feat: /order 接口启用 HTTP Basic 认证 + VO/DTO 全面 Lombok 化

- OrderApi 全部 21 个接口增加 checkBasic（对齐原 hospitalmiddle Sa-Token SaBasicUtil.check），
  401 + WWW-Authenticate 质询，恒定时间比较防时序攻击；配置 order.basic（空=放行）
- app.yml 新增 order.basic / admin.token 配置位
- VO/DTO 改用 @Data/@NoArgsConstructor/@AllArgsConstructor，删除约 450 行手写样板
  （OrderVo/OrderV2Vo/OrderItemVo/UnitVo/ProcResult，业务方法 toPeInfoStr 等全部保留）

Co-Authored-By: Claude <noreply@anthropic.com>

src/main/java/com/hospital/front/api/order/OrderApi.java

@@ -1,6 +1,7 @@
 package com.hospital.front.api.order;
 
 import java.util.ArrayList;
+import java.util.Base64;
 import java.util.List;
 import java.util.Map;
 
@@ -10,7 +11,9 @@ import org.noear.solon.annotation.Inject;
 import org.noear.solon.annotation.Mapping;
 import org.noear.solon.annotation.Param;
 import org.noear.solon.annotation.Path;
+import org.noear.solon.core.handle.Context;
 import org.noear.solon.core.handle.MethodType;
+import org.noear.solon.Solon;
 import org.noear.snack.ONode;
 
 import com.hospital.front.dto.Result;
@@ -22,6 +25,10 @@ import com.hospital.front.service.OrderService;
  *
  * 路径与出参结构保持与原 hospitalmiddle 一致（调用方契约，不可修改）。
  * 根路径前缀为 /order，各方法 Mapping 为相对路径。
+ *
+ * 鉴权：对齐原程序 Sa-Token 的 SaBasicUtil.check()，对 /order/** 做 HTTP Basic 认证。
+ * 配置 order.basic（格式 "user:password"，未配置时放行——与原程序 authFlag=true 且
+ * basic 为空时行为一致，仅建议生产环境必配）。
  */
 @Controller
 @Mapping("/order")
@@ -30,11 +37,50 @@ public class OrderApi {
     @Inject
     private OrderService service;
 
+    // ================= 0. 鉴权 =================
+
+    /**
+     * 全接口 Basic 认证（等价原程序 SaServletFilter 对 /order/** 的 SaBasicUtil.check()）。
+     * 校验失败返回 401 并带 WWW-Authenticate 头（浏览器弹登录框、B 端感知未授权）。
+     */
+    private void checkBasic(Context ctx) {
+        String expected = Solon.cfg().get("order.basic", "");
+        if (expected == null || expected.trim().isEmpty()) {
+            return; // 未配置放行（兼容与调试；生产环境必须配置）
+        }
+
+        String auth = ctx.header("Authorization");
+        if (auth != null && auth.startsWith("Basic ")) {
+            try {
+                String decoded = new String(Base64.getDecoder().decode(auth.substring(6).trim()),
+                        java.nio.charset.StandardCharsets.UTF_8);
+                if (constantTimeEquals(expected, decoded)) {
+                    return; // 认证通过
+                }
+            } catch (IllegalArgumentException e) {
+                // base64 非法 → 按认证失败处理
+            }
+        }
+
+        // 认证失败：401 + 质询头（对齐 Sa-Token SaBasicUtil.check 的响应行为）
+        ctx.status(401);
+        ctx.headerSet("WWW-Authenticate", "Basic realm=\"hospital-front\"");
+        throw BusinessException.of(Result.CODE_AUTH_FAILED, "Basic 认证失败");
+    }
+
+    /** 恒定时间字符串比较（防时序攻击） */
+    private static boolean constantTimeEquals(String a, String b) {
+        return java.security.MessageDigest.isEqual(
+                a.getBytes(java.nio.charset.StandardCharsets.UTF_8),
+                b.getBytes(java.nio.charset.StandardCharsets.UTF_8));
+    }
+
     // ================= 1. 预约提交 / 取消 =================
 
