测试审计：补充破坏性安全测试用例与管理员生命周期审计报告

RuoYi-Vue/ruoyi-admin/src/test/java/com/ruoyi/web/controller/train/PreCustomerStabilizationFinalFixesContractTest.java

@@ -230,4 +230,67 @@ public class PreCustomerStabilizationFinalFixesContractTest
             assertTrue(e.getMessage().contains("产生外部审计流水"));
         }
     }
+
+    /**
+     * 4. 验证管理员破坏性操作各 Controller 端点与 @PreAuthorize 权限注解严格对齐契约
+     */
+    @Test
+    public void testAdminDestructiveActionEndpointsAndPermissionsContract() throws Exception
+    {
+        // 课程删除
+        Method courseRemove = TrainCourseController.class.getMethod("remove", String[].class);
+        assertNotNull(courseRemove);
+        PreAuthorize coursePre = courseRemove.getAnnotation(PreAuthorize.class);
+        assertNotNull(coursePre);
+        assertEquals("@ss.hasPermi('train:course:remove')", coursePre.value());
+
+        // 教室删除
+        Method classroomRemove = TrainClassroomInfoController.class.getMethod("remove", String[].class);
+        assertNotNull(classroomRemove);
+        PreAuthorize classroomPre = classroomRemove.getAnnotation(PreAuthorize.class);
+        assertNotNull(classroomPre);
+        assertEquals("@ss.hasPermi('train:classroom:remove')", classroomPre.value());
+
+        // 住宿删除
+        Method accRemove = TrainAccommodationController.class.getMethod("remove", Long[].class);
+        assertNotNull(accRemove);
+        PreAuthorize accPre = accRemove.getAnnotation(PreAuthorize.class);
+        assertNotNull(accPre);
+        assertEquals("@ss.hasPermi('train:accommodation:remove')", accPre.value());
+
+        // 门禁撤销
+        Method authRevoke = TrainDormAuthController.class.getMethod("revoke", Long.class);
+        assertNotNull(authRevoke);
+        PreAuthorize authRevokePre = authRevoke.getAnnotation(PreAuthorize.class);
+        assertNotNull(authRevokePre);
+        assertEquals("@ss.hasPermi('system:auth:edit')", authRevokePre.value());
+
+        // 成绩删除
+        Method scoreRemove = TrainScoreInfoController.class.getMethod("remove", Long[].class);
+        assertNotNull(scoreRemove);
+        PreAuthorize scorePre = scoreRemove.getAnnotation(PreAuthorize.class);
+        assertNotNull(scorePre);
+        assertEquals("@ss.hasPermi('system:info:remove')", scorePre.value());
+
+        // 课次删除
+        Method lessonRemove = TrainLessonController.class.getMethod("removeLesson", Long.class);
+        assertNotNull(lessonRemove);
+        PreAuthorize lessonPre = lessonRemove.getAnnotation(PreAuthorize.class);
+        assertNotNull(lessonPre);
+        assertEquals("@ss.hasPermi('train:lesson:remove')", lessonPre.value());
+
+        // 计划课程移除
+        Method planCourseRemove = TrainPlanCourseController.class.getMethod("remove", String.class, Long.class);
+        assertNotNull(planCourseRemove);
+        PreAuthorize planCoursePre = planCourseRemove.getAnnotation(PreAuthorize.class);
+        assertNotNull(planCoursePre);
+        assertEquals("@ss.hasPermi('train:plan:edit')", planCoursePre.value());
+
+        // 参训记录移除
+        Method enrollmentRemove = TrainEnrollmentController.class.getMethod("removeEnrollment", Long.class);
+        assertNotNull(enrollmentRemove);
+        PreAuthorize enrollmentPre = enrollmentRemove.getAnnotation(PreAuthorize.class);
+        assertNotNull(enrollmentPre);
+        assertEquals("@ss.hasPermi('train:enrollment:remove')", enrollmentPre.value());
+    }
 }