diff --git a/backend/.gitignore b/backend/.gitignore new file mode 100644 index 0000000..fd7b564 --- /dev/null +++ b/backend/.gitignore @@ -0,0 +1,4 @@ +target/ +*.iml +.idea/ +HELP.md diff --git a/backend/pom.xml b/backend/pom.xml new file mode 100644 index 0000000..bac8aeb --- /dev/null +++ b/backend/pom.xml @@ -0,0 +1,115 @@ + + + 4.0.0 + + + org.springframework.boot + spring-boot-starter-parent + 3.3.5 + + + + com.xly + erp-backend + 0.0.1-SNAPSHOT + erp-backend + 小羚羊 ERP backend + + + 17 + UTF-8 + 3.5.9 + 0.12.6 + + + + + org.springframework.boot + spring-boot-starter-web + + + org.springframework.boot + spring-boot-starter-validation + + + org.springframework.boot + spring-boot-starter-security + + + org.springframework.boot + spring-boot-starter-jdbc + + + + com.baomidou + mybatis-plus-spring-boot3-starter + ${mybatis-plus.version} + + + + com.mysql + mysql-connector-j + runtime + + + + org.flywaydb + flyway-core + + + org.flywaydb + flyway-mysql + + + + io.jsonwebtoken + jjwt-api + ${jjwt.version} + + + io.jsonwebtoken + jjwt-impl + ${jjwt.version} + runtime + + + io.jsonwebtoken + jjwt-jackson + ${jjwt.version} + runtime + + + + org.springframework.boot + spring-boot-starter-test + test + + + org.springframework.security + spring-security-test + test + + + + + + + org.springframework.boot + spring-boot-maven-plugin + + + org.apache.maven.plugins + maven-surefire-plugin + + + **/*Test.java + **/*Tests.java + **/*IT.java + + + + + + diff --git a/backend/src/main/java/com/xly/erp/ErpApplication.java b/backend/src/main/java/com/xly/erp/ErpApplication.java new file mode 100644 index 0000000..227f5e6 --- /dev/null +++ b/backend/src/main/java/com/xly/erp/ErpApplication.java @@ -0,0 +1,15 @@ +package com.xly.erp; + +import com.xly.erp.common.config.StubSecurityProperties; +import com.xly.erp.common.config.TenantProperties; +import org.springframework.boot.SpringApplication; +import org.springframework.boot.autoconfigure.SpringBootApplication; +import org.springframework.boot.context.properties.EnableConfigurationProperties; + +@SpringBootApplication +@EnableConfigurationProperties({TenantProperties.class, StubSecurityProperties.class}) +public class ErpApplication { + public static void main(String[] args) { + SpringApplication.run(ErpApplication.class, args); + } +} diff --git a/backend/src/main/java/com/xly/erp/common/config/MybatisPlusConfig.java b/backend/src/main/java/com/xly/erp/common/config/MybatisPlusConfig.java new file mode 100644 index 0000000..2762add --- /dev/null +++ b/backend/src/main/java/com/xly/erp/common/config/MybatisPlusConfig.java @@ -0,0 +1,9 @@ +package com.xly.erp.common.config; + +import org.mybatis.spring.annotation.MapperScan; +import org.springframework.context.annotation.Configuration; + +@Configuration +@MapperScan("com.xly.erp.module.**.mapper") +public class MybatisPlusConfig { +} diff --git a/backend/src/main/java/com/xly/erp/common/config/StubSecurityProperties.java b/backend/src/main/java/com/xly/erp/common/config/StubSecurityProperties.java new file mode 100644 index 0000000..c037c31 --- /dev/null +++ b/backend/src/main/java/com/xly/erp/common/config/StubSecurityProperties.java @@ -0,0 +1,25 @@ +package com.xly.erp.common.config; + +import org.springframework.boot.context.properties.ConfigurationProperties; + +@ConfigurationProperties(prefix = "erp.security") +public class StubSecurityProperties { + private String stubUserNo; + private String jwtSecret; + + public String getStubUserNo() { + return stubUserNo; + } + + public void setStubUserNo(String stubUserNo) { + this.stubUserNo = stubUserNo; + } + + public String getJwtSecret() { + return jwtSecret; + } + + public void setJwtSecret(String jwtSecret) { + this.jwtSecret = jwtSecret; + } +} diff --git a/backend/src/main/java/com/xly/erp/common/config/TenantProperties.java b/backend/src/main/java/com/xly/erp/common/config/TenantProperties.java new file mode 100644 index 0000000..21d53d6 --- /dev/null +++ b/backend/src/main/java/com/xly/erp/common/config/TenantProperties.java @@ -0,0 +1,25 @@ +package com.xly.erp.common.config; + +import org.springframework.boot.context.properties.ConfigurationProperties; + +@ConfigurationProperties(prefix = "erp.tenant") +public class TenantProperties { + private String brandsId; + private String subsidiaryId; + + public String getBrandsId() { + return brandsId; + } + + public void setBrandsId(String brandsId) { + this.brandsId = brandsId; + } + + public String getSubsidiaryId() { + return subsidiaryId; + } + + public void setSubsidiaryId(String subsidiaryId) { + this.subsidiaryId = subsidiaryId; + } +} diff --git a/backend/src/main/java/com/xly/erp/common/exception/BizException.java b/backend/src/main/java/com/xly/erp/common/exception/BizException.java new file mode 100644 index 0000000..87f9bb4 --- /dev/null +++ b/backend/src/main/java/com/xly/erp/common/exception/BizException.java @@ -0,0 +1,14 @@ +package com.xly.erp.common.exception; + +public class BizException extends RuntimeException { + private final int code; + + public BizException(int code, String msg) { + super(msg); + this.code = code; + } + + public int getCode() { + return code; + } +} diff --git a/backend/src/main/java/com/xly/erp/common/exception/GlobalExceptionHandler.java b/backend/src/main/java/com/xly/erp/common/exception/GlobalExceptionHandler.java new file mode 100644 index 0000000..542158b --- /dev/null +++ b/backend/src/main/java/com/xly/erp/common/exception/GlobalExceptionHandler.java @@ -0,0 +1,37 @@ +package com.xly.erp.common.exception; + +import com.xly.erp.common.response.Result; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.validation.FieldError; +import org.springframework.web.bind.MethodArgumentNotValidException; +import org.springframework.web.bind.annotation.ExceptionHandler; +import org.springframework.web.bind.annotation.RestControllerAdvice; + +@RestControllerAdvice +public class GlobalExceptionHandler { + + private static final Logger log = LoggerFactory.getLogger(GlobalExceptionHandler.class); + + @ExceptionHandler(BizException.class) + public Result handleBiz(BizException e) { + log.warn("BizException code={} msg={}", e.getCode(), e.getMessage()); + return Result.fail(e.getCode(), e.getMessage()); + } + + @ExceptionHandler(MethodArgumentNotValidException.class) + public Result handleValidation(MethodArgumentNotValidException e) { + FieldError fe = e.getBindingResult().getFieldError(); + String msg = fe == null + ? "参数校验失败" + : fe.getField() + ": " + fe.getDefaultMessage(); + log.warn("ValidationException {}", msg); + return Result.fail(40001, msg); + } + + @ExceptionHandler(Exception.class) + public Result handleAny(Exception e) { + log.error("Unhandled exception", e); + return Result.fail(50000, "系统繁忙"); + } +} diff --git a/backend/src/main/java/com/xly/erp/common/response/Result.java b/backend/src/main/java/com/xly/erp/common/response/Result.java new file mode 100644 index 0000000..19391ce --- /dev/null +++ b/backend/src/main/java/com/xly/erp/common/response/Result.java @@ -0,0 +1,52 @@ +package com.xly.erp.common.response; + +public class Result { + private int code; + private String msg; + private T data; + + public Result() { + } + + public Result(int code, String msg, T data) { + this.code = code; + this.msg = msg; + this.data = data; + } + + public static Result ok(T data) { + return new Result<>(0, "ok", data); + } + + public static Result ok() { + return new Result<>(0, "ok", null); + } + + public static Result fail(int code, String msg) { + return new Result<>(code, msg, null); + } + + public int getCode() { + return code; + } + + public void setCode(int code) { + this.code = code; + } + + public String getMsg() { + return msg; + } + + public void setMsg(String msg) { + this.msg = msg; + } + + public T getData() { + return data; + } + + public void setData(T data) { + this.data = data; + } +} diff --git a/backend/src/main/java/com/xly/erp/common/security/JwtAuthenticationFilter.java b/backend/src/main/java/com/xly/erp/common/security/JwtAuthenticationFilter.java new file mode 100644 index 0000000..a332602 --- /dev/null +++ b/backend/src/main/java/com/xly/erp/common/security/JwtAuthenticationFilter.java @@ -0,0 +1,66 @@ +package com.xly.erp.common.security; + +import com.fasterxml.jackson.databind.ObjectMapper; +import com.xly.erp.common.exception.BizException; +import com.xly.erp.common.response.Result; +import jakarta.servlet.FilterChain; +import jakarta.servlet.ServletException; +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpServletResponse; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; +import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.stereotype.Component; +import org.springframework.web.filter.OncePerRequestFilter; + +import java.io.IOException; +import java.nio.charset.StandardCharsets; +import java.util.Collections; + +@Component +public class JwtAuthenticationFilter extends OncePerRequestFilter { + + private static final String HEADER = "Authorization"; + private static final String PREFIX = "Bearer "; + + private final JwtUtil jwtUtil; + private final ObjectMapper objectMapper; + + @Autowired + public JwtAuthenticationFilter(JwtUtil jwtUtil, ObjectMapper objectMapper) { + this.jwtUtil = jwtUtil; + this.objectMapper = objectMapper; + } + + @Override + protected void doFilterInternal(HttpServletRequest request, + HttpServletResponse response, + FilterChain chain) throws ServletException, IOException { + String header = request.getHeader(HEADER); + if (header == null || !header.startsWith(PREFIX)) { + chain.doFilter(request, response); + return; + } + + String token = header.substring(PREFIX.length()); + String userNo; + try { + userNo = jwtUtil.parse(token); + } catch (BizException e) { + writeJsonResult(response, e.getCode(), e.getMessage()); + return; + } + + UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken( + userNo, null, Collections.emptyList()); + SecurityContextHolder.getContext().setAuthentication(auth); + chain.doFilter(request, response); + } + + private void writeJsonResult(HttpServletResponse response, int code, String msg) throws IOException { + response.setStatus(HttpServletResponse.SC_OK); + response.setContentType("application/json;charset=UTF-8"); + response.setCharacterEncoding(StandardCharsets.UTF_8.name()); + response.getWriter().write(objectMapper.writeValueAsString(Result.fail(code, msg))); + } +} diff --git a/backend/src/main/java/com/xly/erp/common/security/JwtUtil.java b/backend/src/main/java/com/xly/erp/common/security/JwtUtil.java new file mode 100644 index 0000000..45c8638 --- /dev/null +++ b/backend/src/main/java/com/xly/erp/common/security/JwtUtil.java @@ -0,0 +1,54 @@ +package com.xly.erp.common.security; + +import com.xly.erp.common.config.StubSecurityProperties; +import com.xly.erp.common.exception.BizException; +import io.jsonwebtoken.Jwts; +import io.jsonwebtoken.JwtException; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.stereotype.Component; + +import javax.crypto.SecretKey; +import javax.crypto.spec.SecretKeySpec; +import java.nio.charset.StandardCharsets; +import java.time.Duration; +import java.util.Date; + +@Component +public class JwtUtil { + + private static final Duration TTL = Duration.ofHours(8); + + private final SecretKey key; + + public JwtUtil(String secret) { + this.key = new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"); + } + + @Autowired + public JwtUtil(StubSecurityProperties props) { + this(props.getJwtSecret()); + } + + public String sign(String userNo) { + Date now = new Date(); + return Jwts.builder() + .subject(userNo) + .issuedAt(now) + .expiration(new Date(now.getTime() + TTL.toMillis())) + .signWith(key) + .compact(); + } + + public String parse(String token) { + try { + return Jwts.parser() + .verifyWith(key) + .build() + .parseSignedClaims(token) + .getPayload() + .getSubject(); + } catch (JwtException | IllegalArgumentException e) { + throw new BizException(20001, "未认证或 token 已失效"); + } + } +} diff --git a/backend/src/main/java/com/xly/erp/common/security/SecurityConfig.java b/backend/src/main/java/com/xly/erp/common/security/SecurityConfig.java new file mode 100644 index 0000000..f5dd50e --- /dev/null +++ b/backend/src/main/java/com/xly/erp/common/security/SecurityConfig.java @@ -0,0 +1,33 @@ +package com.xly.erp.common.security; + +import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.config.http.SessionCreationPolicy; +import org.springframework.security.web.SecurityFilterChain; +import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; + +@Configuration +@ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.SERVLET) +public class SecurityConfig { + + private final JwtAuthenticationFilter jwtFilter; + + public SecurityConfig(JwtAuthenticationFilter jwtFilter) { + this.jwtFilter = jwtFilter; + } + + @Bean + SecurityFilterChain filterChain(HttpSecurity http) throws Exception { + http.csrf(csrf -> csrf.disable()) + .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) + .authorizeHttpRequests(auth -> auth + // REQ-MOD-001 stub: see USR-004 follow-up — 角色硬校验在 USR-004 完成后回填为 hasAuthority('SUPER_ADMIN') + .requestMatchers("/api/mod/**").permitAll() + .anyRequest().authenticated() + ) + .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class); + return http.build(); + } +} diff --git a/backend/src/main/java/com/xly/erp/common/security/SecurityContextHelper.java b/backend/src/main/java/com/xly/erp/common/security/SecurityContextHelper.java new file mode 100644 index 0000000..d0b49ef --- /dev/null +++ b/backend/src/main/java/com/xly/erp/common/security/SecurityContextHelper.java @@ -0,0 +1,20 @@ +package com.xly.erp.common.security; + +import org.springframework.security.authentication.AnonymousAuthenticationToken; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.context.SecurityContextHolder; + +public final class SecurityContextHelper { + + private SecurityContextHelper() { + } + + public static String currentUserNo() { + Authentication auth = SecurityContextHolder.getContext().getAuthentication(); + if (auth == null || auth instanceof AnonymousAuthenticationToken) { + return null; + } + Object p = auth.getPrincipal(); + return p instanceof String s ? s : null; + } +} diff --git a/backend/src/main/java/com/xly/erp/module/mod/controller/ModuleController.java b/backend/src/main/java/com/xly/erp/module/mod/controller/ModuleController.java new file mode 100644 index 0000000..b067c29 --- /dev/null +++ b/backend/src/main/java/com/xly/erp/module/mod/controller/ModuleController.java @@ -0,0 +1,55 @@ +package com.xly.erp.module.mod.controller; + +import com.xly.erp.common.response.Result; +import com.xly.erp.module.mod.dto.CreateModuleDTO; +import com.xly.erp.module.mod.dto.UpdateModuleDTO; +import com.xly.erp.module.mod.service.ModuleService; +import com.xly.erp.module.mod.vo.ModuleTreeVO; +import jakarta.validation.Valid; +import org.springframework.web.bind.annotation.DeleteMapping; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.PathVariable; +import org.springframework.web.bind.annotation.PostMapping; +import org.springframework.web.bind.annotation.PutMapping; +import org.springframework.web.bind.annotation.RequestBody; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.RestController; + +import java.util.List; +import java.util.Map; + +@RestController +@RequestMapping("/api/mod") +public class ModuleController { + + private final ModuleService moduleService; + + public ModuleController(ModuleService moduleService) { + this.moduleService = moduleService; + } + + @PostMapping("/modules") + public Result> create(@Valid @RequestBody CreateModuleDTO dto) { + Integer id = moduleService.create(dto); + return Result.ok(Map.of("iIncrement", id)); + } + + @PutMapping("/modules/{id}") + public Result> update(@PathVariable Integer id, + @Valid @RequestBody UpdateModuleDTO dto) { + Integer updated = moduleService.update(id, dto); + return Result.ok(Map.of("iIncrement", updated)); + } + + @DeleteMapping("/modules/{id}") + public Result delete(@PathVariable Integer id) { + moduleService.delete(id); + return Result.ok(); + } + + @GetMapping("/modules") + public Result> list(@RequestParam(required = false) String keyword) { + return Result.ok(moduleService.listTree(keyword)); + } +} diff --git a/backend/src/main/java/com/xly/erp/module/mod/dto/CreateModuleDTO.java b/backend/src/main/java/com/xly/erp/module/mod/dto/CreateModuleDTO.java new file mode 100644 index 0000000..d9f982e --- /dev/null +++ b/backend/src/main/java/com/xly/erp/module/mod/dto/CreateModuleDTO.java @@ -0,0 +1,58 @@ +package com.xly.erp.module.mod.dto; + +import com.fasterxml.jackson.annotation.JsonProperty; +import jakarta.validation.constraints.NotBlank; +import jakarta.validation.constraints.Size; + +public class CreateModuleDTO { + + @JsonProperty("sDisplayType") + @NotBlank + private String sDisplayType; + + @JsonProperty("sProcedureName") + @NotBlank + @Size(max = 100) + private String sProcedureName; + + @JsonProperty("sModuleType") + @NotBlank + @Size(max = 50) + private String sModuleType; + + @JsonProperty("sManageDeptEn") + @NotBlank + @Size(max = 50) + private String sManageDeptEn; + + @JsonProperty("bShowPermission") + private Boolean bShowPermission; + + @JsonProperty("sModuleNameZh") + @NotBlank + @Size(max = 100) + private String sModuleNameZh; + + @JsonProperty("iParentId") + private Integer iParentId; + + @JsonProperty("iSortOrder") + private Integer iSortOrder; + + public String getSDisplayType() { return sDisplayType; } + public void setSDisplayType(String sDisplayType) { this.sDisplayType = sDisplayType; } + public String getSProcedureName() { return sProcedureName; } + public void setSProcedureName(String sProcedureName) { this.sProcedureName = sProcedureName; } + public String getSModuleType() { return sModuleType; } + public void setSModuleType(String sModuleType) { this.sModuleType = sModuleType; } + public String getSManageDeptEn() { return sManageDeptEn; } + public void setSManageDeptEn(String sManageDeptEn) { this.sManageDeptEn = sManageDeptEn; } + public Boolean getBShowPermission() { return bShowPermission; } + public void setBShowPermission(Boolean bShowPermission) { this.bShowPermission = bShowPermission; } + public String getSModuleNameZh() { return sModuleNameZh; } + public void setSModuleNameZh(String sModuleNameZh) { this.sModuleNameZh = sModuleNameZh; } + public Integer getIParentId() { return iParentId; } + public void setIParentId(Integer iParentId) { this.iParentId = iParentId; } + public Integer getISortOrder() { return iSortOrder; } + public void setISortOrder(Integer iSortOrder) { this.iSortOrder = iSortOrder; } +} diff --git a/backend/src/main/java/com/xly/erp/module/mod/dto/UpdateModuleDTO.java b/backend/src/main/java/com/xly/erp/module/mod/dto/UpdateModuleDTO.java new file mode 100644 index 0000000..476e684 --- /dev/null +++ b/backend/src/main/java/com/xly/erp/module/mod/dto/UpdateModuleDTO.java @@ -0,0 +1,51 @@ +package com.xly.erp.module.mod.dto; + +import com.fasterxml.jackson.annotation.JsonProperty; +import jakarta.validation.constraints.NotBlank; +import jakarta.validation.constraints.Size; + +public class UpdateModuleDTO { + + @JsonProperty("sDisplayType") + @NotBlank + private String sDisplayType; + + @JsonProperty("sModuleType") + @NotBlank + @Size(max = 50) + private String sModuleType; + + @JsonProperty("sManageDeptEn") + @NotBlank + @Size(max = 50) + private String sManageDeptEn; + + @JsonProperty("bShowPermission") + private Boolean bShowPermission; + + @JsonProperty("sModuleNameZh") + @NotBlank + @Size(max = 100) + private String sModuleNameZh; + + @JsonProperty("iParentId") + private Integer iParentId; + + @JsonProperty("iSortOrder") + private Integer iSortOrder; + + public String getSDisplayType() { return sDisplayType; } + public void setSDisplayType(String sDisplayType) { this.sDisplayType = sDisplayType; } + public String getSModuleType() { return sModuleType; } + public void setSModuleType(String sModuleType) { this.sModuleType = sModuleType; } + public String getSManageDeptEn() { return sManageDeptEn; } + public void setSManageDeptEn(String sManageDeptEn) { this.sManageDeptEn = sManageDeptEn; } + public Boolean getBShowPermission() { return bShowPermission; } + public void setBShowPermission(Boolean bShowPermission) { this.bShowPermission = bShowPermission; } + public String getSModuleNameZh() { return sModuleNameZh; } + public void setSModuleNameZh(String sModuleNameZh) { this.sModuleNameZh = sModuleNameZh; } + public Integer getIParentId() { return iParentId; } + public void setIParentId(Integer iParentId) { this.iParentId = iParentId; } + public Integer getISortOrder() { return iSortOrder; } + public void setISortOrder(Integer iSortOrder) { this.iSortOrder = iSortOrder; } +} diff --git a/backend/src/main/java/com/xly/erp/module/mod/entity/Module.java b/backend/src/main/java/com/xly/erp/module/mod/entity/Module.java new file mode 100644 index 0000000..ab122ff --- /dev/null +++ b/backend/src/main/java/com/xly/erp/module/mod/entity/Module.java @@ -0,0 +1,98 @@ +package com.xly.erp.module.mod.entity; + +import com.baomidou.mybatisplus.annotation.IdType; +import com.baomidou.mybatisplus.annotation.TableField; +import com.baomidou.mybatisplus.annotation.TableId; +import com.baomidou.mybatisplus.annotation.TableName; + +import java.time.LocalDateTime; + +@TableName("tModule") +public class Module { + + @TableId(value = "iIncrement", type = IdType.AUTO) + private Integer iIncrement; + + @TableField("sId") + private String sId; + + @TableField("sBrandsId") + private String sBrandsId; + + @TableField("sSubsidiaryId") + private String sSubsidiaryId; + + @TableField("tCreateDate") + private LocalDateTime tCreateDate; + + @TableField("sDisplayType") + private String sDisplayType; + + @TableField("sProcedureName") + private String sProcedureName; + + @TableField("sModuleType") + private String sModuleType; + + @TableField("sManageDeptEn") + private String sManageDeptEn; + + @TableField("bShowPermission") + private Boolean bShowPermission; + + @TableField("sModuleNameZh") + private String sModuleNameZh; + + @TableField("iParentId") + private Integer iParentId; + + @TableField("iSortOrder") + private Integer iSortOrder; + + @TableField("sCreatedBy") + private String sCreatedBy; + + @TableField("bDeleted") + private Boolean bDeleted; + + @TableField("tDeletedDate") + private LocalDateTime tDeletedDate; + + @TableField("sDeletedBy") + private String sDeletedBy; + + public Integer getIIncrement() { return iIncrement; } + public void setIIncrement(Integer iIncrement) { this.iIncrement = iIncrement; } + public String getSId() { return sId; } + public void setSId(String sId) { this.sId = sId; } + public String getSBrandsId() { return sBrandsId; } + public