     /** 4. 提交预约保存 */
     @Mapping(value = "/saveOrder", method = {MethodType.POST})
-    public Result<String> saveOrder(@Body String body) {
+    public Result<String> saveOrder(Context ctx, @Body String body) {
+        checkBasic(ctx);
         // Solon 对 Map 泛型 body 反序列化支持不佳，用 snack3 手动解析
         @SuppressWarnings("unchecked")
         Map<String, Object> map = (Map<String, Object>) ONode.load(body).toObject(Map.class);
@@ -44,9 +90,11 @@ public class OrderApi {
     /** 5. 取消体检预约 */
     @Mapping(value = "/cancelOrder/{peId}", method = {MethodType.POST})
     public Result<?> cancelOrder(
+            Context ctx,
             @Path("peId") String peId,
             @Param("name") String name,
             @Param("idcard") String idcard) {
+        checkBasic(ctx);
         service.cancelOrder(peId, name, idcard);
         return Result.success();
     }
@@ -55,13 +103,15 @@ public class OrderApi {
 
     /** 3. 体检状态查询（多个 peId 逗号分隔） */
     @Mapping("/getPeStatus/{peIds}")
-    public Result<List<Map<String, String>>> getPeStatus(@Path("peIds") String peIds) {
+    public Result<List<Map<String, String>>> getPeStatus(Context ctx, @Path("peIds") String peIds) {
+        checkBasic(ctx);
         return Result.success(service.getPhyexamStatus(peIds));
     }
 
     /** 13. 根据身份证号及年份获取当前体检状态及体检项状态 */
     @Mapping("/getPeStatusAndItemList/{idNo}/{year}")
-    public Result<Map<String, Object>> getPeStatusAndItemList(@Path("idNo") String idNo, @Path("year") String year) {
+    public Result<Map<String, Object>> getPeStatusAndItemList(Context ctx, @Path("idNo") String idNo, @Path("year") String year) {
+        checkBasic(ctx);
         return Result.success(service.getPeStatusByIdnoAndYear(idNo, year));
     }
 
@@ -69,31 +119,36 @@ public class OrderApi {
 
     /** 1. 查询员工体检项目 */
     @Mapping("/getEmpItem/{peId}")
-    public Result<List<Map<String, Object>>> getEmpItem(@Path("peId") String peId) {
+    public Result<List<Map<String, Object>>> getEmpItem(Context ctx, @Path("peId") String peId) {
+        checkBasic(ctx);
         return Result.success(service.getEmpItem(peId));
     }
 
     /** 2. 体检项目查询 */
     @Mapping("/getItemList")
-    public Result<List<Map<String, Object>>> getItemList() {
+    public Result<List<Map<String, Object>>> getItemList(Context ctx) {
+        checkBasic(ctx);
         return Result.success(service.getItemList());
     }
 
     /** 6. 体检指标项数据获取 */
     @Mapping("/getPeItemList")
-    public Result<List<Map<String, Object>>> getPeItemList() {
+    public Result<List<Map<String, Object>>> getPeItemList(Context ctx) {
+        checkBasic(ctx);
         return Result.success(service.getPeItemList());
     }
 
     /** 6.1 体检指标项及体检组合数据获取 */
     @Mapping("/getAllItemList")
-    public Result<List<Map<String, Object>>> getAllItemList() {
+    public Result<List<Map<String, Object>>> getAllItemList(Context ctx) {
+        checkBasic(ctx);
         return Result.success(service.getAllItemList());
     }
 
     /** 7. 根据体检指标项查询所属体检组合项 */
     @Mapping("/getItemInfo/{peItemCode}")
-    public Result<List<Map<String, Object>>> getItemInfo(@Path("peItemCode") String peItemCode) {
+    public Result<List<Map<String, Object>>> getItemInfo(Context ctx, @Path("peItemCode") String peItemCode) {
+        checkBasic(ctx);
         return Result.success(service.getItemInfo(peItemCode));
     }
 
@@ -101,31 +156,36 @@ public class OrderApi {
 
     /** 8. 根据体检编号获取员工体检结果 */
     @Mapping("/getResult/{peId}")
-    public Result<List<Map<String, Object>>> getResult(@Path("peId") String peId) {
+    public Result<List<Map<String, Object>>> getResult(Context ctx, @Path("peId") String peId) {
+        checkBasic(ctx);
         return Result.success(service.getResult(peId));
     }
 
     /** 9. 体检结论（汇总） */
     @Mapping("/getTotalConclusion/{peId}")
-    public Result<Map<String, String>> getTotalConclusion(@Path("peId") String peId) {
+    public Result<Map<String, String>> getTotalConclusion(Context ctx, @Path("peId") String peId) {
+        checkBasic(ctx);
         return Result.success(service.getTotalConclusion(peId));
     }
 
