != 0) {
-            throw new BizException(ResultCode.BAD_REQUEST, "排车车辆及司机证据必须归属平台");
-        }
         if (this == FLEET_TRIP_OPERATION_EVIDENCE && tenantId != 0) {
             throw new BizException(ResultCode.BAD_REQUEST, "出车实测凭证必须归属平台");
         }

file/src/main/resources/openapi/dispatch-evidence-v1.yaml

@@ -1,167 +0,0 @@
-openapi: 3.0.3
-info:
-  title: 平台排车车辆与司机证据内部文件契约
-  version: 1.0.0
-  description: >-
-    复用 InternalBusinessFileController 的现有通用内部入口，不新增公开文件路由。
-    两类证据均固定平台 tenantId=0，businessId 为排车内部正数 Long ID 的十进制表示，
-    不使用车辆 ID、司机 ID、车牌或客户 ID。车辆与司机证据分别使用
-    OVERSEAS_DISPATCH_VEHICLE_EVIDENCE、OVERSEAS_DISPATCH_DRIVER_EVIDENCE，不可互换。
-    File 校验内部服务令牌、平台归属、正数业务 ID、文件非空、最大 10MiB（10485760 字节，包含边界）、
-    PDF/JPG/PNG MIME 及对应内容签名。元数据和下载按 tenantId、businessType、businessId、fileId
-    联合查询 ACTIVE 且未删除文件，错车或错类别均视为归属不匹配，下载前完成归属校验。
-    上传生成不可变文件和真实元数据，不自动绑定证据或通过审核，不返回公开 URL 或存储路径。
-    Lastleg 负责排车存在性、仓库与角色权限、当前及历史附件引用和审核状态；File 不查询 Lastleg 业务表。
-    本文只描述排车网关实际消费的上传、元数据和内容三个操作，不改变通用文件接口的其他用途。
-    统一异常处理使用 HTTP 200 JSON 业务错误，调用方必须检查 code；内容接口错误也返回 JSON，不能当作文件。
-security:
-  - InternalServiceToken: []
-paths:
-  /internal/file/v1/business-files/{tenantId}/{businessType}/{businessId}:
-    parameters:
-      - {$ref: '#/components/parameters/TenantId'}
-      - {$ref: '#/components/parameters/BusinessType'}
-      - {$ref: '#/components/parameters/BusinessId'}
-    post:
-      operationId: uploadDispatchEvidence
-      summary: 上传本排车的车辆或司机证据
-      parameters:
-        - name: X-Operator-Id
-          in: header
-          required: true
-          description: Lastleg 已认证操作者的正数 Long ID
-          schema: {$ref: '#/components/schemas/PositiveLongString'}
-      requestBody:
-        required: true
-        content:
-          multipart/form-data:
-            schema:
-              type: object
-              required: [file]
-              properties:
-                file:
-                  type: string
-                  format: binary
-                  description: 非空且不超过10485760字节；application/pdf、image/jpeg或image/png，并校验对应内容签名
-      responses:
-        '200': {$ref: '#/components/responses/MetadataOrError'}
-  /internal/file/v1/business-files/{tenantId}/{businessType}/{businessId}/{fileId}:
-    parameters:
-      - {$ref: '#/components/parameters/TenantId'}
-      - {$ref: '#/components/parameters/BusinessType'}
-      - {$ref: '#/components/parameters/BusinessId'}
-      - {$ref: '#/components/parameters/FileId'}
-    get:
-      operationId: readDispatchEvidenceMetadata
-      summary: 按本排车与证据类别联合校验并读取元数据
-      responses:
-        '200': {$ref: '#/components/responses/MetadataOrError'}
-  /internal/file/v1/business-files/{tenantId}/{businessType}/{businessId}/{fileId}/content:
-    parameters:
-      - {$ref: '#/components/parameters/TenantId'}
-      - {$ref: '#/components/parameters/BusinessType'}
-      - {$ref: '#/components/parameters/BusinessId'}
-      - {$ref: '#/components/parameters/FileId'}
-    get:
-      operationId: downloadDispatchEvidence
-      summary: 按完整复合归属读取文件内容
-      responses:
-        '200':
-          description: >-
-            成功返回真实文件；错误返回 application/json 统一业务错误。
-            A0400 表示作用域、ID或文件格式无效，A0403 表示内部令牌无效，
-            A0404 表示文件不存在、非有效文件或复合归属不匹配。
-          headers:
-            Cache-Control: {schema: {type: string, enum: [no-store]}}
-            Content-Disposition: {schema: {type: string}, description: 成功时为attachment及UTF-8文件名}
-            Content-Length: {schema: {type: integer, format: int64}, description: 成功时为真实文件字节数}
-          content:
-            application/pdf: {schema: {type: string, format: binary}}
-            image/jpeg: {schema: {type: string, format: binary}}
-            image/png: {schema: {type: string, format: binary}}
-            application/json: {schema: {$ref: '#/components/schemas/ErrorEnvelope'}}
-components:
-  securitySchemes:
-    InternalServiceToken: {type: apiKey, in: header, name: X-Internal-Service-Token}
-  parameters:
-    TenantId:
-      name: tenantId
-      in: path
-      required: true
-      description: 两类排车证据只属于平台，客户作用域一律拒绝
-      schema: {type: string, enum: ['0']}
-    BusinessType:
-      name: businessType
-      in: path
-      required: true
-      schema: {$ref: '#/components/schemas/DispatchEvidenceType'}
-    BusinessId:
-      name: businessId
-      in: path
-      required: true
-      description: 排车内部正数Long ID，上限9223372036854775807；Lastleg以标准十进制字符串传入
-      schema: {$ref: '#/components/schemas/PositiveLongString'}
-    FileId:
-      name: fileId
-      in: path
-      required: true
-      schema: {$ref: '#/components/schemas/PositiveLongString'}
-  responses:
-    MetadataOrError:
-      description: >-
-        统一JSON响应，业务成功code为200。A0400为无效平台作用域、ID、操作者或文件；
-        A0403为内部服务令牌无效；A0404为文件不存在、非ACTIVE、已删除或复合归属不匹配；
-        S0503为存储不可用，S0500为元数据保存失败等内部异常。
-      content:
-        application/json:
-          schema:
-            oneOf:
-              - {$ref: '#/components/schemas/MetadataEnvelope'}
-              - {$ref: '#/components/schemas/ErrorEnvelope'}
-  schemas:
-    PositiveLongString:
-      type: string
-      pattern: '^[1-9][0-9]*$'
-      maxLength: 19
-      description: 正数Long的十进制字符串，值不得超过9223372036854775807
-    DispatchEvidenceType:
-      type: string
-      enum: [OVERSEAS_DISPATCH_VEHICLE_EVIDENCE, OVERSEAS_DISPATCH_DRIVER_EVIDENCE]
-    MetadataEnvelope:
-      type: object
-      required: [code, data]
-      properties:
-        code: {type: string, enum: ['200']}
-        message: {type: string}
-        data: {$ref: '#/components/schemas/Metadata'}
-        requestId: {type: string, nullable: true}
-        traceId: {type: string, nullable: true}
-        timestamp: {type: string, format: date-time}
-    Metadata:
-      type: object
-      required: [fileId, ownerScope, tenantId, businessType, businessId, fileName, sha256, contentType, sizeBytes, createdAt]
-      properties:
-        fileId: {$ref: '#/components/schemas/PositiveLongString'}
-        ownerScope: {type: string, enum: [PLATFORM]}
-        tenantId: {type: string, enum: ['0']}
-        businessType: {$ref: '#/components/schemas/DispatchEvidenceType'}
-        businessId: {$ref: '#/components/schemas/PositiveLongString'}
-        fileName: {type: string, minLength: 1, description: 清理路径和控制字符后的原始文件名}
-        sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
-        contentType: {type: string, enum: [application/pdf, image/jpeg, image/png]}
-        sizeBytes:
-          type: string
-          pattern: '^[1-9][0-9]*$'
-          description: 实际字节数，范围1到10485760；公共Jackson配置将Long输出为字符串
-          example: '1024'
-        createdAt: {type: string, description: File真实上传时间，LocalDateTime的ISO本地时间表示，无时区偏移}
-    ErrorEnvelope:
-      type: object
-      required: [code, data]
-      properties:
-        code: {type: string, enum: [A0400, A0403, A0404, A0422, S0500, S0503]}
-        message: {type: string}
-        data: {type: object, nullable: true, description: 业务错误为null；参数校验错误可携带字段信息}
-        requestId: {type: string, nullable: true}
-        traceId: {type: string, nullable: true}
-        timestamp: {type: string, format: date-time}