void setSBrandsId(String sBrandsId) { this.sBrandsId = sBrandsId; } + public String getSSubsidiaryId() { return sSubsidiaryId; } + public void setSSubsidiaryId(String sSubsidiaryId) { this.sSubsidiaryId = sSubsidiaryId; } + public LocalDateTime getTCreateDate() { return tCreateDate; } + public void setTCreateDate(LocalDateTime tCreateDate) { this.tCreateDate = tCreateDate; } + public String getSDisplayType() { return sDisplayType; } + public void setSDisplayType(String sDisplayType) { this.sDisplayType = sDisplayType; } + public String getSProcedureName() { return sProcedureName; } + public void setSProcedureName(String sProcedureName) { this.sProcedureName = sProcedureName; } + public String getSModuleType() { return sModuleType; } + public void setSModuleType(String sModuleType) { this.sModuleType = sModuleType; } + public String getSManageDeptEn() { return sManageDeptEn; } + public void setSManageDeptEn(String sManageDeptEn) { this.sManageDeptEn = sManageDeptEn; } + public Boolean getBShowPermission() { return bShowPermission; } + public void setBShowPermission(Boolean bShowPermission) { this.bShowPermission = bShowPermission; } + public String getSModuleNameZh() { return sModuleNameZh; } + public void setSModuleNameZh(String sModuleNameZh) { this.sModuleNameZh = sModuleNameZh; } + public Integer getIParentId() { return iParentId; } + public void setIParentId(Integer iParentId) { this.iParentId = iParentId; } + public Integer getISortOrder() { return iSortOrder; } + public void setISortOrder(Integer iSortOrder) { this.iSortOrder = iSortOrder; } + public String getSCreatedBy() { return sCreatedBy; } + public void setSCreatedBy(String sCreatedBy) { this.sCreatedBy = sCreatedBy; } + public Boolean getBDeleted() { return bDeleted; } + public void setBDeleted(Boolean bDeleted) { this.bDeleted = bDeleted; } + public LocalDateTime getTDeletedDate() { return tDeletedDate; } + public void setTDeletedDate(LocalDateTime tDeletedDate) { this.tDeletedDate = tDeletedDate; } + public String getSDeletedBy() { return sDeletedBy; } + public void setSDeletedBy(String sDeletedBy) { this.sDeletedBy = sDeletedBy; } +} diff --git a/backend/src/main/java/com/xly/erp/module/mod/mapper/ModuleMapper.java b/backend/src/main/java/com/xly/erp/module/mod/mapper/ModuleMapper.java new file mode 100644 index 0000000..421a3fc --- /dev/null +++ b/backend/src/main/java/com/xly/erp/module/mod/mapper/ModuleMapper.java @@ -0,0 +1,33 @@ +package com.xly.erp.module.mod.mapper; + +import com.baomidou.mybatisplus.core.mapper.BaseMapper; +import com.xly.erp.module.mod.entity.Module; +import org.apache.ibatis.annotations.Param; +import org.apache.ibatis.annotations.Select; + +import java.util.List; + +public interface ModuleMapper extends BaseMapper { + + @Select("SELECT 1 FROM tModule WHERE iIncrement = #{id} AND bDeleted = 0 LIMIT 1") + Integer findActiveFlagById(@Param("id") Integer iIncrement); + + default boolean existsActiveById(Integer iIncrement) { + return findActiveFlagById(iIncrement) != null; + } + + @Select("SELECT iParentId FROM tModule WHERE iIncrement = #{id} AND bDeleted = 0") + Integer selectParentIdById(@Param("id") Integer iIncrement); + + @Select("SELECT 1 FROM tModule WHERE iParentId = #{parentId} AND bDeleted = 0 LIMIT 1") + Integer findActiveChildFlag(@Param("parentId") Integer parentId); + + default boolean hasActiveChildren(Integer parentId) { + return findActiveChildFlag(parentId) != null; + } + + @Select("SELECT iIncrement, sModuleNameZh, sDisplayType, sManageDeptEn, iParentId, iSortOrder " + + "FROM tModule WHERE bDeleted = 0 AND sModuleNameZh LIKE CONCAT('%', #{keyword}, '%') " + + "ORDER BY iSortOrder ASC, iIncrement ASC") + List selectActiveByKeyword(@Param("keyword") String keyword); +} diff --git a/backend/src/main/java/com/xly/erp/module/mod/service/ModuleService.java b/backend/src/main/java/com/xly/erp/module/mod/service/ModuleService.java new file mode 100644 index 0000000..e17f15f --- /dev/null +++ b/backend/src/main/java/com/xly/erp/module/mod/service/ModuleService.java @@ -0,0 +1,17 @@ +package com.xly.erp.module.mod.service; + +import com.xly.erp.module.mod.dto.CreateModuleDTO; +import com.xly.erp.module.mod.dto.UpdateModuleDTO; +import com.xly.erp.module.mod.vo.ModuleTreeVO; + +import java.util.List; + +public interface ModuleService { + Integer create(CreateModuleDTO dto); + + Integer update(Integer id, UpdateModuleDTO dto); + + void delete(Integer id); + + List listTree(String keyword); +} diff --git a/backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java b/backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java new file mode 100644 index 0000000..b272bb2 --- /dev/null +++ b/backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java @@ -0,0 +1,177 @@ +package com.xly.erp.module.mod.service.impl; + +import com.xly.erp.common.config.StubSecurityProperties; +import com.xly.erp.common.config.TenantProperties; +import com.xly.erp.common.exception.BizException; +import com.xly.erp.common.security.SecurityContextHelper; +import com.xly.erp.module.mod.dto.CreateModuleDTO; +import com.xly.erp.module.mod.dto.UpdateModuleDTO; +import com.xly.erp.module.mod.entity.Module; +import com.xly.erp.module.mod.vo.ModuleTreeVO; +import com.xly.erp.module.mod.mapper.ModuleMapper; +import com.xly.erp.module.mod.service.ModuleService; +import org.springframework.dao.DuplicateKeyException; +import org.springframework.stereotype.Service; +import org.springframework.transaction.annotation.Transactional; + +import java.time.LocalDateTime; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Set; + +@Service +@Transactional(rollbackFor = Exception.class) +public class ModuleServiceImpl implements ModuleService { + + private static final Set DISPLAY_TYPES = Set.of("手机端", "前端业务", "系统配置", "接口"); + private static final int MAX_PARENT_DEPTH = 50; + + private final ModuleMapper moduleMapper; + private final TenantProperties tenant; + private final StubSecurityProperties stub; + + public ModuleServiceImpl(ModuleMapper moduleMapper, + TenantProperties tenant, + StubSecurityProperties stub) { + this.moduleMapper = moduleMapper; + this.tenant = tenant; + this.stub = stub; + } + + @Override + public Integer create(CreateModuleDTO dto) { + if (!DISPLAY_TYPES.contains(dto.getSDisplayType())) { + throw new BizException(40010, "显示类型枚举不合法"); + } + if (dto.getIParentId() != null && !moduleMapper.existsActiveById(dto.getIParentId())) { + throw new BizException(40021, "父模块不存在或已删除"); + } + + Module m = new Module(); + m.setSBrandsId(tenant.getBrandsId()); + m.setSSubsidiaryId(tenant.getSubsidiaryId()); + m.setTCreateDate(LocalDateTime.now()); + m.setSDisplayType(dto.getSDisplayType()); + m.setSProcedureName(dto.getSProcedureName()); + m.setSModuleType(dto.getSModuleType()); + m.setSManageDeptEn(dto.getSManageDeptEn()); + m.setBShowPermission(dto.getBShowPermission() != null ? dto.getBShowPermission() : false); + m.setSModuleNameZh(dto.getSModuleNameZh()); + m.setIParentId(dto.getIParentId()); + m.setISortOrder(dto.getISortOrder() != null ? dto.getISortOrder() : 0); + String authedUserNo = SecurityContextHelper.currentUserNo(); + m.setSCreatedBy(authedUserNo != null ? authedUserNo : stub.getStubUserNo()); + m.setBDeleted(false); + + try { + moduleMapper.insert(m); + } catch (DuplicateKeyException e) { + throw new BizException(40020, "存储过程名称已存在"); + } + return m.getIIncrement(); + } + + @Override + public Integer update(Integer id, UpdateModuleDTO dto) { + Module original = moduleMapper.selectById(id); + if (original == null || Boolean.TRUE.equals(original.getBDeleted())) { + throw new BizException(40400, "模块不存在或已删除"); + } + if (!DISPLAY_TYPES.contains(dto.getSDisplayType())) { + throw new BizException(40010, "显示类型枚举不合法"); + } + validateParent(id, dto.getIParentId()); + + Module entity = new Module(); + entity.setIIncrement(id); + entity.setSDisplayType(dto.getSDisplayType()); + entity.setSModuleType(dto.getSModuleType()); + entity.setSManageDeptEn(dto.getSManageDeptEn()); + entity.setBShowPermission(dto.getBShowPermission() != null ? dto.getBShowPermission() : false); + entity.setSModuleNameZh(dto.getSModuleNameZh()); + entity.setIParentId(dto.getIParentId()); + entity.setISortOrder(dto.getISortOrder() != null ? dto.getISortOrder() : 0); + + moduleMapper.updateById(entity); + return id; + } + + @Override + public void delete(Integer id) { + Module original = moduleMapper.selectById(id); + if (original == null || Boolean.TRUE.equals(original.getBDeleted())) { + throw new BizException(40400, "模块不存在或已删除"); + } + if (moduleMapper.hasActiveChildren(id)) { + throw new BizException(40901, "模块仍有未删除子节点"); + } + + Module entity = new Module(); + entity.setIIncrement(id); + entity.setBDeleted(true); + entity.setTDeletedDate(LocalDateTime.now()); + String authedUserNo = SecurityContextHelper.currentUserNo(); + entity.setSDeletedBy(authedUserNo != null ? authedUserNo : stub.getStubUserNo()); + moduleMapper.updateById(entity); + } + + @Override + @Transactional(readOnly = true) + public List listTree(String keyword) { + String normalized = keyword == null ? "" : keyword.trim(); + if (normalized.length() > 100) { + throw new BizException(40001, "keyword 长度超过 100 字符"); + } + List rows = moduleMapper.selectActiveByKeyword(normalized); + Map idIndex = new HashMap<>(); + for (Module m : rows) { + idIndex.put(m.getIIncrement(), toTreeVO(m)); + } + List roots = new ArrayList<>(); + for (Module m : rows) { + ModuleTreeVO vo = idIndex.get(m.getIIncrement()); + Integer parentId = m.getIParentId(); + if (parentId != null && idIndex.containsKey(parentId)) { + idIndex.get(parentId).getChildren().add(vo); + } else { + roots.add(vo); + } + } + return roots; + } + + private ModuleTreeVO toTreeVO(Module m) { + ModuleTreeVO vo = new ModuleTreeVO(); + vo.setIIncrement(m.getIIncrement()); + vo.setSModuleNameZh(m.getSModuleNameZh()); + vo.setSDisplayType(m.getSDisplayType()); + vo.setSManageDeptEn(m.getSManageDeptEn()); + vo.setIParentId(m.getIParentId()); + vo.setISortOrder(m.getISortOrder()); + return vo; + } + + private void validateParent(Integer id, Integer parentId) { + if (parentId == null) { + return; + } + if (parentId.equals(id)) { + throw new BizException(40021, "父模块不能指向自身"); + } + if (!moduleMapper.existsActiveById(parentId)) { + throw new BizException(40021, "父模块不存在或已删除"); + } + Integer cur = moduleMapper.selectParentIdById(parentId); + for (int depth = 0; cur != null; depth++) { + if (cur.equals(id)) { + throw new BizException(40021, "父模块链构成环路"); + } + if (depth >= MAX_PARENT_DEPTH) { + throw new BizException(40021, "父模块链超过最大层级"); + } + cur = moduleMapper.selectParentIdById(cur); + } + } +} diff --git a/backend/src/main/java/com/xly/erp/module/mod/vo/ModuleTreeVO.java b/backend/src/main/java/com/xly/erp/module/mod/vo/ModuleTreeVO.java new file mode 100644 index 0000000..461a131 --- /dev/null +++ b/backend/src/main/java/com/xly/erp/module/mod/vo/ModuleTreeVO.java @@ -0,0 +1,45 @@ +package com.xly.erp.module.mod.vo; + +import com.fasterxml.jackson.annotation.JsonProperty; + +import java.util.ArrayList; +import java.util.List; + +public class ModuleTreeVO { + + @JsonProperty("iIncrement") + private Integer iIncrement; + + @JsonProperty("sModuleNameZh") + private String sModuleNameZh; + + @JsonProperty("sDisplayType") + private String sDisplayType; + + @JsonProperty("sManageDeptEn") + private String sManageDeptEn; + + @JsonProperty("iParentId") + private Integer iParentId; + + @JsonProperty("iSortOrder") + private Integer iSortOrder; + + @JsonProperty("children") + private List children = new ArrayList<>(); + + public Integer getIIncrement() { return iIncrement; } + public void setIIncrement(Integer iIncrement) { this.iIncrement = iIncrement; } + public String getSModuleNameZh() { return sModuleNameZh; } + public void setSModuleNameZh(String sModuleNameZh) { this.sModuleNameZh = sModuleNameZh; } + public String getSDisplayType() { return sDisplayType; } + public void setSDisplayType(String sDisplayType) { this.sDisplayType = sDisplayType; } + public String getSManageDeptEn() { return sManageDeptEn; } + public void setSManageDeptEn(String sManageDeptEn) { this.sManageDeptEn = sManageDeptEn; } + public Integer getIParentId() { return iParentId; } + public void setIParentId(Integer iParentId) { this.iParentId = iParentId; } + public Integer getISortOrder() { return iSortOrder; } + public void setISortOrder(Integer iSortOrder) { this.iSortOrder = iSortOrder; } + public List getChildren() { return children; } + public void setChildren(List children) { this.children = children; } +} diff --git a/backend/src/main/resources/application-test.yml b/backend/src/main/resources/application-test.yml new file mode 100644 index 0000000..001459e --- /dev/null +++ b/backend/src/main/resources/application-test.yml @@ -0,0 +1,9 @@ +spring: + flyway: + locations: filesystem:../sql/migrations + clean-disabled: true + +logging: + level: + org.springframework.jdbc.core: WARN + com.xly.erp: DEBUG diff --git a/backend/src/main/resources/application.yml b/backend/src/main/resources/application.yml new file mode 100644 index 0000000..3687ac3 --- /dev/null +++ b/backend/src/main/resources/application.yml @@ -0,0 +1,35 @@ +spring: + application: + name: erp-backend + datasource: + url: jdbc:mysql://${DB_HOST}:${DB_PORT}/${DB_SCHEMA}?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true + username: ${DB_USER} + password: ${DB_PASSWORD} + driver-class-name: com.mysql.cj.jdbc.Driver + flyway: + enabled: true + locations: filesystem:../sql/migrations + baseline-on-migrate: true + +server: + port: 8080 + servlet: + context-path: / + +mybatis-plus: + mapper-locations: classpath:mapper/**/*.xml + configuration: + map-underscore-to-camel-case: false + +erp: + tenant: + brands-id: XLY + subsidiary-id: XLY + security: + stub-user-no: STUB_ADMIN + jwt-secret: ${JWT_SECRET} + +logging: + level: + root: INFO + com.xly.erp: DEBUG diff --git a/backend/src/main/resources/logback-spring.xml b/backend/src/main/resources/logback-spring.xml new file mode 100644 index 0000000..232b8af --- /dev/null +++ b/backend/src/main/resources/logback-spring.xml @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/backend/src/test/java/com/xly/erp/SmokeTest.java b/backend/src/test/java/com/xly/erp/SmokeTest.java new file mode 100644 index 0000000..d3f8b93 --- /dev/null +++ b/backend/src/test/java/com/xly/erp/SmokeTest.java @@ -0,0 +1,25 @@ +package com.xly.erp; + +import org.junit.jupiter.api.Test; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.boot.test.context.SpringBootTest; +import org.springframework.jdbc.core.JdbcTemplate; +import org.springframework.test.context.ActiveProfiles; + +import static org.assertj.core.api.Assertions.assertThat; + +@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE) +@ActiveProfiles("test") +class SmokeTest { + + @Autowired + private JdbcTemplate jdbcTemplate; + + @Test + void contextLoads_andFlywayApplied() { + Integer count = jdbcTemplate.queryForObject( + "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema = DATABASE() AND table_name = 'tModule'", + Integer.class); + assertThat(count).isEqualTo(1); + } +} diff --git a/backend/src/test/java/com/xly/erp/common/exception/GlobalExceptionHandlerTest.java b/backend/src/test/java/com/xly/erp/common/exception/GlobalExceptionHandlerTest.java new file mode 100644 index 0000000..c117597 --- /dev/null +++ b/backend/src/test/java/com/xly/erp/common/exception/GlobalExceptionHandlerTest.java @@ -0,0 +1,86 @@ +package com.xly.erp.common.exception; + +import com.xly.erp.common.response.Result; +import jakarta.validation.Valid; +import jakarta.validation.constraints.NotBlank; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; +import org.springframework.test.web.servlet.MockMvc; +import org.springframework.test.web.servlet.setup.MockMvcBuilders; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.PostMapping; +import org.springframework.web.bind.annotation.RequestBody; +import org.springframework.web.bind.annotation.RestController; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; + +class GlobalExceptionHandlerTest { + + private MockMvc mockMvc; + + @BeforeEach + void setUp() { + mockMvc = MockMvcBuilders.standaloneSetup(new StubController()) + .setControllerAdvice(new GlobalExceptionHandler()) + .build(); + } + + @Test + void bizException_returnsResultWithBizCode() throws Exception { + mockMvc.perform(get("/__test/throw-biz")) + .andExpect(status().isOk()) + .andExpect(jsonPath("$.code").value(30001)) + .andExpect(jsonPath("$.msg").value("business x")); + } + + @Test + void validationException_returns40001WithFieldHint() throws Exception { + mockMvc.perform(post("/__test/throw-validate") + .contentType("application/json") + .content("{}")) + .andExpect(status().isOk()) + .andExpect(jsonPath("$.code").value(40001)) + .andExpect(jsonPath("$.msg", org.hamcrest.Matchers.containsString("name"))); + } + + @Test + void uncaughtException_returns50000() throws Exception { + mockMvc.perform(get("/__test/throw-runtime")) + .andExpect(status().isOk()) + .andExpect(jsonPath("$.code").value(50000)); + } + + @Test + void resultOkHelper_buildsZeroCode() { + Result r = Result.ok("hi"); + assertThat(r.getCode()).isZero(); + assertThat(r.getData()).isEqualTo("hi"); + } + + @RestController + static class StubController { + @GetMapping("/__test/throw-biz") + public Result throwBiz() { + throw new BizException(30001, "business x"); + } + + @PostMapping("/__test/throw-validate") + public Result throwValidate(@Valid @RequestBody StubBody body) { + return Result.ok(); + } + + @GetMapping("/__test/throw-runtime") + public Result throwRuntime() { + throw new IllegalStateException("boom"); + } + } + + static class StubBody { + @NotBlank + public String name; + } +} diff --git a/backend/src/test/java/com/xly/erp/common/security/JwtAuthenticationFilterTest.java b/backend/src/test/java/com/xly/erp/common/security/JwtAuthenticationFilterTest.java new file mode 100644 index 0000000..dae0882 --- /dev/null +++ b/backend/src/test/java/com/xly/erp/common/security/JwtAuthenticationFilterTest.java @@ -0,0 +1,80 @@ +package com.xly.erp.common.security; + +import com.fasterxml.jackson.databind.JsonNode; +import com.fasterxml.jackson.databind.ObjectMapper; +import jakarta.servlet.FilterChain; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; +import org.springframework.mock.web.MockHttpServletRequest; +import org.springframework.mock.web.MockHttpServletResponse; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.context.SecurityContextHolder; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.never; +import static org.mockito.Mockito.times; +import static org.mockito.Mockito.verify; + +class JwtAuthenticationFilterTest { + + private static final String SECRET = "f8d4be76bff13bf32fa33ca0b14a4b152ad01ca5719f57df18ec4ecf2370b235"; + + private JwtUtil jwtUtil; + private JwtAuthenticationFilter filter; + + @BeforeEach + void setUp() { + jwtUtil = new JwtUtil(SECRET); + filter = new JwtAuthenticationFilter(jwtUtil, new ObjectMapper()); + } + + @AfterEach + void clearContext() { + SecurityContextHolder.clearContext(); + } + + @Test + void validJwt_setsPrincipalInSecurityContext_andCallsChain() throws Exception { + String token = jwtUtil.sign("USER001"); + MockHttpServletRequest req = new MockHttpServletRequest("POST", "/api/anything"); + req.addHeader("Authorization", "Bearer " + token); + MockHttpServletResponse resp = new MockHttpServletResponse(); + FilterChain chain = mock(FilterChain.class); + + filter.doFilter(req, resp, chain); + + Authentication auth = SecurityContextHolder.getContext().getAuthentication(); + assertThat(auth).isNotNull(); + assertThat(auth.getPrincipal()).isEqualTo("USER001"); + verify(chain, times(1)).doFilter(req, resp); + } + + @Test + void tamperedJwt_writesJsonResultWith20001_andDoesNotCallChain() throws Exception { + MockHttpServletRequest req = new MockHttpServletRequest("POST", "/api/anything"); + req.addHeader("Authorization", "Bearer not.a.real.jwt"); + MockHttpServletResponse resp = new MockHttpServletResponse(); + FilterChain chain = mock(FilterChain.class); + + filter.doFilter(req, resp, chain); + + verify(chain, never()).doFilter(req, resp); + assertThat(resp.getContentType()).contains("application/json"); + JsonNode body = new ObjectMapper().readTree(resp.getContentAsString()); + assertThat(body.get("code").asInt()).isEqualTo(20001); + } + + @Test + void noJwtHeader_passesChainThrough_withoutSettingContext() throws Exception { + MockHttpServletRequest req = new MockHttpServletRequest("POST", "/api/anything"); + MockHttpServletResponse resp = new MockHttpServletResponse(); + FilterChain chain = mock(FilterChain.class); + + filter.doFilter(req, resp, chain); + + assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull(); + verify(chain, times(1)).doFilter(req, resp); + } +} diff --git a/backend/src/test/java/com/xly/erp/common/security/JwtUtilTest.java b/backend/src/test/java/com/xly/erp/common/security/JwtUtilTest.java new file mode 100644 index 0000000..7748aed --- /dev/null +++ b/backend/src/test/java/com/xly/erp/common/security/JwtUtilTest.java @@ -0,0 +1,37 @@ +package com.xly.erp.common.security; + +import com.xly.erp.common.exception.BizException; +import org.junit.jupiter.api.Test; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; + +class JwtUtilTest { + + private static final String SECRET = "f8d4be76bff13bf32fa33ca0b14a4b152ad01ca5719f57df18ec4ecf2370b235"; + + private final JwtUtil jwtUtil = new JwtUtil(SECRET); + + @Test + void signAndParse_roundTrip() { + String token = jwtUtil.sign("ALICE001"); + assertThat(token).isNotBlank(); + assertThat(jwtUtil.parse(token)).isEqualTo("ALICE001"); + } + + @Test + void parseTamperedToken_throwsBizException20001() { + String token = jwtUtil.sign("ALICE001"); + String tampered = token.substring(0, token.length() - 4) + "XXXX"; + assertThatThrownBy(() -> jwtUtil.parse(tampered)) + .isInstanceOf(BizException.class) + .hasFieldOrPropertyWithValue("code", 20001); + } + + @Test + void parseGarbageToken_throwsBizException20001() { + assertThatThrownBy(() -> jwtUtil.parse("not.a.real.jwt")) + .isInstanceOf(BizException.class) + .hasFieldOrPropertyWithValue("code", 20001); + } +} diff --git a/backend/src/test/java/com/xly/erp/common/security/TestJwtHelper.java b/backend/src/test/java/com/xly/erp/common/security/TestJwtHelper.java new file mode 100644 index 0000000..dc79b96 --- /dev/null +++ b/backend/src/test/java/com/xly/erp/common/security/TestJwtHelper.java @@ -0,0 +1,19 @@ +package com.xly.erp.common.security; + +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.stereotype.Component; + +@Component +public class TestJwtHelper { + + private final JwtUtil jwtUtil; + + @Autowired + public