fix(权限): 设备/产品按ID直取接口增加归属校验

修复 GH-32 越权访问：新增 IotDataAccessGuard，在控制器边界校验设备/产品
归属(属主/租户/共享/dataScope=1)，连接凭据不发放给共享用户。

springboot/fastbee-open-api/src/main/java/com/fastbee/data/acl/IotDataAccessGuard.java

@@ -0,0 +1,96 @@
+package com.fastbee.data.acl;
+
+import com.fastbee.common.core.domain.entity.SysUser;
+import com.fastbee.common.core.domain.model.LoginUser;
+import com.fastbee.common.exception.ServiceException;
+import com.fastbee.common.utils.SecurityUtils;
+import com.fastbee.iot.domain.Device;
+import com.fastbee.iot.domain.DeviceUser;
+import com.fastbee.iot.domain.Product;
+import com.fastbee.iot.mapper.DeviceMapper;
+import com.fastbee.iot.mapper.DeviceUserMapper;
+import com.fastbee.iot.mapper.ProductMapper;
+import org.springframework.stereotype.Component;
+
+import javax.annotation.Resource;
+import java.util.Objects;
+
+/**
+ * 按 ID 直取单条记录的接口必须复用列表接口的归属范围。
+ * 列表查询在 Service 层按角色注入 tenantId/userId，而详情、凭据、修改、删除接口此前只校验权限字符串，
+ * 配合自增主键可被遍历读取/操作他人数据。校验放在控制器边界：Service 方法同时被 MQTT broker
+ * 线程和内部流程调用，那里没有登录态。
+ */
+@Component
+public class IotDataAccessGuard {
+
+    /* RuoYi 数据范围 1=全部数据权限，种子中 admin/manager/visitor 持有，保持其原有全局可见行为 */
+    private static final String DATA_SCOPE_ALL = "1";
+
+    @Resource
+    private DeviceMapper deviceMapper;
+    @Resource
+    private DeviceUserMapper deviceUserMapper;
+    @Resource
+    private ProductMapper productMapper;
+
+    public void assertDeviceAccessible(Long deviceId) {
+        checkDevice(deviceMapper.selectDeviceByDeviceId(deviceId), true);
+    }
+
+    public void assertDeviceAccessibleBySerialNumber(String serialNumber) {
+        checkDevice(deviceMapper.selectDeviceBySerialNumber(serialNumber), true);
+    }
+
+    /** 连接凭据可绕过 broker 侧 ACL 以设备身份接入，因此共享用户不发放，只给归属方 */
+    public void assertDeviceConnectAccessible(Long deviceId) {
+        checkDevice(deviceMapper.selectDeviceByDeviceId(deviceId), false);
+    }
+
+    public void assertProductAccessible(Long productId) {
+        Product product = productMapper.selectProductByProductId(productId);
+        if (product == null) {
+            return;
+        }
+        SysUser user = currentUser();
+        if (isGlobal(user) || Objects.equals(product.getTenantId(), user.getUserId())) {
+            return;
+        }
+        throw new ServiceException("无权访问其他租户的产品");
+    }
+
+    private void checkDevice(Device device, boolean allowShare) {
+        if (device == null) {
+            return;
+        }
+        SysUser user = currentUser();
+        if (isGlobal(user)
+                || Objects.equals(device.getUserId(), user.getUserId())
+                || Objects.equals(device.getTenantId(), user.getUserId())
+                || (allowShare && isShared(device.getDeviceId(), user.getUserId()))) {
+            return;
+        }
+        throw new ServiceException("无权访问其他用户的设备");
+    }
+
+    private boolean isShared(Long deviceId, Long userId) {
+        DeviceUser share = deviceUserMapper.selectDeviceUserByDeviceIdAndUserId(deviceId, userId);
+        return share != null && !"2".equals(share.getDelFlag());
+    }
+
+    private boolean isGlobal(SysUser user) {
+        if (user.isAdmin()) {
+            return true;
+        }
+        return user.getRoles() != null && user.getRoles().stream()
+                .anyMatch(role -> DATA_SCOPE_ALL.equals(role.getDataScope()));
+    }
+
+    private SysUser currentUser() {
+        LoginUser loginUser = SecurityUtils.getLoginUser();
+        if (loginUser == null || loginUser.getUser() == null) {
+            throw new ServiceException("登录状态已失效，请重新登录");
+        }
+        return loginUser.getUser();
+    }
+}

springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/DeviceController.java