     /** 10. 体检建议（汇总） */
     @Mapping("/getTotalSuggest/{peId}")
-    public Result<Map<String, String>> getTotalSuggest(@Path("peId") String peId) {
+    public Result<Map<String, String>> getTotalSuggest(Context ctx, @Path("peId") String peId) {
+        checkBasic(ctx);
         return Result.success(service.getTotalSuggest(peId));
     }
 
     /** 11. 体检结论（列表） */
     @Mapping("/getConclusion/{peId}")
-    public Result<List<Map<String, Object>>> getConclusion(@Path("peId") String peId) {
+    public Result<List<Map<String, Object>>> getConclusion(Context ctx, @Path("peId") String peId) {
+        checkBasic(ctx);
         return Result.success(service.getConclusion(peId));
     }
 
     /** 12. 体检建议（列表） */
     @Mapping("/getSuggest/{peId}")
-    public Result<List<Map<String, Object>>> getSuggest(@Path("peId") String peId) {
+    public Result<List<Map<String, Object>>> getSuggest(Context ctx, @Path("peId") String peId) {
+        checkBasic(ctx);
         return Result.success(service.getSuggest(peId));
     }
 
@@ -133,40 +193,47 @@ public class OrderApi {
 
     /** 14. 根据身份证号及年份获取体检结果 */
     @Mapping("/getResultByIdcardAndYear/{idNo}/{year}")
-    public Result<List<Map<String, Object>>> getResultByIdcardAndYear(@Path("idNo") String idNo, @Path("year") String year) {
+    public Result<List<Map<String, Object>>> getResultByIdcardAndYear(Context ctx, @Path("idNo") String idNo, @Path("year") String year) {
+        checkBasic(ctx);
         return Result.success(service.getResultByIdcardAndYear(idNo, year));
     }
 
     /** 14.1 根据身份证号及年份获取体检结果（全量） */
     @Mapping("/getResultByIdcardAndYearAll/{idNo}/{year}")
-    public Result<List<Map<String, Object>>> getResultByIdcardAndYearAll(@Path("idNo") String idNo, @Path("year") String year) {
+    public Result<List<Map<String, Object>>> getResultByIdcardAndYearAll(Context ctx, @Path("idNo") String idNo, @Path("year") String year) {
+        checkBasic(ctx);
         return Result.success(service.getResultByIdcardAndYearAll(idNo, year));
     }
 
     /** 15.1 根据体检编号获取体检结果 */
     @Mapping("/getResultByPeId/{peId}")
-    public Result<List<Map<String, Object>>> getResultByPeId(@Path("peId") String peId) {
+    public Result<List<Map<String, Object>>> getResultByPeId(Context ctx, @Path("peId") String peId) {
+        checkBasic(ctx);
         return Result.success(service.getResultByPeId(peId));
     }
 
     /** 15.2 根据体检编号获取体检状态（简） */
     @Mapping("/getResultStatus/{peId}")
-    public Result<List<Map<String, Object>>> getResultStatus(@Path("peId") String peId) {
+    public Result<List<Map<String, Object>>> getResultStatus(Context ctx, @Path("peId") String peId) {
+        checkBasic(ctx);
         return Result.success(service.getResultByPeId(peId));
     }
 
     /** 15.3 根据 audit_date 查询当天的体检报告 */
     @Mapping("/getResultByAuditDate/{auditDate}")
-    public Result<List<Map<String, Object>>> getResultByAuditDate(@Path("auditDate") String auditDate) {
+    public Result<List<Map<String, Object>>> getResultByAuditDate(Context ctx, @Path("auditDate") String auditDate) {
+        checkBasic(ctx);
         return Result.success(service.getResultByAuditDate(auditDate));
     }
 
     /** 16. 根据 id_code 或 pe_id 和审查年份查询体检报告 */
     @Mapping(value = "/getResultByIdNoOrPeId", method = {MethodType.POST})
     public Result<List<Map<String, Object>>> getResultByIdNoOrPeId(
+            Context ctx,
             @Param(value = "idNo", required = false) String idNo,
             @Param(value = "peId", required = false) String peId,
             @Param("auditYear") String auditYear) {
+        checkBasic(ctx);
         if (isNullOrBlank(idNo) && isNullOrBlank(peId)) {
             throw BusinessException.paramMissing("身份证号或体检编号");
         }
@@ -175,13 +242,15 @@ public class OrderApi {
 