file/src/test/java/com/baiyue/file/service/DispatchEvidenceFileTest.java

@@ -1,245 +0,0 @@
-package com.baiyue.file.service;
-
-import com.baomidou.mybatisplus.core.MybatisConfiguration;
-import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
-import com.baomidou.mybatisplus.core.metadata.TableInfoHelper;
-import com.baiyue.common.core.exception.BizException;
-import com.baiyue.file.controller.InternalBusinessFileController;
-import com.baiyue.file.entity.FileObjectEntity;
-import com.baiyue.file.mapper.FileObjectMapper;
-import org.apache.ibatis.builder.MapperBuilderAssistant;
-import org.junit.jupiter.api.BeforeAll;
-import org.junit.jupiter.api.io.TempDir;
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.ValueSource;
-import org.springframework.mock.web.MockMultipartFile;
-import org.springframework.test.util.ReflectionTestUtils;
-import org.springframework.web.multipart.MultipartFile;
-
-import java.io.ByteArrayOutputStream;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.Arrays;
-import java.util.concurrent.atomic.AtomicLong;
-import java.util.regex.Pattern;
-
-import static org.assertj.core.api.Assertions.*;
-import static org.mockito.ArgumentMatchers.*;
-import static org.mockito.Mockito.*;
-
-class DispatchEvidenceFileTest {
-    private static final String VEHICLE = "OVERSEAS_DISPATCH_VEHICLE_EVIDENCE";
-    private static final String DRIVER = "OVERSEAS_DISPATCH_DRIVER_EVIDENCE";
-    private static final int MAX_BYTES = 10 * 1024 * 1024;
-    @TempDir Path root;
-
-    /** 初始化真实 Lambda 查询列映射，使测试能逐列核对复合归属条件。 */
-    @BeforeAll static void metadata() {
-        TableInfoHelper.initTableInfo(new MapperBuilderAssistant(new MybatisConfiguration(), "dispatch-evidence"),
-            FileObjectEntity.class);
-    }
-
-    /** 两类证据只接受平台与有效排车内部 ID，非法输入不得访问数据库或磁盘。 */
-    @ParameterizedTest
-    @ValueSource(strings = {VEHICLE, DRIVER})
-    void requiresPlatformAndPositiveDispatchIdBeforeAccess(String type) {
-        var files = mock(FileObjectMapper.class);
-        var storage = mock(BusinessFileStorage.class);
-        var service = service(files, storage);
-        var upload = pdf();
-        for (long customer : new long[]{-1, 1, 900}) {
-            assertThatThrownBy(() -> service.upload(customer, type, "71", 7, upload)).isInstanceOf(BizException.class);
-            assertThatThrownBy(() -> service.metadata(customer, type, "71", 501)).isInstanceOf(BizException.class);
-            assertThatThrownBy(() -> service.download(customer, type, "71", 501)).isInstanceOf(BizException.class);
-        }
-        for (String id : new String[]{"0", "-1", "DISPATCH-71", "../71", "9223372036854775808"}) {
-            assertThatThrownBy(() -> service.upload(0, type, id, 7, upload)).isInstanceOf(BizException.class);
-            assertThatThrownBy(() -> service.metadata(0, type, id, 501)).isInstanceOf(BizException.class);
-            assertThatThrownBy(() -> service.download(0, type, id, 501)).isInstanceOf(BizException.class);
-        }
-        assertThatThrownBy(() -> service.upload(0, type, "71", 0, upload)).isInstanceOf(BizException.class);
-        assertThatThrownBy(() -> service.metadata(0, type, "71", 0)).isInstanceOf(BizException.class);
-        assertThatThrownBy(() -> service.download(0, type, "71", 0)).isInstanceOf(BizException.class);
-        verifyNoInteractions(files, storage);
-    }
-
-    /** 真实 PDF、JPG、PNG 均可写入并保持内容；上传不以扩展名代替 MIME 和签名。 */
-    @ParameterizedTest
-    @ValueSource(strings = {VEHICLE, DRIVER})
-    void storesPdfJpegPngAndRejectsEmptyUnsupportedAndSpoofedContent(String type) throws Exception {
-        var storage = storage();
-        var category = BusinessFileCategory.require(type);
-        for (var file : new MockMultipartFile[]{pdf(),
-                new MockMultipartFile("file", "vehicle.jpg", "image/jpeg", image("jpeg")),
-                new MockMultipartFile("file", "driver.png", "image/png", image("png"))}) {
-            var saved = storage.store(0, "71", file, category);
-            assertThat(storage.read(saved.objectKey())).isEqualTo(file.getBytes());
-            assertThat(saved.contentType()).isEqualTo(file.getContentType());
-            assertThat(saved.size()).isEqualTo(file.getSize());
-            assertThat(saved.sha256()).matches("[0-9a-f]{64}");
-        }
-        for (var file : new MockMultipartFile[]{
-                new MockMultipartFile("file", "empty.pdf", "application/pdf", new byte[0]),
-                new MockMultipartFile("file", "fake.pdf", "application/pdf", "plain text".getBytes(StandardCharsets.UTF_8)),
-                new MockMultipartFile("file", "fake.jpg", "image/jpeg", image("png")),
-                new MockMultipartFile("file", "fake.png", "image/png", image("jpeg")),
-                new MockMultipartFile("file", "fake.pdf", "text/plain", pdf().getBytes()),
-                new MockMultipartFile("file", "fake.pdf", "application/octet-stream", pdf().getBytes()),
-                new MockMultipartFile("file", "missing.pdf", null, pdf().getBytes())}) {
-            assertThatThrownBy(() -> storage.store(0, "71", file, category)).isInstanceOf(BizException.class);
-        }
-        assertThatThrownBy(() -> storage.store(0, "71", null, category)).isInstanceOf(BizException.class);
-    }
-
-    /** 10MiB 为包含边界，超限在读取内容或落盘前拒绝。 */
-    @ParameterizedTest
-    @ValueSource(strings = {VEHICLE, DRIVER})
-    void acceptsExactlyTenMibAndRejectsOneByteOverBeforeReading(String type) throws Exception {
-        var storage = storage();
-        var category = BusinessFileCategory.require(type);
-        byte[] content = Arrays.copyOf(pdf().getBytes(), MAX_BYTES);
-        var boundary = new MockMultipartFile("file", "boundary.pdf", "application/pdf", content);
-        var stored = storage.store(0, "71", boundary, category);
-        assertThat(Files.size(root.resolve(stored.objectKey()))).isEqualTo(MAX_BYTES);
-        var oversized = mock(MultipartFile.class);
-        when(oversized.isEmpty()).thenReturn(false);
-        when(oversized.getSize()).thenReturn((long) MAX_BYTES + 1);
-        assertThatThrownBy(() -> storage.store(0, "71", oversized, category))
-            .isInstanceOf(BizException.class).hasMessageContaining("10MB");
-        verify(oversized, never()).getInputStream();
-        verify(oversized, never()).transferTo(any(Path.class));
-    }
-
-    /** 上传生成独立不可变对象和真实元数据；替换引用不覆盖原文件。 */
-    @ParameterizedTest
-    @ValueSource(strings = {VEHICLE, DRIVER})
-    void uploadsKeepPlatformDispatchScopeAndImmutableObjects(String type) throws Exception {
-        var files = mock(FileObjectMapper.class);
-        var storage = storage();
-        var service = service(files, storage);
-        var ids = new AtomicLong(500);
-        when(files.insert(any(FileObjectEntity.class))).thenAnswer(call -> {
-            FileObjectEntity row = call.getArgument(0);
-            row.setId(ids.incrementAndGet());
-            return 1;
-        });
-        var first = service.upload(0, type, "71", 7, pdf());
