chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/device.go

@@ -23,7 +23,7 @@ func RegisterDeviceRoutes(rg *gin.RouterGroup, db *gorm.DB) {
 func listDevices(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		var devices []model.Device
-		query := db.Order("created_at DESC")
+		query := applyRoomScope(db.Model(&model.Device{}), c, "room_id").Order("created_at DESC")
 		if kind := c.Query("kind"); kind != "" {
 			query = query.Where("kind = ?", kind)
 		}
@@ -36,6 +36,9 @@ func listDevices(db *gorm.DB) gin.HandlerFunc {
 func getDevice(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "device", id) {
+			return
+		}
 		var device model.Device
 		if db.Where("id = ?", id).First(&device).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "device not found"})
@@ -64,6 +67,10 @@ func createDevice(db *gorm.DB) gin.HandlerFunc {
 			return
 		}
 		device.ID = "" // 让数据库自动生成
+		if !canAccessRoom(db, c, &device.RoomID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权在该蚕房下新建设备"})
+			return
+		}
 		if err := db.Create(&device).Error; err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "创建失败"})
 			return
@@ -76,6 +83,9 @@ func createDevice(db *gorm.DB) gin.HandlerFunc {
 func updateDevice(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "device", id) {
+			return
+		}
 		var device model.Device
 		if db.Where("id = ?", id).First(&device).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "device not found"})
@@ -86,6 +96,10 @@ func updateDevice(db *gorm.DB) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
+		if roomID, ok := updates["room_id"].(string); ok && !canAccessRoom(db, c, &roomID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权迁移设备到指定蚕房"})
+			return
+		}
 		if len(updates) > 0 {
 			db.Model(&model.Device{}).Where("id = ?", id).Updates(updates)
 		}
@@ -98,6 +112,9 @@ func updateDevice(db *gorm.DB) gin.HandlerFunc {
 func deleteDevice(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "device", id) {
+			return
+		}
 		var device model.Device
 		if db.Where("id = ?", id).First(&device).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "device not found"})