TestJwtHelper(JwtUtil jwtUtil) { + this.jwtUtil = jwtUtil; + } + + public String signFor(String userNo) { + return jwtUtil.sign(userNo); + } +} diff --git a/backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java b/backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java new file mode 100644 index 0000000..8998e35 --- /dev/null +++ b/backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java @@ -0,0 +1,539 @@ +package com.xly.erp.module.mod.controller; + +import com.fasterxml.jackson.databind.JsonNode; +import com.fasterxml.jackson.databind.ObjectMapper; +import com.xly.erp.common.security.TestJwtHelper; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.boot.test.context.SpringBootTest; +import org.springframework.boot.test.web.client.TestRestTemplate; +import org.springframework.boot.test.web.server.LocalServerPort; +import org.springframework.http.HttpEntity; +import org.springframework.http.HttpHeaders; +import org.springframework.http.HttpMethod; +import org.springframework.http.MediaType; +import org.springframework.http.ResponseEntity; +import org.springframework.jdbc.core.JdbcTemplate; +import org.springframework.test.context.ActiveProfiles; + +import java.util.HashMap; +import java.util.Map; + +import static org.assertj.core.api.Assertions.assertThat; + +@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT) +@ActiveProfiles("test") +class ModuleControllerIT { + + @Autowired + private TestRestTemplate rest; + + @Autowired + private TestJwtHelper testJwtHelper; + + @Autowired + private JdbcTemplate jdbcTemplate; + + @Autowired + private ObjectMapper objectMapper; + + @LocalServerPort + private int port; + + @BeforeEach + @AfterEach + void cleanup() { + jdbcTemplate.update("DELETE FROM tModule WHERE sProcedureName LIKE 'sp_test_%'"); + } + + @Test + void postValidBody_with_jwt_returns200_andPersists() throws Exception { + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + + ResponseEntity resp = rest.exchange( + "http://localhost:" + port + "/api/mod/modules", + HttpMethod.POST, + new HttpEntity<>(validBody("sp_test_ctrl_ok", "正常路径"), headers), + String.class); + + assertThat(resp.getStatusCode().value()).isEqualTo(200); + JsonNode body = objectMapper.readTree(resp.getBody()); + assertThat(body.get("code").asInt()).isZero(); + int newId = body.get("data").get("iIncrement").asInt(); + assertThat(newId).isPositive(); + + Map row = jdbcTemplate.queryForMap( + "SELECT sProcedureName, sBrandsId, sCreatedBy FROM tModule WHERE iIncrement = ?", newId); + assertThat(row.get("sProcedureName")).isEqualTo("sp_test_ctrl_ok"); + assertThat(row.get("sBrandsId")).isEqualTo("XLY"); + assertThat(row.get("sCreatedBy")).isEqualTo("ADMIN001"); + } + + @Test + void postEmptyBody_returns40001_withFieldHint() throws Exception { + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + + ResponseEntity resp = rest.exchange( + url(), + HttpMethod.POST, + new HttpEntity<>("{}", headers), + String.class); + + JsonNode body = objectMapper.readTree(resp.getBody()); + assertThat(body.get("code").asInt()).isEqualTo(40001); + assertThat(body.get("msg").asText()).containsAnyOf( + "sProcedureName", "sDisplayType", "sModuleType", "sManageDeptEn", "sModuleNameZh"); + } + + @Test + void postInvalidDisplayType_returns40010() throws Exception { + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + Map bad = validBody("sp_test_bad_type", "枚举非法"); + bad.put("sDisplayType", "火星"); + + ResponseEntity resp = rest.exchange( + url(), HttpMethod.POST, new HttpEntity<>(bad, headers), String.class); + + JsonNode body = objectMapper.readTree(resp.getBody()); + assertThat(body.get("code").asInt()).isEqualTo(40010); + } + + @Test + void postDuplicateProcedureName_returns40020() throws Exception { + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + Map first = validBody("sp_test_dup", "首次"); + ResponseEntity r1 = rest.exchange( + url(), HttpMethod.POST, new HttpEntity<>(first, headers), String.class); + assertThat(objectMapper.readTree(r1.getBody()).get("code").asInt()).isZero(); + + Map dup = validBody("sp_test_dup", "重复"); + ResponseEntity r2 = rest.exchange( + url(), HttpMethod.POST, new HttpEntity<>(dup, headers), String.class); + JsonNode body = objectMapper.readTree(r2.getBody()); + assertThat(body.get("code").asInt()).isEqualTo(40020); + } + + @Test + void postWithMissingParent_returns40021() throws Exception { + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + Map orphan = validBody("sp_test_orphan", "缺父"); + orphan.put("iParentId", 99999999); + + ResponseEntity resp = rest.exchange( + url(), HttpMethod.POST, new HttpEntity<>(orphan, headers), String.class); + + JsonNode body = objectMapper.readTree(resp.getBody()); + assertThat(body.get("code").asInt()).isEqualTo(40021); + } + + @Test + void postWithoutJwt_permitAllStub_returns200_andCreatedBySTUBADMIN() throws Exception { + HttpHeaders headers = jsonHeaders(); + Map body = validBody("sp_test_nojwt", "无JWT"); + + ResponseEntity resp = rest.exchange( + url(), HttpMethod.POST, new HttpEntity<>(body, headers), String.class); + + JsonNode jb = objectMapper.readTree(resp.getBody()); + assertThat(jb.get("code").asInt()).isZero(); + int newId = jb.get("data").get("iIncrement").asInt(); + String createdBy = jdbcTemplate.queryForObject( + "SELECT sCreatedBy FROM tModule WHERE iIncrement = ?", String.class, newId); + assertThat(createdBy).isEqualTo("STUB_ADMIN"); + } + + @Test + void postWithTamperedJwt_returns20001() throws Exception { + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer not.a.real.jwt"); + Map body = validBody("sp_test_tampered", "伪JWT"); + + ResponseEntity resp = rest.exchange( + url(), HttpMethod.POST, new HttpEntity<>(body, headers), String.class); + + JsonNode jb = objectMapper.readTree(resp.getBody()); + assertThat(jb.get("code").asInt()).isEqualTo(20001); + } + + @Test + void putValidBody_with_jwt_returns200_andUpdatesEditableFields() throws Exception { + Integer id = insertOriginal("sp_test_put_orig", "原名", "ORIG_USER"); + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + Map body = updateBody(); + body.put("sModuleNameZh", "新名"); + body.put("sDisplayType", "前端业务"); + + ResponseEntity resp = rest.exchange( + idUrl(id), HttpMethod.PUT, new HttpEntity<>(body, headers), String.class); + + assertThat(resp.getStatusCode().value()).isEqualTo(200); + JsonNode jb = objectMapper.readTree(resp.getBody()); + assertThat(jb.get("code").asInt()).isZero(); + assertThat(jb.get("data").get("iIncrement").asInt()).isEqualTo(id); + + Map row = jdbcTemplate.queryForMap( + "SELECT sModuleNameZh, sDisplayType, sProcedureName, sCreatedBy FROM tModule WHERE iIncrement = ?", id); + assertThat(row.get("sModuleNameZh")).isEqualTo("新名"); + assertThat(row.get("sDisplayType")).isEqualTo("前端业务"); + assertThat(row.get("sProcedureName")).isEqualTo("sp_test_put_orig"); + assertThat(row.get("sCreatedBy")).isEqualTo("ORIG_USER"); + } + + @Test + void putNonExistentId_returns40400() throws Exception { + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + + ResponseEntity resp = rest.exchange( + idUrl(99999998), HttpMethod.PUT, new HttpEntity<>(updateBody(), headers), String.class); + + JsonNode jb = objectMapper.readTree(resp.getBody()); + assertThat(jb.get("code").asInt()).isEqualTo(40400); + } + + @Test + void putInvalidDisplayType_returns40010() throws Exception { + Integer id = insertOriginal("sp_test_put_invalidtype", "原", "ORIG"); + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + Map body = updateBody(); + body.put("sDisplayType", "火星"); + + ResponseEntity resp = rest.exchange( + idUrl(id), HttpMethod.PUT, new HttpEntity<>(body, headers), String.class); + + assertThat(objectMapper.readTree(resp.getBody()).get("code").asInt()).isEqualTo(40010); + } + + @Test + void putSelfParent_returns40021() throws Exception { + Integer id = insertOriginal("sp_test_put_self", "原", "ORIG"); + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + Map body = updateBody(); + body.put("iParentId", id); + + ResponseEntity resp = rest.exchange( + idUrl(id), HttpMethod.PUT, new HttpEntity<>(body, headers), String.class); + + assertThat(objectMapper.readTree(resp.getBody()).get("code").asInt()).isEqualTo(40021); + } + + @Test + void putCyclicParent_returns40021() throws Exception { + Integer rootId = insertOriginal("sp_test_put_root", "根", "ORIG"); + jdbcTemplate.update( + "INSERT INTO tModule (sBrandsId, sSubsidiaryId, tCreateDate, sDisplayType, sProcedureName, " + + "sModuleType, sManageDeptEn, bShowPermission, sModuleNameZh, iParentId, iSortOrder, sCreatedBy, bDeleted) " + + "VALUES ('XLY','XLY', NOW(), '手机端', 'sp_test_put_child', '业务模块', 'IT', 0, '子', ?, 0, 'ORIG', 0)", + rootId); + Integer childId = jdbcTemplate.queryForObject( + "SELECT iIncrement FROM tModule WHERE sProcedureName = 'sp_test_put_child'", Integer.class); + + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + Map body = updateBody(); + body.put("iParentId", childId); + + ResponseEntity resp = rest.exchange( + idUrl(rootId), HttpMethod.PUT, new HttpEntity<>(body, headers), String.class); + + assertThat(objectMapper.readTree(resp.getBody()).get("code").asInt()).isEqualTo(40021); + } + + @Test + void putWithoutJwt_permitAllStub_returns200_andDoesNotChangeCreatedBy() throws Exception { + Integer id = insertOriginal("sp_test_put_nojwt", "原", "ORIG_USER"); + HttpHeaders headers = jsonHeaders(); + Map body = updateBody(); + body.put("sModuleNameZh", "更新无jwt"); + + ResponseEntity resp = rest.exchange( + idUrl(id), HttpMethod.PUT, new HttpEntity<>(body, headers), String.class); + + assertThat(objectMapper.readTree(resp.getBody()).get("code").asInt()).isZero(); + String createdBy = jdbcTemplate.queryForObject( + "SELECT sCreatedBy FROM tModule WHERE iIncrement = ?", String.class, id); + assertThat(createdBy).isEqualTo("ORIG_USER"); + } + + @Test + void putTamperedJwt_returns20001() throws Exception { + Integer id = insertOriginal("sp_test_put_tamper", "原", "ORIG"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer not.a.real.jwt"); + + ResponseEntity resp = rest.exchange( + idUrl(id), HttpMethod.PUT, new HttpEntity<>(updateBody(), headers), String.class); + + assertThat(objectMapper.readTree(resp.getBody()).get("code").asInt()).isEqualTo(20001); + } + + @Test + void deleteValidId_with_jwt_returns200_andSoftDeletes() throws Exception { + Integer id = insertOriginal("sp_test_del_ok", "原", "ORIG_USER"); + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + + ResponseEntity resp = rest.exchange( + idUrl(id), HttpMethod.DELETE, new HttpEntity<>(headers), String.class); + + assertThat(resp.getStatusCode().value()).isEqualTo(200); + JsonNode jb = objectMapper.readTree(resp.getBody()); + assertThat(jb.get("code").asInt()).isZero(); + assertThat(jb.get("data").isNull()).isTrue(); + + Map row = jdbcTemplate.queryForMap( + "SELECT bDeleted, sDeletedBy, tDeletedDate, sProcedureName, sCreatedBy FROM tModule WHERE iIncrement = ?", id); + assertThat(row.get("bDeleted")).isEqualTo(true); + assertThat(row.get("sDeletedBy")).isEqualTo("ADMIN001"); + assertThat(row.get("tDeletedDate")).isNotNull(); + assertThat(row.get("sProcedureName")).isEqualTo("sp_test_del_ok"); + assertThat(row.get("sCreatedBy")).isEqualTo("ORIG_USER"); + } + + @Test + void deleteNonExistentId_returns40400() throws Exception { + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + + ResponseEntity resp = rest.exchange( + idUrl(99999996), HttpMethod.DELETE, new HttpEntity<>(headers), String.class); + + assertThat(objectMapper.readTree(resp.getBody()).get("code").asInt()).isEqualTo(40400); + } + + @Test + void deleteAlreadyDeletedId_returns40400() throws Exception { + Integer id = insertOriginal("sp_test_del_already", "已删", "ORIG"); + jdbcTemplate.update("UPDATE tModule SET bDeleted = 1 WHERE iIncrement = ?", id); + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + + ResponseEntity resp = rest.exchange( + idUrl(id), HttpMethod.DELETE, new HttpEntity<>(headers), String.class); + + assertThat(objectMapper.readTree(resp.getBody()).get("code").asInt()).isEqualTo(40400); + } + + @Test + void deleteWithActiveChildren_returns40901() throws Exception { + Integer rootId = insertOriginal("sp_test_del_root", "根", "ORIG"); + jdbcTemplate.update( + "INSERT INTO tModule (sBrandsId, sSubsidiaryId, tCreateDate, sDisplayType, sProcedureName, " + + "sModuleType, sManageDeptEn, bShowPermission, sModuleNameZh, iParentId, iSortOrder, sCreatedBy, bDeleted) " + + "VALUES ('XLY','XLY', NOW(), '手机端', 'sp_test_del_child', '业务模块', 'IT', 0, '子', ?, 0, 'ORIG', 0)", + rootId); + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + + ResponseEntity resp = rest.exchange( + idUrl(rootId), HttpMethod.DELETE, new HttpEntity<>(headers), String.class); + + assertThat(objectMapper.readTree(resp.getBody()).get("code").asInt()).isEqualTo(40901); + Boolean stillAlive = jdbcTemplate.queryForObject( + "SELECT bDeleted FROM tModule WHERE iIncrement = ?", Boolean.class, rootId); + assertThat(stillAlive).isFalse(); + } + + @Test + void deleteWithoutJwt_permitAllStub_returns200_andDeletedByIsSTUB() throws Exception { + Integer id = insertOriginal("sp_test_del_nojwt", "原", "ORIG"); + HttpHeaders headers = jsonHeaders(); + + ResponseEntity resp = rest.exchange( + idUrl(id), HttpMethod.DELETE, new HttpEntity<>(headers), String.class); + + assertThat(objectMapper.readTree(resp.getBody()).get("code").asInt()).isZero(); + Map row = jdbcTemplate.queryForMap( + "SELECT bDeleted, sDeletedBy FROM tModule WHERE iIncrement = ?", id); + assertThat(row.get("bDeleted")).isEqualTo(true); + assertThat(row.get("sDeletedBy")).isEqualTo("STUB_ADMIN"); + } + + @Test + void deleteTamperedJwt_returns20001() throws Exception { + Integer id = insertOriginal("sp_test_del_tamper", "原", "ORIG"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer not.a.real.jwt"); + + ResponseEntity resp = rest.exchange( + idUrl(id), HttpMethod.DELETE, new HttpEntity<>(headers), String.class); + + assertThat(objectMapper.readTree(resp.getBody()).get("code").asInt()).isEqualTo(20001); + Boolean stillAlive = jdbcTemplate.queryForObject( + "SELECT bDeleted FROM tModule WHERE iIncrement = ?", Boolean.class, id); + assertThat(stillAlive).isFalse(); + } + + @Test + void getEmptyKeyword_returnsCompleteTreeAsForest() throws Exception { + Integer rootId = insertOriginal("sp_test_get_root", "查询用根", "ORIG"); + jdbcTemplate.update( + "INSERT INTO tModule (sBrandsId, sSubsidiaryId, tCreateDate, sDisplayType, sProcedureName, " + + "sModuleType, sManageDeptEn, bShowPermission, sModuleNameZh, iParentId, iSortOrder, sCreatedBy, bDeleted) " + + "VALUES ('XLY','XLY', NOW(), '手机端', 'sp_test_get_child', '业务模块', 'IT', 0, '查询用子', ?, 0, 'ORIG', 0)", + rootId); + Integer childId = jdbcTemplate.queryForObject( + "SELECT iIncrement FROM tModule WHERE sProcedureName = 'sp_test_get_child'", Integer.class); + + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + ResponseEntity resp = rest.exchange( + listUrl(null), HttpMethod.GET, new HttpEntity<>(headers), String.class); + + JsonNode jb = objectMapper.readTree(resp.getBody()); + assertThat(jb.get("code").asInt()).isZero(); + JsonNode data = jb.get("data"); + assertThat(data.isArray()).isTrue(); + JsonNode rootNode = findById(data, rootId); + assertThat(rootNode).isNotNull(); + JsonNode childNode = findById(rootNode.get("children"), childId); + assertThat(childNode).isNotNull(); + assertThat(childNode.get("sModuleNameZh").asText()).isEqualTo("查询用子"); + } + + @Test + void getKeywordMatch_returnsForest() throws Exception { + insertOriginal("sp_test_get_kw_a", "系统模块A", "ORIG"); + insertOriginal("sp_test_get_kw_b", "用户模块B", "ORIG"); + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + + ResponseEntity resp = rest.exchange( + listUrl("系统"), HttpMethod.GET, new HttpEntity<>(headers), String.class); + + JsonNode jb = objectMapper.readTree(resp.getBody()); + assertThat(jb.get("code").asInt()).isZero(); + JsonNode data = jb.get("data"); + assertThat(data.isArray()).isTrue(); + for (JsonNode node : data) { + assertThat(node.get("sModuleNameZh").asText()).contains("系统"); + } + } + + @Test + void getKeywordTooLong_returns40001() throws Exception { + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + + ResponseEntity resp = rest.exchange( + listUrl("x".repeat(101)), HttpMethod.GET, new HttpEntity<>(headers), String.class); + + assertThat(objectMapper.readTree(resp.getBody()).get("code").asInt()).isEqualTo(40001); + } + + @Test + void getNoMatch_returnsEmptyArray() throws Exception { + String token = testJwtHelper.signFor("ADMIN001"); + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer " + token); + + ResponseEntity resp = rest.exchange( + listUrl("不存在的关键字XYZ-zzz"), HttpMethod.GET, new HttpEntity<>(headers), String.class); + + JsonNode data = objectMapper.readTree(resp.getBody()).get("data"); + assertThat(data.isArray()).isTrue(); + assertThat(data.size()).isZero(); + } + + @Test + void getWithoutJwt_permitAllStub_returns200() throws Exception { + HttpHeaders headers = jsonHeaders(); + ResponseEntity resp = rest.exchange( + listUrl(null), HttpMethod.GET, new HttpEntity<>(headers), String.class); + assertThat(objectMapper.readTree(resp.getBody()).get("code").asInt()).isZero(); + } + + @Test + void getTamperedJwt_returns20001() throws Exception { + HttpHeaders headers = jsonHeaders(); + headers.set("Authorization", "Bearer not.a.real.jwt"); + ResponseEntity resp = rest.exchange( + listUrl(null), HttpMethod.GET, new HttpEntity<>(headers), String.class); + assertThat(objectMapper.readTree(resp.getBody()).get("code").asInt()).isEqualTo(20001); + } + + private String listUrl(String keyword) { + String base = "http://localhost:" + port + "/api/mod/modules"; + return keyword == null ? base : base + "?keyword=" + java.net.URLEncoder.encode(keyword, java.nio.charset.StandardCharsets.UTF_8); + } + + private static JsonNode findById(JsonNode array, Integer id) { + if (array == null || !array.isArray()) return null; + for (JsonNode n : array) { + if (n.get("iIncrement").asInt() == id) return n; + } + return null; + } + + private Integer insertOriginal(String procedureName, String nameZh, String createdBy) { + jdbcTemplate.update( + "INSERT INTO tModule (sBrandsId, sSubsidiaryId, tCreateDate, sDisplayType, sProcedureName, " + + "sModuleType, sManageDeptEn, bShowPermission, sModuleNameZh, iSortOrder, sCreatedBy, bDeleted) " + + "VALUES ('XLY','XLY', NOW(), '手机端', ?, '业务模块', 'IT', 0, ?, 0, ?, 0)", + procedureName, nameZh, createdBy); + return jdbcTemplate.queryForObject( + "SELECT iIncrement FROM tModule WHERE sProcedureName = ?", Integer.class, procedureName); + } + + private static Map updateBody() { + Map m = new HashMap<>(); + m.put("sDisplayType", "手机端"); + m.put("sModuleType", "业务模块"); + m.put("sManageDeptEn", "IT"); + m.put("bShowPermission", false); + m.put("sModuleNameZh", "更新后"); + return m; + } + + private String idUrl(Integer id) { + return "http://localhost:" + port + "/api/mod/modules/" + id; + } + + private String url() { + return "http://localhost:" + port + "/api/mod/modules"; + } + + static HttpHeaders jsonHeaders() { + HttpHeaders h = new HttpHeaders(); + h.setContentType(MediaType.APPLICATION_JSON); + return h; + } + + static Map validBody(String procedureName, String nameZh) { + Map m = new HashMap<>(); + m.put("sDisplayType", "手机端"); + m.put("sProcedureName", procedureName); + m.put("sModuleType", "业务模块"); + m.put("sManageDeptEn", "IT"); + m.put("bShowPermission", false); + m.put("sModuleNameZh", nameZh); + return m; + } +} diff --git a/backend/src/test/java/com/xly/erp/module/mod/mapper/ModuleMapperIT.java b/backend/src/test/java/com/xly/erp/module/mod/mapper/ModuleMapperIT.java new file mode 100644 index 0000000..2432da2 --- /dev/null +++ b/backend/src/test/java/com/xly/erp/module/mod/mapper/ModuleMapperIT.java @@ -0,0 +1,144 @@ +package com.xly.erp.module.mod.mapper; + +import com.xly.erp.module.mod.entity.Module; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.boot.test.context.SpringBootTest; +import org.springframework.jdbc.core.JdbcTemplate; +import org.springframework.test.context.ActiveProfiles; + +import java.time.LocalDateTime; + +import static org.assertj.core.api.Assertions.assertThat; + +@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE) +@ActiveProfiles("test") +class ModuleMapperIT { + + @Autowired + private ModuleMapper moduleMapper; + + @Autowired + private JdbcTemplate jdbcTemplate; + + @BeforeEach + @AfterEach + void cleanup() { + jdbcTemplate.update("DELETE FROM tModule WHERE sProcedureName LIKE 'sp_test_%'"); + } + + @Test + void insertAndSelectById_persistsAllStandardCols() { + Module m = newModule("sp_test_insert", "插入用例", null); + int rows = moduleMapper.insert(m); + assertThat(rows).isEqualTo(1); + assertThat(m.getIIncrement()).isNotNull(); + + Module loaded = moduleMapper.selectById(m.getIIncrement()); + assertThat(loaded.getSProcedureName()).isEqualTo("sp_test_insert"); + assertThat(loaded.getSBrandsId()).isEqualTo("XLY"); + assertThat(loaded.getSSubsidiaryId()).isEqualTo("XLY"); + assertThat(loaded.getSDisplayType()).isEqualTo("手机端"); + assertThat(loaded.getSModuleNameZh()).isEqualTo("插入用例"); + assertThat(loaded.getBDeleted()).isFalse(); + assertThat(loaded.getBShowPermission()).isFalse(); + } + + @Test + void existsActiveById_trueForAlive_falseForDeleted() { + Module alive = newModule("sp_test_alive", "活的", null); + moduleMapper.insert(alive); + + Module dead = newModule("sp_test_dead", "死的", null); + dead.setBDeleted(true); + moduleMapper.insert(dead); + + assertThat(moduleMapper.existsActiveById(alive.getIIncrement())).isTrue(); + assertThat(moduleMapper.existsActiveById(dead.getIIncrement())).isFalse(); + assertThat(moduleMapper.existsActiveById(99999999)).isFalse(); + } + + @Test + void selectParentIdById_returnsNullForRootOrMissing_andValueForChild() { + Module root = newModule("sp_test_root", "根", null); + moduleMapper.insert(root); + + Module child = newModule("sp_test_child", "子", root.getIIncrement()); + moduleMapper.insert(child); + + Module deleted = newModule("sp_test_del", "删", root.getIIncrement()); + deleted.setBDeleted(true); + moduleMapper.insert(deleted); + + assertThat(moduleMapper.selectParentIdById(root.getIIncrement())).isNull(); + assertThat(moduleMapper.selectParentIdById(child.getIIncrement())).isEqualTo(root.getIIncrement()); + assertThat(moduleMapper.selectParentIdById(deleted.getIIncrement())).isNull(); + assertThat(moduleMapper.selectParentIdById(99999998)).isNull(); + } + + @Test + void hasActiveChildren_trueIfChildAliveExists_falseOtherwise() { + Module root = newModule("sp_test_hac_root", "根", null); + moduleMapper.insert(root); + + Module child1 = newModule("sp_test_hac_alive", "存活子", root.getIIncrement()); + moduleMapper.insert(child1); + + Module child2 = newModule("sp_test_hac_dead", "已删子", root.getIIncrement()); + child2.setBDeleted(true); + moduleMapper.insert(child2); + + assertThat(moduleMapper.hasActiveChildren(root.getIIncrement())).isTrue(); + assertThat(moduleMapper.hasActiveChildren(99999996)).isFalse(); + + jdbcTemplate.update("UPDATE tModule SET bDeleted = 1 WHERE iIncrement = ?", child1.getIIncrement()); + assertThat(moduleMapper.hasActiveChildren(root.getIIncrement())).isFalse(); + } + + @Test + void selectActiveByKeyword_filtersAndOrders() { + Module a = newModule("sp_test_kw_a", "系统-A", null); a.setISortOrder(1); moduleMapper.insert(a); + Module b = newModule("sp_test_kw_b", "系统-B", null); b.setISortOrder(0); moduleMapper.insert(b); + Module c = newModule("sp_test_kw_c", "用户", null); c.setISortOrder(2); moduleMapper.insert(c); + Module d = newModule("sp_test_kw_d", "系统-D", null); d.setISortOrder(3); d.setBDeleted(true); moduleMapper.insert(d); + Module e = newModule("sp_test_kw_e", "测试", null); e.setISortOrder(4); moduleMapper.insert(e); + + java.util.List namesByEmpty = moduleMapper.selectActiveByKeyword("").stream() + .filter(m -> m.getSProcedureName() == null && m.getSModuleNameZh().matches("系统-[ABDE]|用户|测试")) + .map(Module::getSModuleNameZh).toList(); + // 只取本测试用例插入的 4 行（用 sProcedureName 与名字过滤会丢字段，改为按 iIncrement 集合判定） + java.util.Set insertedIds = java.util.Set.of( + a.getIIncrement(), b.getIIncrement(), c.getIIncrement(), e.getIIncrement()); + java.util.List empty = moduleMapper.selectActiveByKeyword("").stream() + .filter(m -> insertedIds.contains(m.getIIncrement())).toList(); + assertThat(empty).extracting(Module::getIIncrement) + .containsExactly(b.getIIncrement(), a.getIIncrement(), c.getIIncrement(), e.getIIncrement()); + + java.util.List sys = moduleMapper.selectActiveByKeyword("系统").stream() + .filter(m -> insertedIds.contains(m.getIIncrement())).toList(); + assertThat(sys).extracting(Module::getIIncrement) + .containsExactly(b.getIIncrement(), a.getIIncrement()); + + assertThat(moduleMapper.selectActiveByKeyword("不存在XYZ-zzz")).isEmpty(); + } + + private Module newModule(String procedureName, String nameZh, Integer parentId) { + Module m = new Module(); + m.setSBrandsId("XLY"); + m.setSSubsidiaryId("XLY"); + m.setTCreateDate(LocalDateTime.now()); + m.setSDisplayType("手机端"); + m.setSProcedureName(procedureName); + m.setSModuleType("业务模块"); + m.setSManageDeptEn("IT"); + m.setBShowPermission(false); + m.setSModuleNameZh(nameZh); + m.setIParentId(parentId); + m.setISortOrder(0); + m.setSCreatedBy("STUB_ADMIN"); + m.setBDeleted(false); + return m; + } +} diff --git a/backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java b/backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java new file mode 100644 index 0000000..4e49e77 --- /dev/null +++ b/backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java @@ -0,0 +1,418 @@ +package com.xly.erp.module.mod.service; + +import com.xly.erp.common.config.StubSecurityProperties; +import com.xly.erp.common.config.TenantProperties; +import com.xly.erp.common.exception.BizException; +import com.xly.erp.module.mod.dto.CreateModuleDTO; +import com.xly.erp.module.mod.dto.UpdateModuleDTO; +import com.xly.erp.module.mod.entity.Module; +import com.xly.erp.module.mod.mapper.ModuleMapper; +import com.xly.erp.module.mod.service.impl.ModuleServiceImpl; +import com.xly.erp.module.mod.vo.ModuleTreeVO; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; +import org.mockito.ArgumentCaptor; +import org.springframework.dao.DuplicateKeyException; +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; +import org.springframework.security.core.context.SecurityContextHolder; + +import java.util.Collections; +import java.util.List; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; +import static org.mockito.ArgumentMatchers.any; +import static org.mockito.Mockito.lenient; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.never; +import static org.mockito.Mockito.times; +import static org.mockito.Mockito.verify; +import static org.mockito.Mockito.when; + +class ModuleServiceImplTest { + + private ModuleMapper moduleMapper; + private ModuleServiceImpl service; + + @BeforeEach + void setUp() { + moduleMapper = mock(ModuleMapper.class); + TenantProperties tenant = new TenantProperties(); + tenant.setBrandsId("XLY"); + tenant.setSubsidiaryId("XLY"); + StubSecurityProperties stub = new StubSecurityProperties(); + stub.setStubUserNo("STUB_ADMIN"); + service = new ModuleServiceImpl(moduleMapper, tenant, stub); + + lenient().when(moduleMapper.insert(any(Module.class))).thenAnswer(inv -> { + Module m = inv.getArgument(0); + m.setIIncrement(99); + return 1; + }); + } + + @AfterEach + void clearContext() { + SecurityContextHolder.clearContext(); + } + + @Test + void createWithValidDto_persistsWithStandardCols() { + CreateModuleDTO dto = baseDto(); + + Integer id = service.create(dto); + + assertThat(id).isEqualTo(99); + ArgumentCaptor captor = ArgumentCaptor.forClass(Module.class); + verify(moduleMapper, times(1)).insert(captor.capture()); + Module saved = captor.getValue(); + assertThat(saved.getSBrandsId()).isEqualTo("XLY"); + assertThat(saved.getSSubsidiaryId()).isEqualTo("XLY"); + assertThat(saved.getTCreateDate()).isNotNull(); + assertThat(saved.getSCreatedBy()).isEqualTo("STUB_ADMIN"); + assertThat(saved.getBDeleted()).isFalse(); + assertThat(saved.getBShowPermission()).isFalse(); + assertThat(saved.getISortOrder()).isZero(); + verify(moduleMapper, never()).findActiveFlagById(any()); + } + + @Test + void createWithParentNotFound_throws40021() { + CreateModuleDTO dto = baseDto(); + dto.setIParentId(42); + when(moduleMapper.findActiveFlagById(42)).thenReturn(null); + + assertThatThrownBy(() -> service.create(dto)) + .isInstanceOf(BizException.class) + .hasFieldOrPropertyWithValue("code", 40021); + verify(moduleMapper, never()).insert(any(Module.class)); + } + + @Test + void createWithInvalidDisplayType_throws40010() { + CreateModuleDTO dto = baseDto(); + dto.setSDisplayType("未知"); + + assertThatThrownBy(() -> service.create(dto)) + .isInstanceOf(BizException.class) + .hasFieldOrPropertyWithValue("code", 40010); + verify(moduleMapper, never()).insert(any(Module.class)); + } + + @Test + void createWithNullParentId_skipsParentCheck() { + CreateModuleDTO dto = baseDto(); + dto.setIParentId(null); + + service.create(dto); + + verify(moduleMapper, never()).findActiveFlagById(any()); + verify(moduleMapper, times(1)).insert(any(Module.class)); + } + + @Test + void mapperDuplicateKey_throws40020() { + CreateModuleDTO dto = baseDto(); + when(moduleMapper.insert(any(Module.class))) + .thenThrow(new DuplicateKeyException("uk_procedure_name")); + + assertThatThrownBy(() -> service.create(dto)) + .isInstanceOf(BizException.class) + .hasFieldOrPropertyWithValue("code", 40020); + } + + @Test + void usesAuthenticatedUserNoAsCreatedBy() { + SecurityContextHolder.getContext().setAuthentication( + new UsernamePasswordAuthenticationToken("ALICE", null, Collections.emptyList())); + CreateModuleDTO dto = baseDto(); + + service.create(dto); + + ArgumentCaptor captor = ArgumentCaptor.forClass(Module.class); + verify(moduleMapper).insert(captor.capture()); + assertThat(captor.getValue().getSCreatedBy()).isEqualTo("ALICE"); + } + + @Test + void updateWithValidDto_invokesUpdateById_withEditableFieldsOnly() { + Module original = stubExistingModule(10); + when(moduleMapper.selectById(10)).thenReturn(original); + when(moduleMapper.updateById(any(Module.class))).thenReturn(1); + + UpdateModuleDTO dto = baseUpdateDto(); + dto.setSModuleNameZh("新名"); + + Integer result = service.update(10, dto); + assertThat(result).isEqualTo(10); + + ArgumentCaptor captor = ArgumentCaptor.forClass(Module.class); + verify(moduleMapper).updateById(captor.capture()); + Module passed = captor.getValue(); + assertThat(passed.getIIncrement()).isEqualTo(10); + assertThat(passed.getSModuleNameZh()).isEqualTo("新名"); + assertThat(passed.getSDisplayType()).isEqualTo("手机端"); + assertThat(passed.getSProcedureName()).isNull(); + assertThat(passed.getSCreatedBy()).isNull(); + assertThat(passed.getTCreateDate()).isNull(); + assertThat(passed.getSBrandsId()).isNull(); + assertThat(passed.getSSubsidiaryId()).isNull(); + assertThat(passed.getBDeleted()).isNull(); + } + + @Test + void updateWithTargetNotFound_throws40400() { + when(moduleMapper.selectById(99)).thenReturn(null); + UpdateModuleDTO dto = baseUpdateDto(); + + assertThatThrownBy(() -> service.update(99, dto)) + .isInstanceOf(BizException.class) + .hasFieldOrPropertyWithValue("code", 40400); + verify(moduleMapper, never()).updateById(any(Module.class)); + } + + @Test + void updateWithBShowPermissionNull_setsFalseInEntity() { + when(moduleMapper.selectById(10)).thenReturn(stubExistingModule(10)); + when(moduleMapper.updateById(any(Module.class))).thenReturn(1); + UpdateModuleDTO dto = baseUpdateDto(); + dto.setBShowPermission(null); + + service.update(10, dto); + + ArgumentCaptor captor = ArgumentCaptor.forClass(Module.class); + verify(moduleMapper).updateById(captor.capture()); + assertThat(captor.getValue().getBShowPermission()).isFalse(); + } + + @Test + void updateWithInvalidDisplayType_throws40010() { + when(moduleMapper.selectById(10)).thenReturn(stubExistingModule(10)); + UpdateModuleDTO dto = baseUpdateDto(); + dto.setSDisplayType("未知"); + + assertThatThrownBy(() -> service.update(10, dto)) + .isInstanceOf(BizException.class) + .hasFieldOrPropertyWithValue("code", 40010); + verify(moduleMapper, never()).updateById(any(Module.class)); + } + + @Test + void updateWithSelfParentId_throws40021() { + when(moduleMapper.selectById(10)).thenReturn(stubExistingModule(10)); + UpdateModuleDTO dto = baseUpdateDto(); + dto.setIParentId(10); + + assertThatThrownBy(() -> service.update(10, dto)) + .isInstanceOf(BizException.class) + .hasFieldOrPropertyWithValue("code", 40021) + .hasMessageContaining("自身"); + verify(moduleMapper, never()).updateById(any(Module.class)); + } + + @Test + void updateWithMissingParent_throws40021() { + when(moduleMapper.selectById(10)).thenReturn(stubExistingModule(10)); + when(moduleMapper.existsActiveById(42)).thenReturn(false); + UpdateModuleDTO dto = baseUpdateDto(); + dto.setIParentId(42); + + assertThatThrownBy(() -> service.update(10, dto)) + .isInstanceOf(BizException.class) + .hasFieldOrPropertyWithValue("code", 40021) + .hasMessageContaining("父模块不存在"); + verify(moduleMapper, never()).updateById(any(Module.class)); + } + + @Test + void updateWithCyclicParent_throws40021() { + when(moduleMapper.selectById(10)).thenReturn(stubExistingModule(10)); + when(moduleMapper.existsActiveById(20)).thenReturn(true); + when(moduleMapper.selectParentIdById(20)).thenReturn(10); + UpdateModuleDTO dto = baseUpdateDto(); + dto.setIParentId(20); + + assertThatThrownBy(() -> service.update(10, dto)) + .isInstanceOf(BizException.class) + .hasFieldOrPropertyWithValue("code", 40021) + .hasMessageContaining("环路"); + verify(moduleMapper, never()).updateById(any(Module.class)); + } + + @Test + void deleteWithValidId_softDeletes_andSetsAuditFields() { + when(moduleMapper.selectById(10)).thenReturn(stubExistingModule(10)); + when(moduleMapper.hasActiveChildren(10)).thenReturn(false); + when(moduleMapper.updateById(any(Module.class))).thenReturn(1); + + service.delete(10); + + ArgumentCaptor captor = ArgumentCaptor.forClass(Module.class); + verify(moduleMapper).updateById(captor.capture()); + Module passed = captor.getValue(); + assertThat(passed.getIIncrement()).isEqualTo(10); + assertThat(passed.getBDeleted()).isTrue(); + assertThat(passed.getTDeletedDate()).isNotNull(); + assertThat(passed.getSDeletedBy()).isEqualTo("STUB_ADMIN"); + assertThat(passed.getSProcedureName()).isNull(); + assertThat(passed.getSCreatedBy()).isNull(); + assertThat(passed.getSBrandsId()).isNull(); + } + + @Test + void deleteWithTargetNotFound_throws40400() { + when(moduleMapper.selectById(99)).thenReturn(null); + + assertThatThrownBy(() -> service.delete(99)) + .isInstanceOf(BizException.class) + .hasFieldOrPropertyWithValue("code", 40400); + verify(moduleMapper, never()).updateById(any(Module.class)); + } + + @Test + void deleteWithTargetAlreadyDeleted_throws40400() { + Module deleted = stubExistingModule(10); + deleted.setBDeleted(true); + when(moduleMapper.selectById(10)).thenReturn(deleted); + + assertThatThrownBy(() -> service.delete(10)) + .isInstanceOf(BizException.class) + .hasFieldOrPropertyWithValue("code", 40400); + verify(moduleMapper, never()).updateById(any(Module.class)); + } + + @Test + void deleteWithActiveChildren_throws40901() { + when(moduleMapper.selectById(10)).thenReturn(stubExistingModule(10)); + when(moduleMapper.hasActiveChildren(10)).thenReturn(true); + + assertThatThrownBy(() -> service.delete(10)) + .isInstanceOf(BizException.class) + .hasFieldOrPropertyWithValue("code", 40901); + verify(moduleMapper, never()).updateById(any(Module.class)); + } + + @Test + void deleteSetsDeletedByFromAuthenticatedUser() { + SecurityContextHolder.getContext().setAuthentication( + new UsernamePasswordAuthenticationToken("BOB", null, Collections.emptyList())); + when(moduleMapper.selectById(10)).thenReturn(stubExistingModule(10)); + when(moduleMapper.hasActiveChildren(10)).thenReturn(false); + when(moduleMapper.updateById(any(Module.class))).thenReturn(1); + + service.delete(10); + + ArgumentCaptor captor = ArgumentCaptor.forClass(Module.class); + verify(moduleMapper).updateById(captor.capture()); + assertThat(captor.getValue().getSDeletedBy()).isEqualTo("BOB"); + } + + @Test + void listTree_emptyKeyword_invokesMapperWithEmptyString_returnsAssembledTree() { + Module root1 = treeRow(1, "根1", null, 0); + Module root2 = treeRow(2, "根2", null, 0); + Module child1 = treeRow(3, "子1", 1, 0); + Module child2 = treeRow(4, "子2", 1, 1); + Module grand1 = treeRow(5, "孙1", 3, 0); + when(moduleMapper.selectActiveByKeyword("")).thenReturn(List.of(root1, root2, child1, child2, grand1)); + + List result = service.listTree(""); + + assertThat(result).extracting(ModuleTreeVO::getIIncrement).containsExactly(1, 2); + assertThat(result.get(0).getChildren()).extracting(ModuleTreeVO::getIIncrement).containsExactly(3, 4); + assertThat(result.get(0).getChildren().get(0).getChildren()).extracting(ModuleTreeVO::getIIncrement).containsExactly(5); + assertThat(result.get(1).getChildren()).isEmpty(); + } + + @Test + void listTree_nullKeyword_treatedAsEmpty() { + when(moduleMapper.selectActiveByKeyword("")).thenReturn(List.of()); + service.listTree(null); + ArgumentCaptor captor = ArgumentCaptor.forClass(String.class); + verify(moduleMapper).selectActiveByKeyword(captor.capture()); + assertThat(captor.getValue()).isEqualTo(""); + } + + @Test + void listTree_blankKeyword_treatedAsEmpty() { + when(moduleMapper.selectActiveByKeyword("")).thenReturn(List.of()); + service.listTree(" "); + verify(moduleMapper).selectActiveByKeyword(""); + } + + @Test + void listTree_keywordTooLong_throws40001() { + String longKw = "x".repeat(101); + assertThatThrownBy(() -> service.listTree(longKw)) + .isInstanceOf(BizException.class) + .hasFieldOrPropertyWithValue("code", 40001); + verify(moduleMapper, never()).selectActiveByKeyword(any()); + } + + @Test + void listTree_returnsEmptyListWhenNoMatch() { + when(moduleMapper.selectActiveByKeyword("xyz")).thenReturn(List.of()); + List result = service.listTree("xyz"); + assertThat(result).isEmpty(); + } + + @Test + void listTree_orphansBecomeRootsInForest() { + Module orphan = treeRow(3, "孤儿", 99, 0); + when(moduleMapper.selectActiveByKeyword("")).thenReturn(List.of(orphan)); + + List result = service.listTree(""); + + assertThat(result).hasSize(1); + assertThat(result.get(0).getIIncrement()).isEqualTo(3); + assertThat(result.get(0).getChildren()).isEmpty(); + } + + @Test + void listTree_keywordIsTrimmedBeforeQuery() { + when(moduleMapper.selectActiveByKeyword("系统")).thenReturn(List.of()); + service.listTree(" 系统 "); + verify(moduleMapper).selectActiveByKeyword("系统"); + } + + private Module treeRow(int id, String name, Integer parentId, int sortOrder) { + Module m = new Module(); + m.setIIncrement(id); + m.setSModuleNameZh(name); + m.setSDisplayType("手机端"); + m.setSManageDeptEn("IT"); + m.setIParentId(parentId); + m.setISortOrder(sortOrder); + return m; + } + + private UpdateModuleDTO baseUpdateDto() { + UpdateModuleDTO dto = new UpdateModuleDTO(); + dto.setSDisplayType("手机端"); + dto.setSModuleType("业务模块"); + dto.setSManageDeptEn("IT"); + dto.setSModuleNameZh("更新后"); + dto.setBShowPermission(false); + return dto; + } + + private Module stubExistingModule(Integer id) { + Module m = new Module(); + m.setIIncrement(id); + m.setSProcedureName("sp_test_existing"); + m.setSCreatedBy("ORIG_USER"); + m.setBDeleted(false); + return m; + } + + private CreateModuleDTO baseDto() { + CreateModuleDTO dto = new CreateModuleDTO(); + dto.setSDisplayType("手机端"); + dto.setSProcedureName("sp_test_unit"); + dto.setSModuleType("业务模块"); + dto.setSManageDeptEn("IT"); + dto.setSModuleNameZh("单测模块"); + return dto; + } +} diff --git a/docs/08-模块任务管理.md b/docs/08-模块任务管理.md index 40d677c..e7749ba 100644 --- a/docs/08-模块任务管理.md +++ b/docs/08-模块任务管理.md @@ -58,12 +58,12 @@ - module_mod 模块管理 - 依赖: — - 路径: backend/module/mod/, frontend/pages/mod/ - - MR: — + - MR: !1 - 功能: - - [ ] REQ-MOD-001 模块新增 - - [ ] REQ-MOD-002 模块修改 - - [ ] REQ-MOD-003 模块删除 - - [ ] REQ-MOD-004 模块查询 + - [x] REQ-MOD-001 模块新增 + - [x] REQ-MOD-002 模块修改 + - [x] REQ-MOD-003 模块删除 + - [x] REQ-MOD-004 模块查询 - module_usr 用户管理 - 依赖: — diff --git a/docs/superpowers/module-reports/2026-04-30-module_mod.md b/docs/superpowers/module-reports/2026-04-30-module_mod.md new file mode 100644 index 0000000..9577d79 --- /dev/null +++ b/docs/superpowers/module-reports/2026-04-30-module_mod.md @@ -0,0 +1,174 @@ +--- +module_id: module_mod +date: 2026-04-30 +git_range: 642c5f9..b3817b0 +--- + +# 模块完成报告 — module_mod 模块管理 + +## ① 模块信息 +- 模块 ID: module_mod +- 模块名: 模块管理 +- 开发区间: `642c5f9..b3817b0`（33 commits，4035 行新增） +- 分支: `module-module_mod` +- 起点：项目首个模块（首个 REQ 同时承担 Spring Boot 工程脚手架建立） + +## ② REQ 完成清单 + +- [x] REQ-MOD-001 — 模块新增 + - spec: docs/superpowers/specs/2026-04-29-REQ-MOD-001.md + - plan: docs/superpowers/plans/2026-04-29-REQ-MOD-001.md + - review: docs/superpowers/reviews/2026-04-29-REQ-MOD-001.md +- [x] REQ-MOD-002 — 模块修改 + - spec: docs/superpowers/specs/2026-04-29-REQ-MOD-002.md + - plan: docs/superpowers/plans/2026-04-29-REQ-MOD-002.md + - review: docs/superpowers/reviews/2026-04-29-REQ-MOD-002.md +- [x] REQ-MOD-003 — 模块删除 + - spec: docs/superpowers/specs/2026-04-29-REQ-MOD-003.md + - plan: docs/superpowers/plans/2026-04-29-REQ-MOD-003.md + - review: docs/superpowers/reviews/2026-04-29-REQ-MOD-003.md +- [x] REQ-MOD-004 — 模块查询 + - spec: docs/superpowers/specs/2026-04-29-REQ-MOD-004.md + - plan: docs/superpowers/plans/2026-04-29-REQ-MOD-004.md + - review: docs/superpowers/reviews/2026-04-29-REQ-MOD-004.md + +## ③ 文件变更表 + +| 文件 | 操作 | 说明 | +|---|---|---| +| backend/pom.xml | 新建 | Spring Boot 3.3.5 + MyBatis-Plus 3.5.9 + Flyway + jjwt 0.12.6 | +| backend/.gitignore | 新建 | target / *.iml / .idea | +| backend/src/main/java/com/xly/erp/ErpApplication.java | 新建 | Spring Boot 启动类 + EnableConfigurationProperties | +| backend/src/main/java/com/xly/erp/common/config/MybatisPlusConfig.java | 新建 | @MapperScan | +| backend/src/main/java/com/xly/erp/common/config/TenantProperties.java | 新建 | erp.tenant.* 多租户字段 | +| backend/src/main/java/com/xly/erp/common/config/StubSecurityProperties.java | 新建 | erp.security.stub-user-no / jwt-secret | +| backend/src/main/java/com/xly/erp/common/response/Result.java | 新建 | 统一响应 {code,msg,data} | +| backend/src/main/java/com/xly/erp/common/exception/BizException.java | 新建 | 业务异常 | +| backend/src/main/java/com/xly/erp/common/exception/GlobalExceptionHandler.java | 新建 | @RestControllerAdvice 三类 handler | +| backend/src/main/java/com/xly/erp/common/security/JwtUtil.java | 新建 | HS256 sign/parse | +| backend/src/main/java/com/xly/erp/common/security/JwtAuthenticationFilter.java | 新建 | OncePerRequestFilter 解析 token | +| backend/src/main/java/com/xly/erp/common/security/SecurityConfig.java | 新建 | /api/mod/** permitAll（USR-004 stub） | +| backend/src/main/java/com/xly/erp/common/security/SecurityContextHelper.java | 新建 | currentUserNo 含 anonymous 识别 | +| backend/src/main/java/com/xly/erp/module/mod/entity/Module.java | 新建 | tModule 1:1 PO（17 字段） | +| backend/src/main/java/com/xly/erp/module/mod/dto/CreateModuleDTO.java | 新建 | REQ-MOD-001 入参（Bean Validation） | +| backend/src/main/java/com/xly/erp/module/mod/dto/UpdateModuleDTO.java | 新建 | REQ-MOD-002 入参（剔除 sProcedureName） | +| backend/src/main/java/com/xly/erp/module/mod/vo/ModuleTreeVO.java | 新建 | REQ-MOD-004 出参（递归 children） | +| backend/src/main/java/com/xly/erp/module/mod/mapper/ModuleMapper.java | 新建 | BaseMapper + 4 个自定义 SELECT | +| backend/src/main/java/com/xly/erp/module/mod/service/ModuleService.java | 新建 | create/update/delete/listTree | +| backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java | 新建 | 含枚举/父链/子模块/拼树 全部业务校验 | +| backend/src/main/java/com/xly/erp/module/mod/controller/ModuleController.java | 新建 | POST/PUT/DELETE/GET /api/mod/modules | +| backend/src/main/resources/application.yml | 新建 | DB / Flyway / 端口 / erp.* 配置 | +| backend/src/main/resources/application-test.yml | 新建 | test profile override | +| backend/src/main/resources/logback-spring.xml | 新建 | 默认 console appender | +| backend/src/test/java/com/xly/erp/SmokeTest.java | 新建 | Spring 启动 + Flyway apply 验证 | +| backend/src/test/java/com/xly/erp/common/exception/GlobalExceptionHandlerTest.java | 新建 | 4 用例（standalone MockMvc） | +| backend/src/test/java/com/xly/erp/common/security/JwtUtilTest.java | 新建 | 3 用例 | +| backend/src/test/java/com/xly/erp/common/security/TestJwtHelper.java | 新建 | 测试辅助签发 JWT | +| backend/src/test/java/com/xly/erp/common/security/JwtAuthenticationFilterTest.java | 新建 | 3 用例（filter 三分支） | +| backend/src/test/java/com/xly/erp/module/mod/mapper/ModuleMapperIT.java | 新建 | 5 用例（insert/parent/child queries） | +| backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java | 新建 | 25 用例（create/update/delete/listTree） | +| backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java | 新建 | 26 用例（4 接口端到端 + JWT 路径） | +| docs/superpowers/specs/2026-04-29-REQ-MOD-{001,002,003,004}.md | 新建 | 4 份功能规格 | +| docs/superpowers/plans/2026-04-29-REQ-MOD-{001,002,003,004}.md | 新建 | 4 份 TDD 计划 | +| docs/superpowers/reviews/2026-04-29-REQ-MOD-{001,002,003,004}.md | 新建 | 4 份 AI 自审报告 | +| docs/superpowers/module-reports/module_mod-test-gate.md | 新建 | 本模块 test-gate 证据 | +| docs/08-模块任务管理.md | 修改 | 4 个 REQ checkbox 勾上 | +| scripts/setup-test-db.sh | 修改 | macOS Homebrew mysql-client 路径自动 prepend | +| scripts/test.sh | 修改 | frontend 段在 frontend/ 缺失时跳过 | + +## ④ 数据库使用表 + +- 读: `tModule`（REQ-MOD-001/002/003/004 均涉及） +- 写: `tModule` + - INSERT：REQ-MOD-001（新增） + - UPDATE：REQ-MOD-002（更新可编辑字段，依赖 MyBatis-Plus FieldStrategy.NOT_NULL 跳过 null 不动 sProcedureName/sCreatedBy/标准列）；REQ-MOD-003（软删除：`bDeleted=1` + `tDeletedDate` + `sDeletedBy`） + +## ⑤ 测试结果 + +- `scripts/test.sh` 最终：**GREEN** +- 通过: 67 / 失败: 0 / 跳过: 0（前端段因 `frontend/` 未初始化而 skip 不计入） +- 覆盖率：未配置 jacoco，本期不报告（建议 USR 模块开始前在 pom 引入） +- 详见: `docs/superpowers/module-reports/module_mod-test-gate.md` +- 测试分布： + - SmokeTest: 1 + - GlobalExceptionHandlerTest: 4 + - JwtUtilTest: 3 + - JwtAuthenticationFilterTest: 3 + - ModuleMapperIT: 5 + - ModuleServiceImplTest: 25 + - ModuleControllerIT: 26 + +## ⑥ 本模块新增 Migration + +—（本模块无 schema 改动；`tModule` 表由 A4 阶段 `V1__initial_schema.sql` 已落地） + +## ⑦ 跨模块改动清单（软规则 S2） + +无跨模块改动。