新增门禁：实现访问管理界面与Mock端到端测试

RuoYi-Vue/ruoyi-admin/src/main/java/com/ruoyi/web/controller/train/TrainAccessManagementController.java

@@ -0,0 +1,245 @@
+package com.ruoyi.web.controller.train;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import com.ruoyi.common.core.controller.BaseController;
+import com.ruoyi.common.core.domain.AjaxResult;
+import com.ruoyi.common.core.page.TableDataInfo;
+import com.ruoyi.common.utils.SecurityUtils;
+import com.ruoyi.train.domain.TrainDormAuth;
+import com.ruoyi.train.domain.TrainExternalOperation;
+import com.ruoyi.train.domain.TrainExternalResourceMapping;
+import com.ruoyi.train.integration.dms.orchestration.AccessAuthorizationOrchestrator;
+import com.ruoyi.train.integration.dms.orchestration.ReconciliationResult;
+import com.ruoyi.train.service.IExternalOperationService;
+import com.ruoyi.train.service.IExternalResourceMappingService;
+import com.ruoyi.train.service.ITrainDormAuthService;
+
+/**
+ * 宿舍门禁与外部资源映射管理端Controller (Wave 3B)
+ * <p>
+ * 安全红线：
+ * 1. 严格限制管理员权限访问 (train:access:manage / train:access:query)；
+ * 2. 严禁提供远程开锁 (Remote Unlock) 入口；
+ * 3. 严禁向前端返回任何明文密码 (password)、Token 或 Secret；
+ * 4. 手动对账严格遵循领域业务前置条件校验，绝不提供绕过前置条件的强开接口。
+ *
+ * @author ruoyi
+ * @date 2026-09-16
+ */
+@RestController
+@RequestMapping("/train/access")
+public class TrainAccessManagementController extends BaseController
+{
+    private static final String DEFAULT_VENDOR = "DMS";
+
+    @Autowired
+    private IExternalResourceMappingService externalResourceMappingService;
+
+    @Autowired
+    private ITrainDormAuthService trainDormAuthService;
+
+    @Autowired
+    private IExternalOperationService externalOperationService;
+
+    @Autowired
+    private AccessAuthorizationOrchestrator accessAuthorizationOrchestrator;
+
+    /**
+     * 查询指定宿舍的外部资源映射状态（包含房间映射、门锁映射及主锁配置健康度）
+     */
+    @PreAuthorize("@ss.hasPermi('train:access:query')")
+    @GetMapping("/mapping/dorm/{dormId}")
+    public AjaxResult getDormMapping(@PathVariable("dormId") String dormId)
+    {
+        TrainExternalResourceMapping roomMapping = externalResourceMappingService.getActiveRoomMapping(DEFAULT_VENDOR, dormId);
+        List<TrainExternalResourceMapping> lockMappings = externalResourceMappingService.getActiveLockMappings(DEFAULT_VENDOR, dormId);
+        if (lockMappings == null)
+        {
+            lockMappings = new ArrayList<>();
+        }
+
+        long primaryCount = lockMappings.stream()
+                .filter(l -> l.getIsPrimary() != null && l.getIsPrimary() == 1)
+                .count();
+
+        Map<String, Object> data = new HashMap<>();
+        data.put("dormId", dormId);
+        data.put("vendorCode", DEFAULT_VENDOR);
+        data.put("roomMapping", roomMapping);
+        data.put("lockMappings", lockMappings);
+        data.put("lockCount", lockMappings.size());
+        data.put("primaryLockCount", primaryCount);
+        data.put("hasPrimaryLock", primaryCount == 1);
+        data.put("isConfigValid", primaryCount == 1 && roomMapping != null);
+
+        if (primaryCount == 0)
+        {
+            data.put("configError", "未配置主门锁 (0 primary lock)，门禁凭据无法自动下发");
+        }
+        else if (primaryCount > 1)
+        {
+            data.put("configError", "配置异常：存在多把主门锁 (" + primaryCount + " primary locks)，违反单一主锁最少特权原则");
+        }
+        else if (roomMapping == null)
+        {
+            data.put("configError", "未绑定外部房间映射 (No active room mapping)");
+        }
+        else
+        {
+            data.put("configError", null);
+        }
+
+        return success(data);
+    }
+
+    /**
+     * 绑定或更新宿舍外部房间映射
+     */
+    @PreAuthorize("@ss.hasPermi('train:access:manage')")
+    @PostMapping("/mapping/bind-room")
+    public AjaxResult bindRoomMapping(@RequestBody TrainExternalResourceMapping mapping)
+    {
+        if (mapping.getVendorCode() == null || mapping.getVendorCode().trim().isEmpty())
+        {
+            mapping.setVendorCode(DEFAULT_VENDOR);
+        }
+        mapping.setCreateBy(getUsernameSafe());
+        TrainExternalResourceMapping result = externalResourceMappingService.bindRoomMapping(mapping);
+        return success(result);
+    }
+
+    /**
+     * 绑定或新增宿舍外部门锁映射 (支持一房多锁)
+     */
+    @PreAuthorize("@ss.hasPermi('train:access:manage')")
+    @PostMapping("/mapping/bind-lock")
+    public AjaxResult bindLockMapping(@RequestBody TrainExternalResourceMapping mapping)
+    {
+        if (mapping.getVendorCode() == null || mapping.getVendorCode().trim().isEmpty())
+        {
+            mapping.setVendorCode(DEFAULT_VENDOR);
+        }
+        mapping.setCreateBy(getUsernameSafe());
+        TrainExternalResourceMapping result = externalResourceMappingService.bindLockMapping(mapping);
+        return success(result);
+    }
+
+    /**
+     * 解除/注销指定的外部资源映射
+     */
+    @PreAuthorize("@ss.hasPermi('train:access:manage')")
+    @DeleteMapping("/mapping/{mappingId}")
+    public AjaxResult unbindMapping(@PathVariable("mappingId") Long mappingId)
+    {
+        boolean ok = externalResourceMappingService.deactivateMapping(mappingId, getUsernameSafe());
+        return toAjax(ok ? 1 : 0);
+    }
+
+    /**
+     * 查询门禁授权列表 (支持按学员、宿舍、状态筛选)
+     */
+    @PreAuthorize("@ss.hasPermi('train:access:query')")
+    @GetMapping("/auth/list")
+    public TableDataInfo listAuth(TrainDormAuth trainDormAuth)
+    {
+        startPage();
+        List<TrainDormAuth> list = trainDormAuthService.selectTrainDormAuthList(trainDormAuth);
+        return getDataTable(list);
+    }
+
+    /**
+     * 获取指定门禁授权详细信息
+     */
+    @PreAuthorize("@ss.hasPermi('train:access:query')")
+    @GetMapping("/auth/{authId}")
+    public AjaxResult getAuthDetail(@PathVariable("authId") Long authId)
+    {
+        TrainDormAuth auth = trainDormAuthService.selectTrainDormAuthByAuthId(authId);
+        return success(auth);
+    }
+
+    /**
+     * 查询指定门禁授权下的外部操作流水历史 (全要素脱敏返回，绝不泄漏密码或凭据)
+     */
+    @PreAuthorize("@ss.hasPermi('train:access:query')")
+    @GetMapping("/operations/{doorAuthId}")
+    public AjaxResult getOperationHistory(@PathVariable("doorAuthId") Long doorAuthId)
+    {
+        List<TrainExternalOperation> operations = externalOperationService.listOperationsByDoorAuthId(doorAuthId);
+        List<Map<String, Object>> sanitizedList = new ArrayList<>();
+        if (operations != null)
+        {
+            for (TrainExternalOperation op : operations)
+            {
+                Map<String, Object> item = new HashMap<>();
+                item.put("operationId", op.getOperationId());
+                item.put("doorAuthId", op.getDoorAuthId());
+                item.put("operationType", op.getOperationType());
+                item.put("operationStatus", op.getOperationStatus());
+                item.put("vendorCode", op.getVendorCode());
+                item.put("externalOperationId", op.getExternalOperationId());
+                item.put("externalHardwareId", op.getExternalHardwareId());
+                item.put("attemptCount", op.getAttemptCount());
+                item.put("requestedAt", op.getRequestedAt());
+                item.put("completedAt", op.getCompletedAt());
+                item.put("nextPollTime", op.getNextPollTime());
+                item.put("createTime", op.getCreateTime());
+                item.put("updateTime", op.getUpdateTime());
+                item.put("lastErrorCode", op.getLastErrorCode());
+                item.put("lastErrorMessage", sanitizeSecret(op.getLastErrorMessage()));
+                item.put("remark", sanitizeSecret(op.getRemark()));
+                sanitizedList.add(item);
+            }
+        }
+        return success(sanitizedList);
+    }
+
+    /**
+     * 管理员手动触发参训学员门禁权限对账
+     * <p>
+     * 严格遵循相同前置条件校验规则：未报到、未分宿、缺映射或门锁配置异常均正常返回 WAITING_FOR_PREREQUISITE，
+     * 绝不提供绕过安全前置条件的强开权限逻辑。
+     */
+    @PreAuthorize("@ss.hasPermi('train:access:reconcile')")
+    @PostMapping("/reconcile/{enrollmentId}")
+    public AjaxResult manualReconcile(@PathVariable("enrollmentId") Long enrollmentId)
+    {
+        ReconciliationResult result = accessAuthorizationOrchestrator.reconcile(enrollmentId);
+        return success(result);
+    }
+
+    private String sanitizeSecret(String input)
+    {
+        if (input == null)
+        {
+            return null;
+        }
+        return input.replaceAll("(?i)(password|token|secret|appsecret)=[^&\\s]+", "$1=[PROTECTED]")
+                    .replaceAll("(?i)(\"password\"\\s*:\\s*\")[^\"]+(\")", "$1[PROTECTED]$2");
+    }
+
+    private String getUsernameSafe()
+    {
+        try
+        {
+            return SecurityUtils.getUsername();
+        }
+        catch (Exception e)
+        {
+            return "admin";
+        }
+    }
+}

RuoYi-Vue/ruoyi-admin/src/test/java/com/ruoyi/web/controller/train/DmsAccessManagementPermissionMigrationContractTest.java

@@ -0,0 +1,56 @@
+package com.ruoyi.web.controller.train;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import org.junit.Test;
+
+/**
+ * 010 DMS 门禁与外部资源映射管理权限 Migration 契约测试 (Wave 3B Gate M)
+ */
+public class DmsAccessManagementPermissionMigrationContractTest
+{
+    @Test
+    public void migrationClosesAccessManagementPermissionsWithoutRoleWrites() throws Exception
+    {
+        String sql = new String(Files.readAllBytes(findMigration()), StandardCharsets.UTF_8).toLowerCase();
+
+        // 必须包含新增的核心权限标识与幂等子句
+        assertContains(sql,
+                "2191", "train:access:query",
+                "2192", "train:access:manage",
+                "2193", "train:access:reconcile",
+                "menu_type", "'f'", "where not exists");
+
+        // 严禁修改角色权限映射 (角色授权由后续 RBAC 统一分配)
+        assertFalse("migration must not insert role assignments", sql.contains("insert into public.sys_role_menu"));
+        assertFalse("migration must not update role assignments", sql.contains("update public.sys_role_menu"));
+        assertFalse("migration must not delete role assignments", sql.contains("delete from public.sys_role_menu"));
+
+        // 严禁包含高危远程开锁权限或泛化无约束权限
+        assertFalse("must not create remote unlock permission", sql.contains("remoteunlock") || sql.contains("remote-unlock"));
+        assertFalse("must not contain plaintext password column", sql.contains("password") || sql.contains("secret"));
+    }
+
+    private Path findMigration()
+    {
+        for (Path path = Paths.get("").toAbsolutePath(); path != null; path = path.getParent())
+        {
+            Path candidate = path.resolve("sql/system/kingbase/010_dms_access_management_permissions.sql");
+            if (Files.isRegularFile(candidate)) return candidate;
+        }
+        throw new IllegalStateException("010_dms_access_management_permissions.sql migration not found from working directory");
+    }
+
+    private void assertContains(String sql, String... tokens)
+    {
+        for (String token : tokens)
+        {
+            assertTrue("missing migration token: " + token, sql.contains(token));
+        }
+    }
+}

RuoYi-Vue/ruoyi-admin/src/test/java/com/ruoyi/web/controller/train/TrainAccessManagementControllerTest.java