-        var secondFile = new MockMultipartFile("file", "updated.pdf", "application/pdf",
-            "%PDF-1.7\nupdated".getBytes(StandardCharsets.US_ASCII));
-        var second = service.upload(0, type, "71", 7, secondFile);
-        var rows = org.mockito.ArgumentCaptor.forClass(FileObjectEntity.class);
-        verify(files, times(2)).insert(rows.capture());
-        assertThat(first.ownerScope()).isEqualTo("PLATFORM");
-        assertThat(first.tenantId()).isZero();
-        assertThat(first.businessType()).isEqualTo(type);
-        assertThat(first.businessId()).isEqualTo("71");
-        assertThat(first.fileId()).isEqualTo(501L);
-        assertThat(second.fileId()).isEqualTo(502L);
-        assertThat(first.fileName()).isEqualTo("evidence.pdf");
-        assertThat(first.contentType()).isEqualTo("application/pdf");
-        assertThat(first.sizeBytes()).isEqualTo(pdf().getSize());
-        assertThat(first.sha256()).matches("[0-9a-f]{64}");
-        assertThat(first.createdAt()).isNotNull().isEqualTo(rows.getAllValues().get(0).getCreatedAt());
-        assertThat(rows.getAllValues().get(0).getObjectKey()).isNotEqualTo(rows.getAllValues().get(1).getObjectKey());
-        assertThat(storage.read(rows.getAllValues().get(0).getObjectKey())).isEqualTo(pdf().getBytes());
-        assertThat(storage.read(rows.getAllValues().get(1).getObjectKey())).isEqualTo(secondFile.getBytes());
-        verify(files, never()).updateById(any(FileObjectEntity.class));
-    }
-
-    /** 元数据和下载均逐列带全复合键；错车、错类别、错文件不得读取存储内容。 */
-    @ParameterizedTest
-    @ValueSource(strings = {VEHICLE, DRIVER})
-    void metadataAndDownloadEnforceEveryScopeKeyBeforeReading(String type) throws Exception {
-        var files = mock(FileObjectMapper.class);
-        var storage = mock(BusinessFileStorage.class);
-        var service = service(files, storage);
-        var row = new FileObjectEntity();
-        row.setId(501L); row.setTenantId(0L); row.setBusinessType(type); row.setBusinessId("71");
-        row.setOriginalName("evidence.pdf"); row.setContentType("application/pdf");
-        row.setObjectKey("business-files/0/71/evidence.pdf"); row.setSizeBytes(pdf().getSize());
-        row.setSha256("a".repeat(64)); row.setCreatedAt(java.time.LocalDateTime.now());
-        when(files.selectOne(any())).thenAnswer(call -> {
-            LambdaQueryWrapper<FileObjectEntity> query = call.getArgument(0);
-            assertThat(boundValue(query, "status")).isEqualTo("ACTIVE");
-            assertThat(boundValue(query, "deleted")).isEqualTo(false);
-            return Long.valueOf(0).equals(boundValue(query, "tenant_id"))
-                && type.equals(boundValue(query, "business_type"))
-                && "71".equals(boundValue(query, "business_id"))
-                && Long.valueOf(501).equals(boundValue(query, "id")) ? row : null;
-        });
-        when(storage.read(row.getObjectKey())).thenReturn(pdf().getBytes());
-        var metadata = service.metadata(0, type, "71", 501);
-        assertThat(metadata.fileId()).isEqualTo(501L);
-        assertThat(metadata.ownerScope()).isEqualTo("PLATFORM");
-        assertThat(service.download(0, type, "71", 501).content()).isEqualTo(pdf().getBytes());
-        verify(storage).read(row.getObjectKey());
-        clearInvocations(storage);
-        String otherType = VEHICLE.equals(type) ? DRIVER : VEHICLE;
-        for (String candidate : new String[]{otherType, "FLEET_DRIVER_LICENSE", "FLEET_TRIP_OPERATION_EVIDENCE"}) {
-            assertThatThrownBy(() -> service.metadata(0, candidate, "71", 501))
-                .isInstanceOf(BizException.class).hasMessageContaining("归属不匹配");
-            assertThatThrownBy(() -> service.download(0, candidate, "71", 501))
-                .isInstanceOf(BizException.class).hasMessageContaining("归属不匹配");
-        }
-        assertThatThrownBy(() -> service.metadata(0, type, "72", 501)).isInstanceOf(BizException.class);
-        assertThatThrownBy(() -> service.download(0, type, "72", 501)).isInstanceOf(BizException.class);
-        assertThatThrownBy(() -> service.metadata(0, type, "71", 502)).isInstanceOf(BizException.class);
-        assertThatThrownBy(() -> service.download(0, type, "71", 502)).isInstanceOf(BizException.class);
-        verifyNoInteractions(storage);
-    }
-
-    /** 内部服务令牌在业务访问前校验，不对未授权请求暴露元数据或文件。 */
-    @ParameterizedTest
-    @ValueSource(strings = {VEHICLE, DRIVER})
-    void invalidInternalTokenCannotUploadReadMetadataOrDownload(String type) {
-        var service = mock(InternalBusinessFileService.class);
-        var controller = new InternalBusinessFileController();
-        ReflectionTestUtils.setField(controller, "expected", "dispatch-test-token");
-        ReflectionTestUtils.setField(controller, "service", service);
-        for (String token : new String[]{null, "", "wrong-token"}) {
-            assertThatThrownBy(() -> controller.upload(token, 7, 0, type, "71", pdf())).isInstanceOf(BizException.class);
-            assertThatThrownBy(() -> controller.metadata(token, 0, type, "71", 501)).isInstanceOf(BizException.class);
-            assertThatThrownBy(() -> controller.download(token, 0, type, "71", 501)).isInstanceOf(BizException.class);
-        }
-        verifyNoInteractions(service);
-    }
-
-    /** 从实际 SQL 绑定中取指定列的等值条件，缺少任一隔离条件直接失败。 */
-    private static Object boundValue(LambdaQueryWrapper<FileObjectEntity> query, String column) {
-        var matcher = Pattern.compile("(?<![A-Za-z0-9_])" + column
-            + " = #\\{ew\\.paramNameValuePairs\\.([^}]+)}").matcher(query.getSqlSegment());
-        assertThat(matcher.find()).as("复合归属条件 %s", column).isTrue();
-        return query.getParamNameValuePairs().get(matcher.group(1));
-    }
-
-    /** 创建隔离临时目录中的真实存储，不访问运行环境。 */
-    private BusinessFileStorage storage() {
-        var storage = new BusinessFileStorage();
-        ReflectionTestUtils.setField(storage, "configuredRoot", root);
-        storage.initializeRoot();
-        return storage;
-    }
-
-    /** 复用生产服务，数据库边界由 Mapper 替身记录实际查询。 */
-    private InternalBusinessFileService service(FileObjectMapper files, BusinessFileStorage storage) {
-        var service = new InternalBusinessFileService();
-        ReflectionTestUtils.setField(service, "files", files);
-        ReflectionTestUtils.setField(service, "storage", storage);
-        return service;
-    }
-
-    /** 提供具有真实 PDF 文件头的最小上传内容。 */
-    private static MockMultipartFile pdf() {
-        return new MockMultipartFile("file", "evidence.pdf", "application/pdf",
-            "%PDF-1.7\nevidence".getBytes(StandardCharsets.US_ASCII));
-    }
-
-    /** 使用图像编码器生成真实 JPG、PNG，避免测试只验证扩展名。 */
-    private static byte[] image(String format) throws java.io.IOException {
-        var output = new ByteArrayOutputStream();
-        var image = new java.awt.image.BufferedImage(2, 2, java.awt.image.BufferedImage.TYPE_INT_RGB);
-        assertThat(javax.imageio.ImageIO.write(image, format, output)).isTrue();
-        return output.toByteArray();
-    }
-}

lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoService.java

@@ -35,6 +35,11 @@ public class AppointmentCargoService {
         return new PageResult<>(rows, page, size, total, (total + size - 1) / size);
     }
 
+    /** 查询下拉框与货物分页共用权威目录范围，不从当前页猜测目的仓。 */
+    public List<String> destinations() {
+        return scope().destinations().stream().distinct().sorted().toList();
+    }
+
     private record Scope(List<String> origins, List<String> destinations) { }
     private Scope scope() {
         final List<AppointmentWarehouseClient.Warehouse> catalog;

lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentPlanningController.java

@@ -53,6 +53,14 @@ public class AppointmentPlanningController {
         return ApiResponse.success(new Resolved(source,result.get(0)));
     }
 
+    /** 目的仓选项沿用货物查询权限，只返回同范围的美国FBA仓码。 */
+    @GetMapping("/cargo/destinations")
+    @PreAuthorize("hasAuthority('platform:appointment:list') and hasAuthority('platform:overseas-warehouse:last-mile-order:list')")
+    public ApiResponse<java.util.List<String>> destinations(@AuthenticationPrincipal AuthenticatedUser user) {
+        requirePlatform(user);
+        return ApiResponse.success(service.destinations());
+    }
+
     @GetMapping("/cargo")
     @PreAuthorize("hasAuthority('platform:appointment:list') and hasAuthority('platform:overseas-warehouse:last-mile-order:list')")
     public ApiResponse<PageResult<AppointmentCargo>> cargo(@AuthenticationPrincipal AuthenticatedUser user,

lastleg-service/src/main/resources/openapi/appointment-planning-v1.yaml

@@ -6,6 +6,26 @@ info:
 security:
   - bearerAuth: []
 paths:
+  /api/platform/v1/last-leg/appointment-planning/cargo/destinations:
+    get:
+      operationId: listAppointmentCargoDestinations
+      summary: 读取预约货物查询的目的FBA仓选项
+      description: >-
+        仅平台；同时要求platform:appointment:list与platform:overseas-warehouse:last-mile-order:list。
+        与货物分页共用权威启用美国FBA目录，返回去重、按仓码排序的完整选项，不受货物当前分页或关键词限制。
+        不增加仓库主档读取权限；目录失败返回503，不当作空选项。
+      responses:
+        '200':
+          description: 业务响应；data为目的FBA仓码数组
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  data: {type: array, items: {type: string}, example: [ABE4, ONT8]}
+        '403': {description: 非平台或缺少任一读取权限}
+        '503': {description: 权威目录不可用}
   /api/platform/v1/last-leg/appointment-planning/sources/resolve-order:
     get:
       operationId: resolveOrderAppointmentSource

lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoServiceTest.java

@@ -8,6 +8,21 @@ import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.Mockito.*;
 
 class AppointmentCargoServiceTest {
+    /** 选项取完整权威美国FBA目录，不依赖当前页货物或新增仓库主档权限。 */
+    @Test void destinationOptionsUseTheSameAmericanFbaScopeWithoutQueryingCargoRows() {
+        var mapper = mock(AppointmentCargoMapper.class);
+        var warehouses = mock(AppointmentWarehouseClient.class);
+        when(warehouses.catalog("token")).thenReturn(ApiResponse.success(List.of(
+            new AppointmentWarehouseClient.Warehouse(1L,"US-WH","美国仓","OVERSEAS","US"),
+            new AppointmentWarehouseClient.Warehouse(2L,"ONT8","ONT8","FBA","US"),
+            new AppointmentWarehouseClient.Warehouse(3L,"ABE4","ABE4","FBA","US"),
+            new AppointmentWarehouseClient.Warehouse(4L,"YYZ1","YYZ1","FBA","CA"),
+            new AppointmentWarehouseClient.Warehouse(5L,"ONT8","ONT8","FBA","US"))));
+        assertEquals(List.of("ABE4","ONT8"),new AppointmentCargoService(mapper,warehouses,"token").destinations());
+        verifyNoInteractions(mapper);
+        when(warehouses.catalog("token")).thenThrow(new IllegalStateException("offline"));
+        assertEquals(503,assertThrows(ResponseStatusException.class,()->new AppointmentCargoService(mapper,warehouses,"token").destinations()).getStatusCode().value());
+    }
     @Test void authenticUsDirectoryScopesTheDatabaseQueryAndPreservesServerPagination() {
         var mapper = mock(AppointmentCargoMapper.class);
         var warehouses = mock(AppointmentWarehouseClient.class);

lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentPlanningAuthorizationTest.java

