chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/sensor.go

@@ -23,7 +23,10 @@ func RegisterSensorRoutes(rg *gin.RouterGroup, db *gorm.DB) {
 func listSensors(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		var sensors []model.Sensor
-		db.Order("created_at DESC").Find(&sensors)
+		q := db.Model(&model.Sensor{}).
+			Joins("JOIN devices d ON d.id = sensors.device_id")
+		q = applyRoomScope(q, c, "d.room_id")
+		q.Order("sensors.created_at DESC").Find(&sensors)
 		c.JSON(http.StatusOK, sensors)
 	}
 }
@@ -32,6 +35,9 @@ func listSensors(db *gorm.DB) gin.HandlerFunc {
 func getSensor(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "sensor", id) {
+			return
+		}
 		var sensor model.Sensor
 		if db.Where("id = ?", id).First(&sensor).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "sensor not found"})
@@ -50,6 +56,13 @@ func createSensor(db *gorm.DB) gin.HandlerFunc {
 			return
 		}
 		sensor.ID = "" // 让数据库自动生成
+		if !isUUID(sensor.DeviceID) {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "deviceId 不是合法的 UUID"})
+			return
+		}
+		if !requireObjectAccess(c, db, "device", sensor.DeviceID) {
+			return
+		}
 		if err := db.Create(&sensor).Error; err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "创建失败"})
 			return
@@ -62,6 +75,9 @@ func createSensor(db *gorm.DB) gin.HandlerFunc {
 func updateSensor(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "sensor", id) {
+			return
+		}
 		var sensor model.Sensor
 		if db.Where("id = ?", id).First(&sensor).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "sensor not found"})
@@ -72,6 +88,9 @@ func updateSensor(db *gorm.DB) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
+		if deviceID, ok := updates["device_id"].(string); ok && !requireObjectAccess(c, db, "device", deviceID) {
+			return
+		}
 		if len(updates) > 0 {
 			db.Model(&model.Sensor{}).Where("id = ?", id).Updates(updates)
 		}
@@ -84,6 +103,9 @@ func updateSensor(db *gorm.DB) gin.HandlerFunc {
 func deleteSensor(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "sensor", id) {
+			return
+		}
 		var sensor model.Sensor
 		if db.Where("id = ?", id).First(&sensor).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "sensor not found"})