chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/health.go

@@ -33,6 +33,10 @@ func RegisterHealthProfileRoutes(rg *gin.RouterGroup, db *gorm.DB) {
 func roomHealthProfile(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("roomId")
+		if !canAccessRoom(db, c, &id) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权访问该蚕房"})
+			return
+		}
 		var room model.Room
 		if db.Where("id = ?", id).First(&room).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "room not found"})
@@ -107,6 +111,10 @@ func roomHealthProfile(db *gorm.DB) gin.HandlerFunc {
 func roomEffectReport(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		roomID := c.Param("roomId")
+		if !canAccessRoom(db, c, &roomID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权访问该蚕房"})
+			return
+		}
 		now := time.Now()
 		parse := func(key string, fallback time.Time) time.Time {
 			raw := c.Query(key)