     /** 17. 根据身份证号查询当前年的 peId 和预约日期 */
     @Mapping("/getPeIdAndDateByIdcard/{idNo}")
-    public Result<Map<String, Object>> getPeIdAndDateByIdcard(@Path("idNo") String idNo) {
+    public Result<Map<String, Object>> getPeIdAndDateByIdcard(Context ctx, @Path("idNo") String idNo) {
+        checkBasic(ctx);
         return Result.success(service.getPeIdAndDateByIdcard(idNo));
     }
 
     /** 17.1 同上（数组） */
     @Mapping("/getPeIdAndDateByIdcardList/{idNo}")
-    public Result<List<Map<String, Object>>> getPeIdAndDateByIdcardList(@Path("idNo") String idNo) {
+    public Result<List<Map<String, Object>>> getPeIdAndDateByIdcardList(Context ctx, @Path("idNo") String idNo) {
+        checkBasic(ctx);
         return Result.success(service.getPeIdAndDateByIdcardList(idNo));
     }
 
@@ -189,7 +258,8 @@ public class OrderApi {
 
     /** 18. 添加修改单位信息 */
     @Mapping(value = "/addUnit", method = {MethodType.POST})
-    public Result<?> addUnit(@Body String body) {
+    public Result<?> addUnit(Context ctx, @Body String body) {
+        checkBasic(ctx);
         // Solon 对 List 泛型 body 反序列化支持不佳，此处用 snack3 手动解析
         List<Map<String, Object>> units;
         if (body == null || body.trim().isEmpty()) {
@@ -205,7 +275,8 @@ public class OrderApi {
 
     /** 19. 根据日期查询当天体检人员列表（去重），日期为空则查当天 */
     @Mapping("/getExamListByDate")
-    public Result<List<Map<String, Object>>> getExamListByDate(@Param("auditDate") String auditDate) {
+    public Result<List<Map<String, Object>>> getExamListByDate(Context ctx, @Param("auditDate") String auditDate) {
+        checkBasic(ctx);
         return Result.success(service.getExamListByDate(auditDate));
     }
 

src/main/java/com/hospital/front/dto/ProcResult.java

@@ -1,10 +1,17 @@
 package com.hospital.front.dto;
 
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
 /**
  * 医院存储过程执行结果。
  *
  * @author hospital-front重构
  */
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
 public class ProcResult {
 
     /** 医院侧返回码（"1" = 成功） */
@@ -16,56 +23,8 @@ public class ProcResult {
     /** 预约成功后医院分配的体检编号（仅 saveOrder 有值） */
     private String peId;
 
-    /**
-     * 无参构造器（各字段默认为 null，与 Kotlin 默认参数语义一致）。
-     */
-    public ProcResult() {
-    }
-
-    /**
-     * 全参构造器。
-     *
-     * @param resultCode 医院侧返回码（"1" = 成功）
-     * @param errorMsg   错误信息（失败时）
-     * @param peId       预约成功后医院分配的体检编号
-     */
-    public ProcResult(String resultCode, String errorMsg, String peId) {
-        this.resultCode = resultCode;
-        this.errorMsg = errorMsg;
-        this.peId = peId;
-    }
-
     /** 医院侧是否执行成功 */
     public boolean isSuccess() {
         return "1".equals(resultCode);
     }
-
-    public String getResultCode() {
-        return resultCode;
-    }
-
-    public void setResultCode(String resultCode) {
-        this.resultCode = resultCode;
-    }
-
-    public String getErrorMsg() {
-        return errorMsg;
-    }
-
-    public void setErrorMsg(String errorMsg) {
-        this.errorMsg = errorMsg;
-    }
-
-    public String getPeId() {
-        return peId;
-    }
-
-    public void setPeId(String peId) {
-        this.peId = peId;
-    }
-
-    @Override
-    public String toString() {
-        return "ProcResult(resultCode=" + resultCode + ", errorMsg=" + errorMsg + ", peId=" + peId + ")";
-    }
 }

src/main/java/com/hospital/front/dto/Result.java

@@ -111,9 +111,4 @@ public class Result<T> {
     public T getData() {
         return data;
     }
-
-    @Override
-    public String toString() {
-        return "Result(code=" + code + ", msg=" + msg + ", data=" + data + ")";
-    }
 }

src/main/java/com/hospital/front/vo/OrderItemVo.java

@@ -2,39 +2,22 @@ package com.hospital.front.vo;
 
 import java.util.List;
 
