修复门禁：安全化凭据下发与有效期来源

RuoYi-Vue/ruoyi-admin/src/main/java/com/ruoyi/web/controller/train/TrainAccessManagementController.java

@@ -14,13 +14,16 @@ import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
+import com.ruoyi.common.annotation.Log;
 import com.ruoyi.common.core.controller.BaseController;
 import com.ruoyi.common.core.domain.AjaxResult;
 import com.ruoyi.common.core.page.TableDataInfo;
+import com.ruoyi.common.enums.BusinessType;
 import com.ruoyi.common.utils.SecurityUtils;
 import com.ruoyi.train.domain.TrainDormAuth;
 import com.ruoyi.train.domain.TrainExternalOperation;
 import com.ruoyi.train.domain.TrainExternalResourceMapping;
+import com.ruoyi.train.integration.dms.dto.IssueResultVO;
 import com.ruoyi.train.integration.dms.orchestration.AccessAuthorizationOrchestrator;
 import com.ruoyi.train.integration.dms.orchestration.ReconciliationResult;
 import com.ruoyi.train.service.IExternalOperationService;
@@ -221,6 +224,30 @@ public class TrainAccessManagementController extends BaseController
         return success(result);
     }
 
+    /**
+     * 管理员显式触发下发门禁凭据 (交互端点，单次返回明文密码，严禁入库与记入日志)
+     */
+    @PreAuthorize("@ss.hasPermi('train:access:manage')")
+    @Log(title = "门禁授权", businessType = BusinessType.UPDATE, isSaveResponseData = false)
+    @PostMapping("/auth/{authId}/issue")
+    public AjaxResult issueCredential(@PathVariable("authId") Long authId)
+    {
+        IssueResultVO result = accessAuthorizationOrchestrator.issueAuthorization(authId, getUsernameSafe());
+        return success(result);
+    }
+
+    /**
+     * 管理员显式触发注销门禁授权 (统一通过编排器执行)
+     */
+    @PreAuthorize("@ss.hasPermi('train:access:manage')")
+    @Log(title = "门禁授权", businessType = BusinessType.UPDATE)
+    @PostMapping("/auth/{authId}/revoke")
+    public AjaxResult revokeAuth(@PathVariable("authId") Long authId)
+    {
+        ReconciliationResult result = accessAuthorizationOrchestrator.revokeAuthorization(authId, getUsernameSafe());
+        return success(result);
+    }
+
     private String sanitizeSecret(String input)
     {
         if (input == null)