@@ -0,0 +1,269 @@
+package com.ruoyi.web.controller.train;
+
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+
+import org.junit.Before;
+import org.junit.Test;
+import static org.junit.Assert.*;
+
+import com.ruoyi.common.core.domain.AjaxResult;
+import com.ruoyi.common.core.page.TableDataInfo;
+import com.ruoyi.train.domain.TrainDormAuth;
+import com.ruoyi.train.domain.TrainExternalOperation;
+import com.ruoyi.train.domain.TrainExternalResourceMapping;
+import com.ruoyi.train.integration.dms.orchestration.AccessAuthorizationOrchestrator;
+import com.ruoyi.train.integration.dms.orchestration.ReconciliationDecision;
+import com.ruoyi.train.integration.dms.orchestration.ReconciliationResult;
+import com.ruoyi.train.service.IExternalOperationService;
+import com.ruoyi.train.service.IExternalResourceMappingService;
+import com.ruoyi.train.service.ITrainDormAuthService;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.Proxy;
+
+/**
+ * 门禁与外部资源映射管理控制器自动化测试 (Wave 3B)
+ */
+public class TrainAccessManagementControllerTest
+{
+    private TrainAccessManagementController controller;
+
+    private List<TrainExternalResourceMapping> mappingDb;
+    private List<TrainDormAuth> dormAuthDb;
+    private List<TrainExternalOperation> operationDb;
+
+    @Before
+    public void setUp() throws Exception
+    {
+        controller = new TrainAccessManagementController();
+        mappingDb = new ArrayList<>();
+        dormAuthDb = new ArrayList<>();
+        operationDb = new ArrayList<>();
+
+        IExternalResourceMappingService mappingService = (IExternalResourceMappingService) Proxy.newProxyInstance(
+                getClass().getClassLoader(),
+                new Class<?>[]{IExternalResourceMappingService.class},
+                (proxy, method, args) -> {
+                    String name = method.getName();
+                    if ("getActiveRoomMapping".equals(name)) {
+                        String dormId = (String) args[1];
+                        return mappingDb.stream()
+                                .filter(m -> dormId.equals(m.getDormId()) && "ROOM".equals(m.getExternalResourceType()) && "ACTIVE".equals(m.getMappingStatus()))
+                                .findFirst().orElse(null);
+                    }
+                    if ("getActiveLockMappings".equals(name)) {
+                        String dormId = (String) args[1];
+                        List<TrainExternalResourceMapping> locks = new ArrayList<>();
+                        for (TrainExternalResourceMapping m : mappingDb) {
+                            if (dormId.equals(m.getDormId()) && "DOOR_LOCK".equals(m.getExternalResourceType()) && "ACTIVE".equals(m.getMappingStatus())) {
+                                locks.add(m);
+                            }
+                        }
+                        return locks;
+                    }
+                    if ("bindRoomMapping".equals(name)) {
+                        TrainExternalResourceMapping m = (TrainExternalResourceMapping) args[0];
+                        m.setMappingId(101L);
+                        m.setMappingStatus("ACTIVE");
+                        mappingDb.add(m);
+                        return m;
+                    }
+                    if ("bindLockMapping".equals(name)) {
+                        TrainExternalResourceMapping m = (TrainExternalResourceMapping) args[0];
+                        m.setMappingId(201L);
+                        m.setMappingStatus("ACTIVE");
+                        mappingDb.add(m);
+                        return m;
+                    }
+                    if ("deactivateMapping".equals(name)) {
+                        Long mappingId = (Long) args[0];
+                        mappingDb.removeIf(m -> mappingId.equals(m.getMappingId()));
+                        return true;
+                    }
+                    return null;
+                }
+        );
+
+        ITrainDormAuthService authService = (ITrainDormAuthService) Proxy.newProxyInstance(
+                getClass().getClassLoader(),
+                new Class<?>[]{ITrainDormAuthService.class},
+                (proxy, method, args) -> {
+                    String name = method.getName();
+                    if ("selectTrainDormAuthList".equals(name)) {
+                        return dormAuthDb;
+                    }
+                    if ("selectTrainDormAuthByAuthId".equals(name)) {
+                        Long id = (Long) args[0];
+                        return dormAuthDb.stream().filter(a -> id.equals(a.getAuthId())).findFirst().orElse(null);
+                    }
+                    return null;
+                }
+        );
+
+        IExternalOperationService operationService = (IExternalOperationService) Proxy.newProxyInstance(
+                getClass().getClassLoader(),
+                new Class<?>[]{IExternalOperationService.class},
+                (proxy, method, args) -> {
+                    if ("listOperationsByDoorAuthId".equals(method.getName())) {
+                        Long doorAuthId = (Long) args[0];
+                        List<TrainExternalOperation> list = new ArrayList<>();
+                        for (TrainExternalOperation op : operationDb) {
+                            if (doorAuthId.equals(op.getDoorAuthId())) {
+                                list.add(op);
+                            }
+                        }
+                        return list;
+                    }
+                    return null;
+                }
+        );
+
+        AccessAuthorizationOrchestrator orchestrator = new AccessAuthorizationOrchestrator() {
+            @Override
+            public ReconciliationResult reconcile(Long enrollmentId) {
+                if (enrollmentId == 999L) {
+                    return ReconciliationResult.waiting("Prerequisites missing: enrollment not reported");
+                }
+                return ReconciliationResult.grantRequired(10L, 501L, true, true, "Triggered by admin manual reconcile");
+            }
+        };
+
+        setField(controller, "externalResourceMappingService", mappingService);
+        setField(controller, "trainDormAuthService", authService);
+        setField(controller, "externalOperationService", operationService);
+        setField(controller, "accessAuthorizationOrchestrator", orchestrator);
+    }
+
+    /**
+     * 测试房间门锁映射查询及主锁配置健康度判断：
+     * 1. 0主锁 -> configError
+     * 2. 1主锁 -> isConfigValid = true
+     * 3. 2主锁 -> configError
+     */
+    @Test
+    @SuppressWarnings("unchecked")
+    public void testGetDormMapping_HealthAndPrimaryPolicy()
+    {
+        String dormId = "DORM-301";
+
+        // 1. 无任何映射 -> 0 primary
+        AjaxResult r1 = controller.getDormMapping(dormId);
+        assertEquals(200, r1.get("code"));
+        Map<String, Object> data1 = (Map<String, Object>) r1.get("data");
+        assertEquals(0L, data1.get("primaryLockCount"));
+        assertFalse((Boolean) data1.get("isConfigValid"));
+        assertNotNull(data1.get("configError"));
+        assertTrue(data1.get("configError").toString().contains("0 primary lock"));
+
+        // 2. 绑定 1 个房间与 1 个主门锁 -> 正常有效
+        TrainExternalResourceMapping room = new TrainExternalResourceMapping();
+        room.setDormId(dormId);
+        room.setExternalResourceType("ROOM");
+        room.setMappingStatus("ACTIVE");
+        mappingDb.add(room);
+
+        TrainExternalResourceMapping lock1 = new TrainExternalResourceMapping();
+        lock1.setDormId(dormId);
+        lock1.setExternalResourceType("DOOR_LOCK");
+        lock1.setIsPrimary(1);
+        lock1.setMappingStatus("ACTIVE");
+        mappingDb.add(lock1);
+
+        AjaxResult r2 = controller.getDormMapping(dormId);
+        Map<String, Object> data2 = (Map<String, Object>) r2.get("data");
+        assertEquals(1L, data2.get("primaryLockCount"));
+        assertTrue((Boolean) data2.get("isConfigValid"));
+        assertNull(data2.get("configError"));
+
+        // 3. 误配置了第 2 个主锁 -> 配置异常
+        TrainExternalResourceMapping lock2 = new TrainExternalResourceMapping();
+        lock2.setDormId(dormId);
+        lock2.setExternalResourceType("DOOR_LOCK");
+        lock2.setIsPrimary(1);
+        lock2.setMappingStatus("ACTIVE");
+        mappingDb.add(lock2);
+
+        AjaxResult r3 = controller.getDormMapping(dormId);
+        Map<String, Object> data3 = (Map<String, Object>) r3.get("data");
+        assertEquals(2L, data3.get("primaryLockCount"));
+        assertFalse((Boolean) data3.get("isConfigValid"));
+        assertTrue(data3.get("configError").toString().contains("存在多把主门锁"));
+    }
+
+    /**
+     * 测试操作流水查询与敏感数据脱敏：
+     * 即使原始错误消息或备注中含有 password 或 token，API 必须将其全局替换为 [PROTECTED]
+     */
+    @Test
+    @SuppressWarnings("unchecked")
+    public void testGetOperationHistory_SanitizesSensitiveData()
+    {
+        Long authId = 88L;
+        TrainExternalOperation op = new TrainExternalOperation();
+        op.setOperationId(1001L);
+        op.setDoorAuthId(authId);
+        op.setOperationType("GRANT");
+        op.setOperationStatus("FAILED");
+        op.setLastErrorMessage("DMS responded error: password=PlaintextSecret123&appsecret=TopSecretValue");
+        op.setRemark("Operator tried with token=raw_token_xyz");
+        operationDb.add(op);
+
+        AjaxResult r = controller.getOperationHistory(authId);
+        assertEquals(200, r.get("code"));
+        List<Map<String, Object>> list = (List<Map<String, Object>>) r.get("data");
+        assertEquals(1, list.size());
+
+        Map<String, Object> item = list.get(0);
+        String errMsg = (String) item.get("lastErrorMessage");
+        String remark = (String) item.get("remark");
+
+        assertFalse("Password must not be leaked in error message", errMsg.contains("PlaintextSecret123"));
+        assertFalse("AppSecret must not be leaked in error message", errMsg.contains("TopSecretValue"));
+        assertFalse("Token must not be leaked in remark", remark.contains("raw_token_xyz"));
+        assertTrue("Sensitive text must be replaced with [PROTECTED]", errMsg.contains("[PROTECTED]"));
+    }
+
+    /**
+     * 测试手动对账接口：继续遵循相同前置条件校验，绝不提供绕过前置条件的强开权限
+     */
+    @Test
+    public void testManualReconcile_RespectsPrerequisites()
+    {
+        // 1. 未满足条件学员 -> WAITING_FOR_PREREQUISITE
+        AjaxResult r1 = controller.manualReconcile(999L);
+        assertEquals(200, r1.get("code"));
+        ReconciliationResult res1 = (ReconciliationResult) r1.get("data");
+        assertEquals(ReconciliationDecision.WAITING_FOR_PREREQUISITE, res1.getDecision());
+
+        // 2. 满足条件学员 -> GRANT_REQUIRED
+        AjaxResult r2 = controller.manualReconcile(111L);
+        assertEquals(200, r2.get("code"));
+        ReconciliationResult res2 = (ReconciliationResult) r2.get("data");
+        assertEquals(ReconciliationDecision.GRANT_REQUIRED, res2.getDecision());
+    }
+
+    /**
+     * 安全基线红线断言：
+     * 1. 控制器中严禁存在任何名为 remoteUnlock 或类似远程应急开锁方法
+     * 2. 控制器类所有公开方法均无密码明文入参或返回
+     */
+    @Test
+    public void testSecurityReview_ZeroRemoteUnlockMethod()
+    {
+        for (Method m : TrainAccessManagementController.class.getDeclaredMethods()) {
+            String name = m.getName().toLowerCase();
+            assertFalse("Remote unlock is strictly prohibited in controller: " + name,
+                    name.contains("remoteunlock") || name.contains("remote_unlock") || name.contains("forceunlock"));
+        }
+    }
+
+    private void setField(Object target, String fieldName, Object value) throws Exception
+    {
+        Field f = target.getClass().getDeclaredField(fieldName);
+        f.setAccessible(true);
+        f.set(target, value);
+    }
+}

RuoYi-Vue/ruoyi-train/src/main/java/com/ruoyi/train/domain/TrainDormAuth.java

@@ -121,6 +121,9 @@ public class TrainDormAuth extends BaseEntity
     /** 床位号 (非物理列，联表自 train_accommodation) */
     private String bedNo;
 
+    /** 报名ID/学员选课ID (非物理列，联表自 train_accommodation) */
+    private Long enrollmentId;
+
     /** 创建管理员 (兼容旧字段，映射到 BaseEntity.createBy) */
     private String createUser;
 
@@ -378,6 +381,16 @@ public class TrainDormAuth extends BaseEntity
         this.bedNo = bedNo;
     }
 
+    public Long getEnrollmentId()
+    {
+        return enrollmentId;
+    }
+
+    public void setEnrollmentId(Long enrollmentId)
+    {
+        this.enrollmentId = enrollmentId;
+    }
+
     public String getCreateUser()
     {
         return createUser != null ? createUser : getCreateBy();

RuoYi-Vue/ruoyi-train/src/main/resources/mapper/train/TrainDormAuthMapper.xml

@@ -28,12 +28,21 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         <result property="dormRoom"          column="dorm_room"           />
         <result property="bedNo"             column="bed_no"              />
         <result property="createUser"        column="create_by"           />
+        <result property="authStatus"        column="auth_status"         />
+        <result property="credentialType"    column="credential_type"     />
+        <result property="latestOperationId" column="latest_operation_id" />
+        <result property="operationVersion"  column="operation_version"   />
+        <result property="enrollmentId"      column="enrollment_id"       />
     </resultMap>
 
     <sql id="selectTrainDormAuthVo">
         SELECT
             a.auth_id,
             a.accommodation_id,
+            a.auth_status,
+            a.credential_type,
+            a.latest_operation_id,
+            a.operation_version,
             a.auth_start,
             a.auth_end,
             a.face_sync_status,
@@ -46,6 +55,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             a.update_by,
             a.update_time,
             a.remark,
+            acc.enrollment_id,
             acc.dorm_id,
             acc.bed_no,
             e.student_id,
@@ -98,6 +108,12 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="createUser != null and createUser != ''">
                 AND a.create_by = #{createUser}
             </if>
+            <if test="authStatus != null and authStatus != ''">
+                AND a.auth_status = #{authStatus}
+            </if>
+            <if test="enrollmentId != null">
+                AND acc.enrollment_id = #{enrollmentId}
+            </if>
         </where>
         ORDER BY a.create_time DESC
     </select>
@@ -117,6 +133,10 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         INSERT INTO train_dorm_auth
         <trim prefix="(" suffix=")" suffixOverrides=",">
             <if test="accommodationId != null">accommodation_id,</if>
+            <if test="authStatus != null and authStatus != ''">auth_status,</if>
+            <if test="credentialType != null and credentialType != ''">credential_type,</if>
+            <if test="latestOperationId != null">latest_operation_id,</if>
+            <if test="operationVersion != null">operation_version,</if>
             <if test="authStart != null">auth_start,</if>
             <if test="authEnd != null">auth_end,</if>
             <if test="faceSyncStatus != null">face_sync_status,</if>
@@ -132,6 +152,10 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         </trim>
         <trim prefix="values (" suffix=")" suffixOverrides=",">
             <if test="accommodationId != null">#{accommodationId},</if>
+            <if test="authStatus != null and authStatus != ''">#{authStatus},</if>
+            <if test="credentialType != null and credentialType != ''">#{credentialType},</if>
+            <if test="latestOperationId != null">#{latestOperationId},</if>
+            <if test="operationVersion != null">#{operationVersion},</if>
             <if test="authStart != null">#{authStart},</if>
             <if test="authEnd != null">#{authEnd},</if>
             <if test="faceSyncStatus != null">#{faceSyncStatus},</if>
@@ -151,6 +175,10 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         UPDATE train_dorm_auth
         <trim prefix="SET" suffixOverrides=",">
             <if test="accommodationId != null">accommodation_id = #{accommodationId},</if>
+            <if test="authStatus != null and authStatus != ''">auth_status = #{authStatus},</if>
+            <if test="credentialType != null and credentialType != ''">credential_type = #{credentialType},</if>
+            <if test="latestOperationId != null">latest_operation_id = #{latestOperationId},</if>
+            <if test="operationVersion != null">operation_version = #{operationVersion},</if>
             <if test="authStart != null">auth_start = #{authStart},</if>
             <if test="authEnd != null">auth_end = #{authEnd},</if>
             <if test="faceSyncStatus != null">face_sync_status = #{faceSyncStatus},</if>