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
 /**
  * 预约订单体检项目条目。
  *
  * JSON 字段名与原 hospitalmiddle 的 OrderItemVo 保持一致（调用方契约，不可修改）。
  */
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
 public class OrderItemVo {
     private String itemNo;
     private String itemName;
 
-    public OrderItemVo() {
-    }
-
-    public OrderItemVo(String itemNo, String itemName) {
-        this.itemNo = itemNo;
-        this.itemName = itemName;
-    }
-
-    public String getItemNo() {
-        return itemNo;
-    }
-
-    public void setItemNo(String itemNo) {
-        this.itemNo = itemNo;
-    }
-
-    public String getItemName() {
-        return itemName;
-    }
-
-    public void setItemName(String itemName) {
-        this.itemName = itemName;
-    }
-
     /**
      * 拼接子表字符串：多项之间用 & 分隔，项内 编号|名称 分隔。
      */

src/main/java/com/hospital/front/vo/OrderV2Vo.java

@@ -1,10 +1,20 @@
 package com.hospital.front.vo;
 
+import java.util.List;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
 /**
  * V2 版预约订单 VO（hm.ver=V2 时使用）。
  *
  * 与 V1 的差异：工种拆为 编码+其它；危害因素拆为 编码+其它+接害时间。
+ * 字段顺序即存储过程 P_ADD_PE_REGIST 的 peInfoStr 竖线分隔顺序，不可调整。
  */
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
 public class OrderV2Vo {
     private String orderDate;          // 1 预约日期 yyyy-MM-dd
     private String secondDepartId;     // 2 所属单位编码
@@ -43,139 +53,7 @@ public class OrderV2Vo {
     private String harmReasonOther;    // 33b 其它危害因素（V2）
     private String harmDate;           // 33c 接害时间 yyyy-MM-dd（V2）
     private String defendCancer;       // 34 防癌项
-    private java.util.List<OrderItemVo> itemList;
+    private List<OrderItemVo> itemList;
-
-    /**
-     * 全参构造器（保持与 Kotlin data class 相同的字段顺序，供 OrderService 组装用）。
-     */
-    public OrderV2Vo(String orderDate, String secondDepartId, String secondDepartName, String thirdDepartName,
-                     String name, String sexName, String birthDay, Integer age, String idCard,
-                     String marrigeStatusName, String country, String nationName, String birthplace,
-                     String position, String profession, String feeType, String liveSpace, String zipCode,
-                     String mobile, String email, String empSysno, String medicalType, String medicalClass,
-                     String workShape, String workDate, String jobLevel, String workPlace, String baseSite,
-                     String workTypeCode, String workTypeOther, String education, String title,
-                     String oldDepartName, String harmReasonCode, String harmReasonOther, String harmDate,
-                     String defendCancer, java.util.List<OrderItemVo> itemList) {
-        this.orderDate = orderDate;
-        this.secondDepartId = secondDepartId;
-        this.secondDepartName = secondDepartName;
-        this.thirdDepartName = thirdDepartName;
-        this.name = name;
-        this.sexName = sexName;
-        this.birthDay = birthDay;
-        this.age = age;
-        this.idCard = idCard;
-        this.marrigeStatusName = marrigeStatusName;
-        this.country = country;
-        this.nationName = nationName;
-        this.birthplace = birthplace;
-        this.position = position;
-        this.profession = profession;
-        this.feeType = feeType;
-        this.liveSpace = liveSpace;
-        this.zipCode = zipCode;
-        this.mobile = mobile;
-        this.email = email;
-        this.empSysno = empSysno;
-        this.medicalType = medicalType;
-        this.medicalClass = medicalClass;
-        this.workShape = workShape;
-        this.workDate = workDate;
-        this.jobLevel = jobLevel;
-        this.workPlace = workPlace;
-        this.baseSite = baseSite;
-        this.workTypeCode = workTypeCode;
-        this.workTypeOther = workTypeOther;
-        this.education = education;
-        this.title = title;
-        this.oldDepartName = oldDepartName;
-        this.harmReasonCode = harmReasonCode;
-        this.harmReasonOther = harmReasonOther;
-        this.harmDate = harmDate;
-        this.defendCancer = defendCancer;
-        this.itemList = itemList;
-    }
-
-    public OrderV2Vo() {
-    }
-
-    public String getOrderDate() { return orderDate; }
-    public void setOrderDate(String v) { this.orderDate = v; }
-    public String getSecondDepartId() { return secondDepartId; }
-    public void setSecondDepartId(String v) { this.secondDepartId = v; }
