chore: 同步本地 v9 整改与运营能力

server-go/internal/ws/authorizer.go

@@ -14,7 +14,7 @@ type DeviceAuthorizer interface {
 	CanReadDevice(userID, deviceKey string) (bool, error)
 }
 
-// DBDeviceAuthorizer 使用现有 RBAC 权限判断设备读取权；当前未做用户级资源 ACL。
+// DBDeviceAuthorizer 使用 RBAC + 组织/房间归属判断设备读取权。
 type DBDeviceAuthorizer struct {
 	db *gorm.DB
 }
@@ -36,12 +36,28 @@ func (a *DBDeviceAuthorizer) CanReadDevice(userID, deviceKey string) (bool, erro
 		return true, nil
 	}
 
-	var count int64
+	var roleCount int64
 	err := a.db.Table("role_permissions").
 		Joins("JOIN permissions ON permissions.id = role_permissions.permission_id").
 		Where("role_permissions.role = ? AND permissions.code = ?", user.Role, "device:read").
-		Count(&count).Error
-	return count > 0, err
+		Count(&roleCount).Error
+	if err != nil {
+		return false, err
+	}
+	if roleCount == 0 {
+		return false, nil
+	}
+
+	var device model.Device
+	if err := a.db.Where("device_key = ?", deviceKey).First(&device).Error; err != nil {
+		return false, err
+	}
+	var roomCount int64
+	err = a.db.Table("rooms").
+		Joins("JOIN organization_members om ON om.organization_id = rooms.org_id").
+		Where("rooms.id = ? AND om.user_id = ?", device.RoomID, userID).
+		Count(&roomCount).Error
+	return roomCount > 0, err
 }
 
 func (h *Hub) authorizeSubscription(userID, deviceKey string) error {