RuoYi-Vue/ruoyi-train/src/test/java/com/ruoyi/train/integration/dms/orchestration/DmsMockE2EScenariosSuiteTest.java

@@ -0,0 +1,932 @@
+package com.ruoyi.train.integration.dms.orchestration;
+
+import com.ruoyi.train.domain.*;
+import com.ruoyi.train.integration.dms.auth.DmsTokenManager;
+import com.ruoyi.train.integration.dms.client.DmsHttpClient;
+import com.ruoyi.train.integration.dms.client.DmsOperationStatusClient;
+import com.ruoyi.train.integration.dms.client.DmsPasswordClient;
+import com.ruoyi.train.integration.dms.config.DmsProperties;
+import com.ruoyi.train.integration.dms.gateway.DmsCredentialGatewayImpl;
+import com.ruoyi.train.integration.dms.mock.MockDmsServer;
+import com.ruoyi.train.integration.dms.poller.DmsOperationPoller;
+import com.ruoyi.train.mapper.TrainAccommodationMapper;
+import com.ruoyi.train.mapper.TrainDormAuthMapper;
+import com.ruoyi.train.mapper.TrainEnrollmentMapper;
+import com.ruoyi.train.service.IExternalOperationService;
+import com.ruoyi.train.service.IExternalResourceMappingService;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.Proxy;
+import java.util.*;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicLong;
+
+import static org.junit.Assert.*;
+
+/**
+ * R.3B Wave 3B 完整端到端 15 业务场景验收测试套件 (Mock DMS E2E)
+ *
+ * 覆盖场景清单：
+ *  1. 先Accommodation后Report -> Grant -> accepted -> poll success -> ACTIVE
+ *  2. 先Report后Accommodation -> WAITING -> Accommodation后Grant -> ACTIVE
+ *  3. 重复Report + reconcile x5 -> authorization 1条 -> credential create 1次
+ *  4. Grant failed -> Authorization非ACTIVE -> retry生成新Operation
+ *  5. Grant timeout -> 不ACTIVE -> 历史保留
+ *  6. 退训 -> Revoke -> poll success -> REVOKED
+ *  7. 完成 -> Revoke -> REVOKED
+ *  8. 请假 -> 不自动Revoke (LEAVE_AUTO_REVOKE_POLICY = OPEN_QUESTION)
+ *  9. 调房成功 -> Grant new first -> New ACTIVE -> Revoke old -> Old REVOKED
+ * 10. 调房新房Grant失败 -> Old仍ACTIVE -> Old revoke count = 0
+ * 11. 0 primary lock -> no grant
+ * 12. 2 primary locks -> config error/no grant
+ * 13. 1 primary + multiple secondary -> 只grant primary
+ * 14. DMS network failure -> Report Confirm不回滚
+ * 15. DMS revoke failure -> checkout/plan complete不回滚
+ */
+public class DmsMockE2EScenariosSuiteTest {
+
+    private MockDmsServer mockServer;
+    private DmsProperties properties;
+    private AccessAuthorizationOrchestrator orchestrator;
+    private DmsOperationPoller poller;
+
+    private final Map<Long, TrainEnrollment> enrollmentDb = new ConcurrentHashMap<>();
+    private final Map<Long, TrainAccommodation> accommodationDb = new ConcurrentHashMap<>();
+    private final Map<Long, TrainDormAuth> dormAuthDb = new ConcurrentHashMap<>();
+    private final Map<String, TrainExternalResourceMapping> resourceMappingDb = new ConcurrentHashMap<>();
+    private final Map<Long, TrainExternalOperation> operationDb = new ConcurrentHashMap<>();
+    private final Map<String, TrainExternalOperation> operationIdempotencyDb = new ConcurrentHashMap<>();
+
+    private final AtomicLong authSeq = new AtomicLong(1000);
+    private final AtomicLong opSeq = new AtomicLong(5000);
+
+    @Before
+    public void setUp() throws Exception {
+        mockServer = new MockDmsServer();
+        mockServer.start();
+
+        properties = new DmsProperties();
+        properties.setEnabled(true);
+        properties.setBaseUrl(mockServer.getBaseUrl());
+        properties.setAppId("test-suite-app-id");
+        properties.setAppSecret("test-suite-app-secret");
+        properties.setTokenTtlSeconds(7200);
+        properties.setPollIntervalSeconds(10);
+        properties.setMaxRetryAttempts(3);
+
+        DmsTokenManager tokenManager = new DmsTokenManager(properties);
+        DmsHttpClient httpClient = new DmsHttpClient(properties, tokenManager);
+        DmsPasswordClient passwordClient = new DmsPasswordClient(httpClient);
+        DmsCredentialGatewayImpl credentialGateway = new DmsCredentialGatewayImpl(passwordClient);
+        DmsOperationStatusClient statusClient = new DmsOperationStatusClient(httpClient);
+
+        TrainEnrollmentMapper enrollmentMapper = createMockEnrollmentMapper();
+        TrainAccommodationMapper accommodationMapper = createMockAccommodationMapper();
+        TrainDormAuthMapper dormAuthMapper = createMockDormAuthMapper();
+        IExternalResourceMappingService mappingService = createMockMappingService();
+        IExternalOperationService operationService = createMockOperationService();
+
+        com.ruoyi.train.service.impl.TrainDormAuthServiceImpl authService = new com.ruoyi.train.service.impl.TrainDormAuthServiceImpl();
+        setPrivateField(authService, "trainDormAuthMapper", dormAuthMapper);
+        setPrivateField(authService, "trainAccommodationMapper", accommodationMapper);
+
+        poller = new DmsOperationPoller(properties, operationService, statusClient, authService);
+
+        orchestrator = new AccessAuthorizationOrchestrator(
+                enrollmentMapper,
+                accommodationMapper,
+                dormAuthMapper,
+                authService,
+                mappingService,
+                operationService,
+                credentialGateway
+        );
+    }
+
+    @After
+    public void tearDown() {
+        if (mockServer != null) {
+            mockServer.stop();
+        }
+        enrollmentDb.clear();
+        accommodationDb.clear();
+        dormAuthDb.clear();
+        resourceMappingDb.clear();
+        operationDb.clear();
+        operationIdempotencyDb.clear();
+    }
+
+    // 辅助方法：注册标准房间与门锁映射
+    private void setupStandardMapping(String dormId, String roomId, String lockId, String hardwareId) {
+        TrainExternalResourceMapping room = new TrainExternalResourceMapping();
+        room.setDormId(dormId);
+        room.setVendorCode("DMS");
+        room.setLocalResourceType("DORM_ROOM");
+        room.setExternalResourceType("ROOM");
+        room.setExternalResourceId(roomId);
+        room.setMappingStatus("ACTIVE");
+        resourceMappingDb.put("ROOM:" + dormId, room);
+
+        TrainExternalResourceMapping lock = new TrainExternalResourceMapping();
+        lock.setDormId(dormId);
+        lock.setVendorCode("DMS");
+        lock.setLocalResourceType("DOOR_LOCK");
+        lock.setExternalResourceType("DOOR_LOCK");
+        lock.setExternalResourceId(lockId);
+        lock.setExternalHardwareId(hardwareId);
+        lock.setIsPrimary(1);
+        lock.setMappingStatus("ACTIVE");
+        resourceMappingDb.put("LOCK:" + dormId + ":" + lockId, lock);
+    }
+
+    // ==========================================
+    // 场景 1: 先Accommodation后Report -> Grant -> accepted -> poll success -> ACTIVE
+    // ==========================================
+    @Test
+    public void test01_AccommodationFirstThenReport_GrantPollSuccessActive() {
+        Long eid = 101L;
+        TrainEnrollment enrollment = new TrainEnrollment();
+        enrollment.setEnrollmentId(eid);
+        enrollment.setStudentId("STU-101");
+        enrollment.setEnrollmentStatus(0); // 待报到
+        enrollmentDb.put(eid, enrollment);
+
+        setupStandardMapping("DORM-101", "1001", "5001", "HW-101-MAIN");
+
+        TrainAccommodation acc = new TrainAccommodation();
+        acc.setAccommodationId(1001L);
+        acc.setEnrollmentId(eid);
+        acc.setDormId("DORM-101");
+        acc.setAccommodationStatus(0); // 预分配
+        accommodationDb.put(1001L, acc);
+
+        // 未报到 -> WAITING_FOR_PREREQUISITE
+        ReconciliationResult r1 = orchestrator.reconcile(eid);
+        assertEquals(ReconciliationDecision.WAITING_FOR_PREREQUISITE, r1.getDecision());
+        assertEquals(0, mockServer.getPasswordCreatePostCounter());
+
+        // 报到确认
+        enrollment.setEnrollmentStatus(1);
+        acc.setAccommodationStatus(1);
+        ReconciliationResult r2 = orchestrator.reconcile(eid);
+        assertEquals(ReconciliationDecision.GRANT_REQUIRED, r2.getDecision());
+        assertEquals(1, mockServer.getPasswordCreatePostCounter());
+
+        TrainDormAuth auth = dormAuthDb.get(1001L);
+        assertNotNull(auth);
+        assertEquals(TrainDormAuth.AUTH_STATUS_GRANTING, auth.getAuthStatus());
+
+        // Poller 轮询成功终态 -> 变更为 ACTIVE
+        mockServer.setOperationStatus(99001L, "success", "Success");
+        poller.pollPendingOperations();
+        assertEquals(TrainDormAuth.AUTH_STATUS_ACTIVE, auth.getAuthStatus());
+    }
+
+    // ==========================================
+    // 场景 2: 先Report后Accommodation -> WAITING -> Accommodation后Grant -> ACTIVE
+    // ==========================================
+    @Test
+    public void test02_ReportFirstThenAccommodation_WaitingThenGrantPollSuccessActive() {
+        Long eid = 102L;
+        TrainEnrollment enrollment = new TrainEnrollment();
+        enrollment.setEnrollmentId(eid);
+        enrollment.setStudentId("STU-102");
+        enrollment.setEnrollmentStatus(1); // 已报到
+        enrollmentDb.put(eid, enrollment);
+
+        setupStandardMapping("DORM-102", "1002", "5002", "HW-102-MAIN");
+
+        // 暂无住宿 -> WAITING_FOR_PREREQUISITE
+        ReconciliationResult r1 = orchestrator.reconcile(eid);
+        assertEquals(ReconciliationDecision.WAITING_FOR_PREREQUISITE, r1.getDecision());
+        assertEquals(0, mockServer.getPasswordCreatePostCounter());
+
+        // 分配住宿
+        TrainAccommodation acc = new TrainAccommodation();
+        acc.setAccommodationId(1002L);
+        acc.setEnrollmentId(eid);
+        acc.setDormId("DORM-102");
+        acc.setAccommodationStatus(1);
+        accommodationDb.put(1002L, acc);
+
+        ReconciliationResult r2 = orchestrator.reconcile(eid);
+        assertEquals(ReconciliationDecision.GRANT_REQUIRED, r2.getDecision());
+        assertEquals(1, mockServer.getPasswordCreatePostCounter());
+
+        mockServer.setOperationStatus(99001L, "success", "Success");
+        poller.pollPendingOperations();
+        TrainDormAuth auth = dormAuthDb.get(1002L);
+        assertEquals(TrainDormAuth.AUTH_STATUS_ACTIVE, auth.getAuthStatus());
+    }
+
+    // ==========================================
+    // 场景 3: 重复Report + reconcile x5 -> authorization 1条 -> credential create 1次
+    // ==========================================
+    @Test
+    public void test03_DuplicateReportAndReconcile5Times_Idempotent() {
+        Long eid = 103L;
+        TrainEnrollment enrollment = new TrainEnrollment();
+        enrollment.setEnrollmentId(eid);
+        enrollment.setStudentId("STU-103");
+        enrollment.setEnrollmentStatus(1);
+        enrollmentDb.put(eid, enrollment);
+
+        setupStandardMapping("DORM-103", "1003", "5003", "HW-103-MAIN");
+
+        TrainAccommodation acc = new TrainAccommodation();
+        acc.setAccommodationId(1003L);
+        acc.setEnrollmentId(eid);
+        acc.setDormId("DORM-103");
+        acc.setAccommodationStatus(1);
+        accommodationDb.put(1003L, acc);
+
+        orchestrator.reconcile(eid);
+        mockServer.setOperationStatus(99001L, "success", "Success");
+        poller.pollPendingOperations();
+
+        TrainDormAuth auth = dormAuthDb.get(1003L);
+        assertEquals(TrainDormAuth.AUTH_STATUS_ACTIVE, auth.getAuthStatus());
+        assertEquals(1, mockServer.getPasswordCreatePostCounter());
+
+        // 重复触发 5 次
+        for (int i = 0; i < 5; i++) {
+            ReconciliationResult r = orchestrator.reconcile(eid);
+            assertEquals(ReconciliationDecision.NO_ACTION, r.getDecision());
+        }
+
+        assertEquals("Create count must remain exactly 1", 1, mockServer.getPasswordCreatePostCounter());
+        assertEquals("Authorization must be exactly 1 record", 1, dormAuthDb.size());
+    }
+
+    // ==========================================
+    // 场景 4: Grant failed -> Authorization非ACTIVE -> retry生成新Operation
+    // ==========================================
+    @Test
+    public void test04_GrantFailed_AuthorizationNonActive_RetryGeneratesNewOperation() {
+        Long eid = 104L;
+        TrainEnrollment enrollment = new TrainEnrollment();
+        enrollment.setEnrollmentId(eid);
+        enrollment.setStudentId("STU-104");
+        enrollment.setEnrollmentStatus(1);
+        enrollmentDb.put(eid, enrollment);
+
+        setupStandardMapping("DORM-104", "1004", "5004", "HW-104-MAIN");
+
+        TrainAccommodation acc = new TrainAccommodation();
+        acc.setAccommodationId(1004L);
+        acc.setEnrollmentId(eid);
+        acc.setDormId("DORM-104");
+        acc.setAccommodationStatus(1);
+        accommodationDb.put(1004L, acc);
+
+        orchestrator.reconcile(eid);
+        TrainDormAuth auth = dormAuthDb.get(1004L);
+        assertEquals(TrainDormAuth.AUTH_STATUS_GRANTING, auth.getAuthStatus());
+
+        // DMS 异步执行失败
+        mockServer.setOperationStatus(99001L, "failed", "Hardware busy / timeout");
+        poller.pollPendingOperations();
+
+        // 验证非 ACTIVE，进入 ERROR
+        assertEquals(TrainDormAuth.AUTH_STATUS_ERROR, auth.getAuthStatus());
+        assertNotEquals(TrainDormAuth.AUTH_STATUS_ACTIVE, auth.getAuthStatus());
+
+        // 再次触发对账 -> 重试生成新 Operation
+        ReconciliationResult retryResult = orchestrator.reconcile(eid);
+        assertEquals(ReconciliationDecision.GRANT_REQUIRED, retryResult.getDecision());
+        assertEquals(2, mockServer.getPasswordCreatePostCounter());
+
+        mockServer.setOperationStatus(99001L, "success", "Recovered");
+        poller.pollPendingOperations();
+        assertEquals(TrainDormAuth.AUTH_STATUS_ACTIVE, auth.getAuthStatus());
+    }
+
+    // ==========================================
+    // 场景 5: Grant timeout -> 不ACTIVE -> 历史保留
