chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/telemetry.go

@@ -33,6 +33,9 @@ func listTelemetry(db *gorm.DB, iotdb *service.IoTDBService) gin.HandlerFunc {
 		if limit <= 0 {
 			limit = 2000
 		}
+		if deviceKey != "" && !requireDeviceKeyAccess(c, db, deviceKey) {
+			return
+		}
 
 		// 优先 IoTDB
 		if iotdb.IsAvailable() && deviceKey != "" && metric != "" {
@@ -45,16 +48,19 @@ func listTelemetry(db *gorm.DB, iotdb *service.IoTDBService) gin.HandlerFunc {
 		}
 
 		// 降级 PostgreSQL
-		q := db.Model(&model.Telemetry{}).Order("timestamp DESC").Limit(limit)
+		q := db.Model(&model.Telemetry{}).
+			Joins("JOIN devices d ON d.device_key = telemetry.device_key").
+			Order("telemetry.timestamp DESC").Limit(limit)
+		q = applyRoomScope(q, c, "d.room_id")
 		if deviceKey != "" {
-			q = q.Where("device_key = ?", deviceKey)
+			q = q.Where("telemetry.device_key = ?", deviceKey)
 		}
 		if metric != "" {
-			q = q.Where("metric = ?", metric)
+			q = q.Where("telemetry.metric = ?", metric)
 		}
 		if from != "" || to != "" {
 			fromVal, toVal := parseTimeRangeStr(from, to)
-			q = q.Where("timestamp BETWEEN ? AND ?", fromVal, toVal)
+			q = q.Where("telemetry.timestamp BETWEEN ? AND ?", fromVal, toVal)
 		}
 		var rows []model.Telemetry
 		q.Find(&rows)
@@ -66,6 +72,9 @@ func listTelemetry(db *gorm.DB, iotdb *service.IoTDBService) gin.HandlerFunc {
 func listMetrics(iotdb *service.IoTDBService, db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		deviceKey := c.Param("deviceKey")
+		if !requireDeviceKeyAccess(c, db, deviceKey) {
+			return
+		}
 
 		// 优先 IoTDB
 		if iotdb.IsAvailable() {
@@ -87,6 +96,9 @@ func listMetrics(iotdb *service.IoTDBService, db *gorm.DB) gin.HandlerFunc {
 func latestTelemetry(iotdb *service.IoTDBService, db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		deviceKey := c.Param("deviceKey")
+		if !requireDeviceKeyAccess(c, db, deviceKey) {
+			return
+		}
 
 		// 查询 PG 中该设备每个指标的最新记录
 		var records []model.Telemetry
@@ -105,6 +117,9 @@ func historyBucket(iotdb *service.IoTDBService, db *gorm.DB) gin.HandlerFunc {
 		metric := c.Param("metric")
 		from := c.Query("from")
 		to := c.Query("to")
+		if !requireDeviceKeyAccess(c, db, deviceKey) {
+			return
+		}
 		if from == "" || to == "" {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "from/to required"})
 			return