@@ -17,6 +17,20 @@ import static org.mockito.Mockito.*;
 
 class AppointmentPlanningAuthorizationTest {
     private static final String LIST="platform:appointment:list", CARGO="platform:overseas-warehouse:last-mile-order:list", WRITE="platform:appointment:followup";
+    /** 目的仓选项不要求仓库管理权限，但保留原两项读取权限和平台身份边界。 */
+    @Test void destinationOptionsRequireTheExistingCargoReadPermissionsAndPlatformIdentity() {
+        try(var context=new AnnotationConfigApplicationContext(Config.class)) {
+            var controller=context.getBean(AppointmentPlanningController.class);
+            var service=context.getBean(AppointmentCargoService.class);
+            login(LIST);assertThrows(AccessDeniedException.class,()->controller.destinations(user(0L,"PLATFORM")));
+            login(CARGO);assertThrows(AccessDeniedException.class,()->controller.destinations(user(0L,"PLATFORM")));
+            login(LIST,CARGO);
+            assertThrows(ResponseStatusException.class,()->controller.destinations(user(1L,"CLIENT")));
+            verifyNoInteractions(service);
+            when(service.destinations()).thenReturn(List.of("ABE4","ONT8"));
+            assertEquals(List.of("ABE4","ONT8"),controller.destinations(user(0L,"PLATFORM")).data());
+        } finally { SecurityContextHolder.clearContext(); }
+    }
     @Test void orderLookupUsesCanonicalBookingSourceAndEnforcesCustomerAndReadPermissions() {
         try(var context=new AnnotationConfigApplicationContext(Config.class)) {
             var controller=context.getBean(AppointmentPlanningController.class);

order/src/main/java/com/baiyue/order/dto/OrderRequests.java

@@ -81,7 +81,9 @@ public final class OrderRequests {
             @Schema(description = "Selected customer pickup address ID; required for PICKUP / 已选客户取货地址 ID；PICKUP 时必填")
             @Min(1) Long senderAddressId,
             @Schema(description = "Selected private destination address ID; required for PRIVATE / 已选私人目的仓地址 ID；PRIVATE 时必填")
-            @Min(1) Long privateDestinationAddressId
+            @Min(1) Long privateDestinationAddressId,
+            @Schema(description = "Optional customer courier tracking number for SELF_EXPRESS / 快递自提选填快递单号；其他取货方式不保存", maxLength = 128)
+            @Size(max = 128) String expressTrackingNo
     ) {
         public SaveRequest(Long customerId, String customerName, String transportMode, String tradeTerm,
                            String destinationCountryCode, Long destinationWarehouseId,
@@ -98,7 +100,7 @@ public final class OrderRequests {
                 sender, receiver, cargoes, pickupMethod, requestedPickupAt, receivingWarehouseId,
                 receivingWarehouseName, channelCode, channelName, carrierId, carrierName, taxMode,
                 pricingTaxMode, containerMode, customsInspection, destinationType, amazonWarehouseCode,
-                shipmentId, referenceId, inboundCode, fulfillmentType, null, null, null);
+                shipmentId, referenceId, inboundCode, fulfillmentType, null, null, null, null);
         }
 
         public SaveRequest(Long customerId, String customerName, String transportMode, String tradeTerm,
@@ -116,7 +118,7 @@ public final class OrderRequests {
                 sender, receiver, cargoes, pickupMethod, requestedPickupAt, receivingWarehouseId,
                 receivingWarehouseName, channelCode, channelName, carrierId, carrierName, taxMode,
                 pricingTaxMode, containerMode, customsInspection, destinationType, amazonWarehouseCode,
-                shipmentId, referenceId, inboundCode, null, null, null, null);
+                shipmentId, referenceId, inboundCode, null, null, null, null, null);
         }
 
         public SaveRequest(Long customerId, String customerName, String transportMode, String tradeTerm,
@@ -133,7 +135,7 @@ public final class OrderRequests {
                 sender, receiver, cargoes, pickupMethod, requestedPickupAt, receivingWarehouseId,
                 receivingWarehouseName, channelCode, channelName, carrierId, carrierName, taxMode,
                 pricingTaxMode, containerMode, customsInspection, destinationType, amazonWarehouseCode,
-                shipmentId, referenceId, null, null, null, null, null);
+                shipmentId, referenceId, null, null, null, null, null, null);
         }
 
         public SaveRequest(Long customerId, String customerName, String transportMode, String tradeTerm,
@@ -150,7 +152,7 @@ public final class OrderRequests {
                 sender, receiver, cargoes, pickupMethod, null, receivingWarehouseId,
                 receivingWarehouseName, channelCode, channelName, carrierId, carrierName, taxMode,
                 pricingTaxMode, containerMode, customsInspection, destinationType, amazonWarehouseCode,
-                shipmentId, referenceId, null, null, null, null, null);
+                shipmentId, referenceId, null, null, null, null, null, null);
         }
 
         @AssertTrue(message = "承运商 ID 和名称必须同时填写或同时留空")

order/src/main/java/com/baiyue/order/service/OrderApplicationService.java

@@ -642,6 +642,7 @@ public class OrderApplicationService {
             default -> false;
         };
     }
+    // 保存客户下单资料；快递单号仅属于快递自提，切换方式时清空避免误带。
     private void apply(OrderEntity order, long tenantId, OrderRequests.SaveRequest request,
                        OrderMasterDataGuard.Snapshots snapshots, AddressSnapshots addresses,
                        boolean allowLegacyInboundCode) {
@@ -662,6 +663,10 @@ public class OrderApplicationService {
         order.setExpectedArrivalAt(request.expectedShipDate() == null ? null : request.expectedShipDate().atStartOfDay());
         order.setCustomerRemark(request.customerRemark());
         order.setPickupMethod(request.pickupMethod());
+        if (order.getStatus() == OrderStatus.DRAFT || order.getStatus() == OrderStatus.REJECTED) {
+            order.setExpressTrackingNo("SELF_EXPRESS".equals(request.pickupMethod())
+                ? normalizeRemark(request.expressTrackingNo()) : null);
+        }
         order.setRequestedPickupAt("PICKUP".equals(request.pickupMethod()) ? request.requestedPickupAt() : null);
         order.setReceivingWarehouseId(request.receivingWarehouseId());
         order.setReceivingWarehouseName(snapshots.receiving().warehouse().warehouseName());

order/src/main/java/com/baiyue/order/service/PlatformLegacyOrderImportService.java