+    // ==========================================
+    @Test
+    public void test05_GrantTimeout_RemainsNonActive_HistoryPreserved() {
+        Long eid = 105L;
+        TrainEnrollment enrollment = new TrainEnrollment();
+        enrollment.setEnrollmentId(eid);
+        enrollment.setStudentId("STU-105");
+        enrollment.setEnrollmentStatus(1);
+        enrollmentDb.put(eid, enrollment);
+
+        setupStandardMapping("DORM-105", "1005", "5005", "HW-105-MAIN");
+
+        TrainAccommodation acc = new TrainAccommodation();
+        acc.setAccommodationId(1005L);
+        acc.setEnrollmentId(eid);
+        acc.setDormId("DORM-105");
+        acc.setAccommodationStatus(1);
+        accommodationDb.put(1005L, acc);
+
+        orchestrator.reconcile(eid);
+        TrainDormAuth auth = dormAuthDb.get(1005L);
+
+        // 轮询返回尚未完成状态 (undone)
+        mockServer.setOperationStatus(99001L, "undone", "Device task queued in gateway");
+        poller.pollPendingOperations();
+
+        // 仍保持 GRANTING，严禁进入 ACTIVE
+        assertEquals(TrainDormAuth.AUTH_STATUS_GRANTING, auth.getAuthStatus());
+        assertNotEquals(TrainDormAuth.AUTH_STATUS_ACTIVE, auth.getAuthStatus());
+
+        // 流水历史完整保留
+        assertEquals(1, operationDb.size());
+    }
+
+    // ==========================================
+    // 场景 6: 退训 -> Revoke -> poll success -> REVOKED
+    // ==========================================
+    @Test
+    public void test06_WithdrawalQuit_RevokePollSuccessRevoked() {
+        Long eid = 106L;
+        TrainEnrollment enrollment = new TrainEnrollment();
+        enrollment.setEnrollmentId(eid);
+        enrollment.setStudentId("STU-106");
+        enrollment.setEnrollmentStatus(1);
+        enrollmentDb.put(eid, enrollment);
+
+        setupStandardMapping("DORM-106", "1006", "5006", "HW-106-MAIN");
+
+        TrainAccommodation acc = new TrainAccommodation();
+        acc.setAccommodationId(1006L);
+        acc.setEnrollmentId(eid);
+        acc.setDormId("DORM-106");
+        acc.setAccommodationStatus(1);
+        accommodationDb.put(1006L, acc);
+
+        orchestrator.reconcile(eid);
+        mockServer.setOperationStatus(99001L, "success", "Success");
+        poller.pollPendingOperations();
+
+        TrainDormAuth auth = dormAuthDb.get(1006L);
+        assertEquals(TrainDormAuth.AUTH_STATUS_ACTIVE, auth.getAuthStatus());
+
+        // 学员退训 (status = 3)
+        enrollment.setEnrollmentStatus(3);
+        ReconciliationResult r = orchestrator.reconcile(eid);
+        assertEquals(ReconciliationDecision.REVOKE_REQUIRED, r.getDecision());
+        assertEquals(TrainDormAuth.AUTH_STATUS_REVOKING, auth.getAuthStatus());
+        assertEquals(1, mockServer.getPasswordDeletePostCounter());
+
+        mockServer.setOperationStatus(99002L, "success", "Revoked");
+        poller.pollPendingOperations();
+        assertEquals(TrainDormAuth.AUTH_STATUS_REVOKED, auth.getAuthStatus());
+    }
+
+    // ==========================================
+    // 场景 7: 完成 -> Revoke -> REVOKED
+    // ==========================================
+    @Test
+    public void test07_PlanComplete_RevokePollSuccessRevoked() {
+        Long eid = 107L;
+        TrainEnrollment enrollment = new TrainEnrollment();
+        enrollment.setEnrollmentId(eid);
+        enrollment.setStudentId("STU-107");
+        enrollment.setEnrollmentStatus(1);
+        enrollmentDb.put(eid, enrollment);
+
+        setupStandardMapping("DORM-107", "1007", "5007", "HW-107-MAIN");
+
+        TrainAccommodation acc = new TrainAccommodation();
+        acc.setAccommodationId(1007L);
+        acc.setEnrollmentId(eid);
+        acc.setDormId("DORM-107");
+        acc.setAccommodationStatus(1);
+        accommodationDb.put(1007L, acc);
+
+        orchestrator.reconcile(eid);
+        mockServer.setOperationStatus(99001L, "success", "Success");
+        poller.pollPendingOperations();
+
+        TrainDormAuth auth = dormAuthDb.get(1007L);
+        assertEquals(TrainDormAuth.AUTH_STATUS_ACTIVE, auth.getAuthStatus());
+
+        // 结训完成 (status = 4 已完成)
+        enrollment.setEnrollmentStatus(4);
+        ReconciliationResult r = orchestrator.reconcile(eid);
+        assertEquals(ReconciliationDecision.REVOKE_REQUIRED, r.getDecision());
+        assertEquals(TrainDormAuth.AUTH_STATUS_REVOKING, auth.getAuthStatus());
+
+        mockServer.setOperationStatus(99002L, "success", "Completed Revoke");
+        poller.pollPendingOperations();
+        assertEquals(TrainDormAuth.AUTH_STATUS_REVOKED, auth.getAuthStatus());
+    }
+
+    // ==========================================
+    // 场景 8: 请假 -> 不自动Revoke (保留开放策略)
+    // ==========================================
+    @Test
+    public void test08_Leave_NoAutoRevokePolicyPreserved() {
+        Long eid = 108L;
+        TrainEnrollment enrollment = new TrainEnrollment();
+        enrollment.setEnrollmentId(eid);
+        enrollment.setStudentId("STU-108");
+        enrollment.setEnrollmentStatus(1);
+        enrollmentDb.put(eid, enrollment);
+
+        setupStandardMapping("DORM-108", "1008", "5008", "HW-108-MAIN");
+
+        TrainAccommodation acc = new TrainAccommodation();
+        acc.setAccommodationId(1008L);
+        acc.setEnrollmentId(eid);
+        acc.setDormId("DORM-108");
+        acc.setAccommodationStatus(1);
+        accommodationDb.put(1008L, acc);
+
+        orchestrator.reconcile(eid);
+        mockServer.setOperationStatus(99001L, "success", "Success");
+        poller.pollPendingOperations();
+
+        TrainDormAuth auth = dormAuthDb.get(1008L);
+        assertEquals(TrainDormAuth.AUTH_STATUS_ACTIVE, auth.getAuthStatus());
+
+        // 请假期间宿舍状态仍为已入住 (1)，触发对账不生成任何 Revoke
+        ReconciliationResult leaveReconcile = orchestrator.reconcile(eid);
+        assertEquals(ReconciliationDecision.NO_ACTION, leaveReconcile.getDecision());
+        assertEquals(TrainDormAuth.AUTH_STATUS_ACTIVE, auth.getAuthStatus());
+        assertEquals(0, mockServer.getPasswordDeletePostCounter());
+    }
+
+    // ==========================================
+    // 场景 9: 调房成功 -> Grant new first -> New ACTIVE -> Revoke old -> Old REVOKED
+    // ==========================================
+    @Test
+    public void test09_TransferSuccess_GrantNewFirstNewActiveThenRevokeOldRevoked() {
+        Long eid = 109L;
+        TrainEnrollment enrollment = new TrainEnrollment();
+        enrollment.setEnrollmentId(eid);
+        enrollment.setStudentId("STU-109");
+        enrollment.setEnrollmentStatus(1);
+        enrollmentDb.put(eid, enrollment);
+
+        setupStandardMapping("DORM-109A", "10091", "50091", "HW-109A-MAIN");
+        setupStandardMapping("DORM-109B", "10092", "50092", "HW-109B-MAIN");
+
+        TrainAccommodation oldAcc = new TrainAccommodation();
+        oldAcc.setAccommodationId(1091L);
+        oldAcc.setEnrollmentId(eid);
+        oldAcc.setDormId("DORM-109A");
+        oldAcc.setAccommodationStatus(1);
+        accommodationDb.put(1091L, oldAcc);
+
+        orchestrator.reconcile(eid);
+        mockServer.setOperationStatus(99001L, "success", "Success");
+        poller.pollPendingOperations();
+
+        TrainDormAuth oldAuth = dormAuthDb.get(1091L);
+        assertEquals(TrainDormAuth.AUTH_STATUS_ACTIVE, oldAuth.getAuthStatus());
+
+        // 调房：旧房退宿，新房入住
+        oldAcc.setAccommodationStatus(2);
+        TrainAccommodation newAcc = new TrainAccommodation();
+        newAcc.setAccommodationId(1092L);
+        newAcc.setEnrollmentId(eid);
+        newAcc.setDormId("DORM-109B");
+        newAcc.setAccommodationStatus(1);
+        accommodationDb.put(1092L, newAcc);
+
+        // 调房对账 1：必须先 Grant 新房！旧房保持 ACTIVE！
+        ReconciliationResult r1 = orchestrator.reconcile(eid);
+        assertEquals(ReconciliationDecision.GRANT_REQUIRED, r1.getDecision());
+        assertEquals(TrainDormAuth.AUTH_STATUS_ACTIVE, oldAuth.getAuthStatus());
+        assertEquals(0, mockServer.getPasswordDeletePostCounter());
+
+        TrainDormAuth newAuth = dormAuthDb.get(1092L);
+        assertNotNull(newAuth);
+        assertEquals(TrainDormAuth.AUTH_STATUS_GRANTING, newAuth.getAuthStatus());
+
+        // 新房生效为 ACTIVE
+        mockServer.setOperationStatus(99001L, "success", "New room active");
+        poller.pollPendingOperations();
+        assertEquals(TrainDormAuth.AUTH_STATUS_ACTIVE, newAuth.getAuthStatus());
+
+        // 调房对账 2：新房 ACTIVE 后，触发旧房撤销
+        ReconciliationResult r2 = orchestrator.reconcile(eid);
+        assertEquals(ReconciliationDecision.REVOKE_REQUIRED, r2.getDecision());
+        assertEquals(TrainDormAuth.AUTH_STATUS_REVOKING, oldAuth.getAuthStatus());
+        assertEquals(1, mockServer.getPasswordDeletePostCounter());
+
+        mockServer.setOperationStatus(99002L, "success", "Old room revoked");
+        poller.pollPendingOperations();
+        assertEquals(TrainDormAuth.AUTH_STATUS_REVOKED, oldAuth.getAuthStatus());
+    }
+
+    // ==========================================
+    // 场景 10: 调房新房Grant失败 -> Old仍ACTIVE -> Old revoke count = 0
+    // ==========================================
+    @Test
+    public void test10_TransferFailure_NewRoomGrantFailedOldRemainsActiveZeroRevoke() {
+        Long eid = 110L;
+        TrainEnrollment enrollment = new TrainEnrollment();
+        enrollment.setEnrollmentId(eid);
+        enrollment.setStudentId("STU-110");
+        enrollment.setEnrollmentStatus(1);
+        enrollmentDb.put(eid, enrollment);
+
+        setupStandardMapping("DORM-110A", "10101", "50101", "HW-110A-MAIN");
+
+        TrainAccommodation oldAcc = new TrainAccommodation();
+        oldAcc.setAccommodationId(1101L);
+        oldAcc.setEnrollmentId(eid);
+        oldAcc.setDormId("DORM-110A");
+        oldAcc.setAccommodationStatus(2); // 旧房迁出
+        accommodationDb.put(1101L, oldAcc);
+
+        TrainDormAuth oldAuth = new TrainDormAuth();
+        oldAuth.setAuthId(1101L);
+        oldAuth.setAccommodationId(1101L);
+        oldAuth.setAuthStatus(TrainDormAuth.AUTH_STATUS_ACTIVE);
+        dormAuthDb.put(1101L, oldAuth);
+
+        // 新房 110B (未配置外部映射)
+        TrainAccommodation newAcc = new TrainAccommodation();
+        newAcc.setAccommodationId(1102L);
+        newAcc.setEnrollmentId(eid);
+        newAcc.setDormId("DORM-110B");
+        newAcc.setAccommodationStatus(1);
+        accommodationDb.put(1102L, newAcc);
+
+        ReconciliationResult r = orchestrator.reconcile(eid);
+        assertEquals(ReconciliationDecision.WAITING_FOR_PREREQUISITE, r.getDecision());
+
+        // 关键安全断言：新房未发放成功时，旧房严格保持 ACTIVE，撤销调用次数绝对为 0
+        assertEquals("Old room access must strictly remain ACTIVE", TrainDormAuth.AUTH_STATUS_ACTIVE, oldAuth.getAuthStatus());
+        assertEquals("Old room revoke call count must be 0", 0, mockServer.getPasswordDeletePostCounter());
+    }
+
+    // ==========================================
+    // 场景 11: 0 primary lock -> no grant
+    // ==========================================
+    @Test
+    public void test11_ZeroPrimaryLock_NoGrant() {
+        Long eid = 111L;
+        TrainEnrollment enrollment = new TrainEnrollment();
+        enrollment.setEnrollmentId(eid);
+        enrollment.setStudentId("STU-111");
+        enrollment.setEnrollmentStatus(1);
+        enrollmentDb.put(eid, enrollment);
+
+        // 仅配置次要锁 (isPrimary = 0)
+        TrainExternalResourceMapping secondaryLock = new TrainExternalResourceMapping();
+        secondaryLock.setDormId("DORM-111");
+        secondaryLock.setVendorCode("DMS");
+        secondaryLock.setLocalResourceType("DOOR_LOCK");
+        secondaryLock.setExternalResourceType("DOOR_LOCK");
+        secondaryLock.setExternalResourceId("5111");
+        secondaryLock.setIsPrimary(0);
+        secondaryLock.setMappingStatus("ACTIVE");
+        resourceMappingDb.put("LOCK:DORM-111:5111", secondaryLock);
+
+        TrainAccommodation acc = new TrainAccommodation();
+        acc.setAccommodationId(1111L);
+        acc.setEnrollmentId(eid);
+        acc.setDormId("DORM-111");
+        acc.setAccommodationStatus(1);
+        accommodationDb.put(1111L, acc);
+
+        ReconciliationResult r = orchestrator.reconcile(eid);
+        assertEquals(ReconciliationDecision.WAITING_FOR_PREREQUISITE, r.getDecision());
+        assertEquals(0, mockServer.getPasswordCreatePostCounter());
+    }
+
+    // ==========================================
+    // 场景 12: 2 primary locks -> config error/no grant
+    // ==========================================
+    @Test
+    public void test12_TwoPrimaryLocks_ConfigErrorNoGrant() {
+        Long eid = 112L;
+        TrainEnrollment enrollment = new TrainEnrollment();
+        enrollment.setEnrollmentId(eid);
+        enrollment.setStudentId("STU-112");
+        enrollment.setEnrollmentStatus(1);
+        enrollmentDb.put(eid, enrollment);
+
+        // 配置 2 把主锁
+        TrainExternalResourceMapping pri1 = new TrainExternalResourceMapping();
+        pri1.setDormId("DORM-112");
+        pri1.setVendorCode("DMS");
+        pri1.setLocalResourceType("DOOR_LOCK");
+        pri1.setExternalResourceType("DOOR_LOCK");
+        pri1.setExternalResourceId("51121");
+        pri1.setIsPrimary(1);
+        pri1.setMappingStatus("ACTIVE");
+        resourceMappingDb.put("LOCK:DORM-112:51121", pri1);
+
+        TrainExternalResourceMapping pri2 = new TrainExternalResourceMapping();
+        pri2.setDormId("DORM-112");
+        pri2.setVendorCode("DMS");
+        pri2.setLocalResourceType("DOOR_LOCK");
+        pri2.setExternalResourceType("DOOR_LOCK");
+        pri2.setExternalResourceId("51122");
+        pri2.setIsPrimary(1);
+        pri2.setMappingStatus("ACTIVE");
