fix: 付款特批附件前端查看下载放行并支持pdf内嵌预览

附件下载接口加入 nacos skip-url 与 auth permitAll（前端新窗口打开无令牌，fdId 32位随机不可枚举）；下载接口支持 inline=true 内嵌预览（pdf 在线打开，Content-Type application/pdf），默认仍为 attachment 下载；特批附件展示行 url 改网关服务名前缀 /blade-transport 全路径并携带 name=付款特批附件.pdf 与 inline=true

blade-service/blade-transport/src/main/java/org/springblade/transport/controller/HcsSyncController.java

@@ -261,13 +261,17 @@ public class HcsSyncController {
 	 */
 	@GetMapping("/attachment/download")
 	@ApiOperationSupport(order = 12)
-	@Operation(summary = "合规附件下载", description = "C103-5 代理：按合规附件ID 下载文件流，name 参数可选用于指定下载文件名")
+	@Operation(summary = "合规附件下载", description = "C103-5 代理：按合规附件ID 下载文件流，name 参数可选用于指定下载文件名，inline=true 时内嵌预览（pdf 浏览器直接打开）")
 	public void downloadAttachment(@Parameter(description = "合规附件ID", required = true) @RequestParam String fdId,
 								   @Parameter(description = "下载文件名（可选）") @RequestParam(required = false) String name,
+								   @Parameter(description = "内嵌预览（可选，pdf 在线查看）") @RequestParam(required = false) Boolean inline,
 								   HttpServletResponse response) throws Exception {
 		String fileName = StringUtil.isBlank(name) ? "hcs-attachment-" + fdId : name;
-		response.setContentType(MediaType.APPLICATION_OCTET_STREAM_VALUE);
+		// 内嵌预览：inline + 真实类型浏览器直接打开（pdf 在线查看），默认 attachment 走下载
-		response.setHeader("Content-Disposition", "attachment; filename*=UTF-8''" + URLEncoder.encode(fileName, StandardCharsets.UTF_8).replace("+", "%20"));
+		boolean preview = Boolean.TRUE.equals(inline) && fileName.toLowerCase().endsWith(".pdf");
+		response.setContentType(preview ? "application/pdf" : MediaType.APPLICATION_OCTET_STREAM_VALUE);
+		response.setHeader("Content-Disposition", (preview ? "inline" : "attachment") + "; filename*=UTF-8''"
+			+ URLEncoder.encode(fileName, StandardCharsets.UTF_8).replace("+", "%20"));
 		try (Response hcsResponse = hcsAttachmentSupport.downloadRaw(fdId);
 			 InputStream inputStream = hcsResponse.body().asInputStream();
 			 OutputStream outputStream = response.getOutputStream()) {

blade-service/blade-transport/src/main/java/org/springblade/transport/service/impl/PaymentApplicationServiceImpl.java

@@ -606,10 +606,11 @@ public class PaymentApplicationServiceImpl extends BaseServiceImpl<PaymentApplic
 			rows.removeIf(row -> row instanceof Map<?, ?> map
 				&& HcsSyncConstant.PAYMENT_ATTACH_TYPE_SPEC_RESULT.equals(map.get("attachmentType")));
 			Map<String, Object> specRow = new LinkedHashMap<>();
-			specRow.put("name", "付款特批附件");
+			specRow.put("name", "付款特批附件.pdf");
 			specRow.put("attachmentType", HcsSyncConstant.PAYMENT_ATTACH_TYPE_SPEC_RESULT);
-			specRow.put("url", "/hcs/attachment/download?fdId=" + vo.getHcsSpecAttachFdId()
+			// 网关按服务名前缀路由（口径同 nacos skip-url）；inline 内嵌预览 pdf，浏览器可直接查看/另存
-				+ "&name=" + URLEncoder.encode("付款特批附件", StandardCharsets.UTF_8));
+			specRow.put("url", "/blade-transport/hcs/attachment/download?fdId=" + vo.getHcsSpecAttachFdId()
+				+ "&inline=true&name=" + URLEncoder.encode("付款特批附件.pdf", StandardCharsets.UTF_8));
 			rows.add(specRow);
 			vo.setAttachmentsJson(JsonUtil.toJson(rows));
 		} catch (Exception exception) {

doc/nacos/blade.yaml

@@ -246,6 +246,9 @@ blade:
       - /hcs/projectLegal/result
       - /blade-transport/hcs/contractKingdee/result
       - /hcs/contractKingdee/result
+      # HCS 合规附件下载（C103-5 代理）：前端附件面板凭合规附件ID 查看/下载，fdId 32位随机不可枚举，免登免授权
+      - /blade-transport/hcs/attachment/download
+      - /hcs/attachment/download
     #授权认证配置
     auth:
       - method: ALL
@@ -298,6 +301,13 @@ blade:
       - method: POST
         pattern: /hcs/contractKingdee/result
         expression: "permitAll()"
+      # HCS 合规附件下载（C103-5 代理）：前端附件面板凭合规附件ID 查看/下载，fdId 32位随机不可枚举，免登免授权
+      - method: GET
+        pattern: /blade-transport/hcs/attachment/download
+        expression: "permitAll()"
+      - method: GET
+        pattern: /hcs/attachment/download
+        expression: "permitAll()"
     #基础认证配置
     basic:
       - method: ALL