chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/video_record.go

@@ -42,7 +42,7 @@ func RegisterVideoRecordRoutes(rg *gin.RouterGroup, db *gorm.DB, media *service.
 	readPerm := middleware.RequirePermission(db, "video:read")
 	rg.POST("/video/cameras/:id/record/start", recordPerm, startRecording(db, media, cfg))
 	rg.POST("/video/cameras/:id/record/stop", recordPerm, stopRecording(db, media, cfg))
-	rg.GET("/video/recordings/active", readPerm, listActiveRecordings(cfg))
+	rg.GET("/video/recordings/active", readPerm, listActiveRecordings(db, cfg))
 	rg.POST("/video/recordings/internal/end", endRecordingInternal(media, cfg)) // 白名单接口，无需权限
 }
 
@@ -50,6 +50,9 @@ func RegisterVideoRecordRoutes(rg *gin.RouterGroup, db *gorm.DB, media *service.
 func startRecording(db *gorm.DB, media *service.MediaService, cfg *config.Config) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		cameraId := c.Param("id")
+		if !requireObjectAccess(c, db, "camera", cameraId) {
+			return
+		}
 		var camera model.Camera
 		if db.Where("id = ?", cameraId).First(&camera).Error != nil {
 			c.JSON(http.StatusNotFound, gin.H{"error": "camera not found"})
@@ -129,6 +132,9 @@ func startRecording(db *gorm.DB, media *service.MediaService, cfg *config.Config
 func stopRecording(db *gorm.DB, media *service.MediaService, cfg *config.Config) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		cameraId := c.Param("id")
+		if !requireObjectAccess(c, db, "camera", cameraId) {
+			return
+		}
 
 		activeMu.Lock()
 		rec, ok := activeRecordings[cameraId]
@@ -217,7 +223,7 @@ func endRecordingInternal(media *service.MediaService, cfg *config.Config) gin.H
 
 // listActiveRecordings 返回活跃录制列表
 // 优先以 recorder-go 服务的实际状态为准（Go 后端重启后内存 map 会丢失，但 recorder-go 仍在录制）
-func listActiveRecordings(cfg *config.Config) gin.HandlerFunc {
+func listActiveRecordings(db *gorm.DB, cfg *config.Config) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		// 1. 查询 recorder-go 实际录制状态
 		recorderBase := strings.TrimSuffix(cfg.RecorderAPIBase, "/")
@@ -270,7 +276,7 @@ func listActiveRecordings(cfg *config.Config) gin.HandlerFunc {
 						}
 						activeMu.Unlock()
 					}
-					c.JSON(http.StatusOK, list)
+					c.JSON(http.StatusOK, filterAccessibleRecordings(db, c, list))
 					return
 				}
 			}
@@ -283,6 +289,23 @@ func listActiveRecordings(cfg *config.Config) gin.HandlerFunc {
 			list = append(list, rec)
 		}
 		activeMu.Unlock()
-		c.JSON(http.StatusOK, list)
+		c.JSON(http.StatusOK, filterAccessibleRecordings(db, c, list))
 	}
 }
+
+func filterAccessibleRecordings(db *gorm.DB, c *gin.Context, list []*ActiveRecording) []*ActiveRecording {
+	if hasGlobalAccess(c) {
+		return list
+	}
+	filtered := make([]*ActiveRecording, 0, len(list))
+	for _, rec := range list {
+		var camera model.Camera
+		if db.Where("id = ?", rec.CameraID).First(&camera).Error != nil {
+			continue
+		}
+		if canAccessRoom(db, c, camera.RoomID) {
+			filtered = append(filtered, rec)
+		}
+	}
+	return filtered
+}