+        resourceMappingDb.put("LOCK:DORM-112:51122", pri2);
+
+        TrainAccommodation acc = new TrainAccommodation();
+        acc.setAccommodationId(1112L);
+        acc.setEnrollmentId(eid);
+        acc.setDormId("DORM-112");
+        acc.setAccommodationStatus(1);
+        accommodationDb.put(1112L, acc);
+
+        ReconciliationResult r = orchestrator.reconcile(eid);
+        assertEquals(ReconciliationDecision.WAITING_FOR_PREREQUISITE, r.getDecision());
+        assertEquals(0, mockServer.getPasswordCreatePostCounter());
+    }
+
+    // ==========================================
+    // 场景 13: 1 primary + multiple secondary -> 只grant primary
+    // ==========================================
+    @Test
+    public void test13_OnePrimaryPlusMultipleSecondary_GrantsPrimaryOnly() {
+        Long eid = 113L;
+        TrainEnrollment enrollment = new TrainEnrollment();
+        enrollment.setEnrollmentId(eid);
+        enrollment.setStudentId("STU-113");
+        enrollment.setEnrollmentStatus(1);
+        enrollmentDb.put(eid, enrollment);
+
+        // 1 主锁 + 1 房间映射
+        setupStandardMapping("DORM-113", "1013", "51130", "HW-113-PRIMARY");
+
+        // 附加次要锁
+        TrainExternalResourceMapping sec1 = new TrainExternalResourceMapping();
+        sec1.setDormId("DORM-113");
+        sec1.setVendorCode("DMS");
+        sec1.setLocalResourceType("DOOR_LOCK");
+        sec1.setExternalResourceType("DOOR_LOCK");
+        sec1.setExternalResourceId("51131");
+        sec1.setIsPrimary(0);
+        sec1.setMappingStatus("ACTIVE");
+        resourceMappingDb.put("LOCK:DORM-113:51131", sec1);
+
+        TrainAccommodation acc = new TrainAccommodation();
+        acc.setAccommodationId(1113L);
+        acc.setEnrollmentId(eid);
+        acc.setDormId("DORM-113");
+        acc.setAccommodationStatus(1);
+        accommodationDb.put(1113L, acc);
+
+        ReconciliationResult r = orchestrator.reconcile(eid);
+        assertEquals(ReconciliationDecision.GRANT_REQUIRED, r.getDecision());
+        assertEquals(1, mockServer.getPasswordCreatePostCounter());
+
+        TrainExternalOperation op = operationDb.values().iterator().next();
+        assertEquals("LK-HD-101", op.getExternalHardwareId());
+    }
+
+    // ==========================================
+    // 场景 14: DMS network failure -> Report Confirm不回滚
+    // ==========================================
+    @Test
+    public void test14_DmsNetworkFailure_ReportConfirmDoesNotRollback() {
+        Long eid = 114L;
+        TrainEnrollment enrollment = new TrainEnrollment();
+        enrollment.setEnrollmentId(eid);
+        enrollment.setStudentId("STU-114");
+        enrollment.setEnrollmentStatus(1); // 报到成功完成
+        enrollmentDb.put(eid, enrollment);
+
+        setupStandardMapping("DORM-114", "1014", "5014", "HW-114-MAIN");
+
+        TrainAccommodation acc = new TrainAccommodation();
+        acc.setAccommodationId(1114L);
+        acc.setEnrollmentId(eid);
+        acc.setDormId("DORM-114");
+        acc.setAccommodationStatus(1);
+        accommodationDb.put(1114L, acc);
+
+        // 停止 Mock Server 模拟网络崩溃
+        mockServer.stop();
+
+        try {
+            orchestrator.reconcile(eid);
+        } catch (Exception ignored) {
+        }
+
+        // 核心事务独立性断言：学员报到状态保持 1，不因外部接口通信失败回滚！
+        assertEquals(Integer.valueOf(1), enrollment.getEnrollmentStatus());
+    }
+
+    // ==========================================
+    // 场景 15: DMS revoke failure -> checkout/plan complete不回滚
+    // ==========================================
+    @Test
+    public void test15_DmsRevokeFailure_CheckoutPlanCompleteDoesNotRollback() {
+        Long eid = 115L;
+        TrainEnrollment enrollment = new TrainEnrollment();
+        enrollment.setEnrollmentId(eid);
+        enrollment.setStudentId("STU-115");
+        enrollment.setEnrollmentStatus(1);
+        enrollmentDb.put(eid, enrollment);
+
+        setupStandardMapping("DORM-115", "1015", "5015", "HW-115-MAIN");
+
+        TrainAccommodation acc = new TrainAccommodation();
+        acc.setAccommodationId(1115L);
+        acc.setEnrollmentId(eid);
+        acc.setDormId("DORM-115");
+        acc.setAccommodationStatus(1);
+        accommodationDb.put(1115L, acc);
+
+        orchestrator.reconcile(eid);
+        mockServer.setOperationStatus(99001L, "success", "Success");
+        poller.pollPendingOperations();
+
+        // 结训退宿本地已完成 (status = 2)
+        acc.setAccommodationStatus(2);
+
+        // 模拟外部网络中断
+        mockServer.stop();
+
+        try {
+            orchestrator.reconcile(eid);
+        } catch (Exception ignored) {
+        }
+
+        // 核心事务独立性断言：本地退房状态保持 2，不回滚！
+        assertEquals(Integer.valueOf(2), acc.getAccommodationStatus());
+    }
+
+    // ==========================================
+    // Mock Mapper & Service 桩实现
+    // ==========================================
+    private TrainEnrollmentMapper createMockEnrollmentMapper() {
+        return (TrainEnrollmentMapper) Proxy.newProxyInstance(
+                getClass().getClassLoader(),
+                new Class<?>[]{TrainEnrollmentMapper.class},
+                (proxy, method, args) -> {
+                    String name = method.getName();
+                    if ("selectTrainEnrollmentById".equals(name) || "selectTrainEnrollmentByEnrollmentId".equals(name)) {
+                        return enrollmentDb.get((Long) args[0]);
+                    }
+                    return null;
+                }
+        );
+    }
+
+    private TrainAccommodationMapper createMockAccommodationMapper() {
+        return (TrainAccommodationMapper) Proxy.newProxyInstance(
+                getClass().getClassLoader(),
+                new Class<?>[]{TrainAccommodationMapper.class},
+                (proxy, method, args) -> {
+                    String name = method.getName();
+                    if ("selectActiveAccommodationByEnrollmentId".equals(name)) {
+                        Long eid = (Long) args[0];
+                        return accommodationDb.values().stream()
+                                .filter(a -> eid.equals(a.getEnrollmentId()) && (a.getAccommodationStatus() != null && (a.getAccommodationStatus() == 0 || a.getAccommodationStatus() == 1)))
+                                .findFirst().orElse(null);
+                    }
+                    if ("selectAccommodationHistoryByEnrollmentId".equals(name)) {
+                        Long eid = (Long) args[0];
+                        List<TrainAccommodation> list = new ArrayList<>();
+                        for (TrainAccommodation a : accommodationDb.values()) {
+                            if (eid.equals(a.getEnrollmentId())) {
+                                list.add(a);
+                            }
+                        }
+                        return list;
+                    }
+                    if ("selectTrainAccommodationByAccommodationId".equals(name)) {
+                        return accommodationDb.get((Long) args[0]);
+                    }
+                    return null;
+                }
+        );
+    }
+
+    private TrainDormAuthMapper createMockDormAuthMapper() {
+        return (TrainDormAuthMapper) Proxy.newProxyInstance(
+                getClass().getClassLoader(),
+                new Class<?>[]{TrainDormAuthMapper.class},
+                (proxy, method, args) -> {
+                    String name = method.getName();
+                    if ("selectTrainDormAuthByAccommodationId".equals(name)) {
+                        return dormAuthDb.get((Long) args[0]);
+                    }
+                    if ("selectTrainDormAuthByAuthId".equals(name)) {
+                        Long aid = (Long) args[0];
+                        return dormAuthDb.values().stream().filter(a -> aid.equals(a.getAuthId())).findFirst().orElse(null);
+                    }
+                    if ("insertTrainDormAuth".equals(name)) {
+                        TrainDormAuth auth = (TrainDormAuth) args[0];
+                        auth.setAuthId(authSeq.incrementAndGet());
+                        dormAuthDb.put(auth.getAccommodationId(), auth);
+                        return 1;
+                    }
+                    if ("updateTrainDormAuth".equals(name)) {
+                        TrainDormAuth auth = (TrainDormAuth) args[0];
+                        dormAuthDb.put(auth.getAccommodationId(), auth);
+                        return 1;
+                    }
+                    return null;
+                }
+        );
+    }
+
+    private IExternalResourceMappingService createMockMappingService() {
+        return (IExternalResourceMappingService) Proxy.newProxyInstance(
+                getClass().getClassLoader(),
+                new Class<?>[]{IExternalResourceMappingService.class},
+                (proxy, method, args) -> {
+                    String name = method.getName();
+                    if ("getActiveRoomMapping".equals(name)) {
+                        String dormId = (String) args[1];
+                        return resourceMappingDb.get("ROOM:" + dormId);
+                    }
+                    if ("getActiveLockMappings".equals(name)) {
+                        String dormId = (String) args[1];
+                        List<TrainExternalResourceMapping> locks = new ArrayList<>();
+                        for (Map.Entry<String, TrainExternalResourceMapping> entry : resourceMappingDb.entrySet()) {
+                            if (entry.getKey().startsWith("LOCK:" + dormId)) {
+                                locks.add(entry.getValue());
+                            }
+                        }
+                        return locks;
+                    }
+                    return null;
+                }
+        );
+    }
+
+    private IExternalOperationService createMockOperationService() {
+        return (IExternalOperationService) Proxy.newProxyInstance(
+                getClass().getClassLoader(),
+                new Class<?>[]{IExternalOperationService.class},
+                (proxy, method, args) -> {
+                    String name = method.getName();
+                    if ("createOperation".equals(name)) {
+                        TrainExternalOperation op = (TrainExternalOperation) args[0];
+                        if (op.getIdempotencyKey() != null && operationIdempotencyDb.containsKey(op.getIdempotencyKey())) {
+                            return operationIdempotencyDb.get(op.getIdempotencyKey());
+                        }
+                        op.setOperationId(opSeq.incrementAndGet());
+                        operationDb.put(op.getOperationId(), op);
+                        if (op.getIdempotencyKey() != null) {
+                            operationIdempotencyDb.put(op.getIdempotencyKey(), op);
+                        }
+                        return op;
+                    }
+                    if ("bindExternalReference".equals(name)) {
+                        Long opId = (Long) args[0];
+                        TrainExternalOperation op = operationDb.get(opId);
+                        if (op != null) {
+                            op.setExternalOperationId((String) args[1]);
+                            op.setExternalHardwareId((String) args[2]);
+                            op.setExternalKeyId((String) args[3]);
+                        }
+                        return op;
+                    }
+                    if ("transitStatus".equals(name)) {
+                        Long opId = (Long) args[0];
+                        TrainExternalOperation op = operationDb.get(opId);
+                        if (op != null) {
+                            op.setOperationStatus((String) args[1]);
+                            op.setLastErrorCode((String) args[2]);
+                            op.setLastErrorMessage((String) args[3]);
+                        }
+                        return op;
+                    }
+                    if ("listPendingPollOperations".equals(name)) {
+                        List<TrainExternalOperation> list = new ArrayList<>();
+                        for (TrainExternalOperation op : operationDb.values()) {
+                            if (TrainExternalOperation.STATUS_PENDING.equals(op.getOperationStatus()) ||
+                                TrainExternalOperation.STATUS_ACCEPTED.equals(op.getOperationStatus()) ||
+                                TrainExternalOperation.STATUS_RETRY_WAIT.equals(op.getOperationStatus())) {
+                                list.add(op);
+                            }
+                        }
+                        return list;
+                    }
+                    if ("updateOperationPollResult".equals(name)) {
+                        Long opId = (Long) args[0];
+                        TrainExternalOperation op = operationDb.get(opId);
+                        if (op != null) {
+                            op.setOperationStatus((String) args[1]);
+                            if (args[4] != null) op.setLastErrorCode((String) args[4]);
+                            if (args[5] != null) op.setLastErrorMessage((String) args[5]);
+                        }
+                        return op;
+                    }
+                    return null;
+                }
+        );
+    }
+
+    private void setPrivateField(Object target, String fieldName, Object value) {
+        try {
+            Field field = target.getClass().getDeclaredField(fieldName);
+            field.setAccessible(true);
+            field.set(target, value);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+}