-    public String getSecondDepartName() { return secondDepartName; }
-    public void setSecondDepartName(String v) { this.secondDepartName = v; }
-    public String getThirdDepartName() { return thirdDepartName; }
-    public void setThirdDepartName(String v) { this.thirdDepartName = v; }
-    public String getName() { return name; }
-    public void setName(String v) { this.name = v; }
-    public String getSexName() { return sexName; }
-    public void setSexName(String v) { this.sexName = v; }
-    public String getBirthDay() { return birthDay; }
-    public void setBirthDay(String v) { this.birthDay = v; }
-    public Integer getAge() { return age; }
-    public void setAge(Integer v) { this.age = v; }
-    public String getIdCard() { return idCard; }
-    public void setIdCard(String v) { this.idCard = v; }
-    public String getMarrigeStatusName() { return marrigeStatusName; }
-    public void setMarrigeStatusName(String v) { this.marrigeStatusName = v; }
-    public String getCountry() { return country; }
-    public void setCountry(String v) { this.country = v; }
-    public String getNationName() { return nationName; }
-    public void setNationName(String v) { this.nationName = v; }
-    public String getBirthplace() { return birthplace; }
-    public void setBirthplace(String v) { this.birthplace = v; }
-    public String getPosition() { return position; }
-    public void setPosition(String v) { this.position = v; }
-    public String getProfession() { return profession; }
-    public void setProfession(String v) { this.profession = v; }
-    public String getFeeType() { return feeType; }
-    public void setFeeType(String v) { this.feeType = v; }
-    public String getLiveSpace() { return liveSpace; }
-    public void setLiveSpace(String v) { this.liveSpace = v; }
-    public String getZipCode() { return zipCode; }
-    public void setZipCode(String v) { this.zipCode = v; }
-    public String getMobile() { return mobile; }
-    public void setMobile(String v) { this.mobile = v; }
-    public String getEmail() { return email; }
-    public void setEmail(String v) { this.email = v; }
-    public String getEmpSysno() { return empSysno; }
-    public void setEmpSysno(String v) { this.empSysno = v; }
-    public String getMedicalType() { return medicalType; }
-    public void setMedicalType(String v) { this.medicalType = v; }
-    public String getMedicalClass() { return medicalClass; }
-    public void setMedicalClass(String v) { this.medicalClass = v; }
-    public String getWorkShape() { return workShape; }
-    public void setWorkShape(String v) { this.workShape = v; }
-    public String getWorkDate() { return workDate; }
-    public void setWorkDate(String v) { this.workDate = v; }
-    public String getJobLevel() { return jobLevel; }
-    public void setJobLevel(String v) { this.jobLevel = v; }
-    public String getWorkPlace() { return workPlace; }
-    public void setWorkPlace(String v) { this.workPlace = v; }
-    public String getBaseSite() { return baseSite; }
-    public void setBaseSite(String v) { this.baseSite = v; }
-    public String getWorkTypeCode() { return workTypeCode; }
-    public void setWorkTypeCode(String v) { this.workTypeCode = v; }
-    public String getWorkTypeOther() { return workTypeOther; }
-    public void setWorkTypeOther(String v) { this.workTypeOther = v; }
-    public String getEducation() { return education; }
-    public void setEducation(String v) { this.education = v; }
-    public String getTitle() { return title; }
-    public void setTitle(String v) { this.title = v; }
-    public String getOldDepartName() { return oldDepartName; }
-    public void setOldDepartName(String v) { this.oldDepartName = v; }
-    public String getHarmReasonCode() { return harmReasonCode; }
-    public void setHarmReasonCode(String v) { this.harmReasonCode = v; }
-    public String getHarmReasonOther() { return harmReasonOther; }
-    public void setHarmReasonOther(String v) { this.harmReasonOther = v; }
-    public String getHarmDate() { return harmDate; }
-    public void setHarmDate(String v) { this.harmDate = v; }
-    public String getDefendCancer() { return defendCancer; }
-    public void setDefendCancer(String v) { this.defendCancer = v; }
-    public java.util.List<OrderItemVo> getItemList() { return itemList; }
-    public void setItemList(java.util.List<OrderItemVo> v) { this.itemList = v; }
 
