chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/tray_batch.go

@@ -40,7 +40,7 @@ func RegisterTrayBatchRoutes(rg *gin.RouterGroup, db *gorm.DB) {
 
 func listTrays(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		q := db.Model(&model.Tray{})
+		q := applyRoomScope(db.Model(&model.Tray{}), c, "room_id")
 		if room := c.Query("roomId"); room != "" {
 			q = q.Where("room_id = ?", room)
 		}
@@ -69,6 +69,10 @@ func createTray(db *gorm.DB) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "roomId 不是合法的 UUID"})
 			return
 		}
+		if !canAccessRoom(db, c, &t.RoomID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权在该蚕房下创建蚕匾"})
+			return
+		}
 		if err := db.Create(&t).Error; err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "创建失败"})
 			return
@@ -80,6 +84,9 @@ func createTray(db *gorm.DB) gin.HandlerFunc {
 func updateTray(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "tray", id) {
+			return
+		}
 		var t model.Tray
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "tray not found"})
@@ -90,6 +97,10 @@ func updateTray(db *gorm.DB) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
+		if roomID, ok := updates["room_id"].(string); ok && !canAccessRoom(db, c, &roomID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权迁移蚕匾到指定蚕房"})
+			return
+		}
 		if len(updates) > 0 {
 			db.Model(&model.Tray{}).Where("id = ?", id).Updates(updates)
 		}
@@ -101,6 +112,9 @@ func updateTray(db *gorm.DB) gin.HandlerFunc {
 func deleteTray(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "tray", id) {
+			return
+		}
 		var t model.Tray
 		if db.Where("id = ?", id).First(&t).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "tray not found"})
@@ -115,7 +129,7 @@ func deleteTray(db *gorm.DB) gin.HandlerFunc {
 
 func listBatches(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		q := db.Model(&model.Batch{})
+		q := applyRoomScope(db.Model(&model.Batch{}), c, "room_id")
 		if room := c.Query("roomId"); room != "" {
 			q = q.Where("room_id = ?", room)
 		}
@@ -144,6 +158,10 @@ func createBatch(db *gorm.DB) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "roomId 不是合法的 UUID"})
 			return
 		}
+		if !canAccessRoom(db, c, &b.RoomID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权在该蚕房下创建批次"})
+			return
+		}
 		if b.Status == "" {
 			b.Status = "rearing"
 		}
@@ -158,6 +176,9 @@ func createBatch(db *gorm.DB) gin.HandlerFunc {
 func updateBatch(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "batch", id) {
+			return
+		}
 		var b model.Batch
 		if db.Where("id = ?", id).First(&b).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "batch not found"})
@@ -168,6 +189,10 @@ func updateBatch(db *gorm.DB) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
+		if roomID, ok := updates["room_id"].(string); ok && !canAccessRoom(db, c, &roomID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权迁移批次到指定蚕房"})
+			return
+		}
 		if len(updates) > 0 {
 			db.Model(&model.Batch{}).Where("id = ?", id).Updates(updates)
 		}
@@ -179,6 +204,9 @@ func updateBatch(db *gorm.DB) gin.HandlerFunc {
 func deleteBatch(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "batch", id) {
+			return
+		}
 		var b model.Batch
 		if db.Where("id = ?", id).First(&b).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "batch not found"})
@@ -195,7 +223,7 @@ func deleteBatch(db *gorm.DB) gin.HandlerFunc {
 
 func listRearingRecords(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		q := db.Model(&model.RearingRecord{})
+		q := applyRoomScope(db.Table("rearing_records").Joins("JOIN batches b ON b.id = rearing_records.batch_id"), c, "b.room_id")
 		if batch := c.Query("batchId"); batch != "" {
 			q = q.Where("batch_id = ?", batch)
 		}
@@ -217,6 +245,9 @@ func createRearingRecord(db *gorm.DB) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "batchId 不是合法的 UUID"})
 			return
 		}
+		if !requireObjectAccess(c, db, "batch", r.BatchID) {
+			return
+		}
 		if r.RecordDate.IsZero() {
 			r.RecordDate = time.Now()
 		}
@@ -231,6 +262,9 @@ func createRearingRecord(db *gorm.DB) gin.HandlerFunc {
 func updateRearingRecord(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "rearing_record", id) {
+			return
+		}
 		var r model.RearingRecord
 		if db.Where("id = ?", id).First(&r).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "rearing record not found"})
@@ -252,6 +286,9 @@ func updateRearingRecord(db *gorm.DB) gin.HandlerFunc {
 func deleteRearingRecord(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "rearing_record", id) {
+			return
+		}
 		var r model.RearingRecord
 		if db.Where("id = ?", id).First(&r).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "rearing record not found"})