本模块所有源码改动均位于 `backend/src/main/java/com/xly/erp/module/mod/**` + `backend/src/main/java/com/xly/erp/common/**`（首 REQ 必要的全局基础设施：Result/Exception/Security/Config）+ `backend/src/test/**`。`common/` 下的类（Result / GlobalExceptionHandler / JwtAuthenticationFilter / SecurityConfig 等）属于"项目级共用脚手架"，由首 REQ MOD-001 一次建立，后续模块复用，不视为 S2 跨模块。 + +## ⑧ 偏离 spec 清单 + +- **REQ-MOD-002**：错误码段位与 docs/05 偏离——MOD-002 spec 选择复用 MOD-001 的 `40010`（显示类型枚举非法），而 docs/05 § REQ-MOD-002 错误码列表只列 40001/40021/40400。 （原因: 同字段在两个接口语义一致更优；spec § 业务规则 #2 已显式声明该决策，docs/05 后续可补一行） +- **REQ-MOD-002**：spec 与 plan 写"controller 先 trim"，实际实现 trim 在 service。 （原因: service 集中归一化更易测，行为等价；REQ-MOD-004 review 已指出，建议改 spec 文案对齐） +- **REQ-MOD-003**：未实现 docs/05 § REQ-MOD-003 列出的 `40902` 外部引用拦截。 （原因: docs/03 当前 schema 中 tModule 无引用方表；spec § 业务规则 #3 + § 实现范围与边界抉择 #4 双处显式声明本期不实现，待引用方表落地后回填） +- **REQ-MOD-004**：拼树策略不扩展祖先链——子节点命中而父节点未命中时，子节点直接挂为森林 root。 （原因: spec § 实现范围与边界抉择 #1 已声明，REQ 卡仅要求"以树形展示匹配结果"，森林是合法树形；扩展祖先需二次查询或 CTE，复杂度收益不匹配本期需求） +- **REQ-MOD-004**：LIKE 通配符 `%` / `_` 不做转义。 （原因: spec § 边界与约束已声明，业务上不敏感；docs/05 未要求；后续可通过 `replace("%","\\%")` 收口） + +## ⑨ AI reviewer 报告汇总 + +- REQ-MOD-001: round 1 — approve（link: docs/superpowers/reviews/2026-04-29-REQ-MOD-001.md） +- REQ-MOD-002: round 1 — approve（link: docs/superpowers/reviews/2026-04-29-REQ-MOD-002.md） +- REQ-MOD-003: round 1 — approve（link: docs/superpowers/reviews/2026-04-29-REQ-MOD-003.md） +- REQ-MOD-004: round 1 — approve（link: docs/superpowers/reviews/2026-04-29-REQ-MOD-004.md） + +全部 round 1 一次性通过；4 份 review 共 25 条 nice-to-have，无 must-fix。 + +## ⑩ 已知问题 + +整合自 4 份 review 的非阻塞 nice-to-have，按主题分组： + +**鉴权 stub 收尾（USR-004 闭环时一次性处理）** +1. `SecurityConfig` 的 `requestMatchers("/api/mod/**").permitAll()` → 改为 `authenticated()` 或 `hasAuthority('SUPER_ADMIN')`（按 docs/05 § 各 REQ 的 Permission 字段精细化） +2. `ModuleServiceImpl#create` 的 `stub.getStubUserNo()` 回退路径需移除（`sCreatedBy` 必须来自 JWT principal） +3. 6 处 IT stub 用例（`postWithoutJwt_*` / `putWithoutJwt_*` / `deleteWithoutJwt_*` / `getWithoutJwt_*`）缺 `// REQ-MOD-001 stub: see USR-004 follow-up` 锚点；USR-004 上线时 grep 替换会漏 + +**架构遗留** +4. `backend/src/main/java/com/xly/erp/module/mod/entity/Module.java` 类名 `Module` 与 `java.lang.Module`（JPMS）冲突；建议未来重命名为 `ModuleEntity` 或 `TModule` +5. `JwtAuthenticationFilter` 加 `@Component` 同时被 Spring Security `addFilterBefore` 与原生 servlet 注册重复登记（`OncePerRequestFilter` 防住执行，但作用域不清）；建议 USR-004 时改为 `@Bean` + `FilterRegistrationBean(setEnabled(false))` +6. `JwtUtil` 暴露两个 public 构造器，`JwtUtil(String secret)` 实质 test-only；可改 package-private + 注释 + +**配置 / 校验** +7. `application.yml` 中 `${JWT_SECRET}` 缺 fail-fast 默认值；建议改为 `${JWT_SECRET:?JWT_SECRET 必须从 .env.local 注入}` +8. `application-dev.yml` 缺失（docs/09 § 二 列出但未生成）；下一个模块本机 dev 启动时需要 +9. `GlobalExceptionHandler#handleAny` 把 `HttpMessageNotReadableException` / `HttpRequestMethodNotSupportedException` 转 `code=50000`（应当是 40001）；建议增加专用 4xx handler +10. `DTO` `iParentId` / `iSortOrder` 缺 `@PositiveOrZero` / `@Min` 约束 +11. `ModuleServiceImpl#updateById` / `delete` 的返回值（受影响行数）丢弃；并发场景下 `affected=0` 仍返回成功——可断言 `affected==1` 否则抛兜底异常 + +**测试覆盖缺口（非阻塞）** +12. `@Size` 长度溢出（如 `sProcedureName > 100` 字符）路径仅在"缺必填"用例顺带覆盖，未独立断言 +13. `iParentId` 指向 `bDeleted=1` 旧记录是否回 `40021` 未单独验证 +14. 环检测 `MAX_PARENT_DEPTH=50` 超深路径仅有间接覆盖（未构造 50 层脏数据链） +15. `tCreateDate` / `sBrandsId` / `sSubsidiaryId` 在 update / delete IT 端未端到端断言保留（service 单测已 captureArgument 验 entity 字段为 null + 依赖 NOT_NULL 策略） +16. 业务方法行内 `// REQ-MOD-XXX:` 锚点缺失（4 处：create/update/delete/listTree）；建议下个模块开始前一次性补齐 +17. `ModuleMapperIT#selectActiveByKeyword_filtersAndOrders` 第 108–110 行 `namesByEmpty` 局部变量构造后未被任何 assert 使用（dead code），建议清理 + +## ⑪ 下一模块预览 + +**module_usr 用户管理**（docs/02 § 二 顺序的 REQ 5–8） +- REQ-USR-001 用户新增（依赖 `tStaff` / `tPermissionCategory` 作下拉数据源） +- REQ-USR-002 用户修改 +- REQ-USR-003 用户查询（多条件 + 分页） +- REQ-USR-004 用户登录（**关键**——完成后才能把 `/api/mod/**` 与 `/api/usr/**` 的 stub permitAll 收紧为 `hasAuthority('SUPER_ADMIN')`，并移除 service 层 `stub.getStubUserNo()` 回退路径） + +预期范围：`backend/src/main/java/com/xly/erp/module/usr/**` 全新模块树；`tUser` / `tStaff` / `tPermissionCategory` / `tUserPermission` schema 已在 V1 就位；JWT 签发由 USR-004 接管（覆写 MOD 期间手工签发的逻辑）。 + +USR 模块开工前的"扫尾建议"： +- 处理 § ⑩ #16（业务方法行内 REQ 锚点 4 处） +- 处理 § ⑩ #8（生成 application-dev.yml 占位） +- 处理 § ⑩ #17（删除 dead code） + +这三项是低成本一次性收口，建议作为 module_usr 的 REQ-USR-001 开工前第一个 chore commit 完成；其余 § ⑩ 项均围绕 USR-004 / 后续模块自然解决。 + +## ⑫ MR 链接 + +- !1 — http://git.xlyprint.cn/zhuzc/test/merge_requests/1 diff --git a/docs/superpowers/module-reports/module_mod-test-gate.md b/docs/superpowers/module-reports/module_mod-test-gate.md new file mode 100644 index 0000000..87269a3 --- /dev/null +++ b/docs/superpowers/module-reports/module_mod-test-gate.md @@ -0,0 +1,31 @@ +## Local test gate — module_mod + +执行时间: 2026-04-30 09:14 +08:00 + +### scripts/test.sh (subagent) +- 子会话: a7d5818a97a7b5c66 +- 命令: `bash scripts/test.sh` +- 退出码: 0 +- 通过: 67 / 失败: 0 +- 关键 stdout (≤30 行): + +``` +[INFO] Tests run: 67, Failures: 0, Errors: 0, Skipped: 0 +[INFO] BUILD SUCCESS +[INFO] Total time: 17.058 s +[INFO] Finished at: 2026-04-30T09:14:23+08:00 +[test.sh] skip frontend unit tests (frontend/ not initialized yet) +[test.sh] 5/6 E2E +[test.sh] e2e 略 +[test.sh] 6/6 reset test db +[setup-test-db] done — schema will be applied by Flyway when Spring Boot starts +[test.sh] GREEN +``` + +结论: green + +### 备注 + +- 首次 test-gate 因环境缺失 mysql CLI 退出 127；用户修复 PATH 后重跑。 +- 项目阶段 `frontend/` 尚未初始化，scripts/test.sh 的 build / lint / unit 三段在 frontend 缺失时打印 skip 跳过（详见同 commit 的 `chore(infra): skip frontend test segments when frontend/ absent`）。前端正式启动后该守卫天然失效，回到完整跑链路。 +- backend 全量 67 用例端到端验证 module_mod 4 个 REQ 的实现 + 工程脚手架；setup-test-db.sh DROP+CREATE → Spring Boot 启动 Flyway apply V1 → mvn test 路径全程通过。 diff --git a/docs/superpowers/plans/2026-04-29-REQ-MOD-001.md b/docs/superpowers/plans/2026-04-29-REQ-MOD-001.md new file mode 100644 index 0000000..b20ed6c --- /dev/null +++ b/docs/superpowers/plans/2026-04-29-REQ-MOD-001.md @@ -0,0 +1,418 @@ +--- +req_id: REQ-MOD-001 +date: 2026-04-29 +spec_ref: docs/superpowers/specs/2026-04-29-REQ-MOD-001.md +--- + +# REQ-MOD-001 模块新增 Implementation Plan + +> **Execution:** Parent skill `feature-tdd` executes this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** 在尚未存在的 `backend/` Spring Boot 工程中，从零搭起最小后端脚手架（统一响应 / 异常 / JWT Filter / Flyway / MyBatis-Plus）+ 实现 `POST /api/mod/modules` 完成模块新增（写入 `tModule`），并以单元 + 集成双层覆盖 spec 验收清单。 + +**Architecture:** 三层（controller / service / mapper） + 通用层（response / exception / security / config）。Spring Security 启 `JwtAuthenticationFilter` 解析 token 写 `principal=sUserNo`；本 REQ 对 `POST /api/mod/modules` 走 `permitAll` stub（角色硬校验留 USR-004 闭环）。多租户字段 `sBrandsId` / `sSubsidiaryId` 通过 `application.yml` 的 `erp.tenant.*` 注入，默认 `XLY`/`XLY`。错误码沿用 `docs/05` 已声明值（`40001/40010/40020/40021`），认证层错误用 `20001`。 + +**Tech Stack:** Spring Boot 3.x · MyBatis-Plus · Spring Security · JJWT · Flyway 10.x · MySQL 8 · Java 17 · Maven 3.9 · JUnit 5 · Mockito · Spring Boot Test。 + +--- + +## Schema 改动 + +无（`tModule` 已在 `sql/migrations/V1__initial_schema.sql` 由 A4 落地，本 REQ 仅写入数据，不动 DDL）。 + +## 文件变更清单 + +### 工程脚手架 + +- `backend/pom.xml` — 新建（声明依赖 + 编译/测试插件） +- `backend/src/main/java/com/xly/erp/ErpApplication.java` — 新建（`@SpringBootApplication` 启动类） +- `backend/src/main/java/com/xly/erp/common/config/MybatisPlusConfig.java` — 新建（`@MapperScan("com.xly.erp.**.mapper")`） +- `backend/src/main/resources/application.yml` — 新建（默认 profile + Flyway + datasource 用 `${ENV}` 占位） +- `backend/src/main/resources/application-test.yml` — 新建（test profile，沿用同一测试库） +- `backend/src/main/resources/logback-spring.xml` — 新建（最小日志配置，关闭 SQL 详细日志以外的噪音） +- `backend/src/test/resources/application-test.yml` — 与 main 同名 override 用，仅在测试时生效 +- `backend/.gitignore` — 新建（`target/`、`*.iml`） + +### 通用层 + +- `backend/src/main/java/com/xly/erp/common/response/Result.java` — 通用响应 `{code,msg,data}`，提供 `ok(T)` / `fail(int,String)` 静态工厂 +- `backend/src/main/java/com/xly/erp/common/exception/BizException.java` — `RuntimeException` 子类，含 `code`、`msg` +- `backend/src/main/java/com/xly/erp/common/exception/GlobalExceptionHandler.java` — `@RestControllerAdvice`，处理 `BizException` / `MethodArgumentNotValidException` / `Exception` 兜底 +- `backend/src/main/java/com/xly/erp/common/config/TenantProperties.java` — `@ConfigurationProperties("erp.tenant")`，字段 `brandsId` / `subsidiaryId` +- `backend/src/main/java/com/xly/erp/common/config/StubSecurityProperties.java` — `@ConfigurationProperties("erp.security")`，字段 `stubUserNo`（默认 `STUB_ADMIN`） +- `backend/src/main/java/com/xly/erp/common/security/JwtUtil.java` — 签发 + 解析 HS256；`sign(String userNo)` / `parse(String token) : String userNo`；密钥读 `JWT_SECRET` +- `backend/src/main/java/com/xly/erp/common/security/JwtAuthenticationFilter.java` — `OncePerRequestFilter`，存在 `Authorization: Bearer` 时尝试解析；解析失败写 `Result(20001,"未认证")` 并短路；缺失则 chain 透传（permitAll 路径需要这种放行能力） +- `backend/src/main/java/com/xly/erp/common/security/SecurityConfig.java` — `SecurityFilterChain`：禁 CSRF，`POST /api/mod/modules` permitAll，其他 `authenticated()`，注册 Filter +- `backend/src/main/java/com/xly/erp/common/security/SecurityContextHelper.java` — 静态方法 `currentUserNo() : String`（无认证返回 `null`） + +### MOD 业务模块 + +- `backend/src/main/java/com/xly/erp/module/mod/entity/Module.java` — MyBatis-Plus `@TableName("tModule")` PO（含 `iIncrement`/`sId`/`sBrandsId`/`sSubsidiaryId`/`tCreateDate`/`sDisplayType`/`sProcedureName`/`sModuleType`/`sManageDeptEn`/`bShowPermission`/`sModuleNameZh`/`iParentId`/`iSortOrder`/`sCreatedBy`/`bDeleted`/`tDeletedDate`/`sDeletedBy`） +- `backend/src/main/java/com/xly/erp/module/mod/dto/CreateModuleDTO.java` — Bean Validation 注解的入参 DTO +- `backend/src/main/java/com/xly/erp/module/mod/mapper/ModuleMapper.java` — 继承 `BaseMapper`，自定义 `boolean existsActiveById(Integer iIncrement)` +- `backend/src/main/resources/mapper/mod/ModuleMapper.xml` — `existsActiveById` 的 SELECT 1 实现 +- `backend/src/main/java/com/xly/erp/module/mod/service/ModuleService.java` — 接口，方法 `Integer create(CreateModuleDTO dto)` +- `backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java` — 实现，`@Transactional`，含枚举校验/父校验/标准列填充/唯一冲突捕获 +- `backend/src/main/java/com/xly/erp/module/mod/controller/ModuleController.java` — `@PostMapping("/api/mod/modules")` 接受 `@Valid CreateModuleDTO`，返回 `Result>` + +### 测试 + +- `backend/src/test/java/com/xly/erp/SmokeTest.java` — `@SpringBootTest` 启动 + 验 Flyway 已 apply（`tModule` 表存在） +- `backend/src/test/java/com/xly/erp/common/security/TestJwtHelper.java` — 测试辅助，`signFor(String userNo) : String` +- `backend/src/test/java/com/xly/erp/common/exception/GlobalExceptionHandlerTest.java` — Mock MVC 单测，`@WebMvcTest` 限定 + 一个抛 `BizException` 的 stub controller +- `backend/src/test/java/com/xly/erp/common/security/JwtUtilTest.java` — 单测，`signAndParse_roundTrip` +- `backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java` — Mockito 单测，6 个用例（参 spec 单元测试清单） +- `backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java` — `@SpringBootTest(webEnvironment=RANDOM_PORT)` + `TestRestTemplate`，7 个用例（参 spec 集成测试清单） + +## 任务步骤 + +> 全局约束：每个 commit 形如 `(mod): REQ-MOD-001`；测试运行强制派发到子会话执行（`mvn -B test -pl backend` 或带 `-Dtest=` 单测过滤）；spec 中任意 `permitAll stub` 注释统一带 `// REQ-MOD-001 stub: see USR-004 follow-up` 形式锚点，便于后续 grep 替换。 + +### Task 1: 工程脚手架立起来（pom + Application + yml + smoke） + +**Files:** +- Create: `backend/pom.xml` +- Create: `backend/src/main/java/com/xly/erp/ErpApplication.java` +- Create: `backend/src/main/resources/application.yml` +- Create: `backend/src/main/resources/application-test.yml` +- Create: `backend/src/main/java/com/xly/erp/common/config/MybatisPlusConfig.java` +- Create: `backend/src/main/resources/logback-spring.xml` +- Create: `backend/.gitignore` +- Test: `backend/src/test/java/com/xly/erp/SmokeTest.java` + +**API shape:** N/A（脚手架） + +**关键依赖**（pom.xml 必须含）：`spring-boot-starter-web`、`spring-boot-starter-validation`、`spring-boot-starter-security`、`mybatis-plus-spring-boot3-starter`、`mysql-connector-j`、`flyway-core`、`flyway-mysql`、`io.jsonwebtoken:jjwt-api/impl/jackson 0.12.x`、`spring-boot-starter-test`。Java 17，编码 UTF-8。 + +**application.yml 必填字段**（值通过环境变量注入，对照 `.env.local`）： +- `spring.datasource.url=jdbc:mysql://${DB_HOST}:${DB_PORT}/${DB_SCHEMA}?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai` +- `spring.datasource.username=${DB_USER}` +- `spring.datasource.password=${DB_PASSWORD}` +- `spring.flyway.enabled=true` / `locations=classpath:db/migration,filesystem:./sql/migrations`（指向仓库根 `sql/migrations/`，不复制文件） +- `spring.flyway.baseline-on-migrate=true` +- `server.port=8080` +- `erp.tenant.brands-id=XLY` +- `erp.tenant.subsidiary-id=XLY` +- `erp.security.stub-user-no=STUB_ADMIN` +- `erp.security.jwt-secret=${JWT_SECRET}` +- `mybatis-plus.mapper-locations=classpath:mapper/**/*.xml` + +- [ ] **Step 1: 建 pom.xml + ErpApplication + yml + logback-spring + .gitignore** + - 直接创建上述文件骨架，不写任何业务代码 + - `ErpApplication` 仅 `@SpringBootApplication` + `main` + +- [ ] **Step 2: 写失败测试 `SmokeTest`** + - 测试名: `SmokeTest#contextLoads_andFlywayApplied` + - 意图: `@SpringBootTest(webEnvironment=NONE)` 启动 + 注入 `JdbcTemplate`，断言 `SHOW TABLES LIKE 'tModule'` 命中 1 行 + - 子会话先跑：编译应通过、测试失败的原因应是 Spring 启动错误（如缺 driver）或 Flyway 未 apply + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=SmokeTest` + - 期望：BUILD SUCCESS，1 test passed + - 排查点：DB 连接（用 `.env.local` 现有凭据 `118.178.19.35:3318`）、Flyway location 是否能解析到 `sql/migrations/V1` + - **测试前置**：本会话先在主会话调 `bash scripts/setup-test-db.sh` 清库，让 SmokeTest 依赖的 Flyway apply 从 V1 重放 + +- [ ] **Step 4: Commit** + - `git add backend/` + - `git commit -m "chore(mod): bootstrap backend scaffold REQ-MOD-001"` + +### Task 2: 通用响应 + 异常处理框架 + +**Files:** +- Create: `backend/src/main/java/com/xly/erp/common/response/Result.java` +- Create: `backend/src/main/java/com/xly/erp/common/exception/BizException.java` +- Create: `backend/src/main/java/com/xly/erp/common/exception/GlobalExceptionHandler.java` +- Test: `backend/src/test/java/com/xly/erp/common/exception/GlobalExceptionHandlerTest.java` + +**API shape:** +- `Result` 字段: `int code`, `String msg`, `T data`；静态方法 `ok(T)` / `ok()` / `fail(int, String)` +- `BizException(int code, String msg)` extends `RuntimeException` +- `GlobalExceptionHandler` `@RestControllerAdvice`： + - `handleBiz(BizException) -> Result.fail(e.code, e.msg)`，HTTP 200 + - `handleValidation(MethodArgumentNotValidException) -> Result.fail(40001, ": ")`，HTTP 200 + - `handleAny(Exception) -> Result.fail(50000, "系统繁忙")`，HTTP 200，**只记日志、不回显堆栈** + +- [ ] **Step 1: 写失败测试** + - 测试文件: `GlobalExceptionHandlerTest` + - `@WebMvcTest` 限定 + 一个 stub controller `/__test/throw-biz`（抛 `BizException(30001,"x")`）/ `/__test/throw-validate`（接 `@Valid` 入参）/ `/__test/throw-runtime`（抛 `IllegalStateException`） + - 三个测试： + - `bizException_returnsResultWithBizCode` 期望 body `{code:30001,msg:"x"}` + - `validationException_returns40001WithFieldHint` 期望 `code=40001` 且 `msg` 包含字段名 + - `uncaughtException_returns50000` 期望 `code=50000` + - 子会话确认 FAIL（类不存在） + +- [ ] **Step 2: 实现最小代码** + - 涉及文件：`Result.java`、`BizException.java`、`GlobalExceptionHandler.java` + - 不超出 spec § 边界与约束 列出的错误码语义 + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=GlobalExceptionHandlerTest` + - 期望：3 tests passed + +- [ ] **Step 4: Commit** + - `git commit -m "feat(mod): unified Result + global exception handler REQ-MOD-001"` + +### Task 3: 租户配置 + JWT 工具 + 测试辅助 + +**Files:** +- Create: `backend/src/main/java/com/xly/erp/common/config/TenantProperties.java` +- Create: `backend/src/main/java/com/xly/erp/common/config/StubSecurityProperties.java` +- Create: `backend/src/main/java/com/xly/erp/common/security/JwtUtil.java` +- Test: `backend/src/test/java/com/xly/erp/common/security/JwtUtilTest.java` +- Test: `backend/src/test/java/com/xly/erp/common/security/TestJwtHelper.java`（生产代码意义上是测试基础设施） + +**API shape:** +- `TenantProperties` 字段 `String brandsId`, `String subsidiaryId`，绑定前缀 `erp.tenant` +- `StubSecurityProperties` 字段 `String stubUserNo`, `String jwtSecret`，绑定前缀 `erp.security` +- `JwtUtil#sign(String userNo) : String`（HS256，subject=userNo，过期 8 小时） +- `JwtUtil#parse(String token) : String`（返回 subject；过期/签名错抛 `BizException(20001,"未认证或 token 已失效")`） +- `TestJwtHelper#signFor(String userNo) : String`（包装 JwtUtil，方便 IT 用） + +- [ ] **Step 1: 写失败测试 `JwtUtilTest`** + - 测试名: + - `signAndParse_roundTrip` — `parse(sign("u1")) == "u1"` + - `parseTamperedToken_throwsBizException20001` + - 用 `@SpringBootTest` 注入 `JwtUtil`，密钥走 application-test.yml 的 `${JWT_SECRET}` + +- [ ] **Step 2: 实现最小代码** + - `TenantProperties` / `StubSecurityProperties` + 在 `ErpApplication` 加 `@EnableConfigurationProperties({TenantProperties.class, StubSecurityProperties.class})` + - `JwtUtil` 用 `io.jsonwebtoken.Jwts.builder()/parser()` + - `TestJwtHelper` `@Component` 注 `JwtUtil` + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=JwtUtilTest` + +- [ ] **Step 4: Commit** + - `git commit -m "feat(mod): tenant + jwt config + util REQ-MOD-001"` + +### Task 4: JWT Filter + SecurityConfig + +**Files:** +- Create: `backend/src/main/java/com/xly/erp/common/security/JwtAuthenticationFilter.java` +- Create: `backend/src/main/java/com/xly/erp/common/security/SecurityConfig.java` +- Create: `backend/src/main/java/com/xly/erp/common/security/SecurityContextHelper.java` +- Test: `backend/src/test/java/com/xly/erp/common/security/SecurityFilterIT.java` + +**API shape:** +- `JwtAuthenticationFilter extends OncePerRequestFilter` + - 头解析：`Authorization: Bearer ` + - 有 token 且解析成功 → `SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(userNo, null, List.of()))` + - 有 token 但解析失败 → 写 `Result.fail(20001,"未认证或 token 已失效")` JSON 到 response，状态码 200，**短路 chain** + - 无 token → chain 直接放行（让 SecurityConfig 的 permitAll/authenticated 规则决定） +- `SecurityConfig#filterChain(HttpSecurity)`: + - `csrf().disable()` / `sessionManagement().sessionCreationPolicy(STATELESS)` + - `authorizeHttpRequests` 顺序： + 1. `requestMatchers(HttpMethod.POST, "/api/mod/modules").permitAll()` — REQ-MOD-001 stub: see USR-004 follow-up + 2. `anyRequest().authenticated()` + - `addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class)` +- `SecurityContextHelper.currentUserNo() : String` — 读 `SecurityContextHolder` principal；无认证返回 `null` + +- [ ] **Step 1: 写失败测试 `SecurityFilterIT`** + - 测试名（用 `@SpringBootTest(webEnvironment=RANDOM_PORT)` + `TestRestTemplate`，命中一个真实接口；本任务先 stub 一个 `/__test/principal` 暴露 `currentUserNo()`，但更稳妥的做法是放在 Task 8 实现 controller 后回填，**故本任务测试范围限制在 SecurityConfig 的路径规则**）： + - `validJwt_authenticatedEndpoint_returnsPrincipal` — POST `/api/mod/modules` 带合法 token，期望 200（permitAll，sCreatedBy 由后续 Task 验证） + - `tamperedJwt_anyEndpoint_returns20001` — Authorization 伪造 → JSON `code=20001` + - `noJwt_permitAllEndpoint_passes` — 无 Authorization 头 → 200（不阻断 permitAll） + - `noJwt_protectedEndpoint_returns20001OrSpring403` — 命中默认 protected，期望状态码非 200 或 `code=20001`（Spring Security 默认会返回 403/401，二者皆可） + - 上述测试 POST `/api/mod/modules` 在本任务尚未实现 controller，会返回 404；将 405/404 视作 "permitAll 通过 filter 链" 的间接证据，断言不要求 200 + - 子会话确认 FAIL（filter/config 类不存在） + +- [ ] **Step 2: 实现最小代码** + - 三个类按 API shape 实现；filter 中"短路 + 写 JSON" 用 `ObjectMapper` 序列化 `Result.fail(20001,...)`，content-type=application/json + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=SecurityFilterIT` + +- [ ] **Step 4: Commit** + - `git commit -m "feat(mod): jwt filter + security config (role stub) REQ-MOD-001"` + +### Task 5: tModule Entity + Mapper（数据层） + +**Files:** +- Create: `backend/src/main/java/com/xly/erp/module/mod/entity/Module.java` +- Create: `backend/src/main/java/com/xly/erp/module/mod/mapper/ModuleMapper.java` +- Create: `backend/src/main/resources/mapper/mod/ModuleMapper.xml` +- Test: `backend/src/test/java/com/xly/erp/module/mod/mapper/ModuleMapperIT.java` + +**API shape:** +- `Module` 类字段（与 `tModule` 1:1，使用 `@TableName("tModule")` + `@TableField` 显式映射）： + - `Integer iIncrement` (`@TableId(type=IdType.AUTO)`) + - `String sId`, `String sBrandsId`, `String sSubsidiaryId` + - `LocalDateTime tCreateDate` + - `String sDisplayType`, `String sProcedureName`, `String sModuleType`, `String sManageDeptEn` + - `Boolean bShowPermission` + - `String sModuleNameZh` + - `Integer iParentId`, `Integer iSortOrder` + - `String sCreatedBy` + - `Boolean bDeleted`, `LocalDateTime tDeletedDate`, `String sDeletedBy` +- `ModuleMapper extends BaseMapper`，附加方法： + - `boolean existsActiveById(@Param("id") Integer iIncrement)` — XML 中 `SELECT 1 FROM tModule WHERE iIncrement=#{id} AND bDeleted=0 LIMIT 1`，返回非空结果即 true + +- [ ] **Step 1: 写失败测试 `ModuleMapperIT`** + - 测试名: + - `insertAndSelectById_persistsAllStandardCols` — 构造 Module 实例 set 全字段后 `mapper.insert(...)` → `mapper.selectById(...)` 比较各字段（含 `sBrandsId='XLY'`） + - `existsActiveById_trueForAlive_falseForDeleted` — 插两条，一条 `bDeleted=0`、一条 `bDeleted=1`，分别校验 + - 用 `@SpringBootTest` + `@Transactional`（自动回滚不污染库），`@Autowired ModuleMapper` + - 子会话先跑 → FAIL（类不存在） + +- [ ] **Step 2: 实现最小代码** + - Module entity + Mapper 接口 + XML + - 标准列 `tCreateDate` 由测试代码填，不依赖 DB 默认（spec 边界对齐） + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=ModuleMapperIT` + +- [ ] **Step 4: Commit** + - `git commit -m "feat(mod): tModule entity + mapper REQ-MOD-001"` + +### Task 6: CreateModuleDTO + ModuleService 主流程（合法路径 + 父校验） + +**Files:** +- Create: `backend/src/main/java/com/xly/erp/module/mod/dto/CreateModuleDTO.java` +- Create: `backend/src/main/java/com/xly/erp/module/mod/service/ModuleService.java` +- Create: `backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java` +- Test: `backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java` + +**API shape:** +- `CreateModuleDTO` 字段（带 Bean Validation）： + - `@NotBlank String sDisplayType` + - `@NotBlank @Size(max=100) String sProcedureName` + - `@NotBlank @Size(max=50) String sModuleType` + - `@NotBlank @Size(max=50) String sManageDeptEn` + - `Boolean bShowPermission`（可空，service 层默认 false） + - `@NotBlank @Size(max=100) String sModuleNameZh` + - `Integer iParentId`（可空） + - `Integer iSortOrder`（可空，service 层默认 0） +- `ModuleService#create(CreateModuleDTO dto) : Integer`（返回新 `iIncrement`） +- `ModuleServiceImpl` 依赖：`ModuleMapper` / `TenantProperties` / `StubSecurityProperties` +- 流程： + 1. 