     /**
      * 按存储过程约定顺序拼接主表字符串（竖线分隔，空值为空串）。

src/main/java/com/hospital/front/vo/OrderVo.java

@@ -1,11 +1,16 @@
 package com.hospital.front.vo;
 
+import java.util.List;
+
+import lombok.Data;
+
 /**
  * V1 版预约订单 VO（hm.ver=V1 时使用）。
  *
  * 字段名与字段顺序均与原 hospitalmiddle 的 OrderVo（Java）保持一致，
  * 字段顺序即存储过程 P_ADD_PE_REGIST 的 peInfoStr 竖线分隔顺序，不可调整。
  */
+@Data
 public class OrderVo {
     private String orderDate;          // 1 预约日期 yyyy-MM-dd
     private String secondDepartId;     // 2 所属单位编码
@@ -41,78 +46,7 @@ public class OrderVo {
     private String oldDepartName;      // 32 原单位
     private String harmReason;         // 33 危害因素（V1 单字段）
     private String defendCancer;       // 34 防癌项
-    private java.util.List<OrderItemVo> itemList;
+    private List<OrderItemVo> itemList;
-
-    public String getOrderDate() { return orderDate; }
-    public void setOrderDate(String v) { this.orderDate = v; }
-    public String getSecondDepartId() { return secondDepartId; }
-    public void setSecondDepartId(String v) { this.secondDepartId = v; }
-    public String getSecondDepartName() { return secondDepartName; }
-    public void setSecondDepartName(String v) { this.secondDepartName = v; }
-    public String getThirdDepartName() { return thirdDepartName; }
-    public void setThirdDepartName(String v) { this.thirdDepartName = v; }
-    public String getName() { return name; }
-    public void setName(String v) { this.name = v; }
-    public String getSexName() { return sexName; }
-    public void setSexName(String v) { this.sexName = v; }
-    public String getBirthDay() { return birthDay; }
-    public void setBirthDay(String v) { this.birthDay = v; }
-    public Integer getAge() { return age; }
-    public void setAge(Integer v) { this.age = v; }
-    public String getIdCard() { return idCard; }
-    public void setIdCard(String v) { this.idCard = v; }
-    public String getMarrigeStatusName() { return marrigeStatusName; }
-    public void setMarrigeStatusName(String v) { this.marrigeStatusName = v; }
-    public String getCountry() { return country; }
-    public void setCountry(String v) { this.country = v; }
-    public String getNationName() { return nationName; }
-    public void setNationName(String v) { this.nationName = v; }
-    public String getBirthplace() { return birthplace; }
-    public void setBirthplace(String v) { this.birthplace = v; }
-    public String getPosition() { return position; }
-    public void setPosition(String v) { this.position = v; }
-    public String getProfession() { return profession; }
-    public void setProfession(String v) { this.profession = v; }
-    public String getFeeType() { return feeType; }
-    public void setFeeType(String v) { this.feeType = v; }
-    public String getLiveSpace() { return liveSpace; }
-    public void setLiveSpace(String v) { this.liveSpace = v; }
-    public String getZipCode() { return zipCode; }
-    public void setZipCode(String v) { this.zipCode = v; }
-    public String getMobile() { return mobile; }
-    public void setMobile(String v) { this.mobile = v; }
-    public String getEmail() { return email; }
-    public void setEmail(String v) { this.email = v; }
-    public String getEmpSysno() { return empSysno; }
-    public void setEmpSysno(String v) { this.empSysno = v; }
-    public String getMedicalType() { return medicalType; }
-    public void setMedicalType(String v) { this.medicalType = v; }
-    public String getMedicalClass() { return medicalClass; }
-    public void setMedicalClass(String v) { this.medicalClass = v; }
-    public String getWorkShape() { return workShape; }
-    public void setWorkShape(String v) { this.workShape = v; }
-    public String getWorkDate() { return workDate; }
-    public void setWorkDate(String v) { this.workDate = v; }
-    public String getJobLevel() { return jobLevel; }
-    public void setJobLevel(String v) { this.jobLevel = v; }
-    public String getWorkPlace() { return workPlace; }
-    public void setWorkPlace(String v) { this.workPlace = v; }
-    public String getBaseSite() { return baseSite; }
-    public void setBaseSite(String v) { this.baseSite = v; }
-    public String getWorkType() { return workType; }
-    public void setWorkType(String v) { this.workType = v; }
-    public String getEducation() { return education; }
-    public void setEducation(String v) { this.education = v; }
-    public String getTitle() { return title; }
-    public void setTitle(String v) { this.title = v; }
-    public String getOldDepartName() { return oldDepartName; }
-    public void setOldDepartName(String v) { this.oldDepartName = v; }
-    public String getHarmReason() { return harmReason; }
-    public void setHarmReason(String v) { this.harmReason = v; }
-    public String getDefendCancer() { return defendCancer; }
-    public void setDefendCancer(String v) { this.defendCancer = v; }
-    public java.util.List<OrderItemVo> getItemList() { return itemList; }
-    public void setItemList(java.util.List<OrderItemVo> v) { this.itemList = v; }
 
