feat(rbac): add @RequirePermission decorators to all business controllers

backend/src/occupancies/occupancies.controller.ts

@@ -6,6 +6,7 @@ import { CheckInDto, CheckOutDto, TransferRoomDto, BatchCheckOutDto } from './dt
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
 import { OperationLogsService } from '../operation-logs/operation-logs.service';
 import { extractRequestInfo } from '../common/request-utils';
+import { RequirePermission } from '../auth/decorators/permission.decorator';
 import * as ExcelJS from 'exceljs';
 
 @UseGuards(JwtAuthGuard)
@@ -14,6 +15,7 @@ export class OccupanciesController {
   constructor(private service: OccupanciesService, private logService: OperationLogsService) {}
 
   @Get()
+  @RequirePermission('occupancy:view')
   findAll(
     @Query('roomId') roomId?: string,
     @Query('studentId') studentId?: string,
@@ -27,6 +29,7 @@ export class OccupanciesController {
   }
 
   @Post('batch-check-out')
+  @RequirePermission('occupancy:checkout')
   async batchCheckOut(@Body() dto: BatchCheckOutDto, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.batchCheckOut(dto);
@@ -35,6 +38,7 @@ export class OccupanciesController {
   }
 
   @Post('check-in')
+  @RequirePermission('occupancy:checkin')
   async checkIn(@Body() dto: CheckInDto, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.checkIn(dto);
@@ -43,6 +47,7 @@ export class OccupanciesController {
   }
 
   @Put(':id/check-out')
+  @RequirePermission('occupancy:checkout')
   async checkOut(@Param('id') id: string, @Body() dto: CheckOutDto, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.checkOut(+id, dto);
@@ -51,6 +56,7 @@ export class OccupanciesController {
   }
 
   @Put(':id/transfer')
+  @RequirePermission('occupancy:transfer')
   async transferRoom(@Param('id') id: string, @Body() dto: TransferRoomDto, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.transferRoom(+id, dto);
@@ -59,6 +65,7 @@ export class OccupanciesController {
   }
 
   @Delete(':id')
+  @RequirePermission('occupancy:view')
   async remove(@Param('id') id: string, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.remove(+id);
@@ -67,6 +74,7 @@ export class OccupanciesController {
   }
 
   @Post('batch-delete')
+  @RequirePermission('occupancy:view')
   async batchRemove(@Body() body: { ids: number[] }, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.batchRemove(body.ids || []);
@@ -75,6 +83,7 @@ export class OccupanciesController {
   }
 
   @Get('export')
+  @RequirePermission('occupancy:view')
   async exportExcel(@Query('active') active?: string, @Res() res?: Response) {
     const records = await this.service.findAll({ active: active === 'true' });
     const workbook = new ExcelJS.Workbook();
@@ -120,6 +129,7 @@ export class OccupanciesController {
   }
 
   @Get('template')
+  @RequirePermission('occupancy:view')
   async downloadTemplate(@Res() res: Response) {
     const workbook = new ExcelJS.Workbook();
     const ws = workbook.addWorksheet('入住名单导入模板');
@@ -163,6 +173,7 @@ export class OccupanciesController {
   }
 
   @Post('import')
+  @RequirePermission('occupancy:checkin')
   @UseInterceptors(FileInterceptor('file'))
   async importCheckIn(@UploadedFile() file: Express.Multer.File, @Request() req: any, @Query('autoDeposit') autoDeposit?: string, @Query('depositAmount') depositAmount?: string) {
     const { ipAddress, userAgent } = extractRequestInfo(req);