chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/control.go

@@ -51,8 +51,8 @@ type ControlCommand struct {
 // RegisterControlRoutes 注册控制命令路由
 func RegisterControlRoutes(rg *gin.RouterGroup, db *gorm.DB) {
 	perm := middleware.RequirePermission(db, "device:control")
-	rg.POST("/control/send", perm, sendControl())
-	rg.POST("/control/batch", perm, batchControl())
+	rg.POST("/control/send", perm, sendControl(db))
+	rg.POST("/control/batch", perm, batchControl(db))
 	rg.POST("/devices/:id/gstmb1/command", perm, sendGSTMB1Command(db))
 	rg.POST("/devices/:id/gstmb1/info", perm, sendGSTMB1Info(db))
 	rg.POST("/devices/:id/gstmb1/restart", perm, sendGSTMB1Restart(db))
@@ -70,13 +70,16 @@ func RegisterControlRoutes(rg *gin.RouterGroup, db *gorm.DB) {
 }
 
 // sendControl 下发单条控制命令（通过 MQTT 发布到 devices/{deviceKey}/cmd 主题）
-func sendControl() gin.HandlerFunc {
+func sendControl(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		var cmd ControlCommand
 		if err := c.ShouldBindJSON(&cmd); err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
+		if !requireDeviceKeyAccess(c, db, cmd.DeviceKey) {
+			return
+		}
 		result, err := publishControl(cmd)
 		if err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
@@ -91,6 +94,9 @@ func sendControl() gin.HandlerFunc {
 // sendPlugOn 插座通电 {"type":"event","key":1}
 func sendPlugOn(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if !requireObjectAccess(c, db, "device", c.Param("id")) {
+			return
+		}
 		result, err := publishGSTMB1Command(db, c.Param("id"), map[string]interface{}{
 			"type": "event",
 			"key":  1,
@@ -106,6 +112,9 @@ func sendPlugOn(db *gorm.DB) gin.HandlerFunc {
 // sendPlugOff 插座断电 {"type":"event","key":0}
 func sendPlugOff(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if !requireObjectAccess(c, db, "device", c.Param("id")) {
+			return
+		}
 		result, err := publishGSTMB1Command(db, c.Param("id"), map[string]interface{}{
 			"type": "event",
 			"key":  0,
@@ -121,6 +130,9 @@ func sendPlugOff(db *gorm.DB) gin.HandlerFunc {
 // sendPlugStatistic 查询插座电量信息 {"type":"statistic"}
 func sendPlugStatistic(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if !requireObjectAccess(c, db, "device", c.Param("id")) {
+			return
+		}
 		result, err := publishGSTMB1Command(db, c.Param("id"), map[string]interface{}{
 			"type":      "statistic",
 			"messageId": fmt.Sprintf("%d", time.Now().UnixMilli()),
@@ -138,6 +150,9 @@ func sendPlugStatistic(db *gorm.DB) gin.HandlerFunc {
 // sendIRLearn 学习红外码 {"type":"infrared","action":"learn","data":{"no":N}}
 func sendIRLearn(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if !requireObjectAccess(c, db, "device", c.Param("id")) {
+			return
+		}
 		var body struct {
 			No int `json:"no"`
 		}
@@ -161,6 +176,9 @@ func sendIRLearn(db *gorm.DB) gin.HandlerFunc {
 // sendIREmit 发射红外码 {"type":"infrared","action":"emit","data":{"no":N}}
 func sendIREmit(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if !requireObjectAccess(c, db, "device", c.Param("id")) {
+			return
+		}
 		var body struct {
 			No int `json:"no"`
 		}
@@ -184,6 +202,9 @@ func sendIREmit(db *gorm.DB) gin.HandlerFunc {
 // sendIRCancel 取消学习 {"type":"infrared","action":"learnCancel"}
 func sendIRCancel(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if !requireObjectAccess(c, db, "device", c.Param("id")) {
+			return
+		}
 		result, err := publishGSTMB1Command(db, c.Param("id"), map[string]interface{}{
 			"type":   "infrared",
 			"action": "learnCancel",
@@ -199,6 +220,9 @@ func sendIRCancel(db *gorm.DB) gin.HandlerFunc {
 // sendIRErase 擦除全部红外码 {"type":"infrared","action":"erase"}
 func sendIRErase(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if !requireObjectAccess(c, db, "device", c.Param("id")) {
+			return
+		}
 		result, err := publishGSTMB1Command(db, c.Param("id"), map[string]interface{}{
 			"type":   "infrared",
 			"action": "erase",
@@ -214,6 +238,9 @@ func sendIRErase(db *gorm.DB) gin.HandlerFunc {
 // getIRStatus 查询红外操作结果
 func getIRStatus(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if !requireObjectAccess(c, db, "device", c.Param("id")) {
+			return
+		}
 		deviceKey, err := getDeviceKey(db, c.Param("id"))
 		if err != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
@@ -234,7 +261,7 @@ func getIRStatus(db *gorm.DB) gin.HandlerFunc {
 }
 
 // batchControl 批量下发控制命令
-func batchControl() gin.HandlerFunc {
+func batchControl(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		var body struct {
 			Commands []ControlCommand `json:"commands"`
@@ -246,6 +273,9 @@ func batchControl() gin.HandlerFunc {
 
 		results := make([]gin.H, 0, len(body.Commands))
 		for _, cmd := range body.Commands {
+			if !requireDeviceKeyAccess(c, db, cmd.DeviceKey) {
+				continue
+			}
 			result, err := publishControl(cmd)
 			if err != nil {
 				results = append(results, gin.H{"error": err.Error(), "deviceKey": cmd.DeviceKey})
@@ -328,6 +358,9 @@ func publishGSTMB1Command(db *gorm.DB, deviceID string, payload map[string]inter
 // sendGSTMB1Command 发送自定义 GSTMB1 命令（body 原样转发）
 func sendGSTMB1Command(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if !requireObjectAccess(c, db, "device", c.Param("id")) {
+			return
+		}
 		var body map[string]interface{}
 		if err := c.ShouldBindJSON(&body); err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
@@ -345,6 +378,9 @@ func sendGSTMB1Command(db *gorm.DB) gin.HandlerFunc {
 // sendGSTMB1Info 获取设备信息 {"type":"info"}
 func sendGSTMB1Info(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if !requireObjectAccess(c, db, "device", c.Param("id")) {
+			return
+		}
 		result, err := publishGSTMB1Command(db, c.Param("id"), map[string]interface{}{
 			"type":      "info",
 			"messageId": fmt.Sprintf("%d", time.Now().UnixMilli()),
@@ -360,6 +396,9 @@ func sendGSTMB1Info(db *gorm.DB) gin.HandlerFunc {
 // sendGSTMB1Restart 重启设备 {"type":"setting","system":"restart"}
 func sendGSTMB1Restart(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if !requireObjectAccess(c, db, "device", c.Param("id")) {
+			return
+		}
 		result, err := publishGSTMB1Command(db, c.Param("id"), map[string]interface{}{
 			"type":   "setting",
 			"system": "restart",
@@ -375,6 +414,9 @@ func sendGSTMB1Restart(db *gorm.DB) gin.HandlerFunc {
 // sendGSTMB1Interval 设置定时上报间隔 {"type":"setting","timerEnable":1,"timerInterval":N}
 func sendGSTMB1Interval(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if !requireObjectAccess(c, db, "device", c.Param("id")) {
+			return
+		}
 		var body struct {
 			Interval int `json:"interval"`
 		}