校验 `sDisplayType` ∈ `{手机端,前端业务,系统配置,接口}`，否则 `BizException(40010,"显示类型枚举不合法")` + 2. 若 `iParentId != null` 调 `mapper.existsActiveById(iParentId)`；不存在 → `BizException(40021,"父模块不存在或已删除")` + 3. 构造 `Module` 实例：DTO 字段透传 + 标准列填充： + - `tCreateDate = LocalDateTime.now()` + - `sBrandsId = tenantProps.brandsId` + - `sSubsidiaryId = tenantProps.subsidiaryId` + - `sCreatedBy = SecurityContextHelper.currentUserNo()` 或 `stubProps.stubUserNo`（前者为 null 时回退） + - `bShowPermission = dto.bShowPermission != null ? dto : false` + - `iSortOrder = dto.iSortOrder != null ? dto : 0` + - `bDeleted = false` + 4. `mapper.insert(entity)`；MyBatis-Plus 自动回填 `iIncrement` + 5. `return entity.getIIncrement()` +- 类上加 `@Transactional(rollbackFor = Exception.class)` + +- [ ] **Step 1: 写失败测试 `ModuleServiceImplTest`（本任务两用例）** + - 测试名: + - `createWithValidDto_persistsWithStandardCols` — Mock `ModuleMapper.insert`（用 `Answer` 设置 entity.iIncrement=99）+ Mock `existsActiveById(true)`，断言：返回 99；捕获 `ArgumentCaptor` 校验 `sBrandsId="XLY"` / `sSubsidiaryId="XLY"` / `tCreateDate != null` / `sCreatedBy="STUB_ADMIN"`（无认证上下文，回退 stub） + - `createWithParentNotFound_throws40021` — Mock `existsActiveById(false)` + DTO `iParentId=42`，断言抛 `BizException`，`code=40021` + - 子会话先跑 → FAIL + +- [ ] **Step 2: 实现最小代码** + - DTO + Service interface + Impl，仅覆盖本任务两用例的最小逻辑（枚举校验和重复键捕获放下个 Task 写测试驱动） + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=ModuleServiceImplTest` + +- [ ] **Step 4: Commit** + - `git commit -m "feat(mod): module create dto + service happy path REQ-MOD-001"` + +### Task 7: Service 层异常分支补全（枚举非法 + 唯一冲突） + +**Files:** +- Modify: `backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java` +- Modify: `backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java` + +**API shape:** 同 Task 6（仅补分支逻辑） + +- [ ] **Step 1: 在测试类中追加 4 个用例** + - `createWithInvalidDisplayType_throws40010` — DTO `sDisplayType="未知"`，期望 `BizException.code=40010` + - `createWithNullParentId_skipsParentCheck` — DTO `iParentId=null`，期望 `mapper.existsActiveById` 不被调用，且仍走完插入 + - `mapperDuplicateKey_throws40020` — Mock `mapper.insert` 抛 `org.springframework.dao.DuplicateKeyException`，期望转抛 `BizException.code=40020` + - `usesAuthenticatedUserNoAsCreatedBy` — `SecurityContextHolder` 注入 `userNo="ALICE"`，断言传给 mapper 的 entity.sCreatedBy="ALICE"（**用 `@AfterEach SecurityContextHolder.clearContext()` 隔离**） + - 子会话先跑 → 4 用例 FAIL + +- [ ] **Step 2: 在 ServiceImpl 中补充分支** + - 枚举校验（白名单 `Set.of("手机端","前端业务","系统配置","接口")`） + - try/catch `DuplicateKeyException` → `BizException(40020,"存储过程名称已存在")` + - sCreatedBy 优先取 `SecurityContextHelper.currentUserNo()` + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=ModuleServiceImplTest` + - 期望：6 tests passed（含 Task 6 的 2 个） + +- [ ] **Step 4: Commit** + - `git commit -m "feat(mod): module create error branches REQ-MOD-001"` + +### Task 8: Controller + 集成测试（正常路径） + +**Files:** +- Create: `backend/src/main/java/com/xly/erp/module/mod/controller/ModuleController.java` +- Test: `backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java` + +**API shape:** +- `@RestController` + `@RequestMapping("/api/mod")` +- `@PostMapping("/modules") public Result> create(@Valid @RequestBody CreateModuleDTO dto)` +- 返回 `Result.ok(Map.of("iIncrement", service.create(dto)))` + +- [ ] **Step 1: 写失败测试 IT 正常路径** + - 测试名: `ModuleControllerIT#postValidBody_with_jwt_returns200_andPersists` + - 用 `@SpringBootTest(webEnvironment=RANDOM_PORT)` + `TestRestTemplate` + `@Autowired TestJwtHelper` + `@Autowired JdbcTemplate` + - 步骤： + 1. `String token = testJwtHelper.signFor("ADMIN001")` + 2. POST `/api/mod/modules` body `{sDisplayType:"手机端", sProcedureName:"sp_test_001", sModuleType:"业务模块", sManageDeptEn:"IT", sModuleNameZh:"测试模块"}`，header `Authorization: Bearer ` + 3. 期望 HTTP 200，响应 `code=0`，`data.iIncrement` 是正整数 N + 4. JdbcTemplate 查 `tModule WHERE iIncrement=N`，断言 `sCreatedBy="ADMIN001"`、`sBrandsId="XLY"` + - **测试隔离**：`@BeforeEach`/`@AfterEach` 用 JdbcTemplate `DELETE FROM tModule WHERE sProcedureName LIKE 'sp_test_%'`，避免污染 + - 子会话先跑 → FAIL（controller 不存在 → 404） + +- [ ] **Step 2: 实现 ModuleController** + - 严格按 API shape，不加任何额外路径 + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=ModuleControllerIT#postValidBody_with_jwt_returns200_andPersists` + +- [ ] **Step 4: Commit** + - `git commit -m "feat(mod): POST /api/mod/modules controller REQ-MOD-001"` + +### Task 9: 集成测试异常路径（参数缺失 / 枚举非法 / 唯一冲突 / 父不存在 / 鉴权 stub 行为） + +**Files:** +- Modify: `backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java` + +**API shape:** 不新增（覆盖现有接口 6 条异常路径） + +- [ ] **Step 1: 在 IT 中追加 6 个用例** + - `postEmptyBody_returns40001_withFieldHint` — body `{}`，期望 `code=40001`，`msg` 含 `sProcedureName` 等任一字段名 + - `postInvalidDisplayType_returns40010` — body `sDisplayType="火星"`，期望 `code=40010` + - `postDuplicateProcedureName_returns40020` — 先插一条（直接 JdbcTemplate 或先 POST 一次），再 POST 同名 → `code=40020` + - `postWithMissingParent_returns40021` — `iParentId=999999` → `code=40021` + - `postWithoutJwt_permitAllStub_returns200_andCreatedBySTUBADMIN` — 不带 Authorization 头，期望 200 + 新行 `sCreatedBy="STUB_ADMIN"`（验证 stub 行为，spec 已声明 USR-004 后改为 401） + - `postWithTamperedJwt_returns20001` — Authorization 头伪造（`Bearer xxx.yyy.zzz`），期望 `code=20001`（filter 拦截短路） + - 6 个用例先跑 → FAIL（缺分支/HTTP 状态预期不符） + +- [ ] **Step 2: 让测试通过** + - 多数用例的服务端逻辑已在 Task 7 + Task 4 实现；本步骤主要是排查测试中 RestTemplate 行为（如 4xx 是否抛、是否需要用 `String.class` 接收 body 再手动 parse JSON） + - **不应当**为让测试通过新增业务分支；如发现确实缺分支，回炉对应 Task 的 service/filter + +- [ ] **Step 3: 子会话验证全 IT PASS** + - 命令：`cd backend && mvn -B test -Dtest=ModuleControllerIT` + - 期望：7 tests passed（含 Task 8 的 1 个） + +- [ ] **Step 4: 子会话跑全模块单测套件做回归** + - 命令：`cd backend && mvn -B test` + - 期望：所有用例 PASS（SmokeTest + GlobalExceptionHandlerTest + JwtUtilTest + SecurityFilterIT + ModuleMapperIT + ModuleServiceImplTest + ModuleControllerIT） + +- [ ] **Step 5: Commit** + - `git commit -m "test(mod): module create integration coverage REQ-MOD-001"` + +## 提交计划 + +| commit | 覆盖 | +|---|---| +| `chore(mod): bootstrap backend scaffold REQ-MOD-001` | Task 1 | +| `feat(mod): unified Result + global exception handler REQ-MOD-001` | Task 2 | +| `feat(mod): tenant + jwt config + util REQ-MOD-001` | Task 3 | +| `feat(mod): jwt filter + security config (role stub) REQ-MOD-001` | Task 4 | +| `feat(mod): tModule entity + mapper REQ-MOD-001` | Task 5 | +| `feat(mod): module create dto + service happy path REQ-MOD-001` | Task 6 | +| `feat(mod): module create error branches REQ-MOD-001` | Task 7 | +| `feat(mod): POST /api/mod/modules controller REQ-MOD-001` | Task 8 | +| `test(mod): module create integration coverage REQ-MOD-001` | Task 9 | diff --git a/docs/superpowers/plans/2026-04-29-REQ-MOD-002.md b/docs/superpowers/plans/2026-04-29-REQ-MOD-002.md new file mode 100644 index 0000000..4e041ea --- /dev/null +++ b/docs/superpowers/plans/2026-04-29-REQ-MOD-002.md @@ -0,0 +1,222 @@ +--- +req_id: REQ-MOD-002 +date: 2026-04-29 +spec_ref: docs/superpowers/specs/2026-04-29-REQ-MOD-002.md +--- + +# REQ-MOD-002 模块修改 Implementation Plan + +> **Execution:** Parent skill `feature-tdd` executes this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** 在 MOD-001 已有工程基础上增量实现 `PUT /api/mod/modules/{id}`，更新 7 个可编辑字段，保留 `sProcedureName` / `sCreatedBy` / 标准列；含目标存在性、枚举、父链合法性（自指 / 不存在 / 环）四类校验。 + +**Architecture:** 复用 `ModuleService` / `ModuleServiceImpl` / `ModuleController` / `ModuleMapper` / `Module entity`，新增 `UpdateModuleDTO`、`ModuleService#update`、controller `@PutMapping`、`mapper.selectParentIdById`（轻量父链查询）。SecurityConfig 路径白名单从 `POST /api/mod/modules` 扩展为 `/api/mod/**` 以覆盖 MOD-002~004。环检测在 service 层用循环回溯，最大深度 50。 + +**Tech Stack:** Spring Boot 3.3.5 / MyBatis-Plus / Spring Security（已有）；JUnit 5 + Mockito + TestRestTemplate（已有）。 + +--- + +## Schema 改动 + +无（`tModule` schema 已满足；本 REQ 仅 UPDATE 操作）。 + +## 文件变更清单 + +### 新增 + +- `backend/src/main/java/com/xly/erp/module/mod/dto/UpdateModuleDTO.java` — 入参 DTO（无 `sProcedureName` 字段） + +### 修改 + +- `backend/src/main/java/com/xly/erp/common/security/SecurityConfig.java` — `requestMatchers(POST, "/api/mod/modules")` → `requestMatchers("/api/mod/**")`，stub 注释保持 +- `backend/src/main/java/com/xly/erp/module/mod/mapper/ModuleMapper.java` — 追加 `Integer selectParentIdById(Integer id)` 注解 SELECT 方法（仅查 iParentId 列，不取整行） +- `backend/src/main/java/com/xly/erp/module/mod/service/ModuleService.java` — 追加 `Integer update(Integer id, UpdateModuleDTO dto)` 方法 +- `backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java` — 实现 `update(...)`：目标存在性 → 枚举 → iParentId 三重校验 → mapper.updateById +- `backend/src/main/java/com/xly/erp/module/mod/controller/ModuleController.java` — 追加 `@PutMapping("/modules/{id}")` 端点 +- `backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java` — 追加 7 个 update 用例 +- `backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java` — 追加 7 个 PUT IT 用例 +- `backend/src/test/java/com/xly/erp/module/mod/mapper/ModuleMapperIT.java` — 追加 1 个 `selectParentIdById` 用例 + +## 任务步骤 + +> 全局约束：每 commit 形如 `(mod): REQ-MOD-002`；测试派发到子会话执行；现有 26 用例全程保持绿。 + +### Task 1: SecurityConfig 路径白名单扩范围 + +**Files:** +- Modify: `backend/src/main/java/com/xly/erp/common/security/SecurityConfig.java:25` + +**API shape:** +- 改一行：`requestMatchers(HttpMethod.POST, "/api/mod/modules").permitAll()` → `requestMatchers("/api/mod/**").permitAll()` +- 注释保留 `// REQ-MOD-001 stub: see USR-004 follow-up`（语义不变，覆盖范围扩大） + +- [ ] **Step 1: 修改 SecurityConfig** + - 单行 Edit；不动任何其他类 + +- [ ] **Step 2: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=ModuleControllerIT` + - 期望：现有 7 用例全绿（permitAll 范围扩大不收紧已有路径） + +- [ ] **Step 3: Commit** + - `git commit -m "refactor(mod): widen permitAll stub to /api/mod/** REQ-MOD-002"` + +### Task 2: ModuleMapper 追加父 ID 查询 + +**Files:** +- Modify: `backend/src/main/java/com/xly/erp/module/mod/mapper/ModuleMapper.java` +- Modify: `backend/src/test/java/com/xly/erp/module/mod/mapper/ModuleMapperIT.java` + +**API shape:** +- `@Select("SELECT iParentId FROM tModule WHERE iIncrement = #{id} AND bDeleted = 0")` `Integer selectParentIdById(@Param("id") Integer id)` + - 命中行的 `iParentId` 可能为 NULL（根模块）→ 返回 null + - 未命中（不存在 / 已软删）→ 返回 null（与"根模块"在调用方语义不同，需要调用方明确校验存在性） + +- [ ] **Step 1: 写失败测试 `ModuleMapperIT#selectParentIdById_returnsNullForRootOrMissing_andValueForChild`** + - 准备 3 行：root（iParentId=NULL）、child（iParentId=root）、deleted（iParentId=root, bDeleted=1） + - 断言：`selectParentIdById(root.id) == null`；`selectParentIdById(child.id) == root.id`；`selectParentIdById(deleted.id) == null`；`selectParentIdById(99999999) == null` + +- [ ] **Step 2: 实现 mapper 方法** + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=ModuleMapperIT` + +- [ ] **Step 4: Commit** + - `git commit -m "feat(mod): mapper#selectParentIdById for cycle check REQ-MOD-002"` + +### Task 3: UpdateModuleDTO + Service.update 合法路径 + +**Files:** +- Create: `backend/src/main/java/com/xly/erp/module/mod/dto/UpdateModuleDTO.java` +- Modify: `backend/src/main/java/com/xly/erp/module/mod/service/ModuleService.java` +- Modify: `backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java` +- Modify: `backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java` + +**API shape:** +- `UpdateModuleDTO` 字段（带 `@JsonProperty` 锁定 JSON 名 + Bean Validation）： + - `@NotBlank String sDisplayType` + - `@NotBlank @Size(max=50) String sModuleType` + - `@NotBlank @Size(max=50) String sManageDeptEn` + - `Boolean bShowPermission`（可空） + - `@NotBlank @Size(max=100) String sModuleNameZh` + - `Integer iParentId`（可空） + - `Integer iSortOrder`（可空） + - **不含 `sProcedureName`** +- `ModuleService#update(Integer id, UpdateModuleDTO dto) : Integer` +- `ModuleServiceImpl#update`： + 1. `Module original = moduleMapper.selectById(id)`；若 null 或 `original.getBDeleted()==true` → `BizException(40400, "模块不存在或已删除")` + 2. 枚举校验同 MOD-001 → 40010 + 3. `iParentId` 校验（4 类）（在本 task 不全实现，仅留 hook，详见 Task 4）：本 task 暂只对 null/合法路径走通；非 null 时调 `existsActiveById` 但暂不做自指/环检测，留 Task 4 加。 + 4. 构造 `Module entity`：仅 set `iIncrement` 和可改 7 字段（其余 null）；`bShowPermission` null → false + 5. `moduleMapper.updateById(entity)` 返回 `id` + +- [ ] **Step 1: 写失败测试** + - 在 `ModuleServiceImplTest` 追加 3 用例： + - `updateWithValidDto_invokesUpdateById_withEditableFieldsOnly` + - `updateWithTargetNotFound_throws40400` + - `updateWithBShowPermissionNull_setsFalseInEntity` + - mock 准备：`moduleMapper.selectById(id)` 返回 stub Module（含原 sProcedureName / sCreatedBy）；`moduleMapper.updateById(any(Module.class))` 返回 1 + - ArgumentCaptor 抓传给 `updateById` 的 entity，断言：`iIncrement` 是路径 id；`sProcedureName == null`；`sCreatedBy == null`；`tCreateDate == null`；`sBrandsId == null`；`sSubsidiaryId == null`；可改字段被透传 + - 子会话先跑 → FAIL（方法不存在） + +- [ ] **Step 2: 实现 DTO + Service** + - DTO 与 CreateModuleDTO 平行结构；Service 实现仅覆盖 Task 3 三个用例所需逻辑 + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=ModuleServiceImplTest` + - 期望：6 (MOD-001) + 3 (本 task) = 9 用例全绿 + +- [ ] **Step 4: Commit** + - `git commit -m "feat(mod): module update dto + service happy path REQ-MOD-002"` + +### Task 4: Service 校验分支（枚举 + iParentId 三类） + +**Files:** +- Modify: `backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java` +- Modify: `backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java` + +**API shape:** 不变（仅补 update 方法内部校验逻辑） + +**校验顺序**（service 实现）： + +1. 目标存在 / 枚举（已在 Task 3 实现） +2. 若 `iParentId != null`: + a. `iParentId.equals(id)` → `BizException(40021, "父模块不能指向自身")` + b. `!moduleMapper.existsActiveById(iParentId)` → `BizException(40021, "父模块不存在或已删除")` + c. 环检测：`Integer cur = iParentId; for (int depth = 0; cur != null && depth < 50; depth++) { if (cur.equals(id)) throw BizException(40021,"父模块链构成环路"); cur = moduleMapper.selectParentIdById(cur); }`；若 depth 达到 50 → `BizException(40021, "父模块链超过最大层级")` + +- [ ] **Step 1: 写失败测试** + - 在 `ModuleServiceImplTest` 追加 4 用例： + - `updateWithInvalidDisplayType_throws40010` + - `updateWithSelfParentId_throws40021`（msg contains "自身"） + - `updateWithMissingParent_throws40021`（msg contains "父模块不存在"） + - `updateWithCyclicParent_throws40021`（msg contains "环路"；mock 编排：`existsActiveById(parent)=true`；`selectParentIdById(parent) = id`） + - 子会话先跑 → 4 用例 FAIL + +- [ ] **Step 2: 实现校验分支** + - 严格按上述 a/b/c 顺序，**a 在 b 之前**（自指应当先于存在性，否则用户传自身 id 在父表里又恰好不存在时报错信息会误导） + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=ModuleServiceImplTest` + - 期望：6 + 3 + 4 = 13 用例全绿 + +- [ ] **Step 4: Commit** + - `git commit -m "feat(mod): module update parent validation REQ-MOD-002"` + +### Task 5: ModuleController PUT + IT 正常路径 + +**Files:** +- Modify: `backend/src/main/java/com/xly/erp/module/mod/controller/ModuleController.java` +- Modify: `backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java` + +**API shape:** +- `@PutMapping("/modules/{id}") public Result> update(@PathVariable Integer id, @Valid @RequestBody UpdateModuleDTO dto)` +- 返回 `Result.ok(Map.of("iIncrement", moduleService.update(id, dto)))` + +- [ ] **Step 1: 写失败测试 `ModuleControllerIT#putValidBody_with_jwt_returns200_andUpdatesEditableFields`** + - 步骤：① JdbcTemplate 直插一行原始数据（含 sProcedureName="sp_test_orig"、sCreatedBy="ORIG_USER"、sBrandsId="XLY"、sModuleNameZh="原名"）；② PUT body 改 sModuleNameZh="新名"、sDisplayType="前端业务"；带 JWT="ADMIN001"；③ 期望 `code=0`，`data.iIncrement` 等于 ① 的 id；④ JdbcTemplate 查行：`sModuleNameZh="新名"`、`sDisplayType="前端业务"`、`sProcedureName="sp_test_orig"`（保留）、`sCreatedBy="ORIG_USER"`（保留） + +- [ ] **Step 2: 实现 controller PUT** + - 与 POST 同结构 + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest='ModuleControllerIT#putValidBody_with_jwt_returns200_andUpdatesEditableFields'` + +- [ ] **Step 4: Commit** + - `git commit -m "feat(mod): PUT /api/mod/modules/{id} controller REQ-MOD-002"` + +### Task 6: IT 异常路径补全 + 全量回归 + +**Files:** +- Modify: `backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java` + +**API shape:** 不新增（覆盖 PUT 接口 6 条异常路径） + +- [ ] **Step 1: 在 IT 中追加 6 个用例** + - `putNonExistentId_returns40400` — PUT `/api/mod/modules/99999999` body 合法 → `code=40400` + - `putInvalidDisplayType_returns40010` — `sDisplayType="火星"` → `code=40010` + - `putSelfParent_returns40021` — body `iParentId == path id` → `code=40021` + - `putCyclicParent_returns40021` — 准备：先插 root，再插 child(parent=root)；PUT root 把 `iParentId=child.id` → `code=40021` + - `putWithoutJwt_permitAllStub_returns200_andDoesNotChangeCreatedBy` — 先插原行（sCreatedBy="ORIG_USER"），无 token PUT；期望 `code=0`，DB 中 sCreatedBy 仍为 "ORIG_USER"（不被覆盖为 STUB_ADMIN） + - `putTamperedJwt_returns20001` — Authorization 头 `Bearer not.a.real.jwt` → `code=20001` + - 6 个用例先跑 → 期望 FAIL（部分分支需 Task 4/5 已经覆盖；这里主要补 IT 端到端） + +- [ ] **Step 2: 让测试通过** + - service / controller / config 已实现；本 task 主要排查 RestTemplate 行为（4xx 是否抛、URL 拼接、JSON parse）；不应当为让测试通过新增业务分支 + +- [ ] **Step 3: 子会话跑全量回归** + - 命令：`cd backend && mvn -B test` + - 期望：MOD-001 26 用例 + MOD-002 新增 1(mapperIT) + 7(serviceTest) + 7(controllerIT) = 41 用例全绿 + +- [ ] **Step 4: Commit** + - `git commit -m "test(mod): module update integration coverage REQ-MOD-002"` + +## 提交计划 + +| commit | 覆盖 | +|---|---| +| `refactor(mod): widen permitAll stub to /api/mod/** REQ-MOD-002` | Task 1 | +| `feat(mod): mapper#selectParentIdById for cycle check REQ-MOD-002` | Task 2 | +| `feat(mod): module update dto + service happy path REQ-MOD-002` | Task 3 | +| `feat(mod): module update parent validation REQ-MOD-002` | Task 4 | +| `feat(mod): PUT /api/mod/modules/{id} controller REQ-MOD-002` | Task 5 | +| `test(mod): module update integration coverage REQ-MOD-002` | Task 6 | diff --git a/docs/superpowers/plans/2026-04-29-REQ-MOD-003.md b/docs/superpowers/plans/2026-04-29-REQ-MOD-003.md new file mode 100644 index 0000000..8aefd16 --- /dev/null +++ b/docs/superpowers/plans/2026-04-29-REQ-MOD-003.md @@ -0,0 +1,131 @@ +--- +req_id: REQ-MOD-003 +date: 2026-04-29 +spec_ref: docs/superpowers/specs/2026-04-29-REQ-MOD-003.md +--- + +# REQ-MOD-003 模块删除 Implementation Plan + +> **Execution:** Parent skill `feature-tdd` executes this plan task-by-task. + +**Goal:** 在 MOD-001/002 已建工程基础上增量实现 `DELETE /api/mod/modules/{id}` 软删除接口，含目标存在性、子模块拦截两类校验，软删除后 `bDeleted=1` + 审计字段。 + +**Architecture:** 复用现有 `ModuleService` / `ModuleServiceImpl` / `ModuleController` / `ModuleMapper`；新增 `mapper.hasActiveChildren(id)` + `service.delete(id)` + controller `@DeleteMapping`。SecurityConfig 已对 `/api/mod/**` permitAll，无需改。`sDeletedBy` 取 JWT principal 或回退 stub（与 MOD-001 `sCreatedBy` 同策略）。**40902 外部引用拦截不实现**——docs/03 当前 schema 中 tModule 无引用方表。 + +**Tech Stack:** Spring Boot 3.3.5 / MyBatis-Plus / JUnit 5 + Mockito + TestRestTemplate（沿用）。 + +--- + +## Schema 改动 + +无（仅 UPDATE 软删除字段）。 + +## 文件变更清单 + +### 修改 + +- `backend/src/main/java/com/xly/erp/module/mod/mapper/ModuleMapper.java` — 追加 `findActiveChildFlag` + default `hasActiveChildren` +- `backend/src/main/java/com/xly/erp/module/mod/service/ModuleService.java` — 追加 `void delete(Integer id)` 方法 +- `backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java` — 实现 `delete(...)` +- `backend/src/main/java/com/xly/erp/module/mod/controller/ModuleController.java` — 追加 `@DeleteMapping("/modules/{id}")` 端点 +- `backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java` — 追加 5 用例 +- `backend/src/test/java/com/xly/erp/module/mod/mapper/ModuleMapperIT.java` — 追加 1 用例 +- `backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java` — 追加 6 用例 + +## 任务步骤 + +> 全局：每 commit `(mod): REQ-MOD-003`；测试派发子会话；现有 41 用例全程绿。 + +### Task 1: Mapper#hasActiveChildren + IT + +**Files:** +- Modify: `backend/src/main/java/com/xly/erp/module/mod/mapper/ModuleMapper.java` +- Modify: `backend/src/test/java/com/xly/erp/module/mod/mapper/ModuleMapperIT.java` + +**API shape:** +- `@Select("SELECT 1 FROM tModule WHERE iParentId = #{parentId} AND bDeleted = 0 LIMIT 1")` `Integer findActiveChildFlag(@Param("parentId") Integer parentId)` +- `default boolean hasActiveChildren(Integer parentId) { return findActiveChildFlag(parentId) != null; }` + +- [ ] **Step 1: 写失败测试 `ModuleMapperIT#hasActiveChildren_trueIfChildAliveExists_falseOtherwise`** + - 准备：root（无 parent）；child1（parent=root, bDeleted=0）；child2（parent=root, bDeleted=1） + - 断言：`hasActiveChildren(root.id) == true` + - 用 JdbcTemplate `UPDATE tModule SET bDeleted=1 WHERE iIncrement=child1.id` 软删唯一活跃子节点 + - 再次断言：`hasActiveChildren(root.id) == false` + - `hasActiveChildren(99999997) == false` + +- [ ] **Step 2: 实现 mapper 方法** + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=ModuleMapperIT` + +- [ ] **Step 4: Commit** + - `git commit -m "feat(mod): mapper#hasActiveChildren for delete check REQ-MOD-003"` + +### Task 2: Service#delete + 单测 + +**Files:** +- Modify: `backend/src/main/java/com/xly/erp/module/mod/service/ModuleService.java` +- Modify: `backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java` +- Modify: `backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java` + +**API shape:** +- `ModuleService#delete(Integer id) : void` +- `ModuleServiceImpl#delete(Integer id)`： + 1. `Module original = moduleMapper.selectById(id)` → null 或 `bDeleted=true` → `BizException(40400, "模块不存在或已删除")` + 2. `moduleMapper.hasActiveChildren(id)` → true → `BizException(40901, "模块仍有未删除子节点")` + 3. 