chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/room.go

@@ -25,7 +25,8 @@ func RegisterRoomRoutes(rg *gin.RouterGroup, db *gorm.DB) {
 func listRooms(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		var rooms []model.Room
-		db.Order("created_at DESC").Find(&rooms)
+		q := applyOrgScope(db.Model(&model.Room{}), c, "org_id")
+		q.Order("created_at DESC").Find(&rooms)
 		c.JSON(http.StatusOK, rooms)
 	}
 }
@@ -34,6 +35,9 @@ func listRooms(db *gorm.DB) gin.HandlerFunc {
 func getRoom(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "room", id) {
+			return
+		}
 		var room model.Room
 		if db.Where("id = ?", id).First(&room).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "room not found"})
@@ -52,6 +56,12 @@ func createRoom(db *gorm.DB) gin.HandlerFunc {
 			return
 		}
 		room.ID = "" // 让数据库自动生成
+		if room.OrgID == nil {
+			room.OrgID = defaultOrgID(db, c)
+		} else if !canAccessOrganization(db, c, *room.OrgID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权在该组织下创建蚕房"})
+			return
+		}
 		if err := db.Create(&room).Error; err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "创建失败"})
 			return
@@ -64,6 +74,9 @@ func createRoom(db *gorm.DB) gin.HandlerFunc {
 func updateRoom(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "room", id) {
+			return
+		}
 		var room model.Room
 		if db.Where("id = ?", id).First(&room).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "room not found"})
@@ -74,6 +87,12 @@ func updateRoom(db *gorm.DB) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
+		if orgID, ok := updates["org_id"]; ok {
+			if orgStr, ok := orgID.(string); ok && !canAccessOrganization(db, c, orgStr) {
+				c.JSON(http.StatusForbidden, gin.H{"error": "无权迁移蚕房到该组织"})
+				return
+			}
+		}
 		if len(updates) > 0 {
 			db.Model(&model.Room{}).Where("id = ?", id).Updates(updates)
 		}
@@ -86,6 +105,9 @@ func updateRoom(db *gorm.DB) gin.HandlerFunc {
 func deleteRoom(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "room", id) {
+			return
+		}
 		var room model.Room
 		if db.Where("id = ?", id).First(&room).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "room not found"})