RuoYi-Vue/sql/system/kingbase/010_dms_access_management_permissions.sql

@@ -0,0 +1,36 @@
+-- =============================================================================
+-- 脚本名称: 010_dms_access_management_permissions.sql
+-- 业务模块: DMS门禁与外部资源映射管理端权限扩展 (R.3B Wave 3B)
+-- 适用数据库: KingbaseES, schema public
+-- 范围: 仅限 sys_menu 按钮级权限增量插入，不改动已有角色分配 (sys_role_menu Δ = 0)
+-- 幂等性设计: 支持重复执行，WHERE NOT EXISTS 防重，无破坏性语句
+-- 安全红线: 严禁引入远程应急开门权限，严禁普通学员/教师授权
+-- =============================================================================
+
+BEGIN;
+
+-- 1. 门禁与映射查看权限 (train:access:query)
+INSERT INTO public.sys_menu
+    (menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
+     menu_type, visible, status, perms, icon, create_by, create_time, update_by, update_time, remark)
+SELECT 2191, '门禁与资源映射查看', 2060, 1, '#', '', '', 1, 0,
+       'F', '0', '0', 'train:access:query', '#', 'admin', CURRENT_TIMESTAMP, '', NULL, '门禁授权与外部资源映射查看权限'
+WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE perms = 'train:access:query');
+
+-- 2. 门禁资源映射管理权限 (train:access:manage)
+INSERT INTO public.sys_menu
+    (menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
+     menu_type, visible, status, perms, icon, create_by, create_time, update_by, update_time, remark)
+SELECT 2192, '门禁资源映射维护', 2060, 2, '#', '', '', 1, 0,
+       'F', '0', '0', 'train:access:manage', '#', 'admin', CURRENT_TIMESTAMP, '', NULL, '门禁房间与门锁资源绑定解绑维护权限'
+WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE perms = 'train:access:manage');
+
+-- 3. 门禁手动对账权限 (train:access:reconcile)
+INSERT INTO public.sys_menu
+    (menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
+     menu_type, visible, status, perms, icon, create_by, create_time, update_by, update_time, remark)
+SELECT 2193, '门禁手动对账触发', 2060, 3, '#', '', '', 1, 0,
+       'F', '0', '0', 'train:access:reconcile', '#', 'admin', CURRENT_TIMESTAMP, '', NULL, '门禁权限手动对账触发执行权限'
+WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE perms = 'train:access:reconcile');
+
+COMMIT;

build_ui/.env.development

@@ -1,5 +1,5 @@
 # 页面标题
-VUE_APP_TITLE = 智慧培训管理平台
+VUE_APP_TITLE = SYFJGYD学员管理系统
 
 # 开发环境配置
 ENV = 'development'

build_ui/.env.production

@@ -1,5 +1,5 @@
-# 页面标题  智慧培训管理平台
-VUE_APP_TITLE = 智慧培训管理平台
+# 页面标题  SYFJGYD学员管理系统
+VUE_APP_TITLE = SYFJGYD学员管理系统
 
 # 生产环境配置
 ENV = 'production'

build_ui/src/api/train/access.js

@@ -0,0 +1,68 @@
+import request from '@/utils/request'
+
+// 查询宿舍关联的外部资源映射（包含房间与门锁映射及主锁健康度）
+export function getDormMapping(dormId) {
+  return request({
+    url: '/train/access/mapping/dorm/' + dormId,
+    method: 'get'
+  })
+}
+
+// 绑定或修改宿舍外部房间映射
+export function bindRoomMapping(data) {
+  return request({
+    url: '/train/access/mapping/bind-room',
+    method: 'post',
+    data: data
+  })
+}
+
+// 绑定或新增宿舍外部门锁映射
+export function bindLockMapping(data) {
+  return request({
+    url: '/train/access/mapping/bind-lock',
+    method: 'post',
+    data: data
+  })
+}
+
+// 解除/失效指定的外部资源映射
+export function unbindMapping(mappingId) {
+  return request({
+    url: '/train/access/mapping/' + mappingId,
+    method: 'delete'
+  })
+}
+
+// 查询门禁授权列表
+export function listAuth(query) {
+  return request({
+    url: '/train/access/auth/list',
+    method: 'get',
+    params: query
+  })
+}
+
+// 获取门禁授权详细信息
+export function getAuthDetail(authId) {
+  return request({
+    url: '/train/access/auth/' + authId,
+    method: 'get'
+  })
+}
+
+// 查询门禁授权关联的外部操作流水历史（脱敏）
+export function getOperationHistory(doorAuthId) {
+  return request({
+    url: '/train/access/operations/' + doorAuthId,
+    method: 'get'
+  })
+}
+
+// 手动触发学员门禁权限对账
+export function manualReconcile(enrollmentId) {
+  return request({
+    url: '/train/access/reconcile/' + enrollmentId,
+    method: 'post'
+  })
+}

build_ui/src/layout/components/Sidebar/Logo.vue

@@ -2,11 +2,11 @@
   <div class="sidebar-logo-container" :class="{'collapse':collapse}" :style="{ backgroundColor: sideTheme === 'theme-dark' ? variables.menuBackground : variables.menuLightBackground }">
     <transition name="sidebarLogoFade">
       <router-link v-if="collapse" key="collapse" class="sidebar-logo-link" to="/">
-        <img v-if="logo" :src="logo" class="sidebar-logo" />
+        <img v-if="logo" :src="logo" class="sidebar-logo">
         <h1 v-else class="sidebar-title" :style="{ color: sideTheme === 'theme-dark' ? variables.logoTitleColor : variables.logoLightTitleColor }">{{ title }} </h1>
       </router-link>
       <router-link v-else key="expand" class="sidebar-logo-link" to="/">
-        <img v-if="logo" :src="logo" class="sidebar-logo" />
+        <img v-if="logo" :src="logo" class="sidebar-logo">
         <h1 class="sidebar-title" :style="{ color: sideTheme === 'theme-dark' ? variables.logoTitleColor : variables.logoLightTitleColor }">{{ title }} </h1>
       </router-link>
     </transition>
@@ -25,19 +25,19 @@ export default {
       required: true
     }
   },
+  data() {
+    return {
+      title: process.env.VUE_APP_TITLE || 'SYFJGYD学员管理系统',
+      logo: logoImg
+    }
+  },
   computed: {
     variables() {
-      return variables;
+      return variables
     },
     sideTheme() {
       return this.$store.state.settings.sideTheme
     }
-  },
-  data() {
-    return {
-      title: '智慧培训管理平台',
-      logo: logoImg
-    }
   }
 }
 </script>

build_ui/src/views/train/auth/index.vue

@@ -1,61 +1,48 @@
 <template>
   <div class="app-container">
-    <el-form :model="queryParams" ref="queryForm" size="small" :inline="true" v-show="showSearch" label-width="68px">
-      <el-form-item label="学员学号，关联train_student.s_id" prop="studentId">
+    <el-alert
+      title="门禁授权管理规范：门禁授权受学员报到确认、住宿安排及排课计划自动驱动。根据当前安全策略，在线密码凭证待业务侧安全交付方案确认（密文脱敏），系统不持久化亦不展示任何密码明文、Token或密钥。"
+      type="info"
+      :closable="false"
+      show-icon
+      style="margin-bottom: 16px;"
+    />
+
+    <el-form v-show="showSearch" ref="queryForm" :model="queryParams" size="small" :inline="true" label-width="80px">
+      <el-form-item label="学员学号" prop="studentId">
         <el-input
           v-model="queryParams.studentId"
-          placeholder="请输入学员学号，关联train_student.s_id"
+          placeholder="请输入学员学号"
           clearable
           @keyup.enter.native="handleQuery"
         />
       </el-form-item>
-      <el-form-item label="所属开班计划ID，train_class_plan.plan_id" prop="planId">
+      <el-form-item label="宿舍楼栋" prop="dormBuilding">
         <el-input
-          v-model="queryParams.planId"
-          placeholder="请输入所属开班计划ID，train_class_plan.plan_id"
+          v-model="queryParams.dormBuilding"
+          placeholder="请输入楼栋"
           clearable
           @keyup.enter.native="handleQuery"
         />
       </el-form-item>
-      <el-form-item label="分配宿舍ID，train_dormitory_info.dorm_id" prop="dormId">
+      <el-form-item label="房间号" prop="dormRoom">
         <el-input
-          v-model="queryParams.dormId"
-          placeholder="请输入分配宿舍ID，train_dormitory_info.dorm_id"
+          v-model="queryParams.dormRoom"
+          placeholder="请输入房间号"
           clearable
           @keyup.enter.native="handleQuery"
         />
       </el-form-item>
-      <el-form-item label="床位号" prop="bedNo">
-        <el-input
-          v-model="queryParams.bedNo"
-          placeholder="请输入床位号"
-          clearable
-          @keyup.enter.native="handleQuery"
-        />
-      </el-form-item>
-      <el-form-item label="权限生效时间" prop="authStart">
-        <el-date-picker clearable
-          v-model="queryParams.authStart"
-          type="date"
-          value-format="yyyy-MM-dd"
-          placeholder="请选择权限生效时间">
-        </el-date-picker>
-      </el-form-item>
-      <el-form-item label="权限失效时间 (开班结束自动失效)" prop="authEnd">
-        <el-date-picker clearable
-          v-model="queryParams.authEnd"
-          type="date"
-          value-format="yyyy-MM-dd"
-          placeholder="请选择权限失效时间 (开班结束自动失效)">
-        </el-date-picker>
-      </el-form-item>
-      <el-form-item label="创建管理员账号" prop="createUser">
-        <el-input
-          v-model="queryParams.createUser"
-          placeholder="请输入创建管理员账号"
-          clearable
-          @keyup.enter.native="handleQuery"
-        />
+      <el-form-item label="授权状态" prop="authStatus">
+        <el-select v-model="queryParams.authStatus" placeholder="全部状态" clearable>
+          <el-option label="待授权 (PENDING_GRANT)" value="PENDING_GRANT" />
+          <el-option label="授权中 (GRANTING)" value="GRANTING" />
+          <el-option label="生效中 (ACTIVE)" value="ACTIVE" />
+          <el-option label="待注销 (PENDING_REVOKE)" value="PENDING_REVOKE" />
+          <el-option label="注销中 (REVOKING)" value="REVOKING" />
+          <el-option label="已注销 (REVOKED)" value="REVOKED" />
+          <el-option label="异常 (ERROR)" value="ERROR" />
+        </el-select>
       </el-form-item>
       <el-form-item>
         <el-button type="primary" icon="el-icon-search" size="mini" @click="handleQuery">搜索</el-button>
@@ -64,87 +51,79 @@
     </el-form>
 
