fix(server-go): 巡检 roomId UUID 校验（400）；文档更新

server-go/internal/handler/inspection.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"io"
 	"net/http"
+	"regexp"
 	"strconv"
 	"strings"
 
@@ -16,6 +17,13 @@ import (
 	"gorm.io/gorm"
 )
 
+var uuidPattern = regexp.MustCompile(`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`)
+
+// isUUID 判断字符串是否为标准 UUID 格式（roomId 等外键校验用）
+func isUUID(s string) bool {
+	return uuidPattern.MatchString(s)
+}
+
 // RegisterInspectionRoutes 注册 AI 巡检路由
 func RegisterInspectionRoutes(rg *gin.RouterGroup, db *gorm.DB, s3 *service.S3Service, ai *service.AIClient, imageBucket string) {
 	rg.POST("/inspections", middleware.RequirePermission(db, "inspection:create"), createInspection(db, s3, ai, imageBucket))
@@ -88,6 +96,10 @@ func createInspection(db *gorm.DB, s3 *service.S3Service, ai *service.AIClient,
 			AIStatus: "done",
 		}
 		if roomID != "" {
+			if !isUUID(roomID) {
+				c.JSON(http.StatusBadRequest, gin.H{"error": "roomId 不是合法的 UUID"})
+				return
+			}
 			rec.RoomID = &roomID
 		}
 		if idemKey != "" {

server-go/internal/handler/inspection_test.go

@@ -0,0 +1,21 @@
+package handler
+
+import "testing"
+
+func TestIsUUID(t *testing.T) {
+	valid := []string{
+		"1271e550-ccf1-443e-8964-980c6047e2f0",
+		"00000000-0000-0000-0000-000000000000",
+	}
+	invalid := []string{"smoke-room", "", "not-a-uuid", "1271e550ccf1443e8964980c6047e2f0"}
+	for _, s := range valid {
+		if !isUUID(s) {
+			t.Errorf("%q 应为合法 UUID", s)
+		}
+	}
+	for _, s := range invalid {
+		if isUUID(s) {
+			t.Errorf("%q 不应被当作 UUID", s)
+		}
+	}
+}