chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/consultation.go

@@ -27,7 +27,7 @@ func RegisterConsultationRoutes(rg *gin.RouterGroup, db *gorm.DB) {
 // listConsultations 会诊单列表（status 过滤）
 func listConsultations(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		q := db.Model(&model.Consultation{})
+		q := applyRoomScope(db.Model(&model.Consultation{}), c, "room_id")
 		if status := c.Query("status"); status != "" {
 			q = q.Where("status = ?", status)
 		}
@@ -57,6 +57,9 @@ func fillConsultationRoomNames(db *gorm.DB, list []model.Consultation) {
 // getConsultation 会诊单详情
 func getConsultation(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if !requireObjectAccess(c, db, "consultation", c.Param("id")) {
+			return
+		}
 		var t model.Consultation
 		if db.Where("id = ?", c.Param("id")).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "consultation not found"})
@@ -87,6 +90,16 @@ func createConsultation(db *gorm.DB) gin.HandlerFunc {
 				return
 			}
 		}
+		if body.RoomID != nil && !canAccessRoom(db, c, body.RoomID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权为该蚕房发起会诊"})
+			return
+		}
+		if body.BatchID != nil && !requireObjectAccess(c, db, "batch", *body.BatchID) {
+			return
+		}
+		if body.LampTestID != nil && !requireObjectAccess(c, db, "lamp_test", *body.LampTestID) {
+			return
+		}
 
 		rec := model.Consultation{
 			RoomID:     body.RoomID,
@@ -167,6 +180,9 @@ func buildConsultationSnapshot(db *gorm.DB, roomID, batchID *string, lamp *model
 func updateConsultation(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "consultation", id) {
+			return
+		}
 		var t model.Consultation
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "consultation not found"})
@@ -177,6 +193,21 @@ func updateConsultation(db *gorm.DB) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
+		if roomID, ok := updates["room_id"].(string); ok && !canAccessRoom(db, c, &roomID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权迁移会诊到指定蚕房"})
+			return
+		}
+		for _, ref := range []struct {
+			key  string
+			kind string
+		}{
+			{key: "batch_id", kind: "batch"},
+			{key: "lamp_test_id", kind: "lamp_test"},
+		} {
+			if id, ok := updates[ref.key].(string); ok && !requireObjectAccess(c, db, ref.kind, id) {
+				return
+			}
+		}
 		if s, ok := updates["status"]; ok {
 			to, _ := s.(string)
 			if !model.ValidConsultationTransition(t.Status, to) {
@@ -206,6 +237,9 @@ func updateConsultation(db *gorm.DB) gin.HandlerFunc {
 func resolveConsultation(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "consultation", id) {
+			return
+		}
 		var t model.Consultation
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "consultation not found"})
@@ -271,6 +305,9 @@ func consultationStrPtr(value string) *string {
 func archiveConsultation(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "consultation", id) {
+			return
+		}
 		var t model.Consultation
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "consultation not found"})