     <el-row :gutter="10" class="mb8">
-      <el-col :span="1.5">
-        <el-button
-          type="primary"
-          plain
-          icon="el-icon-plus"
-          size="mini"
-          @click="handleAdd"
-          v-hasPermi="['train:auth:add']"
-        >新增</el-button>
-      </el-col>
-      <el-col :span="1.5">
-        <el-button
-          type="success"
-          plain
-          icon="el-icon-edit"
-          size="mini"
-          :disabled="single"
-          @click="handleUpdate"
-          v-hasPermi="['train:auth:edit']"
-        >修改</el-button>
-      </el-col>
-      <el-col :span="1.5">
-        <el-button
-          type="danger"
-          plain
-          icon="el-icon-delete"
-          size="mini"
-          :disabled="multiple"
-          @click="handleDelete"
-          v-hasPermi="['train:auth:remove']"
-        >删除</el-button>
-      </el-col>
-      <el-col :span="1.5">
-        <el-button
-          type="warning"
-          plain
-          icon="el-icon-download"
-          size="mini"
-          @click="handleExport"
-          v-hasPermi="['train:auth:export']"
-        >导出</el-button>
-      </el-col>
-      <right-toolbar :showSearch.sync="showSearch" @queryTable="getList"></right-toolbar>
+      <right-toolbar :show-search.sync="showSearch" @queryTable="getList" />
     </el-row>
 
-    <el-table v-loading="loading" :data="authList" @selection-change="handleSelectionChange">
-      <el-table-column type="selection" width="55" align="center" />
-      <el-table-column label="权限分配ID" align="center" prop="authId" />
-      <el-table-column label="学员学号，关联train_student.s_id" align="center" prop="studentId" />
-      <el-table-column label="所属开班计划ID，train_class_plan.plan_id" align="center" prop="planId" />
-      <el-table-column label="分配宿舍ID，train_dormitory_info.dorm_id" align="center" prop="dormId" />
-      <el-table-column label="床位号" align="center" prop="bedNo" />
-      <el-table-column label="0 未下发人脸 1 已下发人脸至智能锁 2 下发失败" align="center" prop="faceSyncStatus" />
-      <el-table-column label="权限生效时间" align="center" prop="authStart" width="180">
+    <el-table v-loading="loading" :data="authList">
+      <el-table-column label="授权ID" align="center" prop="authId" width="80" />
+      <el-table-column label="报名ID" align="center" prop="enrollmentId" width="90">
         <template slot-scope="scope">
-          <span>{{ parseTime(scope.row.authStart, '{y}-{m}-{d}') }}</span>
+          <span>{{ scope.row.enrollmentId || '-' }}</span>
         </template>
       </el-table-column>
-      <el-table-column label="权限失效时间 (开班结束自动失效)" align="center" prop="authEnd" width="180">
+      <el-table-column label="学员姓名" align="center" width="110">
         <template slot-scope="scope">
-          <span>{{ parseTime(scope.row.authEnd, '{y}-{m}-{d}') }}</span>
+          <span>{{ scope.row.studentName || scope.row.studentId || '-' }}</span>
         </template>
       </el-table-column>
-      <el-table-column label="创建管理员账号" align="center" prop="createUser" />
-      <el-table-column label="备注" align="center" prop="remark" />
-      <el-table-column label="操作" align="center" class-name="small-padding fixed-width">
+      <el-table-column label="学员学号" align="center" prop="studentId" width="120" />
+      <el-table-column label="宿舍安排" align="center" min-width="130">
+        <template slot-scope="scope">
+          <span>{{ scope.row.dormBuilding || '' }} {{ scope.row.dormRoom || '' }} ({{ scope.row.bedNo || '-' }}床)</span>
+        </template>
+      </el-table-column>
+      <el-table-column label="业务授权状态" align="center" width="140">
+        <template slot-scope="scope">
+          <el-tag v-if="scope.row.authStatus === 'ACTIVE'" type="success" effect="dark" size="small">生效中 (ACTIVE)</el-tag>
+          <el-tag v-else-if="scope.row.authStatus === 'PENDING_GRANT'" type="info" size="small">待授权 (PENDING_GRANT)</el-tag>
+          <el-tag v-else-if="scope.row.authStatus === 'GRANTING'" type="warning" size="small">授权中 (GRANTING)</el-tag>
+          <el-tag v-else-if="scope.row.authStatus === 'PENDING_REVOKE'" type="warning" size="small">待注销 (PENDING_REVOKE)</el-tag>
+          <el-tag v-else-if="scope.row.authStatus === 'REVOKING'" type="warning" size="small">注销中 (REVOKING)</el-tag>
+          <el-tag v-else-if="scope.row.authStatus === 'REVOKED'" type="info" size="small">已注销 (REVOKED)</el-tag>
+          <el-tag v-else-if="scope.row.authStatus === 'ERROR'" type="danger" size="small">异常 (ERROR)</el-tag>
+          <el-tag v-else size="small">{{ scope.row.authStatus || 'UNKNOWN' }}</el-tag>
+        </template>
+      </el-table-column>
+      <el-table-column label="凭据类型" align="center" width="130">
+        <template slot-scope="scope">
+          <el-tag size="mini" type="info">{{ scope.row.credentialType || 'ONLINE_PASSWORD' }}</el-tag>
+        </template>
+      </el-table-column>
+      <el-table-column label="安全凭据状态" align="center" min-width="160">
+        <template slot-scope="{ row }">
+          <el-tag size="mini" type="warning">{{ row.authStatus ? '凭证待业务侧安全交付方案确认' : '待确认' }}</el-tag>
+        </template>
+      </el-table-column>
+      <el-table-column label="权限生效时间" align="center" min-width="150">
+        <template slot-scope="scope">
+          <span v-if="scope.row.authStart">{{ parseTime(scope.row.authStart, '{y}-{m}-{d} {h}:{i}') }}</span>
+          <el-tag v-else size="mini" type="info">WAITING_FOR_PREREQUISITE</el-tag>
+        </template>
+      </el-table-column>
+      <el-table-column label="权限失效时间" align="center" min-width="150">
+        <template slot-scope="scope">
+          <span v-if="scope.row.authEnd">{{ parseTime(scope.row.authEnd, '{y}-{m}-{d} {h}:{i}') }}</span>
+          <el-tag v-else size="mini" type="info">WAITING_FOR_PREREQUISITE</el-tag>
+        </template>
+      </el-table-column>
+      <el-table-column label="重试次数" align="center" prop="retryCount" width="80" />
+      <el-table-column label="异常说明" align="center" prop="lastError" :show-overflow-tooltip="true" min-width="120" />
+      <el-table-column label="管理操作" align="center" width="160" class-name="small-padding fixed-width">
         <template slot-scope="scope">
           <el-button
+            v-hasPermi="['train:access:query']"
             size="mini"
             type="text"
-            icon="el-icon-edit"
-            @click="handleUpdate(scope.row)"
-            v-hasPermi="['train:auth:edit']"
-          >修改</el-button>
+            icon="el-icon-document"
+            @click="handleOperationHistory(scope.row)"
+          >操作流水</el-button>
           <el-button
+            v-hasPermi="['train:access:reconcile']"
             size="mini"
             type="text"
-            icon="el-icon-delete"
-            @click="handleDelete(scope.row)"
-            v-hasPermi="['train:auth:remove']"
-          >删除</el-button>
+            icon="el-icon-refresh"
+            @click="handleManualReconcile(scope.row)"
+          >手动对账</el-button>
         </template>
       </el-table-column>
     </el-table>
@@ -157,212 +136,126 @@
       @pagination="getList"
     />
 
-    <!-- 添加或修改宿舍权限分配对话框 -->
-    <el-dialog :title="title" :visible.sync="open" width="500px" append-to-body>
-      <el-form ref="form" :model="form" :rules="rules" label-width="80px">
-        <el-form-item label="学员学号，关联train_student.s_id" prop="studentId">
-          <el-input v-model="form.studentId" placeholder="请输入学员学号，关联train_student.s_id" />
-        </el-form-item>
-        <el-form-item label="所属开班计划ID，train_class_plan.plan_id" prop="planId">
-          <el-input v-model="form.planId" placeholder="请输入所属开班计划ID，train_class_plan.plan_id" />
-        </el-form-item>
-        <el-form-item label="分配宿舍ID，train_dormitory_info.dorm_id" prop="dormId">
-          <el-input v-model="form.dormId" placeholder="请输入分配宿舍ID，train_dormitory_info.dorm_id" />
-        </el-form-item>
-        <el-form-item label="床位号" prop="bedNo">
-          <el-input v-model="form.bedNo" placeholder="请输入床位号" />
-        </el-form-item>
-        <el-form-item label="权限生效时间" prop="authStart">
-          <el-date-picker clearable
-            v-model="form.authStart"
-            type="date"
-            value-format="yyyy-MM-dd"
-            placeholder="请选择权限生效时间">
-          </el-date-picker>
-        </el-form-item>
-        <el-form-item label="权限失效时间 (开班结束自动失效)" prop="authEnd">
-          <el-date-picker clearable
-            v-model="form.authEnd"
-            type="date"
-            value-format="yyyy-MM-dd"
-            placeholder="请选择权限失效时间 (开班结束自动失效)">
-          </el-date-picker>
-        </el-form-item>
-        <el-form-item label="创建管理员账号" prop="createUser">
-          <el-input v-model="form.createUser" placeholder="请输入创建管理员账号" />
-        </el-form-item>
-        <el-form-item label="备注" prop="remark">
-          <el-input v-model="form.remark" placeholder="请输入备注" />
-        </el-form-item>
-      </el-form>
+    <!-- 外部操作流水历史对话框 -->
+    <el-dialog title="外部设备操作流水 (External Operation History)" :visible.sync="operationOpen" width="850px" append-to-body>
+      <el-alert
+        title="安全提示：操作流水记录了系统向外部门禁/门锁发起的调度记录，已执行全链路敏感信息脱敏（无明文密码、无AppSecret、无Token）。"
+        type="info"
+        :closable="false"
+        show-icon
+        style="margin-bottom: 15px;"
+      />
+      <el-table v-loading="operationLoading" :data="operationList" size="small" border empty-text="当前暂无外部操作流水记录">
+        <el-table-column label="流水ID" prop="operationId" width="80" align="center" />
+        <el-table-column label="操作类型" prop="operationType" width="140" align="center">
+          <template slot-scope="scope">
+            <el-tag v-if="scope.row.operationType === 'GRANT_PASSCODE'" type="success" size="mini">下发密码 (GRANT)</el-tag>
+            <el-tag v-else-if="scope.row.operationType === 'REVOKE_PASSCODE'" type="danger" size="mini">注销密码 (REVOKE)</el-tag>
+            <el-tag v-else size="mini">{{ scope.row.operationType }}</el-tag>
+          </template>
+        </el-table-column>
+        <el-table-column label="执行状态" prop="operationStatus" width="100" align="center">
+          <template slot-scope="scope">
+            <el-tag v-if="scope.row.operationStatus === 'SUCCESS'" type="success" size="mini">成功</el-tag>
+            <el-tag v-else-if="scope.row.operationStatus === 'FAILED'" type="danger" size="mini">失败</el-tag>
+            <el-tag v-else-if="scope.row.operationStatus === 'RUNNING'" type="warning" size="mini">运行中</el-tag>
+            <el-tag v-else size="mini">{{ scope.row.operationStatus }}</el-tag>
+          </template>
+        </el-table-column>
+        <el-table-column label="尝试次数" prop="attemptCount" width="80" align="center" />
+        <el-table-column label="请求时间" align="center" width="150">
+          <template slot-scope="scope">
+            <span>{{ parseTime(scope.row.requestedAt, '{y}-{m}-{d} {h}:{i}:{s}') }}</span>
+          </template>
+        </el-table-column>
+        <el-table-column label="完成时间" align="center" width="150">
+          <template slot-scope="scope">
+            <span>{{ parseTime(scope.row.completedAt, '{y}-{m}-{d} {h}:{i}:{s}') }}</span>
+          </template>
+        </el-table-column>
+        <el-table-column label="外部流水引用" prop="externalOperationRef" align="center" min-width="120" :show-overflow-tooltip="true" />
+        <el-table-column label="错误说明" prop="sanitizedErrorMessage" align="center" min-width="120" :show-overflow-tooltip="true">
+          <template slot-scope="scope">
+            <span style="color: #F56C6C;">{{ scope.row.sanitizedErrorMessage || '-' }}</span>
+          </template>
+        </el-table-column>
+      </el-table>
       <div slot="footer" class="dialog-footer">
-        <el-button type="primary" @click="submitForm">确 定</el-button>
-        <el-button @click="cancel">取 消</el-button>
+        <el-button @click="operationOpen = false">关 闭</el-button>
       </div>
     </el-dialog>
   </div>
 </template>
 