@@ -9,6 +9,7 @@ import com.fastbee.common.enums.BusinessType;
 import com.fastbee.common.utils.MessageUtils;
 import com.fastbee.common.utils.StringUtils;
 import com.fastbee.common.utils.poi.ExcelUtil;
+import com.fastbee.data.acl.IotDataAccessGuard;
 import com.fastbee.iot.domain.Device;
 import com.fastbee.iot.model.DeviceRelateUserInput;
 import com.fastbee.iot.model.ThingsModelItem.ThingsModel;
@@ -46,6 +47,9 @@ public class DeviceController extends BaseController
     @Autowired
     private IDeviceService deviceService;
 
+    @Autowired
+    private IotDataAccessGuard accessGuard;
+
     // @Lazy
     @Autowired
     private IMqttMessagePublish messagePublish;
@@ -131,6 +135,7 @@ public class DeviceController extends BaseController
     @ApiOperation("获取设备详情")
     public AjaxResult getInfo(@PathVariable("deviceId") Long deviceId)
     {
+        accessGuard.assertDeviceAccessible(deviceId);
         return AjaxResult.success(deviceService.selectDeviceByDeviceId(deviceId));
     }
 
@@ -142,6 +147,7 @@ public class DeviceController extends BaseController
     @ApiOperation("设备数据同步")
     public AjaxResult deviceSynchronization(@PathVariable("serialNumber") String serialNumber)
     {
+        accessGuard.assertDeviceAccessibleBySerialNumber(serialNumber);
         return AjaxResult.success(messagePublish.deviceSynchronization(serialNumber));
     }
 
@@ -153,6 +159,7 @@ public class DeviceController extends BaseController
     @ApiOperation("根据设备编号获取设备详情")
     public AjaxResult getInfoBySerialNumber(@PathVariable("serialNumber") String serialNumber)
     {
+        accessGuard.assertDeviceAccessibleBySerialNumber(serialNumber);
         return AjaxResult.success(deviceService.selectDeviceBySerialNumber(serialNumber));
     }
 
@@ -175,6 +182,7 @@ public class DeviceController extends BaseController
     @ApiOperation("获取设备详情和运行状态")
     public AjaxResult getRunningStatusInfo(Long deviceId, Integer slaveId)
     {
+        accessGuard.assertDeviceAccessible(deviceId);
         return AjaxResult.success(deviceService.selectDeviceRunningStatusByDeviceId(deviceId,slaveId));
     }
 
@@ -217,6 +225,7 @@ public class DeviceController extends BaseController
     @ApiOperation("修改设备")
     public AjaxResult edit(@RequestBody Device device)
     {
+        accessGuard.assertDeviceAccessible(device.getDeviceId());
         return deviceService.updateDevice(device);
     }
 
@@ -229,6 +238,7 @@ public class DeviceController extends BaseController
     @ApiOperation("重置设备状态")
     public AjaxResult resetDeviceStatus(@PathVariable String serialNumber)
     {
+        accessGuard.assertDeviceAccessibleBySerialNumber(serialNumber);
         Device device=new Device();
         device.setSerialNumber(serialNumber);
         return toAjax(deviceService.resetDeviceStatus(device.getSerialNumber()));
@@ -242,6 +252,9 @@ public class DeviceController extends BaseController
 	@DeleteMapping("/{deviceIds}")
     @ApiOperation("批量删除设备")
     public AjaxResult remove(@PathVariable Long[] deviceIds) throws SchedulerException {
+        for (Long deviceId : deviceIds) {
+            accessGuard.assertDeviceAccessible(deviceId);
+        }
         return toAjax(deviceService.deleteDeviceByDeviceId(deviceIds[0]));
     }
 
