chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/trace.go

@@ -43,10 +43,11 @@ func traceMonthlyStats(db *gorm.DB) gin.HandlerFunc {
 			Month   string `gorm:"column:month"`
 			Disease string `gorm:"column:disease"`
 		}
-		db.Table("trace_records").
+		q := db.Table("trace_records").
 			Select("to_char(created_at, 'YYYY-MM') AS month, disease").
-			Where("created_at >= ? AND created_at < ?", start, end).
-			Scan(&rows)
+			Where("created_at >= ? AND created_at < ?", start, end)
+		q = applyRoomScope(q, c, "room_id")
+		q.Scan(&rows)
 		entries := make([]service.MonthDiseaseEntry, 0, len(rows))
 		for _, r := range rows {
 			entries = append(entries, service.MonthDiseaseEntry{Month: r.Month, Disease: r.Disease})
@@ -66,6 +67,7 @@ func traceRegionStats(db *gorm.DB) gin.HandlerFunc {
 			Select("rooms.region AS region, trace_records.disease AS disease").
 			Joins("LEFT JOIN rooms ON rooms.id = trace_records.room_id").
 			Where("trace_records.created_at >= ?", time.Now().Add(-time.Duration(days)*24*time.Hour))
+		q = applyRoomScope(q, c, "trace_records.room_id")
 		if disease := c.Query("disease"); disease != "" {
 			q = q.Where("trace_records.disease = ?", disease)
 		}
@@ -84,7 +86,7 @@ func traceRegionStats(db *gorm.DB) gin.HandlerFunc {
 
 func listTraceRecords(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		q := db.Model(&model.TraceRecord{})
+		q := applyRoomScope(db.Model(&model.TraceRecord{}), c, "room_id")
 		if status := c.Query("status"); status != "" {
 			q = q.Where("status = ?", status)
 		}
@@ -116,6 +118,9 @@ func fillTraceRoomNames(db *gorm.DB, list []model.TraceRecord) {
 
 func getTraceRecord(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if !requireObjectAccess(c, db, "trace_record", c.Param("id")) {
+			return
+		}
 		var t model.TraceRecord
 		if db.Where("id = ?", c.Param("id")).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "trace record not found"})
@@ -145,6 +150,19 @@ func createTraceRecord(db *gorm.DB) gin.HandlerFunc {
 				return
 			}
 		}
+		if body.RoomID != nil && !canAccessRoom(db, c, body.RoomID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权为该蚕房创建溯源记录"})
+			return
+		}
+		if body.DiseaseEventID != nil && !requireObjectAccess(c, db, "disease_event", *body.DiseaseEventID) {
+			return
+		}
+		if body.LampTestID != nil && !requireObjectAccess(c, db, "lamp_test", *body.LampTestID) {
+			return
+		}
+		if body.ConsultationID != nil && !requireObjectAccess(c, db, "consultation", *body.ConsultationID) {
+			return
+		}
 		if body.Disease == "" {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "病种不能为空"})
 			return
@@ -165,6 +183,9 @@ func createTraceRecord(db *gorm.DB) gin.HandlerFunc {
 func updateTraceRecord(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "trace_record", id) {
+			return
+		}
 		var t model.TraceRecord
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "trace record not found"})
@@ -175,6 +196,22 @@ func updateTraceRecord(db *gorm.DB) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
+		if roomID, ok := updates["room_id"].(string); ok && !canAccessRoom(db, c, &roomID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权迁移溯源记录到指定蚕房"})
+			return
+		}
+		for _, ref := range []struct {
+			key  string
+			kind string
+		}{
+			{key: "disease_event_id", kind: "disease_event"},
+			{key: "lamp_test_id", kind: "lamp_test"},
+			{key: "consultation_id", kind: "consultation"},
+		} {
+			if id, ok := updates[ref.key].(string); ok && !requireObjectAccess(c, db, ref.kind, id) {
+				return
+			}
+		}
 		if len(updates) > 0 {
 			db.Model(&model.TraceRecord{}).Where("id = ?", id).Updates(updates)
 		}
@@ -186,6 +223,9 @@ func updateTraceRecord(db *gorm.DB) gin.HandlerFunc {
 func deleteTraceRecord(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "trace_record", id) {
+			return
+		}
 		var t model.TraceRecord
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "trace record not found"})
@@ -200,6 +240,9 @@ func deleteTraceRecord(db *gorm.DB) gin.HandlerFunc {
 func autoTrace(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "trace_record", id) {
+			return
+		}
 		var t model.TraceRecord
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "trace record not found"})
@@ -318,6 +361,9 @@ func autoTrace(db *gorm.DB) gin.HandlerFunc {
 // getTraceChecklist 分病种二级排查清单
 func getTraceChecklist(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if !requireObjectAccess(c, db, "trace_record", c.Param("id")) {
+			return
+		}
 		var t model.TraceRecord
 		if db.Where("id = ?", c.Param("id")).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "trace record not found"})
@@ -331,6 +377,9 @@ func getTraceChecklist(db *gorm.DB) gin.HandlerFunc {
 func submitTraceChecklist(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "trace_record", id) {
+			return
+		}
 		var t model.TraceRecord
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "trace record not found"})