@@ -162,7 +162,7 @@ public class PlatformLegacyOrderImportService {
             "买单".equals(required(row, 5, "买单/退税")) ? "BUY_DECLARATION" : "TAX_REFUND",
             channel.channelName().contains("包税") && !channel.channelName().contains("不包税") ? "TAX_INCLUDED" : "TAX_EXCLUDED",
             "LCL", false, destinationType, amazonCode, shipmentId, referenceId, inboundCode, fulfillmentType,
-            "ONE_CLICK_DROPSHIP".equals(fulfillmentType) ? referenceId : null, null, null);
+            "ONE_CLICK_DROPSHIP".equals(fulfillmentType) ? referenceId : null, null, null, null);
     }
 
     private Customer fixedCustomer() {

order/src/main/resources/openapi/order-v1.yaml

@@ -1451,6 +1451,7 @@ components:
         pricingTaxMode: {$ref: '#/components/schemas/PricingTaxMode'}
         senderAddressId: {type: string, pattern: '^[1-9][0-9]*$', description: PICKUP 时必填；必须是本客户 PICKUP 地址}
         privateDestinationAddressId: {type: string, pattern: '^[1-9][0-9]*$', description: PRIVATE 时必填；必须是本客户 PRIVATE_DESTINATION 地址}
+        expressTrackingNo: {type: string, nullable: true, maxLength: 128, description: 快递自提（SELF_EXPRESS）时选填；留空清空单号，其他取货方式不保存。客户仅能在下单或编辑草稿时填写}
         customsInspection: {type: boolean, nullable: true, description: 非木制品可空；任一货物 woodenProduct=true 时必须为 true}
         cargoes:
           type: array

order/src/test/java/com/baiyue/order/controller/MerchantOrderCommandBindingTest.java

@@ -52,6 +52,24 @@ class MerchantOrderCommandBindingTest {
         }).build();
     }
 
+    /** 客户创建入口绑定选填单号，并拒绝超过持久化长度的输入。 */
+    @Test
+    void courierTrackingIsOptionalAndLengthBoundedOnCreate() throws Exception {
+        String createPath = "/api/merchant/v1/orders/first-leg";
+        for (String tracking : new String[] {null, "", "SF123456789"}) {
+            String body = tracking == null ? DRAFT : DRAFT.replace("\"customerName\"", "\"expressTrackingNo\":\"" + tracking + "\",\"customerName\"");
+            mvc.perform(post(createPath).header("Idempotency-Key", "courier-create").contentType(MediaType.APPLICATION_JSON).content(body))
+                .andExpect(status().isOk()).andExpect(jsonPath("$.code").value("200"));
+            verify(service).createDraft(eq(11L), eq(7L), eq("operator"),
+                argThat(request -> java.util.Objects.equals(tracking, request.expressTrackingNo())), eq("courier-create"));
+        }
+        clearInvocations(service);
+        String invalid = DRAFT.replace("\"customerName\"", "\"expressTrackingNo\":\"" + "A".repeat(129) + "\",\"customerName\"");
+        mvc.perform(post(createPath).header("Idempotency-Key", "courier-create").contentType(MediaType.APPLICATION_JSON).content(invalid))
+            .andExpect(status().isBadRequest());
+        verifyNoInteractions(service);
+    }
+
     @Test
     void platformEditRequiresVersionEnvelopeAndKey() throws Exception {
         String path = "/api/platform/v1/orders/first-leg/1?tenantId=11";

order/src/test/java/com/baiyue/order/service/OrderApplicationServiceStateTest.java

@@ -111,6 +111,58 @@ class OrderApplicationServiceStateTest {
             && order.getInboundCode() == null && "STANDARD".equals(order.getFulfillmentType())));
     }
 
+    /** 快递草稿支持填写或留空单号，非快递方式不能携带单号。 */
+    @Test
+    void courierDraftPersistsOptionalTrackingNumber() {
+        for (String pickupMethod : List.of("SELF_EXPRESS", "SELF_TRUCK")) {
+            for (String tracking : List.of("  SF123456789  ", "", "   ")) {
+                var json = new ObjectMapper().valueToTree(request(null, pickupMethod, null, null, "OVERSEAS"));
+                ((com.fasterxml.jackson.databind.node.ObjectNode) json).put("expressTrackingNo", tracking);
+                ((com.fasterxml.jackson.databind.node.ObjectNode) json).remove("carrierSnapshotComplete");
+                var draft = new ObjectMapper().convertValue(json, OrderRequests.SaveRequest.class);
+                OrderRepository repository = mock(OrderRepository.class);
+                OrderMasterDataGuard masterData = mock(OrderMasterDataGuard.class);
+                when(masterData.validate(10001L, draft)).thenReturn(snapshots());
+                when(repository.completeIdempotency(anyLong(), any(), anyLong())).thenReturn(1);
+
+                service(repository, mock(OrderEligibilityGuard.class), masterData)
+                    .createDraft(10001L, 2L, draft, "courier-draft");
+
+                String expected = "SELF_EXPRESS".equals(pickupMethod) && !tracking.isBlank()
+                    ? tracking.trim() : null;
+                verify(repository).insertOrder(argThat(saved -> java.util.Objects.equals(expected, saved.getExpressTrackingNo())));
+            }
+        }
+    }
+
+    /** 修改草稿允许更换、清空单号，切换交货方式后不保留旧单号。 */
+    @Test
+    void editingCourierDraftReplacesOrClearsTrackingNumber() {
+        for (String pickupMethod : List.of("SELF_EXPRESS", "SELF_TRUCK")) {
+            for (String tracking : List.of("  SF-NEW  ", "")) {
+                var json = new ObjectMapper().valueToTree(request(null, pickupMethod, null, null, "OVERSEAS"));
+                ((com.fasterxml.jackson.databind.node.ObjectNode) json).put("expressTrackingNo", tracking);
+                ((com.fasterxml.jackson.databind.node.ObjectNode) json).remove("carrierSnapshotComplete");
+                var draft = new ObjectMapper().convertValue(json, OrderRequests.SaveRequest.class);
+                var order = persistedOrder(OrderStatus.DRAFT);
+                order.setExpressTrackingNo("SF-OLD");
+                OrderRepository repository = mock(OrderRepository.class);
+                OrderMasterDataGuard masterData = mock(OrderMasterDataGuard.class);
+                when(repository.findOwned(10001L, 1L)).thenReturn(order);
+                when(repository.saveOrder(10001L, order)).thenReturn(1);
+                when(repository.completeIdempotency(anyLong(), any(), anyLong())).thenReturn(1);
+                when(masterData.validate(10001L, draft)).thenReturn(snapshots());
+
+                service(repository, mock(OrderEligibilityGuard.class), masterData).updateDraft(10001L, 2L, 1L,
+                    new OrderRequests.DraftUpdateRequest(0, draft), "courier-edit");
+
+                assertThat(order.getExpressTrackingNo()).isEqualTo(
+                    "SELF_EXPRESS".equals(pickupMethod) && !tracking.isBlank() ? tracking.trim() : null);
+                verify(repository).saveOrder(10001L, order);
+            }
+        }
+    }
+
     @Test
     void creatingDraftPreservesProductImageDimensionsAndRemark() {
         OrderRepository repository = mock(OrderRepository.class);

scripts/admin-test-env-modules/README.md

@@ -172,7 +172,7 @@ export async function run(context) {
 
 `dropship-browser-fixture.mjs` 通过总入口 `--modules dropship-browser-fixture` 执行，自动依赖客户资质准备；复用矩阵生产者创建一票四箱两托，完成国内装柜、船节点和按柜生成海外入库计划，明确停在 `READY_FOR_BROWSER_RECEIVING`。只准备新测试数据，不调用海外 PDA 收货或出库、不创建海外操作员；后续由浏览器页面验收。报告仍保存于 `createdResources.dropshipPalletMatrix`，准备通过不代表全流程通过，不自动删除数据。
 