@@ -259,6 +272,7 @@ public class DeviceController extends BaseController
     @GetMapping("/gwDevCount")
     @ApiOperation("子设备数量")
     public AjaxResult getGwDevCount(String gwDevCode){
+        accessGuard.assertDeviceAccessibleBySerialNumber(gwDevCode);
         return AjaxResult.success(deviceService.getSubDeviceCount(gwDevCode));
     }
 
@@ -271,6 +285,7 @@ public class DeviceController extends BaseController
     @GetMapping("/getMqttConnectData")
     @ApiOperation("获取设备MQTT连接参数")
     public AjaxResult getMqttConnectData(Long deviceId){
+        accessGuard.assertDeviceConnectAccessible(deviceId);
         return AjaxResult.success(deviceService.getMqttConnectData(deviceId));
     }
 
@@ -281,6 +296,7 @@ public class DeviceController extends BaseController
     @GetMapping("/listThingsModel")
     @ApiOperation("查询变量概况")
     public TableDataInfo listThingsModel(Integer pageNum, Integer pageSize, Long deviceId, String modelName, Integer type, Integer isMonitor, Integer isReadonly) {
+        accessGuard.assertDeviceAccessible(deviceId);
         Device device = deviceService.selectDeviceByDeviceId(deviceId);
         if (Objects.isNull(device)) {
             return new TableDataInfo();

springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ProductController.java

@@ -6,6 +6,7 @@ import com.fastbee.common.core.domain.AjaxResult;
 import com.fastbee.common.core.page.TableDataInfo;
 import com.fastbee.common.enums.BusinessType;
 import com.fastbee.common.utils.poi.ExcelUtil;
+import com.fastbee.data.acl.IotDataAccessGuard;
 import com.fastbee.iot.domain.Product;
 import com.fastbee.iot.model.ChangeProductStatusModel;
 import com.fastbee.iot.model.IdAndName;
@@ -33,6 +34,9 @@ public class ProductController extends BaseController
     @Autowired
     private IProductService productService;
 
+    @Autowired
+    private IotDataAccessGuard accessGuard;
+
     /**
      * 查询产品列表
      */
@@ -79,6 +83,7 @@ public class ProductController extends BaseController
     @ApiOperation("获取产品详情")
     public AjaxResult getInfo(@PathVariable("productId") Long productId)
     {
+        accessGuard.assertProductAccessible(productId);
         return AjaxResult.success(productService.selectProductByProductId(productId));
     }
 
@@ -103,6 +108,7 @@ public class ProductController extends BaseController
     @ApiOperation("修改产品")
     public AjaxResult edit(@RequestBody Product product)
     {
+        accessGuard.assertProductAccessible(product.getProductId());
         return toAjax(productService.updateProduct(product));
     }
 
@@ -114,6 +120,7 @@ public class ProductController extends BaseController
     @ApiOperation("获取产品下面的设备数量")
     public AjaxResult deviceCount(@PathVariable Long productId)
     {
+        accessGuard.assertProductAccessible(productId);
         return AjaxResult.success(productService.selectDeviceCountByProductId(productId));
     }
 
@@ -126,6 +133,7 @@ public class ProductController extends BaseController
     @ApiOperation("更新产品状态")
     public AjaxResult changeProductStatus(@RequestBody ChangeProductStatusModel model)
     {
+        accessGuard.assertProductAccessible(model.getProductId());
         return productService.changeProductStatus(model);
     }
 
@@ -138,6 +146,9 @@ public class ProductController extends BaseController
     @ApiOperation("批量删除产品")
     public AjaxResult remove(@PathVariable Long[] productIds)
     {
+        for (Long productId : productIds) {
+            accessGuard.assertProductAccessible(productId);
+        }
         return productService.deleteProductByProductIds(productIds);
     }