chore: release server-v1.0.72

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx

backend/internal/handler/stock_in_test.go

@@ -182,6 +182,47 @@ func TestStockInHandler_Reject(t *testing.T) {
 	assert.Equal(t, "rejected", detailData["status"])
 }
 
+func TestStockInHandler_Withdraw(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "SI006")
+	admin := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+	operator := testutil.CreateTestUser(db, shop.ID, "op", "pass", "operator")
+	warehouse := testutil.CreateTestWarehouse(db, shop.ID, "Warehouse")
+	product := testutil.CreateTestProduct(db, shop.ID, "Tequila")
+	adminToken := getAuthToken(admin.ID, shop.ID, "admin")
+	opToken := getAuthToken(operator.ID, shop.ID, "operator")
+	r := setupProtectedRouter(db)
+
+	// 创建并提交（进入 pending）
+	w := makeRequest(r, "POST", "/api/v1/stock-in/orders", adminToken, map[string]interface{}{
+		"warehouse_id": warehouse.ID,
+		"order_date":   time.Now().Format(time.RFC3339),
+		"items": []map[string]interface{}{
+			{"product_id": product.ID, "quantity": 5.0},
+		},
+	})
+	orderID := extractID(w)
+	makeRequest(r, "PUT", fmt.Sprintf("/api/v1/stock-in/orders/%d/submit", orderID), adminToken, nil)
+
+	// 1. 非管理员撤回 → 403
+	w = makeRequest(r, "PUT", fmt.Sprintf("/api/v1/stock-in/orders/%d/withdraw", orderID), opToken, nil)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+
+	// 2. 管理员撤回 → 200，状态回到 draft
+	w = makeRequest(r, "PUT", fmt.Sprintf("/api/v1/stock-in/orders/%d/withdraw", orderID), adminToken, nil)
+	assert.Equal(t, http.StatusOK, w.Code)
+	w = makeRequest(r, "GET", fmt.Sprintf("/api/v1/stock-in/orders/%d", orderID), adminToken, nil)
+	assert.Equal(t, "draft", parseResponse(w)["data"].(map[string]interface{})["status"])
+
+	// 3. 撤回后已是 draft，再撤回 → 400（仅 pending 可撤回）
+	w = makeRequest(r, "PUT", fmt.Sprintf("/api/v1/stock-in/orders/%d/withdraw", orderID), adminToken, nil)
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+
+	// 4. 撤回为 draft 后可再次修改并提交
+	w = makeRequest(r, "PUT", fmt.Sprintf("/api/v1/stock-in/orders/%d/submit", orderID), adminToken, nil)
+	assert.Equal(t, http.StatusOK, w.Code)
+}
+
 func TestStockInHandler_GetNotFound(t *testing.T) {
 	db := testutil.SetupTestDB()
 	shop := testutil.CreateTestShop(db, "SI006")