fix

docs/frontend-security-integration.md

@@ -203,3 +203,15 @@ ip 筛选目前只精确匹配 remoteIp 或 realIp，不查询 forwardedFor 链
 - 缺少参数、参数类型错误、JSON 格式错误的细化提示只用于管理路径；字段校验管理路径增加字段名。
 - 登录/角色/权限异常沿用原业务码及提示，不改变登录跳转协议。未知错误仍不返回原始异常、SQL或堆栈。
 - 其他路径保留原业务提示及错误编号 data 约定，不新增管理字段细节。无需 SQL、无需前端提示改动。
+
+## 补差价独立权限（2026-10-21）
+- `PUT /manage/order/refund/price/differ` 改为独立 `order:priceDiffer`，不再共用 `order:refund`；仍要求后台登录且账号启用。
+- 管理端补差价按钮、打开弹窗、请求拦截同步检查；退款权限不变。
+- 更新统一菜单 SQL：订单列表下新增“补差价”，共 21 项。不自动授权任何角色；已执行旧版本可重跑新版补齐。
+- 发布后需要 root 在角色管理显式勾选补差价并保存刷新权限。只有退款权限不能补差价，只有补差价权限不能退款（不含通配权限）。
+
+## 商品规格写接口权限补齐（2026-10-21）
+- 商品规格控制器与规格标题控制器共 10 个写入口接入现有 platform 权限：新增 add、修改/排序 update、删除 delete、批量上架 updateStatus。
+- 沿用既有角色菜单授权，无新增 SQL。平台写权限同时核验后台账号启用状态。
+- spec1.vue 的新增/编辑/删除/批量上架入口与通用 SKU/spec 写请求拦截同步校验；保留合并后的其他页面逻辑。
+- 此次覆盖这两个控制器的写入口，不代表所有商品、批发或增值服务接口已审计完成。需部署前后端，验证无权限管理员直接请求同样被拒绝。

netflix-web/src/main/java/com/cyksj/aspect/RefundAuthorizationAspect.java

@@ -19,7 +19,7 @@ public class RefundAuthorizationAspect {
     @Around("@annotation(permission)")
     public Object authorize(ProceedingJoinPoint point, SaCheckPermission permission) throws Throwable {
         for (String value : permission.value()) {
-            if (!"order:refund".equals(value) && !"order:refundTransfer".equals(value) && !value.startsWith("merchant:")) continue;
+            if (!"order:refund".equals(value) && !"order:refundTransfer".equals(value) && !"order:priceDiffer".equals(value) && !value.startsWith("merchant:") && !value.startsWith("platform:")) continue;
             StpUtil.checkLogin();
             StpUtil.checkPermission(value);
             CmsUser admin = cmsUserMapper.selectById(StpUtil.getLoginIdAsLong());

netflix-web/src/main/java/com/cyksj/web/controller/manage/CmsOrderController.java

@@ -1091,7 +1091,7 @@ public class CmsOrderController {
 	 * 订单补差价，补差价退款到余额
 	 */
 	@SaCheckLogin
-    @SaCheckPermission("order:refund")
+    @SaCheckPermission("order:priceDiffer")
     @PutMapping("/refund/price/differ")
 	@Log(module = "订单管理/订单补差价", businessType = BusinessType.PUT, isSaveRequestData = true)
 	public Result<String> refundPriceDiffer(@RequestBody OrderRefundReq orderRefundReq) throws Exception {

netflix-web/src/main/java/com/cyksj/web/controller/manage/goods/CmsGoodsDonSkuController.java

@@ -1,5 +1,7 @@
 package com.cyksj.web.controller.manage.goods;
 
