chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/video_clip.go

@@ -39,7 +39,7 @@ func listClips(db *gorm.DB) gin.HandlerFunc {
 			}
 		}
 
-		q := db.Model(&model.VideoClip{}).Order("start_at DESC").Limit(limit)
+		q := applyRoomScope(db.Model(&model.VideoClip{}), c, "room_id").Order("start_at DESC").Limit(limit)
 		if cameraId := c.Query("cameraId"); cameraId != "" {
 			q = q.Where("camera_id = ?", cameraId)
 		}
@@ -77,6 +77,9 @@ func playClip(db *gorm.DB) gin.HandlerFunc {
 		}
 
 		clipId := c.Param("clipId")
+		if !requireObjectAccess(c, db, "video_clip", clipId) {
+			return
+		}
 		var clip model.VideoClip
 		if db.Where("id = ?", clipId).First(&clip).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "video clip not found"})