     /**
      * 按存储过程约定顺序拼接主表字符串（竖线分隔，空值为空串）。

src/main/java/com/hospital/front/vo/UnitVo.java

@@ -1,8 +1,15 @@
 package com.hospital.front.vo;
 
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
 /**
  * 单位信息 VO（addUnit 接口入参，字段名与原 UnitVo 一致）。
  */
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
 public class UnitVo {
     private String unitCode;        // 单位编码
     private String unitName;        // 单位名称
@@ -12,39 +19,4 @@ public class UnitVo {
     private String phone1;          // 电话1（V2）
     private String connecter2;      // 联系人2（V2）
     private String phone2;          // 电话2（V2）
-
-    /**
-     * 全参构造器（保持与 Kotlin data class 相同的字段顺序，供 OrderService 组装用）。
-     */
-    public UnitVo(String unitCode, String unitName, String parentUnitCode, String address,
-                  String connecter1, String phone1, String connecter2, String phone2) {
-        this.unitCode = unitCode;
-        this.unitName = unitName;
-        this.parentUnitCode = parentUnitCode;
-        this.address = address;
-        this.connecter1 = connecter1;
-        this.phone1 = phone1;
-        this.connecter2 = connecter2;
-        this.phone2 = phone2;
-    }
-
-    public UnitVo() {
-    }
-
-    public String getUnitCode() { return unitCode; }
-    public void setUnitCode(String v) { this.unitCode = v; }
-    public String getUnitName() { return unitName; }
-    public void setUnitName(String v) { this.unitName = v; }
-    public String getParentUnitCode() { return parentUnitCode; }
-    public void setParentUnitCode(String v) { this.parentUnitCode = v; }
-    public String getAddress() { return address; }
-    public void setAddress(String v) { this.address = v; }
-    public String getConnecter1() { return connecter1; }
-    public void setConnecter1(String v) { this.connecter1 = v; }
-    public String getPhone1() { return phone1; }
-    public void setPhone1(String v) { this.phone1 = v; }
-    public String getConnecter2() { return connecter2; }
-    public void setConnecter2(String v) { this.connecter2 = v; }
-    public String getPhone2() { return phone2; }
-    public void setPhone2(String v) { this.phone2 = v; }
 }

src/main/resources/app.yml

@@ -31,6 +31,18 @@ hm:
   allsecondFlag: false        # 宁夏医院强制发送二级单位编码和名称
   occFlag: false             # 健康体检不发送职业相关信息
 
+# ====================================
+# 接口鉴权
+# ====================================
+# /order/** 的 HTTP Basic 认证（对齐原 hospitalmiddle Sa-Token basic），
+# 格式 "user:password"，未配置时放行；生产环境必须配置
+# order.basic: "hmapiuser:xxxx"
+order:
+  basic: ""
+# /api/admin/** 的管理 Token（Agent 环回调用携带 X-Admin-Token 头），未配置时放行
+admin:
+  token: ""
+
 # ====================================
 # MyBatis-Plus 公共配置（db1 为唯一数据源，随医院配置注入）
 # mappers 条目两种形式（Solon mybatis 约定）：