chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/video_camera.go

@@ -37,7 +37,8 @@ func RegisterVideoCameraRoutes(rg *gin.RouterGroup, db *gorm.DB, media *service.
 func listCameras(db *gorm.DB, media *service.MediaService) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		var cameras []model.Camera
-		db.Order("created_at DESC").Find(&cameras)
+		q := applyRoomScope(db.Model(&model.Camera{}), c, "room_id")
+		q.Order("created_at DESC").Find(&cameras)
 
 		// 先用 DB 中的 is_online 初始化 Online 字段（gorm:"-" 不会自动填充）
 		for i := range cameras {
@@ -98,6 +99,9 @@ func listCameras(db *gorm.DB, media *service.MediaService) gin.HandlerFunc {
 func getCamera(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "camera", id) {
+			return
+		}
 		var camera model.Camera
 		if db.Where("id = ?", id).First(&camera).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "camera not found"})
@@ -118,8 +122,15 @@ func createCamera(db *gorm.DB, media *service.MediaService) gin.HandlerFunc {
 		camera := input.toModel()
 		camera.ID = 0 // 让数据库自动生成
 		if camera.RoomID == nil {
-			defaultRoom := "1"
-			camera.RoomID = &defaultRoom
+			camera.RoomID = firstAccessibleRoomID(db, c)
+			if camera.RoomID == nil {
+				c.JSON(http.StatusBadRequest, gin.H{"error": "当前账号无可用蚕房，请先选择 roomId"})
+				return
+			}
+		}
+		if !canAccessRoom(db, c, camera.RoomID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权在该蚕房下创建摄像头"})
+			return
 		}
 		if err := db.Create(&camera).Error; err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "创建失败"})
@@ -150,6 +161,9 @@ func createCamera(db *gorm.DB, media *service.MediaService) gin.HandlerFunc {
 func updateCamera(db *gorm.DB, media *service.MediaService) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "camera", id) {
+			return
+		}
 		var camera model.Camera
 		if db.Where("id = ?", id).First(&camera).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "camera not found"})
@@ -160,6 +174,10 @@ func updateCamera(db *gorm.DB, media *service.MediaService) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
+		if roomID, ok := updates["room_id"].(string); ok && !canAccessRoom(db, c, &roomID) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无权迁移摄像头到指定蚕房"})
+			return
+		}
 		if len(updates) > 0 {
 			if err := db.Model(&model.Camera{}).Where("id = ?", id).Updates(updates).Error; err != nil {
 				c.JSON(http.StatusInternalServerError, gin.H{"error": "更新失败: " + err.Error()})
@@ -198,6 +216,9 @@ func updateCamera(db *gorm.DB, media *service.MediaService) gin.HandlerFunc {
 func deleteCamera(db *gorm.DB, media *service.MediaService) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "camera", id) {
+			return
+		}
 		var camera model.Camera
 		if db.Where("id = ?", id).First(&camera).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "camera not found"})
@@ -224,6 +245,9 @@ func playCamera(db *gorm.DB, media *service.MediaService) gin.HandlerFunc {
 		}
 
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "camera", id) {
+			return
+		}
 		var camera model.Camera
 		if db.Where("id = ?", id).First(&camera).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "camera not found"})
@@ -287,6 +311,9 @@ func playbackCamera(db *gorm.DB) gin.HandlerFunc {
 		}
 
 		id := c.Param("id")
+		if !requireObjectAccess(c, db, "camera", id) {
+			return
+		}
 
 		limit := 50
 		if l, err := strconv.Atoi(c.Query("limit")); err == nil && l > 0 {
@@ -335,10 +362,10 @@ func getWvpConfig(media *service.MediaService) gin.HandlerFunc {
 			return
 		}
 		c.JSON(http.StatusOK, gin.H{
-			"sipId":       sip["id"],
-			"sipDomain":   sip["domain"],
-			"sipPort":     sip["port"],
-			"sipShowIp":   sip["showIp"],
+			"sipId":     sip["id"],
+			"sipDomain": sip["domain"],
+			"sipPort":   sip["port"],
+			"sipShowIp": sip["showIp"],
 		})
 	}
 }