-`dropship-mixed-palletization.mjs` 通过总入口 `--modules dropship-mixed-palletization` 执行，自动依赖客户资质准备。经正式 HTTP 创建两客户三票一件代发（2/3/1 个物理箱，每箱两个 SKU），完成下单审核和测量，交替调用跨客户箱码预览、领取、清点、先箱后托批绑、移回/归回、六箱混托封托、解封和重新封托。核对客户/入仓单/SKU/数量守恒、只读识别无写入、同键重放、未知码/跨仓拒绝及逐票待分柜；结果保存在 `createdResources.dropshipMixedPalletization`。使用显式目标环境文件，开发机获授权时 Gateway 必须显式指向本机。会创建并保留客户、订单、测量与托盘数据，不自动清理；失败必须检查报告，重跑创建新批次。终点为 `MIXED_PALLET_SEALED_VERIFIED`，不代表装柜、海外履约或 Android 真机验收通过。
+`dropship-mixed-palletization.mjs` 通过总入口 `--modules dropship-mixed-palletization` 执行，自动依赖客户资质准备。经正式 HTTP 创建两客户三票一件代发（2/3/1 个物理箱，每箱两个 SKU），完成下单审核和测量，交替调用跨客户箱码预览、领取、清点、先箱后托批绑、移回/归回、六箱混托封托、解封和重新封托。核对客户/入仓单/SKU/数量守恒、只读识别无写入、同键重放、未知码/跨仓拒绝及逐票待分柜；结果保存在 `createdResources.dropshipMixedPalletization`。另外保留四票已测量、未领取未组托样本：同客户两票（2/1 箱）和跨客户两票（2/3 箱），逐票核对 Admin `WAIT_PALLETIZE` 列表可见，保存 `manualRecords` 和 `manualStage=WAIT_PALLETIZE_VISIBLE`。显式启用 `orders` 的 `orderFixtureOnly` 来源生产范围，保留审核收敛、重放与受理启动，默认订单全量验收仍覆盖申报修改；称重复用当前仓已有托盘，不要求固定编号。使用显式目标环境文件，开发机获授权时 Gateway 必须显式指向本机。会创建并保留客户、订单、测量与托盘数据，不自动清理；失败必须检查报告，重跑创建新批次。终点为 `MIXED_PALLET_SEALED_VERIFIED`，不代表装柜、海外履约或 Android 真机验收通过。离线合同为 `dropship-mixed-palletization-contract.test.mjs`。
 
 `dropship-pallet-matrix.mjs` 验证下述四场景整托手工加入、整托移除、智能推荐、独立订舱与文件放舱、真实柜号关联、预装确认、PDA 整托拣货和五类证据上传；异步装柜完成必须等到任务 `COMPLETED` 并逐票回查 `LOADED`。智能装柜的托盘汇总与装柜详情逐票组成分别核对，不能把共托汇总行的首票编号当作全托归属。随后经正式报关、国内离仓及人工船节点接口推进至 `PICKUP_READY`，再按柜生成逐票海外入库计划，检查来源托盘完整绑定、共享托盘身份一致和同键重放。海外收货使用本轮创建并绑定接柜仓的 PDA 操作员，上传三类照片、签收、逐实物托盘收货、逐票箱数核平和完成入库，同键重放及同托新键扫码均不得重复入账。随后从本轮逐票库存候选创建一件代发专用出库，携带原始箱唛由 PDA 拣货、完成，核对终态、幂等和可用库存扣减；finally 停用本轮操作员。出库重放按业务身份和数据库毫秒时间精度核对。离线合同为 `dropship-pallet-matrix-contract.test.mjs`；脚本覆盖不等于真实 HTTP 已通过，须检查当轮报告和库存审计。
 

scripts/admin-test-env-modules/dropship-mixed-palletization-contract.test.mjs

@@ -0,0 +1,33 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+
+const source = readFileSync(new URL('./dropship-mixed-palletization.mjs', import.meta.url), 'utf8')
+const orders = readFileSync(new URL('./orders.mjs', import.meta.url), 'utf8')
+
+test('mixed pallet acceptance uses formal producers and fails on any failed preparation assertion', () => {
+  assert.match(source, /await createOrder\(context\)/)
+  assert.match(source, /await measure\(context\)/)
+  assert.match(source, /!context.steps.slice\(start\).some\(\(step\) => !step.passed\)/)
+  assert.match(source, /if \(!passed\) throw new Error/)
+  assert.match(source, /context.context.allowAnyExistingPallet = true/)
+})
+
+test('retained manual fixtures cover same and different customers and remain visible and unclaimed', () => {
+  assert.match(source, /\[2, 1, 2, 3\].entries\(\)/)
+  assert.match(source, /index < 3 \? savedContext.merchantQualificationFixture : secondCustomer/)
+  assert.match(source, /index < 2 \? 'SAME_CUSTOMER' : 'CROSS_CUSTOMER'/)
+  assert.match(source, /mainStatus=WAIT_PALLETIZE&inboundCode=/)
+  assert.match(source, /task.taskStatus === 'PENDING' && task.countedCartons === 0 && task.boundCartons === 0/)
+  assert.match(source, /result.manualStage = 'WAIT_PALLETIZE_VISIBLE'/)
+})
+
+test('explicit order producer scope preserves approval convergence and default declaration acceptance', () => {
+  const branch = orders.indexOf('if (context.context.orderFixtureOnly === true)')
+  assert.ok(branch > orders.indexOf('const inboundResult = await waitForInbound'))
+  assert.ok(branch > orders.indexOf('await verifyOrderApprovalReplay(context'))
+  assert.ok(branch < orders.indexOf('const editableDetailResponse'))
+  assert.match(orders.slice(branch, orders.indexOf('const editableDetailResponse')), /await finishOrderLifecycle\(context/)
+  assert.match(orders, /申报修改保持订单号入仓码和渠道且版本递增/)
+  assert.match(orders, /申报修改异步同步到Firstleg入库事实/)
+})

