diff --git a/src/main/java/com/ffii/fpsms/config/security/SecurityConfig.java b/src/main/java/com/ffii/fpsms/config/security/SecurityConfig.java index c82ca67..d97ca32 100644 --- a/src/main/java/com/ffii/fpsms/config/security/SecurityConfig.java +++ b/src/main/java/com/ffii/fpsms/config/security/SecurityConfig.java @@ -109,6 +109,8 @@ public class SecurityConfig { .hasAnyAuthority("TESTING", "ADMIN") .requestMatchers(HttpMethod.GET, "/label-printer-monitor/label-stats") .hasAnyAuthority("TESTING", "ADMIN") + .requestMatchers(HttpMethod.POST, "/stockAdjustment/submit") + .hasAnyAuthority("ADMIN", "INVENTORY_ADJUST") .anyRequest().authenticated()) .httpBasic(httpBasic -> httpBasic.authenticationEntryPoint( (request, response, authException) -> sendUnauthorizedJson(response, "Unauthorized", "UNAUTHORIZED"))) diff --git a/src/main/resources/db/changelog/changes/20260617_inventory_adjust/01_inventory_adjust_authority.sql b/src/main/resources/db/changelog/changes/20260617_inventory_adjust/01_inventory_adjust_authority.sql new file mode 100644 index 0000000..3c5e74e --- /dev/null +++ b/src/main/resources/db/changelog/changes/20260617_inventory_adjust/01_inventory_adjust_authority.sql @@ -0,0 +1,9 @@ +--liquibase formatted sql + +--changeset fpsms:inventory_adjust_authority +--preconditions onFail:MARK_RAN +--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM authority WHERE authority = 'INVENTORY_ADJUST' +--comment: Add independent permission for stock adjustment (inventory adjustment) +INSERT IGNORE INTO `authority` (`authority`, `name`, `module`, `description`) +VALUES ('INVENTORY_ADJUST', '庫存調整', 'INVENTORY', 'Allow submitting stock adjustments (POST /stockAdjustment/submit)'); +