权限门禁：拆分凭据与硬件映射最小权限

RuoYi-Vue/ruoyi-admin/src/main/java/com/ruoyi/web/controller/train/TrainAccessManagementController.java

@@ -60,6 +60,9 @@ public class TrainAccessManagementController extends BaseController
     @Autowired
     private AccessAuthorizationOrchestrator accessAuthorizationOrchestrator;
 
+    @Autowired(required = false)
+    private com.ruoyi.train.integration.dms.config.DmsProperties dmsProperties;
+
     /**
      * 查询指定宿舍的外部资源映射状态（包含房间映射、门锁映射及主锁配置健康度）
      */
@@ -210,6 +213,31 @@ public class TrainAccessManagementController extends BaseController
         return success(sanitizedList);
     }
 
+    /**
+     * 获取门禁能力只读状态 (Section 16: 只返回开关状态与可用性，严禁返回任何密钥/Token/URL)
+     */
+    @PreAuthorize("@ss.hasPermi('train:access:query')")
+    @GetMapping("/capabilities")
+    public AjaxResult getCapabilities()
+    {
+        boolean dmsEnabled = dmsProperties != null && dmsProperties.isEnabled();
+        Map<String, Object> data = new HashMap<>();
+        data.put("dmsEnabled", dmsEnabled);
+        data.put("manualIssueAvailable", dmsEnabled);
+        data.put("manualRevokeAvailable", true);
+        return success(data);
+    }
+
+    /**
+     * 根据住宿安排ID获取门禁授权详细信息 (MIN-08 统一门禁API表面)
+     */
+    @PreAuthorize("@ss.hasPermi('train:access:query')")
+    @GetMapping(value = "/auth/accommodation/{accommodationId}")
+    public AjaxResult getAuthByAccommodationId(@PathVariable("accommodationId") Long accommodationId)
+    {
+        return success(trainDormAuthService.selectTrainDormAuthByAccommodationId(accommodationId));
+    }
+
     /**
      * 管理员手动触发参训学员门禁权限对账
      * <p>
@@ -225,9 +253,9 @@ public class TrainAccessManagementController extends BaseController
     }
 
     /**
-     * 管理员显式触发下发门禁凭据 (交互端点，单次返回明文密码，严禁入库与记入日志)
+     * 管理员显式触发下发门禁凭据 (交互端点，单次返回明文密码，严禁入库与记入日志，MIN-09: train:access:credential)
      */
-    @PreAuthorize("@ss.hasPermi('train:access:manage')")
+    @PreAuthorize("@ss.hasPermi('train:access:credential')")
     @Log(title = "门禁授权", businessType = BusinessType.UPDATE, isSaveResponseData = false)
     @PostMapping("/auth/{authId}/issue")
     public AjaxResult issueCredential(@PathVariable("authId") Long authId)
@@ -237,9 +265,9 @@ public class TrainAccessManagementController extends BaseController
     }
 
     /**
-     * 管理员显式触发注销门禁授权 (统一通过编排器执行)
+     * 管理员显式触发注销门禁授权 (统一通过编排器执行，MIN-09: train:access:credential)
      */
-    @PreAuthorize("@ss.hasPermi('train:access:manage')")
+    @PreAuthorize("@ss.hasPermi('train:access:credential')")
     @Log(title = "门禁授权", businessType = BusinessType.UPDATE)
     @PostMapping("/auth/{authId}/revoke")
     public AjaxResult revokeAuth(@PathVariable("authId") Long authId)

RuoYi-Vue/ruoyi-admin/src/main/java/com/ruoyi/web/controller/train/TrainDormAuthController.java

@@ -1,87 +0,0 @@
-package com.ruoyi.web.controller.train;
-
-import java.util.List;
-import javax.servlet.http.HttpServletResponse;
-import org.springframework.security.access.prepost.PreAuthorize;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.PutMapping;
-import org.springframework.web.bind.annotation.DeleteMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-import com.ruoyi.common.annotation.Log;
-import com.ruoyi.common.core.controller.BaseController;
-import com.ruoyi.common.core.domain.AjaxResult;
-import com.ruoyi.common.enums.BusinessType;
-import com.ruoyi.train.domain.TrainDormAuth;
-import com.ruoyi.train.service.ITrainDormAuthService;
-import com.ruoyi.common.utils.poi.ExcelUtil;
-import com.ruoyi.common.core.page.TableDataInfo;
-import com.ruoyi.common.utils.SecurityUtils;
-
-/**
- * 宿舍门禁授权Controller (Database V2)
- *
- * @author ruoyi
- * @date 2026-09-15
- */
-@RestController
-@RequestMapping("/train/auth")
-public class TrainDormAuthController extends BaseController
-{
-    @Autowired
-    private ITrainDormAuthService trainDormAuthService;
-
-    /**
-     * 查询宿舍权限分配列表
-     */
-    @PreAuthorize("@ss.hasPermi('system:auth:list')")
-    @GetMapping("/list")
-    public TableDataInfo list(TrainDormAuth trainDormAuth)
-    {
-        startPage();
-        List<TrainDormAuth> list = trainDormAuthService.selectTrainDormAuthList(trainDormAuth);
-        return getDataTable(list);
-    }
-
-    /**
-     * 导出宿舍权限分配列表
-     */
-    @PreAuthorize("@ss.hasPermi('system:auth:export')")
-    @Log(title = "宿舍权限分配", businessType = BusinessType.EXPORT)
-    @PostMapping("/export")
-    public void export(HttpServletResponse response, TrainDormAuth trainDormAuth)
-    {
-        List<TrainDormAuth> list = trainDormAuthService.selectTrainDormAuthList(trainDormAuth);
-        ExcelUtil<TrainDormAuth> util = new ExcelUtil<TrainDormAuth>(TrainDormAuth.class);
-        util.exportExcel(response, list, "宿舍权限分配数据");
-    }
-
-    /**
-     * 获取宿舍权限分配详细信息
-     */
-    @PreAuthorize("@ss.hasPermi('system:auth:query')")
-    @GetMapping(value = "/{authId}")
-    public AjaxResult getInfo(@PathVariable("authId") Long authId)
-    {
-        return success(trainDormAuthService.selectTrainDormAuthByAuthId(authId));
-    }
-
-    /**
-     * 根据住宿安排ID获取门禁授权详细信息
-     */
-    @PreAuthorize("@ss.hasPermi('system:auth:query')")
-    @GetMapping(value = "/accommodation/{accommodationId}")
-    public AjaxResult getInfoByAccommodationId(@PathVariable("accommodationId") Long accommodationId)
-    {
-        return success(trainDormAuthService.selectTrainDormAuthByAccommodationId(accommodationId));
-    }
-
-    // 注意：Package A 架构整改：门禁授权的所有写操作（新增、修改、下发凭据、注销、删除）
-    // 统一收归到 TrainAccessManagementController -> AccessAuthorizationOrchestrator -> DMS 权威调用链。
-    // TrainDormAuthController 仅保留纯读取端点（list, export, getInfo, getInfoByAccommodationId）。
-}
-

build_ui/src/api/train/auth.js

@@ -1,18 +0,0 @@
-import request from '@/utils/request'
-
-// 查询宿舍权限分配列表
-export function listAuth(query) {
-  return request({
-    url: '/train/auth/list',
-    method: 'get',
-    params: query
-  })
-}
-
-// 查询宿舍权限分配详细
-export function getAuth(authId) {
-  return request({
-    url: '/train/auth/' + authId,
-    method: 'get'
-  })
-}