构造 `Module entity`：`setIIncrement(id)` / `setBDeleted(true)` / `setTDeletedDate(LocalDateTime.now())` / `setSDeletedBy(SecurityContextHelper.currentUserNo() ?: stub.getStubUserNo())`；其他字段 null + 4. `moduleMapper.updateById(entity)` + +- [ ] **Step 1: 写失败测试（5 用例）** + - `deleteWithValidId_softDeletes_andSetsAuditFields`：mock `selectById(10)=alive`、`hasActiveChildren(10)=false`、`updateById(any)=1`；ArgumentCaptor 抓 entity；断言 `iIncrement=10` / `bDeleted=true` / `tDeletedDate != null` / `sDeletedBy="STUB_ADMIN"` / 其他字段 null + - `deleteWithTargetNotFound_throws40400`：`selectById(99)=null`；`updateById` 永不调用 + - `deleteWithTargetAlreadyDeleted_throws40400`：`selectById(10)` 返回 `bDeleted=true` 的 Module + - `deleteWithActiveChildren_throws40901`：`hasActiveChildren(10)=true` + - `deleteSetsDeletedByFromAuthenticatedUser`：SecurityContextHolder 注入 principal "BOB"；ArgumentCaptor `sDeletedBy="BOB"` + - 子会话先跑 → 5 用例 FAIL + +- [ ] **Step 2: 实现 service** + - 严格按 API shape 顺序 + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=ModuleServiceImplTest` + - 期望：13 (前) + 5 = 18 用例全绿 + +- [ ] **Step 4: Commit** + - `git commit -m "feat(mod): module delete service + soft delete REQ-MOD-003"` + +### Task 3: Controller DELETE + 6 IT 用例 + +**Files:** +- Modify: `backend/src/main/java/com/xly/erp/module/mod/controller/ModuleController.java` +- Modify: `backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java` + +**API shape:** +- `@DeleteMapping("/modules/{id}") public Result delete(@PathVariable Integer id)` +- 调 `moduleService.delete(id)`；返回 `Result.ok()` + +- [ ] **Step 1: 写失败测试（6 用例）** + - `deleteValidId_with_jwt_returns200_andSoftDeletes`：JdbcTemplate 直插 alive 行；DELETE 带 JWT="ADMIN001"；期望 `code=0` / `data=null`；JdbcTemplate 查 `bDeleted=1` / `sDeletedBy="ADMIN001"` / `tDeletedDate IS NOT NULL` / `sProcedureName` 不变 / `sCreatedBy` 不变 + - `deleteNonExistentId_returns40400`：DELETE `/api/mod/modules/99999996` → `code=40400` + - `deleteAlreadyDeletedId_returns40400`：JdbcTemplate 直插 `bDeleted=1` 行；DELETE → `code=40400` + - `deleteWithActiveChildren_returns40901`：JdbcTemplate 直插 root + child（bDeleted=0, parent=root）；DELETE root → `code=40901`；JdbcTemplate 查 root 仍 `bDeleted=0` + - `deleteWithoutJwt_permitAllStub_returns200_andDeletedByIsSTUB`：JdbcTemplate 直插 alive；无 token DELETE；DB 查 `sDeletedBy="STUB_ADMIN"` / `bDeleted=1` + - `deleteTamperedJwt_returns20001`：JdbcTemplate 直插 alive；Authorization "Bearer not.a.real.jwt" DELETE；`code=20001`；DB 查行 `bDeleted=0`（filter 短路，service 未触发） + - 6 用例先跑 → FAIL（controller 不存在 → 405/404） + +- [ ] **Step 2: 实现 controller DELETE** + +- [ ] **Step 3: 子会话跑全量回归** + - 命令：`cd backend && mvn -B test` + - 期望：MOD-001 26 + MOD-002 15 + MOD-003 新增 1(mapperIT) + 5(svc) + 6(it) = 53 用例全绿 + +- [ ] **Step 4: Commit** + - `git commit -m "test(mod): module delete integration coverage REQ-MOD-003"` + +## 提交计划 + +| commit | 覆盖 | +|---|---| +| `feat(mod): mapper#hasActiveChildren for delete check REQ-MOD-003` | Task 1 | +| `feat(mod): module delete service + soft delete REQ-MOD-003` | Task 2 | +| `test(mod): module delete integration coverage REQ-MOD-003` | Task 3 | diff --git a/docs/superpowers/plans/2026-04-29-REQ-MOD-004.md b/docs/superpowers/plans/2026-04-29-REQ-MOD-004.md new file mode 100644 index 0000000..a9d58d1 --- /dev/null +++ b/docs/superpowers/plans/2026-04-29-REQ-MOD-004.md @@ -0,0 +1,140 @@ +--- +req_id: REQ-MOD-004 +date: 2026-04-29 +spec_ref: docs/superpowers/specs/2026-04-29-REQ-MOD-004.md +--- + +# REQ-MOD-004 模块查询 Implementation Plan + +> **Execution:** Parent skill `feature-tdd` executes this plan task-by-task. + +**Goal:** 在 MOD-001~003 已建工程基础上增量实现 `GET /api/mod/modules` 模块树查询：DB 模糊匹配 + 内存拼装森林。 + +**Architecture:** 复用 `ModuleService` / `ModuleServiceImpl` / `ModuleController` / `ModuleMapper`；新增 `ModuleTreeVO`、`mapper.selectActiveByKeyword(String)`、`service.listTree(String)`、controller `@GetMapping`。无新外部依赖。空 keyword 由 controller 归一化为 `""`，超长校验在 service。SecurityConfig 已对 `/api/mod/**` permitAll 覆盖该接口。 + +**Tech Stack:** 沿用（Spring Boot 3.3.5 / MyBatis-Plus / JUnit 5 + Mockito + TestRestTemplate）。 + +--- + +## Schema 改动 + +无（仅 SELECT）。 + +## 文件变更清单 + +### 新增 + +- `backend/src/main/java/com/xly/erp/module/mod/vo/ModuleTreeVO.java` — 树节点出参 VO + +### 修改 + +- `backend/src/main/java/com/xly/erp/module/mod/mapper/ModuleMapper.java` — 追加 `List selectActiveByKeyword(@Param("keyword") String keyword)` 注解 SELECT +- `backend/src/main/java/com/xly/erp/module/mod/service/ModuleService.java` — 追加 `List listTree(String keyword)` +- `backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java` — 实现 listTree（trim + 长度校验 + 拼树） +- `backend/src/main/java/com/xly/erp/module/mod/controller/ModuleController.java` — 追加 `@GetMapping("/modules")` +- `backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java` — 追加 7 用例 +- `backend/src/test/java/com/xly/erp/module/mod/mapper/ModuleMapperIT.java` — 追加 1 用例 +- `backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java` — 追加 6 用例 + +## 任务步骤 + +> 全局：每 commit `(mod): REQ-MOD-004`；测试派发子会话；现有 53 用例全程绿。 + +### Task 1: Mapper#selectActiveByKeyword + IT + +**Files:** +- Modify: `backend/src/main/java/com/xly/erp/module/mod/mapper/ModuleMapper.java` +- Modify: `backend/src/test/java/com/xly/erp/module/mod/mapper/ModuleMapperIT.java` + +**API shape:** +- `@Select("SELECT iIncrement, sModuleNameZh, sDisplayType, sManageDeptEn, iParentId, iSortOrder FROM tModule WHERE bDeleted = 0 AND sModuleNameZh LIKE CONCAT('%', #{keyword}, '%') ORDER BY iSortOrder ASC, iIncrement ASC")` +- `List selectActiveByKeyword(@Param("keyword") String keyword)` +- 返回的 Module 实例只填查询的 6 列；其他字段为 null（MyBatis 默认行为） + +- [ ] **Step 1: 写失败测试 `ModuleMapperIT#selectActiveByKeyword_filtersAndOrders`** + - 准备 5 行：A "系统-A" iSortOrder=1; B "系统-B" iSortOrder=0; C "用户" iSortOrder=2; D "系统-D" bDeleted=1; E "测试" iSortOrder=3 + - 断言：`selectActiveByKeyword("")` → 4 行，顺序 [B(0), A(1), C(2), E(3)]（D 被 bDeleted 过滤） + - 断言：`selectActiveByKeyword("系统")` → [B, A]（D 被 bDeleted 过滤） + - 断言：`selectActiveByKeyword("不存在XYZ")` → 空 list + +- [ ] **Step 2: 实现 mapper 方法** + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=ModuleMapperIT` + +- [ ] **Step 4: Commit** + - `git commit -m "feat(mod): mapper#selectActiveByKeyword REQ-MOD-004"` + +### Task 2: ModuleTreeVO + Service.listTree + 单测 + +**Files:** +- Create: `backend/src/main/java/com/xly/erp/module/mod/vo/ModuleTreeVO.java` +- Modify: `backend/src/main/java/com/xly/erp/module/mod/service/ModuleService.java` +- Modify: `backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java` +- Modify: `backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java` + +**API shape:** +- `ModuleTreeVO` POJO：字段 `iIncrement` / `sModuleNameZh` / `sDisplayType` / `sManageDeptEn` / `iParentId` / `iSortOrder` / `List children`（默认 new ArrayList<>()）；getter/setter；含 `@JsonProperty` 锁定 JSON 名（与 DTO 风格一致）。 +- `ModuleService#listTree(String keyword) : List` +- `ModuleServiceImpl#listTree(String keyword)`： + 1. `String normalized = keyword == null ? "" : keyword.trim()` + 2. `if (normalized.length() > 100) throw new BizException(40001, "keyword 长度超过 100 字符")` + 3. `List rows = moduleMapper.selectActiveByKeyword(normalized)` + 4. 拼树：建 `Map idIndex`，遍历 rows 转 VO 入 map；二次遍历：parent 在 map → 挂入 parent.children；否则视为 root 加入返回 list + 5. 返回 list（保持 SQL ORDER BY 顺序，孤立子节点出现在 root 列表中按其行序） +- 类级 `@Transactional` 不影响只读；可在方法上加 `@Transactional(readOnly = true)` 显式覆盖（建议） + +- [ ] **Step 1: 写失败测试（7 用例）** + - `listTree_emptyKeyword_invokesMapperWithEmptyString_returnsAssembledTree`：mock 返回 [root1(id=1,parent=null), root2(id=2,parent=null), child1(id=3,parent=1), child2(id=4,parent=1), grand1(id=5,parent=3)]；断言返回 list size==2；root1.children size==2 含 child1+child2；child1.children 含 grand1；root2.children 空 + - `listTree_nullKeyword_treatedAsEmpty`：参数 null；ArgumentCaptor 抓 mapper 入参 == "" + - `listTree_blankKeyword_treatedAsEmpty`：参数 " "；mapper 入参 == "" + - `listTree_keywordTooLong_throws40001`：参数 = "x".repeat(101)；BizException(40001)；mapper 永不调用 + - `listTree_returnsEmptyListWhenNoMatch`：mock 返回 emptyList；返回 List.of() + - `listTree_orphansBecomeRootsInForest`：mock 返回 [child(id=3,parent=99)]；返回 list size==1，第 0 项 iIncrement=3，children 空 + - `listTree_keywordIsTrimmedBeforeQuery`：参数 " 系统 "；mapper 入参 == "系统" + - 子会话先跑 → 7 用例 FAIL + +- [ ] **Step 2: 实现 VO + service** + +- [ ] **Step 3: 子会话验证 PASS** + - 命令：`cd backend && mvn -B test -Dtest=ModuleServiceImplTest` + - 期望：18 (前) + 7 = 25 用例全绿 + +- [ ] **Step 4: Commit** + - `git commit -m "feat(mod): module list tree service + vo REQ-MOD-004"` + +### Task 3: Controller GET + 6 IT + 全量回归 + +**Files:** +- Modify: `backend/src/main/java/com/xly/erp/module/mod/controller/ModuleController.java` +- Modify: `backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java` + +**API shape:** +- `@GetMapping("/modules") public Result> list(@RequestParam(required = false) String keyword)` +- 返回 `Result.ok(moduleService.listTree(keyword))` + +- [ ] **Step 1: 写失败测试（6 用例）** + - `getEmptyKeyword_returnsCompleteTreeAsForest`：直插 root + child(parent=root)；GET 带 JWT `/api/mod/modules`；`code=0`，`data` 是数组；找出 iIncrement=root 的节点，children 含 iIncrement=child + - `getKeywordMatch_returnsForest`：直插 "系统模块A"+"用户模块B"；GET `?keyword=系统`；返回数组只含 sModuleNameZh 含"系统"的节点 + - `getKeywordTooLong_returns40001`：`keyword` 101 字符 → `code=40001` + - `getNoMatch_returnsEmptyArray`：`keyword=不存在的关键字XYZ`；`data` JsonNode isArray && size==0 + - `getWithoutJwt_permitAllStub_returns200`：无 token GET；`code=0` + - `getTamperedJwt_returns20001`：Authorization "Bearer not.a.real.jwt" → `code=20001` + - 子会话先跑 → FAIL + +- [ ] **Step 2: 实现 controller** + +- [ ] **Step 3: 子会话跑全量回归** + - 命令：`cd backend && mvn -B test` + - 期望：MOD-001 26 + MOD-002 15 + MOD-003 12 + MOD-004 新增 1(mapperIT) + 7(svc) + 6(IT) = 67 用例全绿 + +- [ ] **Step 4: Commit** + - `git commit -m "test(mod): module list integration coverage REQ-MOD-004"` + +## 提交计划 + +| commit | 覆盖 | +|---|---| +| `feat(mod): mapper#selectActiveByKeyword REQ-MOD-004` | Task 1 | +| `feat(mod): module list tree service + vo REQ-MOD-004` | Task 2 | +| `test(mod): module list integration coverage REQ-MOD-004` | Task 3 | diff --git a/docs/superpowers/reviews/2026-04-29-REQ-MOD-001.md b/docs/superpowers/reviews/2026-04-29-REQ-MOD-001.md new file mode 100644 index 0000000..c3613b3 --- /dev/null +++ b/docs/superpowers/reviews/2026-04-29-REQ-MOD-001.md @@ -0,0 +1,34 @@ +--- +req_id: REQ-MOD-001 +date: 2026-04-29 +round: 1 +reviewer: superpower-code-reviewer +--- + +# Review: REQ-MOD-001 — round 1 + +## 结论 +approve + +## Must-fix +（无） + +## Nice-to-have + +- backend/src/main/java/com/xly/erp/common/security/JwtAuthenticationFilter.java:20 — `@Component` 加在 servlet filter 上会被 Spring Boot 自动注册到原生 servlet 链上（与 `addFilterBefore` 重叠注册）。`OncePerRequestFilter` 防住了重复执行，但顺序与作用域容易让人困惑。建议去掉 `@Component` 改在 SecurityConfig 用 `@Bean` 暴露，或追加 `FilterRegistrationBean` 并 `setEnabled(false)` 禁用原生注册。 +- backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java:58 — stub 回退 `stub.getStubUserNo()` 缺 spec/plan 约定的 `// REQ-MOD-001 stub: see USR-004 follow-up` 锚点；目前只有 SecurityConfig 一处带锚点，USR-004 上线时 grep 容易漏改这处。建议在该行加注释。 +- backend/src/main/java/com/xly/erp/module/mod/entity/Module.java:11 — 类名 `Module` 与 `java.lang.Module`（JPMS）撞，未来 entity 与反射/模块 API 混用易踩坑。可考虑改名 `ModuleEntity` / `TModule`，本 REQ 不强制。 +- backend/src/main/java/com/xly/erp/common/exception/GlobalExceptionHandler.java:32 — 兜底 `handleAny(Exception)` 会把 `HttpMessageNotReadableException`（非法 JSON）/ `HttpRequestMethodNotSupportedException` 等框架级 4xx 转成 50000，掩盖请求格式错误。建议后续 REQ 增加专用 handler 返回 40001。 +- backend/src/main/resources/application.yml:30 — `erp.security.jwt-secret: ${JWT_SECRET}` 没有 fail-fast 默认值，未来漏 export 时会用字面量当 secret。建议 `${JWT_SECRET:?JWT_SECRET 必须从 .env.local 注入}` 让缺失即启动失败。 +- backend/src/main/java/com/xly/erp/common/security/JwtUtil.java:23 — 暴露了两个 public 构造器（`JwtUtil(String)` 实质只供测试用）。建议改 package-private 加 `// test-only`，或在测试侧自行构造 StubSecurityProperties。 +- backend/src/main/resources:0 — docs/09 § 二 列出的 `application-dev.yml` 缺失。本 REQ 不强求，建议在模块完成报告 follow-up 列表中提一下。 +- backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java:142 — `postWithoutJwt_permitAllStub_returns200_andCreatedBySTUBADMIN` 用例硬写 STUB_ADMIN 期望，spec 已声明 USR-004 闭环后改 401。建议加 `@DisplayName` 或 javadoc 带 `REQ-MOD-001 stub: see USR-004 follow-up` 锚点便于 grep。 + +## 反例 / 测试覆盖缺口 + +Spec 验收清单（单测 6 + IT 7 + 工程脚手架 5）全部覆盖到位：surefire 报告 6 个 testsuite 共 26 用例，0 failure / 0 error；错误码 40001 / 40010 / 40020 / 40021 / 20001 全部端到端验证。 + +非阻塞可补缺口（留给后续 REQ）： +1. `@Size` 长度溢出（如 `sProcedureName` > 100 字符）路径仅在『缺必填』用例顺带覆盖，没有独立断言。 +2. `iParentId` 指向 `bDeleted=1` 旧记录是否回 40021 没单独验证（目前只测了不存在的 99999999）。 +3. 非法 JSON body 落到 `handleAny` 转 50000 的链路 spec 未列入，可在引入专用 4xx handler 时一起补。 diff --git a/docs/superpowers/reviews/2026-04-29-REQ-MOD-002.md b/docs/superpowers/reviews/2026-04-29-REQ-MOD-002.md new file mode 100644 index 0000000..c2060ca --- /dev/null +++ b/docs/superpowers/reviews/2026-04-29-REQ-MOD-002.md @@ -0,0 +1,34 @@ +--- +req_id: REQ-MOD-002 +date: 2026-04-29 +round: 1 +reviewer: superpower-code-reviewer +--- + +# Review: REQ-MOD-002 — round 1 + +## 结论 +approve + +## Must-fix +（无） + +## Nice-to-have + +- backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java:111 — 环检测 `depth >= MAX_PARENT_DEPTH` 守卫位于循环体中段，最大执行 51 次 mapper 调用而非 50（`cur.equals(id)` 判断先于守卫）。建议把守卫挪到 for 条件 `depth < MAX_PARENT_DEPTH` 或先判 depth 再判 equals。无功能影响，仅语义更精确。 +- backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java:263 — `putWithoutJwt_permitAllStub_returns200_andDoesNotChangeCreatedBy` 与 MOD-001 同名 POST 用例同样硬绑 stub 行为；建议加 javadoc 锚点 `// REQ-MOD-001 stub: see USR-004 follow-up`，便于 USR-004 上线时一次性 grep 替换为 401 期望。 +- backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java:188 — happy-path IT 仅断言 `sProcedureName` / `sCreatedBy` 保留，未端到端断言 `tCreateDate` / `sBrandsId` / `sSubsidiaryId`。Service 单测已 captureArgument 验证这些字段在 entity 上为 null（依赖 NOT_NULL 跳过），如要 IT 双重保险可加列断言。 +- backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java:215 — update 用例直接 stub interface default 方法 `existsActiveById` / `selectParentIdById`，与 MOD-001 create 用例 stub 抽象方法 `findActiveFlagById` 风格不一致。功能上 Mockito 支持；建议统一风格——推荐 MOD-001 改为 stub 默认方法（更直观）。 +- backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java:92 — `moduleMapper.updateById(entity)` 返回值（受影响行数）被丢弃。`@Transactional` + 先做 selectById 校验后并发 DELETE 概率极低，但若命中可能 0 行受影响而方法仍返回成功。可断言 affected==1 否则抛 BizException(40400)。 +- backend/src/main/java/com/xly/erp/module/mod/dto/UpdateModuleDTO.java:32 — `iParentId` / `iSortOrder` 缺 `@PositiveOrZero` / `@Min` 约束。spec 未要求；负数等异常值需要在 service 层走父链失败才抛 40021。 + +## 反例 / 测试覆盖缺口 + +Spec 验收清单（单元 7 + 集成 7 + 工程 3）端到端实现并 41/41 全绿；分层 / 命名 / 统一响应 / 异常处理 / 事务边界 / 安全 stub 均符合 docs/04 规范。 + +非阻塞缺口： +1. `tCreateDate` / `sBrandsId` / `sSubsidiaryId` 在 IT 端未断言保持原值（service 单测已断言 entity 字段 null + NOT_NULL 策略保证不覆盖）。 +2. 父模块指向 `bDeleted=1` 旧记录是否回 40021 未单独验证（与 MOD-001 review gap #2 同源）。 +3. `updateById` 返回 0 行（并发删除）的场景未覆盖。 +4. DTO `@Size` 长度溢出（如 sModuleNameZh > 100）路径未单独 IT。 +5. 环检测 `MAX_PARENT_DEPTH` 超深路径仅有间接覆盖（脏数据 50 层链未构造测试）。 diff --git a/docs/superpowers/reviews/2026-04-29-REQ-MOD-003.md b/docs/superpowers/reviews/2026-04-29-REQ-MOD-003.md new file mode 100644 index 0000000..453df11 --- /dev/null +++ b/docs/superpowers/reviews/2026-04-29-REQ-MOD-003.md @@ -0,0 +1,33 @@ +--- +req_id: REQ-MOD-003 +date: 2026-04-29 +round: 1 +reviewer: superpower-code-reviewer +--- + +# Review: REQ-MOD-003 — round 1 + +## 结论 +approve + +## Must-fix +（无） + +## Nice-to-have + +- backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java:291 — `deleteValidId_with_jwt_returns200_andSoftDeletes` 仅断言 `sProcedureName` / `sCreatedBy` 不变，spec § 验收 第 95 行明确要求同时断 `sBrandsId`。建议把 SELECT 列表追加 `sBrandsId, sSubsidiaryId, tCreateDate, iSortOrder` 并加断言（service 单测已 captureArgument 验证 entity 上字段为 null + 依赖 NOT_NULL 策略，IT 端到端双保险更稳）。 +- backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java:362 — `deleteWithoutJwt_permitAllStub_returns200_andDeletedByIsSTUB` 沿袭 MOD-001/002 stub 用例缺 `// REQ-MOD-001 stub: see USR-004 follow-up` 锚点注释；USR-004 上线时一次性 grep 替换为 401 会漏这条。 +- backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java:112 — `moduleMapper.updateById(entity)` 返回值（受影响行数）丢弃；并发场景下 selectById 与 updateById 之间另一线程已软删则 affected=0 而方法仍返回成功，覆盖之前的 `tDeletedDate` / `sDeletedBy`。可断言 affected==1 否则抛 BizException(40400)。同 MOD-002 update review 同源问题，stub 期接受。 +- backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java:97 — `delete()` 方法缺行内 `// REQ-MOD-003: 模块删除` 锚点（CLAUDE.md § 编码行为约束 #4 要求 REQ-XXX-NNN 行内可追溯）；MOD-001/002 的 create/update 也缺，建议三处统一补。 +- backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java:97 — 删除路径未加悲观锁（无 SELECT … FOR UPDATE）；spec 声明非幂等单实例顺序满足，多副本并发可能重复进入。建议未来用乐观条件 UPDATE WHERE iIncrement=? AND bDeleted=0 收口，本期接受。 + +## 反例 / 测试覆盖缺口 + +Spec 验收清单（service 5 + mapperIT 1 + controllerIT 6 + 工程 3）端到端实现 53/53 全绿。校验顺序（目标存在 → 子模块 → 写库）与 spec 一致；软删除字段策略与 MOD-001/002 风格统一；mapper `findActiveChildFlag` 用 SELECT 1 LIMIT 1 高效；JWT 伪造路径 IT 通过 filter 短路确认 service 未触发（`bDeleted` 仍 0）；40902 外部引用拦截在 spec 双处显式声明本期不实现并指明 USR/后续模块入口；SecurityContextHelper 处理 anonymous 的方式与 MOD-001/002 一致；测试隔离用 sProcedureName LIKE 'sp_test_%' + Before/AfterEach 双清健壮。 + +非阻塞缺口： +1. `deleteValidId` IT 未断言 `sBrandsId` 等保留列（spec 明言）。 +2. `// REQ-MOD-001 stub: see USR-004 follow-up` 锚点未在 MOD-003 stub 用例上贴。 +3. `updateById` 返回值未校验，并发覆盖窗口存在。 +4. service 方法缺行内 REQ 锚点（MOD-001/002/003 同源）。 +5. 40902 外部引用待 USR/后续模块落地后回填。 diff --git a/docs/superpowers/reviews/2026-04-29-REQ-MOD-004.md b/docs/superpowers/reviews/2026-04-29-REQ-MOD-004.md new file mode 100644 index 0000000..fcd89a3 --- /dev/null +++ b/docs/superpowers/reviews/2026-04-29-REQ-MOD-004.md @@ -0,0 +1,31 @@ +--- +req_id: REQ-MOD-004 +date: 2026-04-30 +round: 1 +reviewer: superpower-code-reviewer +--- + +# Review: REQ-MOD-004 — round 1 + +## 结论 +approve + +## Must-fix +（无） + +## Nice-to-have + +- backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java:122 — spec § 业务规则 #1 与 plan Architecture 节均写「controller 先 trim」，实现把 trim 放在 service。行为等价（controller 立刻调 service），但 spec/plan 与代码不一致。要么把 trim 移到 controller，要么把 spec 改成「service 集中归一化」。建议改 spec（service 归一化 + 7 个单测覆盖更易测）。 +- backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java:420 — `getKeywordMatch_returnsForest` 只断言「返回数组里每个节点 sModuleNameZh 含『系统』」，没断言本测试 INSERT 的 `sp_test_get_kw_a` 行确实出现。日后 V1 seed 含「系统」的行恰好命中时，断言依旧通过——但本测试自身插入的真值未被验证。建议追加按 sModuleNameZh="系统模块A" 定位节点的断言。 +- backend/src/test/java/com/xly/erp/module/mod/controller/ModuleControllerIT.java:466 — `getWithoutJwt_permitAllStub_returns200` / `getTamperedJwt_returns20001` 沿袭 MOD-001/002/003 stub 路径仍缺 `// REQ-MOD-001 stub: see USR-004 follow-up` 锚点。USR-004 上线时一次性 grep 替换为 `authenticated()` + 401 会漏这两条。 +- backend/src/main/java/com/xly/erp/module/mod/service/impl/ModuleServiceImpl.java:122 — `listTree` 方法体缺行内 `// REQ-MOD-004: 模块查询` 锚点；MOD-001/002/003 的 create/update/delete 同源缺失。建议在 module-report 阶段统一补齐 4 处。 +- backend/src/test/java/com/xly/erp/module/mod/service/ModuleServiceImplTest.java:312 — `listTree_emptyKeyword_invokesMapperWithEmptyString_returnsAssembledTree` 中 mock 返回顺序已是 SQL 期望顺序，children 顺序断言 `containsExactly(3, 4)` 实际验的是「mapper 返回顺序被 service 保留」。语义正确（依赖 ModuleMapperIT 验 SQL ORDER BY），加一行注释指向 mapper IT 让 review 路径更清晰。 +- backend/src/test/java/com/xly/erp/module/mod/mapper/ModuleMapperIT.java:108 — `selectActiveByKeyword_filtersAndOrders` 第 108–110 行 `namesByEmpty` 局部变量构造后未被任何 assert 使用（dead code）；真正的断言路径在第 111–117 行的 `insertedIds` 过滤。建议删除 108–110 这段未用 stream。 + +## 反例 / 测试覆盖缺口 + +Spec 验收清单（service 7 + mapperIT 1 + controllerIT 6 + 工程 3）100% 落地，mvn test 67/67 全绿。 + +拼树算法正确性核查通过：HashMap 仅用于 O(1) 查父，roots/children 均按 rows 迭代顺序填充，SQL ORDER BY 顺序穿透到 JSON；同一节点不会既出现在 roots 也挂在 parent.children（if/else 互斥）。VO 字段集严格匹配 docs/05（7 字段，敏感列 sProcedureName / sCreatedBy / sBrandsId 等不暴露）。keyword 归一化（null→''、trim、长度>100→40001）+ 拼树森林（孤儿节点→root）单测覆盖完整。LIKE `%`/`_` 注入在 spec § 边界与约束已显式说明本期不转义。Controller IT 通过 JsonNode 递归读取 children 数组层级，真正验证 JSON 端层级结构。trim 位置（spec/plan 写 controller，实现在 service）为文字不一致而非行为缺陷。 + +继承自 MOD-001~003 的 stub 锚点缺失 / REQ 行内锚点缺失沿袭存在但 spec 已纳入 USR-004 followup 范围，本期接受。**本 REQ 是模块最后一个 REQ，建议在 module-report 阶段一次性把 4 个 REQ 的行内锚点 + 6 处 stub 测试锚点补齐。** diff --git a/docs/superpowers/specs/2026-04-29-REQ-MOD-001.md b/docs/superpowers/specs/2026-04-29-REQ-MOD-001.md new file mode 100644 index 0000000..598034c --- /dev/null +++ b/docs/superpowers/specs/2026-04-29-REQ-MOD-001.md @@ -0,0 +1,153 @@ +--- +req_id: REQ-MOD-001 +date: 2026-04-29 +module: module_mod +--- + +# Spec: REQ-MOD-001 — 模块新增 + +## 目标 + +新增一条 ERP 业务模块定义记录（`tModule`），作为系统功能与权限分组的基础单位，提交后持久化并返回新模块 `iIncrement`。 + +> 本 REQ 是项目首个 REQ，`backend/` 工程目录尚未存在，因此本 spec 同时承担**最小后端脚手架建立**的职责。范围抉择已与用户确认（详见「实现范围与边界抉择」一节）。 + +## 输入 / 触发 + +### HTTP 接口（来自 docs/05 § module_mod.REQ-MOD-001） + +- Method / Path: `POST /api/mod/modules` +- Auth: 必需（JWT Bearer Token） +- Permission: 仅超级管理员（**本 REQ 内 stub 为 permitAll，留待 USR-004 完成后回填硬校验**） +- Content-Type: `application/json` + +### 请求 DTO `CreateModuleDTO` + +| JSON 字段 | Java 类型 | 必填 | Bean Validation | 业务校验 | +|---|---|---|---|---| +| `sDisplayType` | `String` | 是 | `@NotBlank` | 必须在枚举 `[手机端, 前端业务, 系统配置, 接口]` 内；非法 → `40010` | +| `sProcedureName` | `String` | 是 | `@NotBlank @Size(max=100)` | 系统内唯一（依赖 `tModule.uk_procedure_name`）；冲突 → `40020` | +| `sModuleType` | `String` | 是 | `@NotBlank @Size(max=50)` | 自由文本，不做枚举约束（参 docs/03 业务注记） | +| `sManageDeptEn` | `String` | 是 | `@NotBlank @Size(max=50)` | — | +| `bShowPermission` | `Boolean` | 否 | — | 缺省 `false`（写入 `0`） | +| `sModuleNameZh` | `String` | 是 | `@NotBlank @Size(max=100)` | — | +| `iParentId` | `Integer` | 否 | — | 非 null 时必须命中存在且 `bDeleted=0` 的记录；不存在 / 已软删 → `40021` | +| `iSortOrder` | `Integer` | 否 | — | 缺省 `0` | + +> REQ 卡 § 输入只列了前 6 个字段（业务关心的最小集合），API 契约扩展了 `iParentId` / `iSortOrder` 两个可选字段以匹配 `tModule` 自引用 + 排序的 schema。两者一致——前 6 必填，后 2 可选。 + +### 鉴权与上下文 + +- JWT 从 `Authorization: Bearer ` 头解析 +- 解析成功 → 写入 `SecurityContextHolder` 的 `Authentication.principal = sUserNo` +- 解析失败 / 缺失 → `JwtAuthenticationFilter` 直接返回 `Result(20001, "未认证")`，不进入 controller +- **超级管理员判定本期 stub**（`SecurityConfig` 对 `/api/mod/modules` 的 POST 用 `permitAll()`，但 Filter 仍需解析 token 写入 principal 用于 `sCreatedBy`） + +## 输出 / 结果 + +### 成功响应 + +```json +{ + "code": 0, + "msg": "ok", + "data": { "iIncrement": 123 } +} +``` + +### 持久化效果 + +新增一行 `tModule` 记录，字段填充规则： + +| 字段 | 来源 | +|---|---| +| `iIncrement` | DB 自增 | +| `sId` | NULL（本期不生成业务 ID） | +| `sBrandsId` | 配置 `erp.tenant.brands-id`（默认 `XLY`） | +| `sSubsidiaryId` | 配置 `erp.tenant.subsidiary-id`（默认 `XLY`） | +| `tCreateDate` | `LocalDateTime.now()`（service 层填，不依赖 DB 默认） | +| `sDisplayType` ~ `iSortOrder` | DTO 字段 | +| `sCreatedBy` | `SecurityContextHolder` 中 `principal`（即 JWT 中 `sUserNo`）；**stub 期未携带 token 时该接口因 permitAll 也能进，此时 `sCreatedBy` = 配置 `erp.security.stub-user-no`（默认 `STUB_ADMIN`），USR-004 完成后改为强制取 token** | +| `bDeleted` | `0`（DB 默认） | +| `tDeletedDate` / `sDeletedBy` | NULL | + +## 业务规则 + +1. **唯一性**：`sProcedureName` 系统内全局唯一，依赖 DB `uk_procedure_name` 索引兜底；service 层捕获 `org.springframework.dao.DuplicateKeyException` → `BizException(40020, "存储过程名称已存在")`。不做"先查后插"二次校验，避免竞态。 +2. **父模块存在性**：`iParentId != null` 时执行 `SELECT iIncrement FROM tModule WHERE iIncrement=? AND bDeleted=0`；查不到则 `BizException(40021, "父模块不存在或已删除")`。 +3. **枚举校验**：`sDisplayType` 在白名单内（参输入表）；非法 → `BizException(40010, "显示类型枚举不合法")`。在 service 入口处用 `Set.contains()` 校验。 +4. **类型与长度校验**：交给 Bean Validation（`@Valid` + `@NotBlank` / `@Size`）；统一异常处理器把 `MethodArgumentNotValidException` 转 `Result(40001, "<字段名>: ")`。 +5. **事务边界**：`ModuleServiceImpl.create(...)` 上 `@Transactional(rollbackFor = Exception.class)`，整个新增是单条 INSERT 不存在跨表事务，但保持事务注解以便后续业务扩展。 + +## 边界与约束 + +- **必填项缺失** → `40001`（参数校验失败，由 GlobalExceptionHandler 统一处理） +- **`sDisplayType` 非枚举** → `40010` +- **`sProcedureName` 唯一冲突** → `40020` +- **`iParentId` 不存在或已软删** → `40021` +- **超级管理员判定**：本 REQ 不做硬校验（`permitAll` stub），后续在 USR-004 完成后闭环回填——`SecurityConfig` 中 `/api/mod/modules` 的 POST 改为 `hasAuthority('SUPER_ADMIN')`；`JwtAuthenticationFilter` 增加 `tUser` 查询填充 authorities（**本 REQ 不实现**，仅在代码注释中以 `// REQ-MOD-001 stub: see USR-004 follow-up` 形式标注待回填位置） +- **接口异常响应禁回显堆栈**（docs/04 § 1.4），`Result` 仅含 `code + msg`，堆栈走 `logback` +- **错误码段位差异说明**：docs/04 § 1.3 定义段位 `1xxxx/2xxxx/3xxxx/5xxxx`，但 docs/05 接口契约 § REQ-MOD-001 用 `40001/40010/40020/40021/40300`（沿用 HTTP 语义前缀）。