feat(rbac): add @RequirePermission decorators to all business controllers

backend/src/students/students.controller.ts

@@ -6,6 +6,7 @@ import { CreateStudentDto, UpdateStudentDto } from './dto/student.dto';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
 import { OperationLogsService } from '../operation-logs/operation-logs.service';
 import { extractRequestInfo } from '../common/request-utils';
+import { RequirePermission } from '../auth/decorators/permission.decorator';
 import * as ExcelJS from 'exceljs';
 
 @UseGuards(JwtAuthGuard)
@@ -14,11 +15,13 @@ export class StudentsController {
   constructor(private service: StudentsService, private logService: OperationLogsService) {}
 
   @Get()
+  @RequirePermission('student:view')
   findAll(@Query('name') name?: string, @Query('status') status?: string, @Query('includeArchived') includeArchived?: string) {
     return this.service.findAll({ name, status, includeArchived: includeArchived === 'true' });
   }
 
   @Get('export')
+  @RequirePermission('student:export')
   async exportExcel(@Query('includeArchived') includeArchived?: string, @Res() res?: Response) {
     const students = await this.service.findAll({ includeArchived: includeArchived === 'true' });
     const workbook = new ExcelJS.Workbook();
@@ -48,6 +51,7 @@ export class StudentsController {
   }
 
   @Get('template')
+  @RequirePermission('student:view')
   async downloadTemplate(@Res() res: Response) {
     const workbook = new ExcelJS.Workbook();
     const ws = workbook.addWorksheet('学生导入模板');
@@ -72,11 +76,13 @@ export class StudentsController {
   }
 
   @Get(':id')
+  @RequirePermission('student:view')
   findOne(@Param('id') id: string) {
     return this.service.findOne(+id);
   }
 
   @Post()
+  @RequirePermission('student:create')
   async create(@Body() dto: CreateStudentDto, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.create(dto);
@@ -85,6 +91,7 @@ export class StudentsController {
   }
 
   @Put(':id')
+  @RequirePermission('student:edit')
   async update(@Param('id') id: string, @Body() dto: UpdateStudentDto, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.update(+id, dto);
@@ -93,6 +100,7 @@ export class StudentsController {
   }
 
   @Delete(':id')
+  @RequirePermission('student:delete')
   async remove(@Param('id') id: string, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.remove(+id);
@@ -101,6 +109,7 @@ export class StudentsController {
   }
 
   @Post('batch-delete')
+  @RequirePermission('student:delete')
   async batchRemove(@Body() body: { ids: number[] }, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.batchRemove(body.ids || []);
@@ -109,6 +118,7 @@ export class StudentsController {
   }
 
   @Put(':id/restore')
+  @RequirePermission('student:edit')
   async restore(@Param('id') id: string, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.restore(+id);
@@ -117,6 +127,7 @@ export class StudentsController {
   }
 
   @Post('import')
+  @RequirePermission('student:import')
   @UseInterceptors(FileInterceptor('file'))
   async importExcel(@UploadedFile() file: Express.Multer.File, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);