+import cn.dev33.satoken.annotation.SaCheckPermission;
+
 import cn.hutool.core.collection.CollUtil;
 import cn.hutool.core.util.StrUtil;
 import com.baomidou.mybatisplus.core.toolkit.Assert;
@@ -73,6 +75,7 @@ public class CmsGoodsDonSkuController {
     /**
      * 新增 商品spec & sku
      */
+    @SaCheckPermission("platform:add")
     @PostMapping(value = "/post/spec-sku")
     @Log(module = "平台管理/新增商品sku&spec", businessType = BusinessType.POST, isSaveRequestData = true)
     public Result<String> skuInsert(@Validated @RequestBody ReqGoodsSkuInsert insert) throws Exception{
@@ -84,6 +87,7 @@ public class CmsGoodsDonSkuController {
     /**
      * 更新 spec
      */
+    @SaCheckPermission("platform:update")
     @PutMapping("/update/spec")
     public Result<String> updateGoodsSpec(@Validated @RequestBody ReqGoodsSkuInsert insert) throws Exception {
         goodsDonSpecService.insertOrUpdateSkuSpec(insert, true);
@@ -95,6 +99,7 @@ public class CmsGoodsDonSkuController {
      * 追加 商品sku
      */
     @Transactional(rollbackFor = Throwable.class)
+    @SaCheckPermission("platform:add")
     @PostMapping(value = "/post")
     @Log(module = "平台管理/新增规格", businessType = BusinessType.POST, isSaveRequestData = true)
     public Result<String> skuAppend(@Validated @RequestBody ReqGoodsSkuInsert insert) throws Exception{
@@ -114,6 +119,7 @@ public class CmsGoodsDonSkuController {
      * 修改 sku
      */
     @Transactional(rollbackFor = Throwable.class)
+    @SaCheckPermission("platform:update")
     @PutMapping(value = "/update")
     @Log(module = "平台管理/编辑规格", businessType = BusinessType.PUT, isSaveRequestData = true)
     public Result<String> skuUpdate(@RequestBody GoodsDonSku sku) throws Exception {
@@ -219,6 +225,7 @@ public class CmsGoodsDonSkuController {
      * 删除 sku
      */
     @Transactional(rollbackFor = Throwable.class)
+    @SaCheckPermission("platform:delete")
     @DeleteMapping("/delete/{skuId}")
     @Log(module = "平台管理/删除规格", businessType = BusinessType.DELETE)
     public Result<String> skuDelete(@PathVariable Long skuId) {
@@ -234,6 +241,7 @@ public class CmsGoodsDonSkuController {
     /**
      * 新 生成排列组合规格
      */
+    @SaCheckPermission("platform:add")
     @PostMapping("/post/combination/{goodsId}")
     @Transactional(rollbackFor = Throwable.class)
     public Result<String> postCombinationSku(@PathVariable Long goodsId, @RequestBody List<CombinationSkuReq> combinations) throws Exception {
@@ -287,6 +295,7 @@ public class CmsGoodsDonSkuController {
     /**
      * 批量上架
      */
+    @SaCheckPermission("platform:updateStatus")
     @PutMapping("/batch/update/status/{goodsId}")
     public Result<String> batchUpdateStatus(@PathVariable Long goodsId, @RequestBody List<Long> skuIds) {
         GoodsDon goodsDon = goodsDonService.getById(goodsId);
@@ -309,6 +318,7 @@ public class CmsGoodsDonSkuController {
     /**
      * 规格排序
      */
+    @SaCheckPermission("platform:update")
     @PutMapping("/sorted")
     public Result<String> sorted(@RequestBody GoodsDonSku sku) {
         Long id = sku.getId();

netflix-web/src/main/java/com/cyksj/web/controller/manage/goods/CmsGoodsDonSpecController.java

@@ -1,5 +1,7 @@
 package com.cyksj.web.controller.manage.goods;
 
+import cn.dev33.satoken.annotation.SaCheckPermission;
+
 import com.baomidou.mybatisplus.core.toolkit.Wrappers;
 import com.cyksj.common.exception.BusinessRuntimeException;
 import com.cyksj.common.util.Jsons;
@@ -42,6 +44,7 @@ public class CmsGoodsDonSpecController {
 
     private final CmsGoodsDonService goodsDonService;
 
+    @SaCheckPermission("platform:add")
     @PostMapping("/post")
     public Result<String> specAppend(@RequestBody ReqGoodsSpecSingle specSingle) throws Exception {
 
@@ -88,6 +91,7 @@ public class CmsGoodsDonSpecController {
     /**
      * 删除 商品spec
      */
+    @SaCheckPermission("platform:delete")
     @DeleteMapping(value = "/delete")
     public Result<String> delete(Integer specId, Long goodsId) throws Exception {
         //TODO