本 spec **以 docs/05 为准**——`docs/04` 与 `docs/05` 的不一致属跨 REQ 文档问题，本 REQ 不修复。 + +## 实现范围与边界抉择（与用户确认） + +经 `feature-brainstorm` Q&A 确认（2026-04-29）： + +1. **范围 = 脚手架 + 接口 + Filter（角色 stub）**： + - 建立 `backend/` Spring Boot 工程（pom + Application + 基础配置） + - 引入 Flyway、MyBatis-Plus、Spring Security 依赖 + - 实现统一响应 `Result` + 全局异常处理 `GlobalExceptionHandler` + 业务异常 `BizException` + - 实现 `JwtAuthenticationFilter`（解析 token 写 principal）+ 简易 `SecurityConfig`（除 MOD 接口允许 permitAll，其余 `authenticated()`，但本 REQ 仅 MOD-001 一个接口） + - 实现 MOD-001 接口完整链路（controller / service / mapper / entity / dto） +2. **多租户字段处理 = 用配置默认值 `XLY` / `XLY`**：写入 `application.yml` 的 `erp.tenant.*`，由 `@ConfigurationProperties` 注入 service。 + +## 依赖的 schema 表 / 字段 + +写入表：`tModule` + +| 字段 | 用途 | 来源 | +|---|---|---| +| `iIncrement` | 主键，DB 自增返回 | `useGeneratedKeys=true` | +| `sBrandsId` / `sSubsidiaryId` | 多租户列 | `application.yml` 配置 | +| `tCreateDate` | 创建时间 | service 填 `LocalDateTime.now()` | +| `sDisplayType` / `sProcedureName` / `sModuleType` / `sManageDeptEn` / `bShowPermission` / `sModuleNameZh` / `iParentId` / `iSortOrder` | DTO 透传 | `CreateModuleDTO` | +| `sCreatedBy` | 创建人 | JWT principal（stub 期回退到配置） | +| `bDeleted` | 软删除标记 | DB 默认 `0` | +| `sId` / `tDeletedDate` / `sDeletedBy` | 暂未使用 | NULL | + +约束：唯一索引 `uk_procedure_name(sProcedureName)`；外键 `fk_module_parent: iParentId → tModule.iIncrement (ON DELETE RESTRICT)`。 + +## 依赖的接口 + +无（首个 REQ，无前置接口依赖）。 + +## 验收标准 + +### 单元测试（`ModuleServiceImplTest`，Mockito 隔离 mapper） + +- [x] 给定合法 DTO + 父模块存在 → service 调用 `mapper.insert(...)` 一次，返回 `iIncrement` +- [x] 给定合法 DTO + `iParentId=null` → 跳过父模块校验直接 insert +- [x] 给定 `sDisplayType` 非枚举值 → 抛 `BizException(40010)` +- [x] 给定 `iParentId` 在 mapper 中查不到 → 抛 `BizException(40021)` +- [x] mapper.insert 抛 `DuplicateKeyException` → 转抛 `BizException(40020)` +- [x] `tCreateDate` / `sBrandsId` / `sSubsidiaryId` / `sCreatedBy` 字段被正确填充进传给 mapper 的 entity + +### 集成测试（`ModuleControllerIT`，Spring Boot Test + 真实 MySQL via `setup-test-db.sh` + Flyway） + +测试库由 `scripts/setup-test-db.sh` DROP + CREATE，启动时 Flyway 自动 apply `V1__initial_schema.sql`。每个用例前后清空 `tModule`。 + +- [x] **正常路径**：POST 合法 body + 测试用 JWT → 200 / `code=0`，DB 中存在新行，`sCreatedBy` = JWT 解出的 sUserNo +- [x] **缺必填**：POST `{}` → 400 / `code=40001`，body 含字段定位 +- [x] **枚举非法**：`sDisplayType=未知` → `code=40010` +- [x] **唯一冲突**：先 POST 一次成功；再 POST 同 `sProcedureName` → `code=40020` +- [x] **父模块不存在**：`iParentId=99999` → `code=40021` +- [x] **未携带 JWT**：本 REQ 因 stub permitAll，仍返回 200 但 `sCreatedBy=STUB_ADMIN`（仅验证当前 stub 行为；USR-004 闭环后该用例期望值改为 `code=20001`） +- [x] **JWT 解析失败**（恶意 token） → `code=20001`（filter 拦截） + +### 工程脚手架验收 + +- [x] `mvn -f backend/pom.xml clean test` 全绿 +- [x] Spring Boot 启动后 Flyway 自动 apply V1（如已 apply 则跳过） +- [x] `Result` 在 controller 返回类型上一致使用 +- [x] `GlobalExceptionHandler` 至少处理 `BizException` / `MethodArgumentNotValidException` / 兜底 `Exception` +- [x] `JwtAuthenticationFilter` 正确解析 `Authorization` 头；token 缺失时不阻断 stub permitAll 路径 diff --git a/docs/superpowers/specs/2026-04-29-REQ-MOD-002.md b/docs/superpowers/specs/2026-04-29-REQ-MOD-002.md new file mode 100644 index 0000000..555f140 --- /dev/null +++ b/docs/superpowers/specs/2026-04-29-REQ-MOD-002.md @@ -0,0 +1,133 @@ +--- +req_id: REQ-MOD-002 +date: 2026-04-29 +module: module_mod +--- + +# Spec: REQ-MOD-002 — 模块修改 + +## 目标 + +在不破坏唯一性的前提下，更新已有模块的可编辑字段：`sDisplayType` / `sModuleType` / `sManageDeptEn` / `bShowPermission` / `sModuleNameZh` / `iParentId` / `iSortOrder`。`sProcedureName`、`sCreatedBy`、`tCreateDate`、`sBrandsId` / `sSubsidiaryId`、软删除字段一律保留原值。 + +## 输入 / 触发 + +### HTTP 接口（来自 docs/05 § REQ-MOD-002） + +- Method / Path: `PUT /api/mod/modules/{id}`（`{id}` = `tModule.iIncrement`） +- Auth: 必需（JWT Bearer） +- Permission: 仅超级管理员（**沿用 MOD-001 的 stub：SecurityConfig 路径范围扩展为 `/api/mod/**` permitAll，USR-004 完成后统一改 `hasAuthority('SUPER_ADMIN')`**） + +### 请求 DTO `UpdateModuleDTO` + +| JSON 字段 | Java 类型 | 必填 | 校验 | 业务校验 | +|---|---|---|---|---| +| `sDisplayType` | `String` | 是 | `@NotBlank` | 必须在枚举 `[手机端, 前端业务, 系统配置, 接口]` 内；非法 → `40010` | +| `sModuleType` | `String` | 是 | `@NotBlank @Size(max=50)` | 自由文本 | +| `sManageDeptEn` | `String` | 是 | `@NotBlank @Size(max=50)` | — | +| `bShowPermission` | `Boolean` | 否 | — | 缺省视为 `false`（写 0） | +| `sModuleNameZh` | `String` | 是 | `@NotBlank @Size(max=100)` | — | +| `iParentId` | `Integer` | 否 | — | 不为 null 时：① 不能等于路径 `{id}`（自指）；② 必须命中存在且 `bDeleted=0` 的记录；③ 沿父链遍历不能在路径中出现 `{id}`（环检测）。三种违反统一 → `40021` | +| `iSortOrder` | `Integer` | 否 | — | 缺省 `0` | + +> **`sProcedureName` 显式从 DTO 中剔除**——API 契约声明该字段不可改；前端表单仍可显示原值（REQ 卡列为必填仅是前端 UX 约束），但 PUT body 中即便传了也会被 Jackson 丢弃，不进入 service。这一处与 REQ 卡输入表的差异是**有意的**：以 docs/05 API 契约为准。 + +### 鉴权与上下文 + +同 MOD-001：JWT Filter 解析 token 写 `principal=sUserNo`；本 REQ 走 `permitAll` stub，不强制要求 token；伪造 token 仍被 filter 短路返回 `code=20001`。`sCreatedBy` 在更新时**不修改**，无论是否携带 token。 + +## 输出 / 结果 + +### 成功响应 + +```json +{ + "code": 0, + "msg": "ok", + "data": { "iIncrement": 123 } +} +``` + +### 持久化效果 + +`UPDATE tModule SET <可编辑列> WHERE iIncrement = {id}`。 + +| 字段 | 更新策略 | +|---|---| +| `sDisplayType` / `sModuleType` / `sManageDeptEn` / `sModuleNameZh` / `iParentId` / `iSortOrder` | DTO 透传 | +| `bShowPermission` | DTO null → `false`，否则 DTO 值 | +| `sProcedureName` / `sCreatedBy` / `tCreateDate` / `sBrandsId` / `sSubsidiaryId` / `bDeleted` / `tDeletedDate` / `sDeletedBy` / `sId` | **不更新**（entity 上对应字段保持 null，依赖 MyBatis-Plus 默认 `FieldStrategy.NOT_NULL` 跳过 null 字段） | + +> 实施细节：MyBatis-Plus 默认全局 `update-strategy: NOT_NULL`，但需在 entity 字段上不显式标注其他 strategy。`bShowPermission` 因 DTO null 时要写 false，故 service 层先把 DTO null 展开为 false 再赋值给 entity；其余 null 字段保持 null。 + +## 业务规则 + +1. **目标存在性**：先 `SELECT * FROM tModule WHERE iIncrement = {id} AND bDeleted = 0`；找不到 → `BizException(40400, "模块不存在或已删除")`。 +2. **枚举校验**：`sDisplayType` 在 `DISPLAY_TYPES` 内（复用 `ModuleServiceImpl.DISPLAY_TYPES`）；非法 → `BizException(40010, "显示类型枚举不合法")`。 + > docs/05 § MOD-002 错误码表只列了 40001/40021/40400，未单列 40010。本实现选择复用 MOD-001 已建立的 40010 语义（保持同一字段两个接口的错误码一致）。这条偏离已记入 spec，后续若需统一可在 docs/05 补一行。 +3. **iParentId 校验**（`iParentId != null` 时）： + - 自指 (`iParentId == id`) → `BizException(40021, "父模块不能指向自身")` + - 不存在 / 已软删 (`!moduleMapper.existsActiveById(iParentId)`) → `BizException(40021, "父模块不存在或已删除")` + - 形成环：从 `iParentId` 沿 `tModule.iParentId` 链向上回溯，每跳一次查一次 mapper；若某层 ID 等于路径 `{id}` → `BizException(40021, "父模块链构成环路")`；遍历深度上限 `50`，超限抛 `BizException(40021, "父模块链超过最大层级")` 防止脏数据死循环。 +4. **事务边界**：`update(...)` 上 `@Transactional(rollbackFor = Exception.class)`，包裹"目标查询 + 父链校验 + UPDATE"全部步骤。 +5. **空 body / 非 JSON**：交给 Spring + GlobalExceptionHandler，目前会落 `handleAny` 转 `code=50000`（同 MOD-001 已知行为，spec 未要求 fix）。 + +## 边界与约束 + +- **必填项缺失** → `40001` +- **`sDisplayType` 非枚举** → `40010` +- **iParentId 不合法（自指 / 不存在 / 环 / 超深）** → `40021` +- **目标 id 不存在或已软删** → `40400` +- **JWT 伪造** → `20001`（filter 短路） +- **JWT 缺失** → permitAll stub，不阻断（USR-004 后改 401） +- **不允许修改 `sProcedureName`**：DTO 直接不暴露该字段；即便前端误传，service 也不读；不需要单独错误码。 + +## 实现范围与边界抉择 + +1. **复用 MOD-001 工程脚手架**：无需新增 pom 依赖、Application、SecurityConfig 等；仅在 `ModuleService` / `ModuleServiceImpl` / `ModuleController` / `ModuleMapper` 上做增量。 +2. **SecurityConfig 路径调整**：把 MOD-001 的 `POST /api/mod/modules permitAll` 改为 `requestMatchers("/api/mod/**").permitAll()`，stub 范围一次性覆盖整个 MOD 模块的 4 个 REQ；注释保留 `// REQ-MOD-001 stub: see USR-004 follow-up`（路径更动，原 stub 锚点继续生效，无需新增锚点关键字）。 +3. **环检测策略**：选择"递归向上查 mapper"而非"DB 层 CTE"，因为：① 单条业务路径，递归层数小（典型 < 5）；② docs/04 § 3.4 禁循环 N+1 主要针对**列表场景**，单条更新接口的小循环不属于该约束；③ 避免引入 MyBatis-Plus 的 CTE 写法增加复杂度。 + +## 依赖的 schema 表 / 字段 + +写入表：`tModule` + +| 字段 | 用途 | 来源 | +|---|---|---| +| `iIncrement` | path id，定位行 | `@PathVariable` | +| `sDisplayType` / `sModuleType` / `sManageDeptEn` / `bShowPermission` / `sModuleNameZh` / `iParentId` / `iSortOrder` | DTO 透传 | `UpdateModuleDTO` | +| 其他字段 | 不更新 | — | + +依赖索引：`uk_procedure_name` 不冲突（不动该字段）；`fk_module_parent` 在父链校验通过后由 INSERT/UPDATE 默认约束兜底。 + +## 依赖的接口 + +无（仅本 REQ 路径内部使用 MOD-001 已实现的 `ModuleMapper` 工具方法 + 新增父链查询）。 + +## 验收标准 + +### 单元测试（追加到 `ModuleServiceImplTest`） + +- [x] `updateWithValidDto_invokesUpdateById_withEditableFieldsOnly` — Mock `selectById` 返回非空、`existsActiveById` 返回 true（若有 parent）；断言传入 `updateById` 的 entity：` iIncrement` 是路径 id；`sProcedureName` / `sCreatedBy` / `tCreateDate` / `sBrandsId` / `sSubsidiaryId` 全部为 null（NOT_NULL 策略跳过）；可改字段被透传。 +- [x] `updateWithTargetNotFound_throws40400` — Mock `selectById` 返回 null；不调 `updateById`。 +- [x] `updateWithInvalidDisplayType_throws40010` — DTO `sDisplayType="未知"`；不调 `updateById`。 +- [x] `updateWithSelfParentId_throws40021` — DTO `iParentId == path id`；错误信息含"自身"。 +- [x] `updateWithMissingParent_throws40021` — Mock `existsActiveById(parent) → false`；错误信息含"父模块不存在"。 +- [x] `updateWithCyclicParent_throws40021` — 构造 mapper 行为：`existsActiveById(parent)=true`；递归向上 `selectById(parent).getIParentId() == path id`；期望抛 40021，错误信息含"环路"。 +- [x] `updateWithBShowPermissionNull_setsFalseInEntity` — DTO `bShowPermission=null`；entity 字段为 `false`。 + +### 集成测试（追加到 `ModuleControllerIT`） + +- [x] `putValidBody_with_jwt_returns200_andUpdatesEditableFields` — 先 INSERT 一条原始行，再 PUT；查 DB：可改字段为新值，`sProcedureName` / `sCreatedBy` 保持原值。 +- [x] `putNonExistentId_returns40400` — PUT `/api/mod/modules/99999999`；`code=40400`。 +- [x] `putInvalidDisplayType_returns40010` — `code=40010`。 +- [x] `putSelfParent_returns40021` — body `iParentId == path id`；`code=40021`。 +- [x] `putCyclicParent_returns40021` — 准备数据：root → child；PUT root 把 `iParentId` 改成 child（构成环）；`code=40021`。 +- [x] `putWithoutJwt_permitAllStub_returns200_andDoesNotChangeCreatedBy` — 先 INSERT（通过 POST 接口或 JdbcTemplate），再无 token PUT；`sCreatedBy` 仍是原值（不被覆盖为 STUB_ADMIN）。 +- [x] `putTamperedJwt_returns20001` — `code=20001`。 + +### 工程验收 + +- [x] `cd backend && mvn -B test` 全绿（含 MOD-001 已有 26 用例 + 本 REQ 新增至少 7+7=14 用例，总 ≥ 40 用例） +- [x] SecurityConfig 路径规则更新后，MOD-001 已有 IT 仍 PASS（permitAll 范围扩大不收紧） +- [x] DB 中 `sProcedureName` 在更新前后字面相同（验证未被覆盖） diff --git a/docs/superpowers/specs/2026-04-29-REQ-MOD-003.md b/docs/superpowers/specs/2026-04-29-REQ-MOD-003.md new file mode 100644 index 0000000..5318d53 --- /dev/null +++ b/docs/superpowers/specs/2026-04-29-REQ-MOD-003.md @@ -0,0 +1,106 @@ +--- +req_id: REQ-MOD-003 +date: 2026-04-29 +module: module_mod +--- + +# Spec: REQ-MOD-003 — 模块删除 + +## 目标 + +软删除一个已有模块（`bDeleted=0 → 1` + 审计字段填充），并阻止破坏树形数据完整性的删除（已存在未删子模块时拒绝）。 + +## 输入 / 触发 + +### HTTP 接口（docs/05 § REQ-MOD-003） + +- Method / Path: `DELETE /api/mod/modules/{id}`（path 参数 `{id}` = `tModule.iIncrement`） +- 无请求 body +- Auth: 必需（沿用 MOD-001 stub：路径已在 SecurityConfig `/api/mod/**` permitAll，USR-004 完成后改 `hasAuthority('SUPER_ADMIN')`） +- Permission: 仅超级管理员（stub 期不强制） + +### 鉴权与上下文 + +JWT Filter 解析 token 写 `principal=sUserNo`；伪造 token → `code=20001`；缺失 token → permitAll 透传。`sDeletedBy` 取 `SecurityContextHelper.currentUserNo()`，匿名状态回退 `stubProps.stubUserNo`（与 MOD-001 `sCreatedBy` 同策略）。 + +## 输出 / 结果 + +### 成功响应 + +```json +{ "code": 0, "msg": "ok", "data": null } +``` + +### 持久化效果 + +`UPDATE tModule SET bDeleted=1, tDeletedDate=NOW(), sDeletedBy='' WHERE iIncrement={id}`。其他字段保持原值（依赖 MyBatis-Plus FieldStrategy.NOT_NULL 仅写非 null 字段）。 + +## 业务规则 + +1. **目标存在性**：`SELECT * FROM tModule WHERE iIncrement={id}`；行不存在 **或** `bDeleted=1` → `BizException(40400, "模块不存在或已删除")`。已删模块再次 DELETE 也返回 40400（删除接口非幂等设计——业务上想表达"目标已不存在"）。 +2. **子模块拦截**：检查 `tModule WHERE iParentId={id} AND bDeleted=0`；存在 → `BizException(40901, "模块仍有未删除子节点")`。新增 mapper 方法 `boolean hasActiveChildren(Integer parentId)`，实现用 `@Select("SELECT 1 FROM tModule WHERE iParentId = #{parentId} AND bDeleted = 0 LIMIT 1")` + Java default 包装。 +3. **外部引用拦截（40902）**：docs/05 列了该错误码，但 docs/03 § tModule 业务注记明确"与本期其他表无外键关系"——本期 schema 中**不存在**菜单/权限/角色表引用 tModule 的字段，**本 REQ 不实现 40902 校验**。spec 显式记录该决策：当 USR 或后续模块引入 `tMenu` / `tRole` 等表并通过 `iModuleId` 等字段引用 tModule 时，再回头扩展 ModuleService#delete 加引用查询。当前实现保持纯 MOD 模块自包含。 +4. **软删除字段填充**：构造 `Module entity` 仅 set `iIncrement` / `bDeleted=true` / `tDeletedDate=LocalDateTime.now()` / `sDeletedBy=`；其他字段保持 null（NOT_NULL 跳过，避免覆盖原值）。 +5. **事务边界**：复用类级 `@Transactional(rollbackFor = Exception.class)`，包裹"目标查询 + 子模块查询 + UPDATE"。 + +## 边界与约束 + +- **id 不存在 / 已软删** → `40400` +- **存在未删子模块** → `40901` +- **JWT 伪造** → `20001`（filter 短路） +- **JWT 缺失** → permitAll stub，正常 200 + `sDeletedBy=STUB_ADMIN`（USR-004 闭环后改 401） +- **40902 外部引用拦截** → 本 REQ 不实现（docs/03 当前 schema 无引用方），spec 记录后续补点 + +## 实现范围与边界抉择 + +1. **复用 MOD-001/002 工程**：无新增依赖；仅在 `ModuleService` / `ModuleServiceImpl` / `ModuleController` / `ModuleMapper` 上做增量。 +2. **删除接口非幂等**：连续 DELETE 同一 id，第二次返回 40400，不允许覆盖已删除记录的 `tDeletedDate` / `sDeletedBy`。这与"删除"语义对齐——目标不存在就是错。 +3. **mapper 仅查 1 行不查全表**：`hasActiveChildren` 用 `SELECT 1 ... LIMIT 1` 避免全表扫描；与 MOD-001 `findActiveFlagById` 风格一致。 +4. **不做 40902**：待引用方落地。 + +## 依赖的 schema 表 / 字段 + +写入表：`tModule` + +| 字段 | 用途 | 来源 | +|---|---|---| +| `iIncrement` | path id，定位行 | `@PathVariable` | +| `bDeleted` | 软删除标记 | service 设 `true` | +| `tDeletedDate` | 软删除时间 | `LocalDateTime.now()` | +| `sDeletedBy` | 软删除操作人 | JWT principal 或 `stubProps.stubUserNo` | +| 其他字段 | 不动 | — | + +读取表：`tModule`（含子模块查询）。 + +## 依赖的接口 + +无（本 REQ 内部使用 MOD-001/002 已有 mapper 工具方法 + 新增 `hasActiveChildren`）。 + +## 验收标准 + +### 单元测试（追加到 `ModuleServiceImplTest`） + +- [x] `deleteWithValidId_softDeletes_andSetsAuditFields` — Mock `selectById(10)` 返回 alive Module，`hasActiveChildren(10)=false`；ArgumentCaptor 抓 `updateById` 入参，断言 `iIncrement=10` / `bDeleted=true` / `tDeletedDate != null` / `sDeletedBy="STUB_ADMIN"`（无认证上下文）；其他字段 null。 +- [x] `deleteWithTargetNotFound_throws40400` — `selectById(99)=null`；不调 `updateById`。 +- [x] `deleteWithTargetAlreadyDeleted_throws40400` — `selectById(10)` 返回 `bDeleted=true` 的 Module；不调 `updateById`。 +- [x] `deleteWithActiveChildren_throws40901` — `selectById(10)` alive；`hasActiveChildren(10)=true`；不调 `updateById`。 +- [x] `deleteSetsDeletedByFromAuthenticatedUser` — SecurityContextHolder 注入 principal `"BOB"`；ArgumentCaptor `sDeletedBy="BOB"`。 + +### Mapper IT（追加到 `ModuleMapperIT`） + +- [x] `hasActiveChildren_trueIfChildAliveExists_falseOtherwise` — 准备 root + alive child + deleted child；断言 `hasActiveChildren(root)=true`；删除 alive child 后再断言 `hasActiveChildren(root)=false`（用 JdbcTemplate UPDATE bDeleted=1）。 + +### 集成测试（追加到 `ModuleControllerIT`） + +- [x] `deleteValidId_with_jwt_returns200_andSoftDeletes` — 直插一行 alive；DELETE 带 JWT="ADMIN001"；期望 `code=0` / `data=null`；DB 查 `bDeleted=1` / `sDeletedBy="ADMIN001"` / `tDeletedDate IS NOT NULL`；其他列保持原值（断 `sProcedureName` / `sCreatedBy` / `sBrandsId`）。 +- [x] `deleteNonExistentId_returns40400` — DELETE `/api/mod/modules/99999997`；`code=40400`。 +- [x] `deleteAlreadyDeletedId_returns40400` — 直插 `bDeleted=1` 行；DELETE → `code=40400`。 +- [x] `deleteWithActiveChildren_returns40901` — 直插 root + alive child；DELETE root → `code=40901`；DB 查 root 仍 `bDeleted=0`。 +- [x] `deleteWithoutJwt_permitAllStub_returns200_andDeletedByIsSTUB` — 直插 alive；无 token DELETE；`code=0`；DB 查 `sDeletedBy="STUB_ADMIN"`。 +- [x] `deleteTamperedJwt_returns20001` — Authorization 伪造 → `code=20001`，DB 行未被改动。 + +### 工程验收 + +- [x] `cd backend && mvn -B test` 全绿（含 MOD-001 26 + MOD-002 15 + MOD-003 新增 5 service + 1 mapperIT + 6 controllerIT = 53 用例） +- [x] DELETE 接口经路径白名单 `/api/mod/**` permitAll 通过 +- [x] `// REQ-MOD-001 stub: see USR-004 follow-up` 锚点保持不动 diff --git a/docs/superpowers/specs/2026-04-29-REQ-MOD-004.md b/docs/superpowers/specs/2026-04-29-REQ-MOD-004.md new file mode 100644 index 0000000..99115ac --- /dev/null +++ b/docs/superpowers/specs/2026-04-29-REQ-MOD-004.md @@ -0,0 +1,138 @@ +--- +req_id: REQ-MOD-004 +date: 2026-04-29 +module: module_mod +--- + +# Spec: REQ-MOD-004 — 模块查询 + +## 目标 + +按关键字对 `tModule.sModuleNameZh` 模糊匹配，过滤 `bDeleted=0` 行，按 `iParentId` 拼装为树形（森林）输出。空关键字返回完整模块树。 + +## 输入 / 触发 + +### HTTP 接口（docs/05 § REQ-MOD-004） + +- Method / Path: `GET /api/mod/modules` +- Auth: 必需（沿用 MOD-001 stub：路径已在 SecurityConfig `/api/mod/**` permitAll；USR-004 后改 `authenticated()` 即可——不需要 hasAuthority，本接口面向所有登录用户） +- Query: `keyword`（可选；缺省 / 空串 / 仅空白 → 视作空匹配返回完整树） + +### 校验 + +| 输入 | 校验 | 失败码 | +|---|---|---| +| `keyword` | 长度 ≤ 100 字符（与 `sModuleNameZh` 列长一致） | `40001` | + +## 输出 / 结果 + +### 成功响应 + +```json +{ + "code": 0, + "msg": "ok", + "data": [ + { + "iIncrement": 1, + "sModuleNameZh": "系统管理", + "sDisplayType": "手机端", + "sManageDeptEn": "IT", + "iParentId": null, + "iSortOrder": 0, + "children": [ + { "iIncrement": 2, "sModuleNameZh": "用户管理", "sDisplayType": "手机端", + "sManageDeptEn": "IT", "iParentId": 1, "iSortOrder": 0, "children": [] } + ] + } + ] +} +``` + +`data` 是数组（森林），无命中时为 `[]`。 + +### VO `ModuleTreeVO` + +| 字段 | 类型 | 来源 | +|---|---|---| +| `iIncrement` | `Integer` | `tModule.iIncrement` | +| `sModuleNameZh` | `String` | `tModule.sModuleNameZh` | +| `sDisplayType` | `String` | `tModule.sDisplayType` | +| `sManageDeptEn` | `String` | `tModule.sManageDeptEn` | +| `iParentId` | `Integer` | `tModule.iParentId`（null 表根） | +| `iSortOrder` | `Integer` | `tModule.iSortOrder` | +| `children` | `List` | 拼装得到，叶节点为 `[]` | + +> 不返回 `sProcedureName` / `sCreatedBy` / `tCreateDate` / `sBrandsId` / `sSubsidiaryId` / `bShowPermission` / `sModuleType` / 软删除审计字段——这些不在 docs/05 输出 schema 中。 + +## 业务规则 + +1. **关键字归一化**：controller 先 trim；null 或空串均当作空匹配。 +2. **长度校验**：trim 后长度 > 100 → `BizException(40001, "keyword 长度超过 100 字符")`。 +3. **DB 查询**：`SELECT iIncrement, sModuleNameZh, sDisplayType, sManageDeptEn, iParentId, iSortOrder FROM tModule WHERE bDeleted=0 AND sModuleNameZh LIKE CONCAT('%', #{keyword}, '%') ORDER BY iSortOrder ASC, iIncrement ASC`；空 keyword → `LIKE '%%'` 命中所有。 +4. **拼树**（service 内存算法）： + - 把命中行映射为 `ModuleTreeVO`；建 `Map idIndex` + - 遍历：若 `iParentId != null && idIndex.containsKey(iParentId)` → 挂到 parent.children；否则视作 root（含真 root 与"父被过滤掉"的孤立节点），加入返回 list + - 由于 SQL 已 ORDER BY，拼装顺序天然有序；同 parent 下 children 顺序 = SQL 顺序 +5. **只读**：service 上 `@Transactional(readOnly = true)`，明示无写副作用。 +6. **空结果**：返回 `[]`，HTTP 200 / `code=0`。 + +## 边界与约束 + +- **`keyword` 缺失 / 空 / 仅空白** → 等价空匹配，返回完整有效树 +- **`keyword` > 100 字符** → `40001` +- **JWT 伪造** → `20001`（filter 短路） +- **JWT 缺失** → permitAll stub，正常 200（USR-004 后改为要求登录） +- **SQL LIKE 通配符注入**：`keyword` 含 `%` / `_` 时 MyBatis 直接拼到 LIKE 中——理论上影响匹配范围（`%abc%` 用户输入 `%` 等于 `LIKE '%%abc%%'` 仍匹配所有）。本期不做转义（业务上不敏感且 docs/05 未要求）；后续若需要严格匹配可在 service 层做 `keyword.replace("%","\\%").replace("_","\\_")` 处理。spec 记录该选择。 + +## 实现范围与边界抉择 + +1. **拼树策略**：选择"过滤命中后拼树（孤立子节点视为 root，即森林）"，与 docs/03 § tModule 业务注记一致。**不实现"扩展祖先链以保留树形"**——会让查询语义复杂化（要么二次查祖先，要么 SQL 用 CTE）；REQ 卡仅要求"以树形结构展示匹配结果"，森林是合法的树形结果。 +2. **Mapper 直接 SQL LIKE**：相对"先全查再内存过滤"更高效；模块数据量大时也撑得住。 +3. **Service 排序在 SQL**：拼树时不再排序，避免重复劳动；测试断言依赖 SQL `ORDER BY iSortOrder ASC, iIncrement ASC`。 + +## 依赖的 schema 表 / 字段 + +读取表：`tModule` + +| 字段 | 用途 | +|---|---| +| `iIncrement` / `sModuleNameZh` / `sDisplayType` / `sManageDeptEn` / `iParentId` / `iSortOrder` | 输出 VO 字段 | +| `bDeleted` | 过滤条件（=0） | + +依赖索引：`idx_module_name_zh(sModuleNameZh)` 命中 LIKE 前缀匹配；`idx_parent(iParentId)` 不直接命中（拼树用内存 Map），但保留供未来 join 用。 + +## 依赖的接口 + +无。 + +## 验收标准 + +### 单元测试（追加到 `ModuleServiceImplTest`） + +- [x] `listTree_emptyKeyword_invokesMapperWithEmptyString_returnsAssembledTree` — Mock `selectActiveByKeyword("")` 返回 5 行（root1, child1, child2, deepChild1, root2），ArgumentCaptor 验 mapper 入参为 `""`；返回结构符合树（root1.children 含 child1/child2；child1.children 含 deepChild1；root2.children 空） +- [x] `listTree_nullKeyword_treatedAsEmpty` — DTO `keyword=null`，效果同空串 +- [x] `listTree_blankKeyword_treatedAsEmpty` — keyword `" "` trim 后空 +- [x] `listTree_keywordTooLong_throws40001` — keyword 101 字符 → BizException(40001) +- [x] `listTree_returnsEmptyListWhenNoMatch` — Mock 返回空 list；service 返回 `List.of()` +- [x] `listTree_orphansBecomeRootsInForest` — Mock 返回 [child](其父 iParentId=99 不在结果集)；child 出现在顶层 list +- [x] `listTree_keywordIsTrimmedBeforeQuery` — keyword `" 系统 "` → mapper 入参 `"系统"` + +### Mapper IT（追加到 `ModuleMapperIT`） + +- [x] `selectActiveByKeyword_filtersAndOrders` — 准备 5 行（含 1 个 bDeleted=1）；查 `keyword=""` → 4 行（按 iSortOrder, iIncrement 升序）；查 `keyword="系统"` → 仅命中 sModuleNameZh 含"系统"的活跃行；查 `keyword="不存在"` → 空 + +### 集成测试（追加到 `ModuleControllerIT`） + +- [x] `getEmptyKeyword_returnsCompleteTreeAsForest` — 直插 root + child；GET `/api/mod/modules` 带 JWT；`code=0`；`data` 是数组；至少含 root 节点且其 children 含 child +- [x] `getKeywordMatch_returnsForest` — 直插含"系统"的 alive 模块 + 不含"系统"的；GET `?keyword=系统`；只返回含"系统"的 +- [x] `getKeywordTooLong_returns40001` — `keyword` 101 字符 → `code=40001` +- [x] `getNoMatch_returnsEmptyArray` — `keyword=不存在的关键字XYZ`；`data` 是 `[]` +- [x] `getWithoutJwt_permitAllStub_returns200` — 无 JWT GET；`code=0` +- [x] `getTamperedJwt_returns20001` — Authorization 伪造 → `code=20001` + +### 工程验收 + +- [x] `cd backend && mvn -B test` 全绿（53 + MOD-004 新增 7(svc) + 1(mapperIT) + 6(controllerIT) = 67 用例） +- [x] 输出 VO 字段集严格匹配 docs/05 列表，不暴露敏感字段 +- [x] `// REQ-MOD-001 stub: see USR-004 follow-up` 锚点保持（路径已 permitAll，无需新增） diff --git a/scripts/setup-test-db.sh b/scripts/setup-test-db.sh index 41a3970..0a026ca 100755 --- a/scripts/setup-test-db.sh +++ b/scripts/setup-test-db.sh @@ -13,6 +13,12 @@ set -euo pipefail +# macOS Homebrew 的 mysql-client 是 keg-only，默认不在 PATH；非交互式 bash 也不读 ~/.zshrc。 +# 这里幂等 prepend 常见安装路径，命中则用，未命中（如 Linux CI 已自带 mysql）则跳过。 +for p in /opt/homebrew/opt/mysql-client/bin /usr/local/opt/mysql-client/bin; do + [ -d "$p" ] && case ":$PATH:" in *":$p:"*) ;; *) PATH="$p:$PATH" ;; esac +done + ENV_FILE="$(dirname "$0")/../.env.local" [ -f "$ENV_FILE" ] || { echo "[setup-test-db] ⚠️ .env.local 不存在（$ENV_FILE）" >&2; exit 1; } diff --git a/scripts/test.sh b/scripts/test.sh index 2fdb4be..4674205 100755 --- a/scripts/test.sh +++ b/scripts/test.sh @@ -8,17 +8,36 @@ set -euo pipefail PROJECT_ROOT="$(cd "$(dirname "$0")/.." && pwd)" cd "$PROJECT_ROOT" +# 加载 .env.local（DB_HOST/DB_PORT/JWT_SECRET 等），让 mvn / setup-test-db.sh 都能读到 +if [ -f .env.local ]; then + set -a; . ./.env.local; set +a +fi + echo "[test.sh] 1/6 setup test db" ./scripts/setup-test-db.sh echo "[test.sh] 2/6 build" -(cd backend && mvn -B -DskipTests clean package) && (cd frontend && npm ci && npm run build) +(cd backend && mvn -B -DskipTests clean package) +if [ -d frontend ]; then + (cd frontend && npm ci && npm run build) +else + echo "[test.sh] skip frontend build (frontend/ not initialized yet)" +fi echo "[test.sh] 3/6 lint" -(cd frontend && npm run lint) +if [ -d frontend ]; then + (cd frontend && npm run lint) +else + echo "[test.sh] skip frontend lint (frontend/ not initialized yet)" +fi echo "[test.sh] 4/6 unit + integration" -(cd backend && mvn -B test) && (cd frontend && npm test -- --run) +(cd backend && mvn -B test) +if [ -d frontend ]; then + (cd frontend && npm test -- --run) +else + echo "[test.sh] skip frontend unit tests (frontend/ not initialized yet)" +fi echo "[test.sh] 5/6 E2E" echo "[test.sh] e2e 略"