chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/alarm.go

@@ -23,9 +23,12 @@ func RegisterAlarmRoutes(rg *gin.RouterGroup, db *gorm.DB) {
 func listAlarms(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		limit := 500
-		q := db.Model(&model.Alarm{}).Order("triggered_at DESC").Limit(limit)
+		q := db.Model(&model.Alarm{}).
+			Joins("LEFT JOIN devices d ON d.device_key = alarms.device_key").
+			Order("alarms.triggered_at DESC").Limit(limit)
+		q = applyRoomScope(q, c, "d.room_id")
 		if c.Query("openOnly") == "true" {
-			q = q.Where("open = true")
+			q = q.Where("alarms.open = true")
 		}
 		var alarms []model.Alarm
 		q.Find(&alarms)
@@ -37,6 +40,9 @@ func listAlarms(db *gorm.DB) gin.HandlerFunc {
 func getAlarm(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "alarm", id) {
+			return
+		}
 		var alarm model.Alarm
 		if db.Where("id = ?", id).First(&alarm).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "alarm not found"})
@@ -50,6 +56,9 @@ func getAlarm(db *gorm.DB) gin.HandlerFunc {
 func ackAlarm(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "alarm", id) {
+			return
+		}
 		var alarm model.Alarm
 		if db.Where("id = ?", id).First(&alarm).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "alarm not found"})
@@ -69,6 +78,9 @@ func ackAlarm(db *gorm.DB) gin.HandlerFunc {
 func resolveAlarm(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "alarm", id) {
+			return
+		}
 		var alarm model.Alarm
 		if db.Where("id = ?", id).First(&alarm).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "alarm not found"})