chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/threshold.go

@@ -23,7 +23,11 @@ func RegisterThresholdRoutes(rg *gin.RouterGroup, db *gorm.DB) {
 func listThresholds(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		var thresholds []model.Threshold
-		db.Find(&thresholds)
+		q := db.Model(&model.Threshold{}).
+			Joins("JOIN sensors s ON s.id = thresholds.sensor_id").
+			Joins("JOIN devices d ON d.id = s.device_id")
+		q = applyRoomScope(q, c, "d.room_id")
+		q.Order("thresholds.created_at DESC").Find(&thresholds)
 		c.JSON(http.StatusOK, thresholds)
 	}
 }
@@ -32,6 +36,9 @@ func listThresholds(db *gorm.DB) gin.HandlerFunc {
 func getThreshold(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "threshold", id) {
+			return
+		}
 		var threshold model.Threshold
 		if db.Where("id = ?", id).First(&threshold).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "threshold not found"})
@@ -50,6 +57,13 @@ func createThreshold(db *gorm.DB) gin.HandlerFunc {
 			return
 		}
 		threshold.ID = "" // 让数据库自动生成
+		if !isUUID(threshold.SensorID) {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "sensorId 不是合法的 UUID"})
+			return
+		}
+		if !requireObjectAccess(c, db, "sensor", threshold.SensorID) {
+			return
+		}
 		if err := db.Create(&threshold).Error; err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "创建失败"})
 			return
@@ -62,6 +76,9 @@ func createThreshold(db *gorm.DB) gin.HandlerFunc {
 func updateThreshold(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "threshold", id) {
+			return
+		}
 		var threshold model.Threshold
 		if db.Where("id = ?", id).First(&threshold).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "threshold not found"})
@@ -72,6 +89,9 @@ func updateThreshold(db *gorm.DB) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
+		if sensorID, ok := updates["sensor_id"].(string); ok && !requireObjectAccess(c, db, "sensor", sensorID) {
+			return
+		}
 		if len(updates) > 0 {
 			db.Model(&model.Threshold{}).Where("id = ?", id).Updates(updates)
 		}
@@ -84,6 +104,9 @@ func updateThreshold(db *gorm.DB) gin.HandlerFunc {
 func deleteThreshold(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "threshold", id) {
+			return
+		}
 		var threshold model.Threshold
 		if db.Where("id = ?", id).First(&threshold).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "threshold not found"})