deploy/sql/头程数据库统一增量-MySQL8.sql

@@ -6329,6 +6329,8 @@ INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id,
 INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5107003,0,'PLATFORM','BUTTON',5107000,'platform:overseas-warehouse:warehouse-transfer:approve','审核仓储转运单',NULL,'POST',703,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0);
 INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5107004,0,'PLATFORM','BUTTON',5107000,'lastleg:cargo-discard:approve','审核货物废弃申请',NULL,'POST',704,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0);
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000001,5107004,0,CURRENT_TIMESTAMP(3));
+INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5107005,0,'PLATFORM','BUTTON',5107000,'lastleg:warehouse-transfer:manage','执行仓储转运',NULL,'POST',705,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0);
+INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000001,5107005,0,CURRENT_TIMESTAMP(3));
 INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5107010,0,'PLATFORM','MENU',0,'platform:overseas-warehouse:inbound-order:list','海外入仓单','/overseas-warehouse/inbound-orders','GET',710,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0);
 INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5107011,0,'PLATFORM','BUTTON',5107010,'platform:overseas-warehouse:inbound-order:create','创建海外入仓计划',NULL,'POST',711,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0);
 INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5107012,0,'PLATFORM','BUTTON',5107010,'platform:overseas-warehouse:inbound-order:edit','编辑海外入仓计划',NULL,'POST',712,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0);

iam/src/main/resources/db/lastleg-permissions.sql

@@ -23,6 +23,7 @@ VALUES
   (5107002,0,'PLATFORM','BUTTON',5107000,'platform:overseas-warehouse:last-mile-order:export','导出海外尾程订单',NULL,'GET',702,'ACTIVE',1,0),
   (5107003,0,'PLATFORM','BUTTON',5107000,'platform:overseas-warehouse:warehouse-transfer:approve','审核仓储转运单',NULL,'POST',703,'ACTIVE',1,0),
   (5107004,0,'PLATFORM','BUTTON',5107000,'lastleg:cargo-discard:approve','审核货物废弃申请',NULL,'POST',704,'ACTIVE',1,0),
+  (5107005,0,'PLATFORM','BUTTON',5107000,'lastleg:warehouse-transfer:manage','执行仓储转运',NULL,'POST',705,'ACTIVE',1,0),
   (5107010,0,'PLATFORM','MENU',0,'platform:overseas-warehouse:inbound-order:list','海外入仓单','/overseas-warehouse/inbound-orders','GET',710,'ACTIVE',1,0),
   (5107011,0,'PLATFORM','BUTTON',5107010,'platform:overseas-warehouse:inbound-order:create','创建海外入仓计划',NULL,'POST',711,'ACTIVE',1,0),
   (5107012,0,'PLATFORM','BUTTON',5107010,'platform:overseas-warehouse:inbound-order:edit','编辑海外入仓计划',NULL,'POST',712,'ACTIVE',1,0),

iam/src/test/java/com/baiyue/iam/repository/OverseasPhase4PermissionSqlContractTest.java

@@ -14,6 +14,29 @@ import java.util.regex.Pattern;
 import static org.assertj.core.api.Assertions.assertThat;
 
