chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/lamp.go

@@ -40,7 +40,7 @@ func RegisterLampRoutes(rg *gin.RouterGroup, db *gorm.DB, s3 *service.S3Service,
 // listLampTests 检测任务单列表（roomId/batchId/status 过滤）
 func listLampTests(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		q := db.Model(&model.LampTest{})
+		q := applyRoomScope(db.Model(&model.LampTest{}), c, "room_id")
 		if room := c.Query("roomId"); room != "" {
 			q = q.Where("room_id = ?", room)
 		}
@@ -76,14 +76,24 @@ func createLampTest(db *gorm.DB) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "roomId 不是合法的 UUID"})
 			return
 		}
+		if t.RoomID != nil && !canAccessRoom(db, c, t.RoomID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权在该蚕房下创建检测任务"})
+			return
+		}
 		if t.BatchID != nil && !isUUID(*t.BatchID) {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "batchId 不是合法的 UUID"})
 			return
 		}
+		if t.BatchID != nil && !requireObjectAccess(c, db, "batch", *t.BatchID) {
+			return
+		}
 		if t.DetectionTaskID != nil && !isUUID(*t.DetectionTaskID) {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "detectionTaskId 不是合法的 UUID"})
 			return
 		}
+		if t.DetectionTaskID != nil && !requireObjectAccess(c, db, "detection_task", *t.DetectionTaskID) {
+			return
+		}
 		if t.Status == "" {
 			t.Status = "pending"
 		}
@@ -107,6 +117,9 @@ func createLampTest(db *gorm.DB) gin.HandlerFunc {
 func judgeQPCR(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "lamp_test", id) {
+			return
+		}
 		var t model.LampTest
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "lamp test not found"})
@@ -144,6 +157,9 @@ func judgeQPCR(db *gorm.DB) gin.HandlerFunc {
 func uploadLampSpectrum(db *gorm.DB, s3 *service.S3Service, bucket string) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "lamp_test", id) {
+			return
+		}
 		var t model.LampTest
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "lamp test not found"})
@@ -286,6 +302,9 @@ func deleteSpectrumEntry(db *gorm.DB) gin.HandlerFunc {
 func updateLampTest(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "lamp_test", id) {
+			return
+		}
 		var t model.LampTest
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "lamp test not found"})
@@ -296,6 +315,21 @@ func updateLampTest(db *gorm.DB) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
+		if roomID, ok := updates["room_id"].(string); ok && !canAccessRoom(db, c, &roomID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权迁移检测任务到指定蚕房"})
+			return
+		}
+		for _, ref := range []struct {
+			key  string
+			kind string
+		}{
+			{key: "batch_id", kind: "batch"},
+			{key: "detection_task_id", kind: "detection_task"},
+		} {
+			if id, ok := updates[ref.key].(string); ok && !requireObjectAccess(c, db, ref.kind, id) {
+				return
+			}
+		}
 		resultSet := false
 		resultValue := ""
 		if r, ok := updates["result"]; ok {
@@ -429,6 +463,9 @@ func runCrossValidation(db *gorm.DB, lampTestID, lampResult string) error {
 func getLampCrossValidation(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "lamp_test", id) {
+			return
+		}
 		var t model.LampTest
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "lamp test not found"})
@@ -463,6 +500,9 @@ func getLampCrossValidation(db *gorm.DB) gin.HandlerFunc {
 func deleteLampTest(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "lamp_test", id) {
+			return
+		}
 		var t model.LampTest
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "lamp test not found"})
@@ -478,6 +518,9 @@ func deleteLampTest(db *gorm.DB) gin.HandlerFunc {
 func listLampTestSteps(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "lamp_test", id) {
+			return
+		}
 		var t model.LampTest
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "lamp test not found"})
@@ -493,6 +536,9 @@ func listLampTestSteps(db *gorm.DB) gin.HandlerFunc {
 func updateLampTestStep(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "lamp_test", id) {
+			return
+		}
 		stepNo, err := strconv.Atoi(c.Param("stepNo"))
 		if err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "stepNo 不合法"})
@@ -538,6 +584,9 @@ func updateLampTestStep(db *gorm.DB) gin.HandlerFunc {
 func uploadLampResultImage(db *gorm.DB, s3 *service.S3Service, bucket string) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "lamp_test", id) {
+			return
+		}
 		var t model.LampTest
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "lamp test not found"})