feat(rbac): add @RequirePermission decorators to all business controllers

backend/src/rooms/rooms.controller.ts

@@ -6,6 +6,7 @@ import { CreateRoomDto, UpdateRoomDto } from './dto/room.dto';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
 import { OperationLogsService } from '../operation-logs/operation-logs.service';
 import { extractRequestInfo } from '../common/request-utils';
+import { RequirePermission } from '../auth/decorators/permission.decorator';
 import * as ExcelJS from 'exceljs';
 
 @UseGuards(JwtAuthGuard)
@@ -14,21 +15,25 @@ export class RoomsController {
   constructor(private service: RoomsService, private logService: OperationLogsService) {}
 
   @Get()
+  @RequirePermission('room:view')
   findAll(@Query('building') building?: string, @Query('includeArchived') includeArchived?: string) {
     return this.service.findAll({ building, includeArchived: includeArchived === 'true' });
   }
 
   @Get('overview')
+  @RequirePermission('room:view')
   getOverview(@Query('includeArchived') includeArchived?: string) {
     return this.service.getRoomOverview({ includeArchived: includeArchived === 'true' });
   }
 
   @Get('visual')
+  @RequirePermission('room:view')
   getVisual() {
     return this.service.getRoomVisual();
   }
 
   @Get('template')
+  @RequirePermission('room:view')
   async downloadTemplate(@Res() res: Response) {
     const workbook = new ExcelJS.Workbook();
     const ws = workbook.addWorksheet('宿舍导入模板');
@@ -50,6 +55,7 @@ export class RoomsController {
   }
 
   @Get('export')
+  @RequirePermission('room:view')
   async exportExcel(@Query('includeArchived') includeArchived?: string, @Res() res?: Response) {
     const rooms = await this.service.getRoomOverview({ includeArchived: includeArchived === 'true' });
     const workbook = new ExcelJS.Workbook();
@@ -77,11 +83,13 @@ export class RoomsController {
   }
 
   @Get(':id')
+  @RequirePermission('room:view')
   findOne(@Param('id') id: string) {
     return this.service.findOneWithOccupants(+id);
   }
 
   @Post()
+  @RequirePermission('room:create')
   async create(@Body() dto: CreateRoomDto, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.create(dto);
@@ -90,6 +98,7 @@ export class RoomsController {
   }
 
   @Put(':id')
+  @RequirePermission('room:edit')
   async update(@Param('id') id: string, @Body() dto: UpdateRoomDto, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.update(+id, dto);
@@ -98,6 +107,7 @@ export class RoomsController {
   }
 
   @Delete(':id')
+  @RequirePermission('room:delete')
   async remove(@Param('id') id: string, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.remove(+id);
@@ -106,6 +116,7 @@ export class RoomsController {
   }
 
   @Post('batch-delete')
+  @RequirePermission('room:delete')
   async batchRemove(@Body() body: { ids: number[] }, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.batchRemove(body.ids || []);
@@ -114,6 +125,7 @@ export class RoomsController {
   }
 
   @Put(':id/restore')
+  @RequirePermission('room:edit')
   async restore(@Param('id') id: string, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.restore(+id);
@@ -122,6 +134,7 @@ export class RoomsController {
   }
 
   @Post('import')
+  @RequirePermission('room:create')
   @UseInterceptors(FileInterceptor('file'))
   async importExcel(@UploadedFile() file: Express.Multer.File, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);