scripts/admin-test-env-modules/dropship-mixed-palletization.mjs

@@ -12,6 +12,7 @@ export async function run(context) {
   const savedContext = { ...context.context }
   const originalManualCount = context.options.prepareDropshipManualCount
   const records = []
+  let secondCustomer = null
   const result = { marker: originalMarker, stage: 'PREPARING', records, fullFlowVerified: false }
   context.createdResources.dropshipMixedPalletization = result
   function check(name, response, passed, details = '') {
@@ -32,11 +33,13 @@ export async function run(context) {
     return command(`${record.label}回查任务`, 'GET', `${BASE}/tasks/${record.source.taskId}?warehouseId=${record.source.warehouseId}`)
   }
   try {
+    context.context.orderFixtureOnly = true
+    context.context.allowAnyExistingPallet = true
     check('存在本轮已审核客户', null, Boolean(context.context.merchantQualificationFixture?.tenantId))
     for (const [index, count] of [2, 3, 1].entries()) {
       const label = ['A-2BOX', 'B-3BOX', 'B-1BOX'][index]
       context.marker = `${originalMarker}-${label}`
-      if (index === 1) await createCustomer(context, { publishEnvironment: false })
+      if (index === 1) { await createCustomer(context, { publishEnvironment: false }); secondCustomer = context.context.merchantQualificationFixture }
       for (const key of ['orders', 'inboundMeasurement', 'dropshipManualCount']) delete context.createdResources[key]
       for (const key of ['inboundWeightOcr', 'ocrInbound', 'testInbound', 'createdInbound']) delete context.context[key]
       context.context.orderDestinationType = 'OVERSEAS'
@@ -127,6 +130,33 @@ export async function run(context) {
     result.pallet = sealed.pallet; result.members = sealed.members; result.counted = counted
     result.stage = 'MIXED_PALLET_SEALED_VERIFIED'
     for (const record of records) record.task = await readTask(record)
+    // 保留同客户两票和跨客户两票独立样本，均停在未领取、未组托状态。
+    result.manualRecords = []
+    for (const [index, count] of [2, 1, 2, 3].entries()) {
+      context.marker = `${originalMarker}-MANUAL-${index + 1}`
+      context.context.merchantQualificationFixture = index < 3 ? savedContext.merchantQualificationFixture : secondCustomer
+      for (const key of ['orders', 'inboundMeasurement', 'dropshipManualCount']) delete context.createdResources[key]
+      for (const key of ['inboundWeightOcr', 'ocrInbound', 'testInbound', 'createdInbound']) delete context.context[key]
+      context.context.orderDestinationType = 'OVERSEAS'
+      context.context.orderFulfillmentType = 'ONE_CLICK_DROPSHIP'
+      context.context.waitSplitVariant = { skuCount: 2, packageCountPerSku: count, packageCounts: [count, count],
+        totalPackageCount: count, palletCount: 1, skuCodes: [`MANUAL-COMMON-${originalMarker}`.slice(-60), `MANUAL-SECOND-${originalMarker}`.slice(-60)] }
+      context.options.prepareDropshipManualCount = true
+      const start = context.steps.length
+      await createOrder(context)
+      await measure(context)
+      const source = context.createdResources.dropshipManualCount
+      check('人工打托样本正式下单测量通过', null, Boolean(source?.taskId) && !context.steps.slice(start).some((step) => !step.passed))
+      const order = { ...context.createdResources.orders }
+      const list = await command('回查一件代发打托列表可见', 'GET', `/api/platform/v1/orders?mainStatus=WAIT_PALLETIZE&inboundCode=${encodeURIComponent(source.inboundCode)}&page=1&size=20`)
+      const row = list.records?.find((item) => String(item.orderId) === order.orderId)
+      check('人工样本出现在用户的一件代发打托页签', null, Boolean(row) && row.mainStatus === 'WAIT_PALLETIZE')
+      const task = await readTask({ label: `MANUAL-${index + 1}`, source })
+      check('人工样本未领取未清点未归托', null, task.taskStatus === 'PENDING' && task.countedCartons === 0 && task.boundCartons === 0)
+      result.manualRecords.push({ label: `MANUAL-${index + 1}`, group: index < 2 ? 'SAME_CUSTOMER' : 'CROSS_CUSTOMER',
+        order, source: { ...source }, measurement: { ...context.createdResources.inboundMeasurement } })
+    }
+    result.manualStage = 'WAIT_PALLETIZE_VISIBLE'
   } finally {
     context.marker = originalMarker; context.context = savedContext
     context.options.prepareDropshipManualCount = originalManualCount

scripts/admin-test-env-modules/orders-contract.test.mjs

@@ -57,7 +57,7 @@ for (const [status, history] of [['PROCESSING', ['APPROVED', 'ACCEPTED', 'PROCES
 test('approved stop runs after full approval replay, inbound readiness and shared measurement handoff', () => {
   const source = readFileSync(new URL('./orders.mjs', import.meta.url), 'utf8')
   const run = source.slice(source.indexOf('export async function run('))
-  const finish = run.indexOf('await finishOrderLifecycle(')
+  const finish = run.lastIndexOf('await finishOrderLifecycle(')
   for (const fragment of ['await verifyOrderApprovalReplay(', '隔离入库单 marker 来源与可测量状态正确',
     'context.createdResources.orders.inboundId = inboundId', 'context.context.createdInbound =', '履约任务与本轮订单和客户一致']) {
     assert.ok(run.indexOf(fragment) >= 0 && run.indexOf(fragment) < finish, fragment)

scripts/admin-test-env-modules/orders.mjs

@@ -1110,6 +1110,25 @@ export async function run(context) {
   await verifyOrderApprovalReplay(context, { tenantId, orderId, inboundId,
     inboundCode: id(inboundResult.detail?.summary?.inboundCode) })
 
+  // 专项造单仅生产已审核的真实入库来源；默认全量验收仍继续验证申报修改。
+  if (context.context.orderFixtureOnly === true) {
+    const inbound = inboundResult.detail
+    Object.assign(context.createdResources.orders, {
+      inboundId, inboundCode: inbound.summary.inboundCode,
+      customerRemark: inbound.publicRemark,
+      internalRemark: `${context.marker} Admin 订单链路验收`,
+      cargoRemark: payload.cargoes?.[0]?.cargoRemark || null,
+      processStatus: inbound.summary.processStatus, taskId: id(inboundResult.task.id),
+      fixtureOnly: true,
+    })
+    const source = { tenantId, inboundId, marker: context.marker }
+    context.createdResources.ocrInbound = source
+    context.createdResources.testInbound = source
+    for (const key of ['inboundWeightOcr', 'ocrInbound', 'testInbound', 'createdInbound']) context.context[key] = source
+    await finishOrderLifecycle(context, { tenantId, orderId, firstLegDetailPath })
+    return
+  }
+
   const editableDetailResponse = await context.request('GET', firstLegDetailPath)
   const editableDetail = context.apiSuccess(MODULE, 'Admin 读取审核后客户申报资料', editableDetailResponse)
   const declarationDetail = editableDetail?.order?.order ? editableDetail.order : editableDetail