 class OverseasPhase4PermissionSqlContractTest {
+    @Test
+    void stockTransferExecutionPermissionIsSeededAndNotGrantedByWarehouseReadOnlyRoles() throws Exception {
+        String module = new ClassPathResource("db/lastleg-permissions.sql")
+            .getContentAsString(StandardCharsets.UTF_8);
+        Path root = Files.exists(Path.of("deploy/sql")) ? Path.of(".") : Path.of("..");
+        String unified = Files.readString(root.resolve("deploy/sql/头程数据库统一增量-MySQL8.sql"));
+        String controller = Files.readString(root.resolve(
+            "lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/WarehouseTransferController.java"));
+        String permission = "lastleg:warehouse-transfer:manage";
+        assertThat(controller).contains("MANAGE_PERMISSION = \"" + permission + "\"",
+            "requirePermission(user, MANAGE_PERMISSION)");
+        for (String sql : List.of(module, unified)) {
+            assertThat(sql).contains("(5107005,0,'PLATFORM','BUTTON',5107000,'" + permission
+                + "','执行仓储转运',NULL,'POST',705,'ACTIVE',1");
+        }
+        assertThat(module).contains("permission.id BETWEEN 5107000 AND 5107299",
+            "role.role_code='PLATFORM_ADMIN'");
+        assertThat(unified).contains("(4000001,5107005,0,CURRENT_TIMESTAMP(3))")
+            .doesNotContain("(4000004,5107005,0,CURRENT_TIMESTAMP(3))",
+                "(4000005,5107005,0,CURRENT_TIMESTAMP(3))",
+                "(4000006,5107005,0,CURRENT_TIMESTAMP(3))");
+    }
+
     private static final Pattern CANONICAL = Pattern.compile("platform:overseas-[a-z0-9:-]+");
     private static final Set<String> CUSTOM_ADMIN_PERMISSIONS = Set.of(
         "platform:overseas-warehouse:inbound-order:fba-appointment",
@@ -41,7 +64,8 @@ class OverseasPhase4PermissionSqlContractTest {
         "platform:overseas-master-data:driver:upload",
         "platform:overseas-master-data:vehicle:record-create",
         "platform:overseas-master-data:vehicle:record-edit",
-        "platform:overseas-master-data:vehicle:record-upload");
+        "platform:overseas-master-data:vehicle:record-upload",
+        "platform:overseas-master-data:vehicle:record-finance-submit");
 
     @Test
     void canonicalCatalogDisablesLegacyCodesAndExcludesFrozenDomains() throws Exception {
@@ -51,7 +75,7 @@ class OverseasPhase4PermissionSqlContractTest {
         assertThat(sql).contains(REQUIRED.toArray(String[]::new));
         assertThat(sql).contains("'lastleg:pda:operate'");
         assertPdaPickerGrant(sql);
-        assertThat(catalog).hasSize(68).noneMatch(code -> code.endsWith(":view"));
+        assertThat(catalog).hasSize(69).noneMatch(code -> code.endsWith(":view"));
         assertThat(sql).contains(
             "(5107003,0,'PLATFORM','BUTTON',5107000,'platform:overseas-warehouse:warehouse-transfer:approve'");
         assertThat(sql).contains("CALL assert_warehouse_transfer_approval_permission()",
@@ -117,7 +141,7 @@ class OverseasPhase4PermissionSqlContractTest {
     }
 
     @Test
-    void servicePermissionConstantsExactlyMatchTheIamCatalog() throws Exception {
+    void servicePermissionDeclarationsExactlyMatchTheIamCatalog() throws Exception {
         Set<String> moduleCatalog = codes(new ClassPathResource("db/lastleg-permissions.sql")
             .getContentAsString(StandardCharsets.UTF_8));
         codes(new ClassPathResource("db/phase5-delivery-permissions.sql")
@@ -129,6 +153,9 @@ class OverseasPhase4PermissionSqlContractTest {
             "lastleg-service/src/main/java/com/baiyue/lastleg/security/OverseasPermissions.java")));
         serviceCatalog.addAll(codes(repositoryFile(
             "warehouse-overseas-service/src/main/java/com/baiyue/warehouse/security/OverseasWarehousePermissions.java")));
+        // Vehicle care already declares this guard directly on its finance-submit facade.
+        serviceCatalog.addAll(codes(repositoryFile(
+            "lastleg-service/src/main/java/com/baiyue/lastleg/fleet/maintenance/PlatformVehicleCareFinanceController.java")));
 
         assertThat(serviceCatalog).containsExactlyInAnyOrderElementsOf(moduleCatalog);
     }