feat(rbac): add @RequirePermission decorators to all business controllers

backend/src/bills/bills.controller.ts

@@ -5,6 +5,7 @@ import { GenerateBillsDto, UpdateBillStatusDto } from './dto/bill.dto';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
 import { OperationLogsService } from '../operation-logs/operation-logs.service';
 import { extractRequestInfo } from '../common/request-utils';
+import { RequirePermission } from '../auth/decorators/permission.decorator';
 import type { Response } from 'express';
 
 @UseGuards(JwtAuthGuard)
@@ -13,6 +14,7 @@ export class BillsController {
   constructor(private service: BillsService, private exportService: BillsExportService, private logService: OperationLogsService) {}
 
   @Post('generate')
+  @RequirePermission('bill:generate')
   async generateBills(@Body() dto: GenerateBillsDto, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.generateBills(dto);
@@ -21,6 +23,7 @@ export class BillsController {
   }
 
   @Get()
+  @RequirePermission('bill:view')
   findAll(
     @Query('periodStart') periodStart?: string,
     @Query('periodEnd') periodEnd?: string,
@@ -35,11 +38,13 @@ export class BillsController {
   }
 
   @Get(':id')
+  @RequirePermission('bill:view')
   findOne(@Param('id') id: string) {
     return this.service.findOne(+id);
   }
 
   @Put(':id/status')
+  @RequirePermission('bill:confirm')
   async updateStatus(@Param('id') id: string, @Body() dto: UpdateBillStatusDto, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.updateStatus(+id, dto);
@@ -48,6 +53,7 @@ export class BillsController {
   }
 
   @Put('batch/status')
+  @RequirePermission('bill:confirm')
   async batchUpdateStatus(@Body() body: { ids: number[]; status: string }, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.batchUpdateStatus(body.ids, body.status);
@@ -56,6 +62,7 @@ export class BillsController {
   }
 
   @Delete(':id')
+  @RequirePermission('bill:delete')
   async remove(@Param('id') id: string, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.remove(+id);
@@ -64,6 +71,7 @@ export class BillsController {
   }
 
   @Post('batch/delete')
+  @RequirePermission('bill:delete')
   async batchRemove(@Body() body: { ids: number[] }, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.batchRemove(body.ids);
@@ -72,6 +80,7 @@ export class BillsController {
   }
 
   @Get('export/excel')
+  @RequirePermission('bill:export-excel')
   async exportExcel(
     @Query('periodStart') periodStart?: string,
     @Query('periodEnd') periodEnd?: string,
@@ -90,6 +99,7 @@ export class BillsController {
   }
 
   @Get('export/pdf/:id')
+  @RequirePermission('bill:export-pdf')
   async exportPdf(@Param('id') id: string, @Res() res: Response, @Req() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     await this.logService.log({ userId: req?.user?.id, username: req?.user?.username, module: '账单', action: '导出PDF', targetId: +id, targetType: 'bill', ipAddress, userAgent });