修复门禁：统一授权状态机与注销入口

RuoYi-Vue/ruoyi-admin/src/main/java/com/ruoyi/web/controller/train/TrainDormAuthController.java

@@ -38,7 +38,7 @@ public class TrainDormAuthController extends BaseController
     /**
      * 查询宿舍权限分配列表
      */
-    @PreAuthorize("@ss.hasPermi('system:auth:list')")
+    @PreAuthorize("@ss.hasPermi('train:access:query') or @ss.hasPermi('system:auth:list')")
     @GetMapping("/list")
     public TableDataInfo list(TrainDormAuth trainDormAuth)
     {
@@ -80,61 +80,8 @@ public class TrainDormAuthController extends BaseController
         return success(trainDormAuthService.selectTrainDormAuthByAccommodationId(accommodationId));
     }
 
-    /**
-     * 新增宿舍权限分配
-     */
-    @PreAuthorize("@ss.hasPermi('system:auth:add')")
-    @Log(title = "宿舍权限分配", businessType = BusinessType.INSERT)
-    @PostMapping
-    public AjaxResult add(@RequestBody TrainDormAuth trainDormAuth)
-    {
-        trainDormAuth.setCreateBy(getUsernameSafe());
-        return toAjax(trainDormAuthService.insertTrainDormAuth(trainDormAuth));
-    }
-
-    /**
-     * 修改宿舍权限分配
-     */
-    @PreAuthorize("@ss.hasPermi('system:auth:edit')")
-    @Log(title = "宿舍权限分配", businessType = BusinessType.UPDATE)
-    @PutMapping
-    public AjaxResult edit(@RequestBody TrainDormAuth trainDormAuth)
-    {
-        trainDormAuth.setUpdateBy(getUsernameSafe());
-        return toAjax(trainDormAuthService.updateTrainDormAuth(trainDormAuth));
-    }
-
-    /**
-     * 注销宿舍权限分配
-     */
-    @PreAuthorize("@ss.hasPermi('system:auth:edit')")
-    @Log(title = "宿舍权限分配-注销", businessType = BusinessType.UPDATE)
-    @PostMapping("/{authId}/revoke")
-    public AjaxResult revoke(@PathVariable("authId") Long authId)
-    {
-        return toAjax(trainDormAuthService.revokeAuth(authId, getUsernameSafe()));
-    }
-
-    /**
-     * 删除宿舍权限分配
-     */
-    @PreAuthorize("@ss.hasPermi('system:auth:remove')")
-    @Log(title = "宿舍权限分配", businessType = BusinessType.DELETE)
-    @DeleteMapping("/{authIds}")
-    public AjaxResult remove(@PathVariable Long[] authIds)
-    {
-        return toAjax(trainDormAuthService.deleteTrainDormAuthByAuthIds(authIds));
-    }
-
-    private String getUsernameSafe()
-    {
-        try
-        {
-            return SecurityUtils.getUsername();
-        }
-        catch (Exception e)
-        {
-            return "admin";
-        }
-    }
+    // 注意：Package A 架构整改：门禁授权的所有写操作（新增、修改、下发凭据、注销、删除）
+    // 统一收归到 TrainAccessManagementController -> AccessAuthorizationOrchestrator -> DMS 权威调用链。
+    // TrainDormAuthController 仅保留纯读取端点（list, export, getInfo, getInfoByAccommodationId）。
 }
+

RuoYi-Vue/ruoyi-admin/src/test/java/com/ruoyi/web/controller/train/AccommodationAndAuthApiControllerContractTest.java

@@ -2,6 +2,7 @@ package com.ruoyi.web.controller.train;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.fail;
 
 import java.lang.reflect.Method;
 import org.junit.Test;
@@ -116,15 +117,26 @@ public class AccommodationAndAuthApiControllerContractTest
         assertEquals("/accommodation/{accommodationId}", accInfoMethod.getAnnotation(GetMapping.class).value()[0]);
         assertEquals("@ss.hasPermi('system:auth:query')", accInfoMethod.getAnnotation(PreAuthorize.class).value());
 
-        // 4. POST /train/auth
-        Method addMethod = clazz.getMethod("add", TrainDormAuth.class);
-        assertNotNull(addMethod.getAnnotation(PostMapping.class));
-        assertEquals("@ss.hasPermi('system:auth:add')", addMethod.getAnnotation(PreAuthorize.class).value());
+        // 4. 验证 Package A 安全架构：TrainDormAuthController 彻底移除写端点 (add, edit, revoke, remove)
+        try {
+            clazz.getMethod("add", TrainDormAuth.class);
+            fail("TrainDormAuthController 不得存在 POST add 写端点");
+        } catch (NoSuchMethodException expected) {}
 
-        // 5. POST /train/auth/{authId}/revoke
-        Method revokeMethod = clazz.getMethod("revoke", Long.class);
-        assertNotNull(revokeMethod.getAnnotation(PostMapping.class));
-        assertEquals("/{authId}/revoke", revokeMethod.getAnnotation(PostMapping.class).value()[0]);
-        assertEquals("@ss.hasPermi('system:auth:edit')", revokeMethod.getAnnotation(PreAuthorize.class).value());
+        try {
+            clazz.getMethod("edit", TrainDormAuth.class);
+            fail("TrainDormAuthController 不得存在 PUT edit 写端点");
+        } catch (NoSuchMethodException expected) {}
+
+        try {
+            clazz.getMethod("revoke", Long.class);
+            fail("TrainDormAuthController 不得存在 POST revoke 写端点");
+        } catch (NoSuchMethodException expected) {}
+
+        try {
+            clazz.getMethod("remove", Long[].class);
+            fail("TrainDormAuthController 不得存在 DELETE remove 写端点");
+        } catch (NoSuchMethodException expected) {}
     }
 }
+

RuoYi-Vue/ruoyi-admin/src/test/java/com/ruoyi/web/controller/train/PreCustomerStabilizationFinalFixesContractTest.java

@@ -258,12 +258,12 @@ public class PreCustomerStabilizationFinalFixesContractTest
         assertNotNull(accPre);
         assertEquals("@ss.hasPermi('train:accommodation:remove')", accPre.value());
 
-        // 门禁撤销
-        Method authRevoke = TrainDormAuthController.class.getMethod("revoke", Long.class);
-        assertNotNull(authRevoke);
-        PreAuthorize authRevokePre = authRevoke.getAnnotation(PreAuthorize.class);
-        assertNotNull(authRevokePre);
-        assertEquals("@ss.hasPermi('system:auth:edit')", authRevokePre.value());
+        // 门禁撤销：TrainDormAuthController 彻底移除写接口 revoke，收归至 TrainAccessManagementController
+        try {
+            TrainDormAuthController.class.getMethod("revoke", Long.class);
+            fail("TrainDormAuthController 不得存在 revoke 写接口");
+        } catch (NoSuchMethodException expected) {}
+
 
         // 成绩删除
         Method scoreRemove = TrainScoreInfoController.class.getMethod("remove", Long[].class);