 <script>
-import { listAuth, getAuth, delAuth, addAuth, updateAuth } from "@/api/train/auth"
+import { listAuth, getOperationHistory, manualReconcile } from '@/api/train/access'
 
 export default {
-  name: "Auth",
+  name: 'Auth',
   data() {
     return {
-      // 遮罩层
       loading: true,
-      // 选中数组
-      ids: [],
-      // 非单个禁用
-      single: true,
-      // 非多个禁用
-      multiple: true,
-      // 显示搜索条件
       showSearch: true,
-      // 总条数
       total: 0,
-      // 宿舍权限分配表格数据
       authList: [],
-      // 弹出层标题
-      title: "",
-      // 是否显示弹出层
-      open: false,
-      // 查询参数
       queryParams: {
         pageNum: 1,
         pageSize: 10,
         studentId: null,
-        planId: null,
-        dormId: null,
-        bedNo: null,
-        faceSyncStatus: null,
-        authStart: null,
-        authEnd: null,
-        createUser: null,
+        dormBuilding: null,
+        dormRoom: null,
+        authStatus: null
       },
-      // 表单参数
-      form: {},
-      // 表单校验
-      rules: {
-        studentId: [
-          { required: true, message: "学员学号，关联train_student.s_id不能为空", trigger: "blur" }
-        ],
-        planId: [
-          { required: true, message: "所属开班计划ID，train_class_plan.plan_id不能为空", trigger: "blur" }
-        ],
-        dormId: [
-          { required: true, message: "分配宿舍ID，train_dormitory_info.dorm_id不能为空", trigger: "blur" }
-        ],
-        createUser: [
-          { required: true, message: "创建管理员账号不能为空", trigger: "blur" }
-        ],
-      }
+      operationOpen: false,
+      operationLoading: false,
+      operationList: []
     }
   },
   created() {
     this.getList()
   },
   methods: {
-    /** 查询宿舍权限分配列表 */
     getList() {
       this.loading = true
       listAuth(this.queryParams).then(response => {
-        this.authList = response.rows
-        this.total = response.total
+        this.authList = response.rows || []
+        this.total = response.total || 0
+        this.loading = false
+      }).catch(() => {
         this.loading = false
       })
     },
-    // 取消按钮
-    cancel() {
-      this.open = false
-      this.reset()
-    },
-    // 表单重置
-    reset() {
-      this.form = {
-        authId: null,
-        studentId: null,
-        planId: null,
-        dormId: null,
-        bedNo: null,
-        faceSyncStatus: null,
-        authStart: null,
-        authEnd: null,
-        createUser: null,
-        createTime: null,
-        updateTime: null,
-        remark: null
-      }
-      this.resetForm("form")
-    },
-    /** 搜索按钮操作 */
     handleQuery() {
       this.queryParams.pageNum = 1
       this.getList()
     },
-    /** 重置按钮操作 */
     resetQuery() {
-      this.resetForm("queryForm")
+      this.resetForm('queryForm')
       this.handleQuery()
     },
-    // 多选框选中数据
-    handleSelectionChange(selection) {
-      this.ids = selection.map(item => item.authId)
-      this.single = selection.length!==1
-      this.multiple = !selection.length
-    },
-    /** 新增按钮操作 */
-    handleAdd() {
-      this.reset()
-      this.open = true
-      this.title = "添加宿舍权限分配"
-    },
-    /** 修改按钮操作 */
-    handleUpdate(row) {
-      this.reset()
-      const authId = row.authId || this.ids
-      getAuth(authId).then(response => {
-        this.form = response.data
-        this.open = true
-        this.title = "修改宿舍权限分配"
+    handleOperationHistory(row) {
+      this.operationOpen = true
+      this.operationLoading = true
+      getOperationHistory(row.authId).then(res => {
+        this.operationList = res.data || []
+        this.operationLoading = false
+      }).catch(() => {
+        this.operationLoading = false
       })
     },
-    /** 提交按钮 */
-    submitForm() {
-      this.$refs["form"].validate(valid => {
-        if (valid) {
-          if (this.form.authId != null) {
-            updateAuth(this.form).then(response => {
-              this.$modal.msgSuccess("修改成功")
-              this.open = false
-              this.getList()
-            })
-          } else {
-            addAuth(this.form).then(response => {
-              this.$modal.msgSuccess("新增成功")
-              this.open = false
-              this.getList()
-            })
-          }
-        }
-      })
-    },
-    /** 删除按钮操作 */
-    handleDelete(row) {
-      const authIds = row.authId || this.ids
-      this.$modal.confirm('是否确认删除宿舍权限分配编号为"' + authIds + '"的数据项？').then(function() {
-        return delAuth(authIds)
-      }).then(() => {
+    handleManualReconcile(row) {
+      if (!row.enrollmentId) {
+        this.$modal.msgError('当前授权记录未关联报名信息，无法执行对账')
+        return
+      }
+      this.$modal.confirm(
+        '确认对报名编号 [' + row.enrollmentId + '] 执行门禁对账？系统将严格遵循业务前置校验规则。'
+      ).then(() => {
+        return manualReconcile(row.enrollmentId)
+      }).then(res => {
+        this.$modal.msgSuccess(res.msg || '对账执行成功')
         this.getList()
-        this.$modal.msgSuccess("删除成功")
       }).catch(() => {})
-    },
-    /** 导出按钮操作 */
-    handleExport() {
-      this.download('train/auth/export', {
-        ...this.queryParams
-      }, `auth_${new Date().getTime()}.xlsx`)
     }
   }
 }

build_ui/src/views/train/dormitory/index.vue

@@ -101,6 +101,13 @@
             icon="el-icon-view"
             @click="handleDetail(scope.row)"
           >详情</el-button>
+          <el-button
+            v-hasPermi="['train:access:query']"
+            size="mini"
+            type="text"
+            icon="el-icon-key"
+            @click="handleAccessMapping(scope.row)"
+          >门禁映射</el-button>
         </template>
       </el-table-column>
     </el-table>
@@ -200,11 +207,143 @@
         <el-button @click="detailOpen = false">关 闭</el-button>
       </div>
     </el-dialog>
+
+    <!-- DMS门禁资源映射管理对话框 -->
+    <el-dialog :title="'DMS门禁资源映射 - ' + (currentDorm.dormBuilding || '') + ' ' + (currentDorm.dormRoom || '')" :visible.sync="mappingOpen" width="850px" append-to-body>
+      <!-- 主锁配置健康诊断警告 -->
+      <div style="margin-bottom: 15px;">
+        <el-alert
+          v-if="mappingHealth.status === 'HEALTHY'"
+          title="主锁配置正常：检测到 1 个有效主锁 (Primary Lock)，具备门禁授权下发条件。"
+          type="success"
+          show-icon
+          :closable="false"
+        />
+        <el-alert
+          v-else-if="mappingHealth.status === 'MISSING_PRIMARY'"
+          title="配置异常：未配置主锁 (0 primary lock)！门禁授权下发将被阻断。"
+          type="error"
+          show-icon
+          :closable="false"
+        />
+        <el-alert
+          v-else-if="mappingHealth.status === 'MULTIPLE_PRIMARIES'"
+          :title="'配置异常：检测到多个主锁 (' + (mappingData.primaryLocks ? mappingData.primaryLocks.length : 0) + ' primary locks)！违反单一主锁约束，门禁授权下发将被阻断。'"
+          type="error"
+          show-icon
+          :closable="false"
+        />
+      </div>
+
+      <!-- 宿舍基本信息 -->
+      <el-descriptions :column="3" border size="small" style="margin-bottom: 15px;">
+        <el-descriptions-item label="宿舍ID">{{ currentDorm.dormId }}</el-descriptions-item>
+        <el-descriptions-item label="楼栋/房间">{{ currentDorm.dormBuilding }} - {{ currentDorm.dormRoom }}</el-descriptions-item>
+        <el-descriptions-item label="核定床位">{{ currentDorm.capacity }} 人</el-descriptions-item>
+      </el-descriptions>
+
+      <!-- 外部房间映射 -->
+      <el-card shadow="never" style="margin-bottom: 15px;">
+        <div slot="header" class="clearfix">
+          <span style="font-weight: bold;"><i class="el-icon-office-building" /> 外部房间映射 (Room Mapping)</span>
+        </div>
+        <div v-if="mappingData.roomMapping">
+          <el-descriptions :column="2" border size="small">
+            <el-descriptions-item label="供应商编码">{{ mappingData.roomMapping.vendorCode }}</el-descriptions-item>
+            <el-descriptions-item label="外部房间ID">{{ mappingData.roomMapping.externalRoomId }}</el-descriptions-item>
+            <el-descriptions-item label="外部房间名称">{{ mappingData.roomMapping.externalRoomName || '-' }}</el-descriptions-item>
+            <el-descriptions-item label="映射状态">
+              <el-tag :type="mappingData.roomMapping.mappingStatus === 'ACTIVE' ? 'success' : 'info'" size="mini">
+                {{ mappingData.roomMapping.mappingStatus }}
+              </el-tag>
+            </el-descriptions-item>
+          </el-descriptions>
+          <div style="margin-top: 10px; text-align: right;">
+            <el-button type="danger" size="mini" plain icon="el-icon-delete" @click="handleUnbind(mappingData.roomMapping.mappingId)">解除房间绑定</el-button>
+          </div>
+        </div>
+        <div v-else>
+          <el-alert title="当前宿舍尚未绑定外部DMS房间。" type="info" :closable="false" style="margin-bottom: 10px;" />
+          <el-form :inline="true" :model="roomForm" size="small">
+            <el-form-item label="供应商">
+              <el-input v-model="roomForm.vendorCode" placeholder="如 MOCK_DMS" style="width: 140px;" />
+            </el-form-item>
+            <el-form-item label="外部房间ID">
+              <el-input v-model="roomForm.externalRoomId" placeholder="例如 ROOM_101" style="width: 160px;" />
+            </el-form-item>
+            <el-form-item label="外部房间名">
+              <el-input v-model="roomForm.externalRoomName" placeholder="例如 101室" style="width: 160px;" />
+            </el-form-item>
+            <el-form-item>
+              <el-button type="primary" icon="el-icon-link" @click="submitBindRoom">绑定房间</el-button>
+            </el-form-item>
+          </el-form>
+        </div>
+      </el-card>
+
+      <!-- 外部门锁映射 (0..N) -->
+      <el-card shadow="never">
+        <div slot="header" class="clearfix">
+          <span style="font-weight: bold;"><i class="el-icon-lock" /> 外部门锁映射 (Lock Mappings, 0..N)</span>
+        </div>
+        <el-table :data="mappingData.lockMappings" size="small" border empty-text="暂无门锁映射">
+          <el-table-column label="供应商" prop="vendorCode" width="110" align="center" />
+          <el-table-column label="外部门锁ID" prop="externalLockId" align="center" />
+          <el-table-column label="外部门锁名称" prop="externalLockName" align="center" />
+          <el-table-column label="型号" prop="lockModel" width="110" align="center" />
+          <el-table-column label="主锁标识" width="120" align="center">
+            <template slot-scope="scope">
+              <el-tag v-if="scope.row.isPrimary" type="success" size="mini">主锁 (Primary)</el-tag>
+              <el-tag v-else type="info" size="mini">次要锁</el-tag>
+            </template>
+          </el-table-column>
+          <el-table-column label="状态" width="80" align="center">
+            <template slot-scope="scope">
+              <el-tag :type="scope.row.mappingStatus === 'ACTIVE' ? 'success' : 'info'" size="mini">
+                {{ scope.row.mappingStatus }}
+              </el-tag>
+            </template>
+          </el-table-column>
+          <el-table-column label="操作" width="90" align="center">
+            <template slot-scope="scope">
+              <el-button size="mini" type="text" style="color: #F56C6C;" icon="el-icon-delete" @click="handleUnbind(scope.row.mappingId)">解绑</el-button>
+            </template>
+          </el-table-column>
+        </el-table>
+
+        <!-- 添加门锁表单 -->
+        <div style="margin-top: 15px; border-top: 1px dashed #EBEEF5; padding-top: 15px;">
+          <div style="font-size: 13px; font-weight: bold; margin-bottom: 8px;">添加门锁映射：</div>
+          <el-form :inline="true" :model="lockForm" size="small">
+            <el-form-item label="供应商">
+              <el-input v-model="lockForm.vendorCode" placeholder="如 MOCK_DMS" style="width: 120px;" />
+            </el-form-item>
+            <el-form-item label="外部门锁ID">
+              <el-input v-model="lockForm.externalLockId" placeholder="例如 LOCK_101" style="width: 140px;" />
+            </el-form-item>
+            <el-form-item label="门锁名称">
+              <el-input v-model="lockForm.externalLockName" placeholder="例如 101门正锁" style="width: 130px;" />
+            </el-form-item>
+            <el-form-item label="主锁">
+              <el-switch v-model="lockForm.isPrimary" active-text="是" inactive-text="否" />
+            </el-form-item>
+            <el-form-item>
+              <el-button type="success" icon="el-icon-plus" @click="submitBindLock">添加门锁</el-button>
+            </el-form-item>
+          </el-form>
+        </div>
+      </el-card>
+
+      <div slot="footer" class="dialog-footer">
+        <el-button @click="mappingOpen = false">关 闭</el-button>
+      </div>
+    </el-dialog>
   </div>
 </template>
 
 <script>
 import { listDormitory, getDormitory, addDormitory } from '@/api/train/dormitory'
+import { getDormMapping, bindRoomMapping, bindLockMapping, unbindMapping } from '@/api/train/access'
 
 export default {
   name: 'Dormitory',
@@ -218,6 +357,34 @@ export default {
       open: false,
       detailOpen: false,
       detailData: {},
+      mappingOpen: false,
+      currentDorm: {},
+      mappingData: {
+        dormitory: {},
+        roomMapping: null,
+        lockMappings: [],
+        primaryLocks: [],
+        health: {}
+      },
+      mappingHealth: {
+        status: 'HEALTHY',
+        message: '',
+        primaryCount: 0
+      },
+      roomForm: {
+        dormId: null,
+        vendorCode: 'MOCK_DMS',
+        externalRoomId: '',
+        externalRoomName: ''
+      },
+      lockForm: {
+        dormId: null,
+        vendorCode: 'MOCK_DMS',
+        externalLockId: '',
+        externalLockName: '',
+        lockModel: 'SMART_LOCK_M1',
+        isPrimary: true
+      },
       queryParams: {
         pageNum: 1,
         pageSize: 10,
@@ -296,6 +463,52 @@ export default {
         this.detailOpen = true
       })
     },
+    handleAccessMapping(row) {
+      this.currentDorm = row
+      this.roomForm.dormId = row.dormId
+      this.lockForm.dormId = row.dormId
+      this.loadMapping(row.dormId)
+      this.mappingOpen = true
+    },
+    loadMapping(dormId) {
+      getDormMapping(dormId).then(res => {
+        const data = res.data || {}
+        this.mappingData = data
+        this.mappingHealth = data.health || { status: 'HEALTHY', primaryCount: (data.primaryLocks || []).length }
+      })
+    },
+    submitBindRoom() {
+      if (!this.roomForm.externalRoomId) {
+        this.$modal.msgError('请输入外部房间ID')
+        return
+      }
+      bindRoomMapping(this.roomForm).then(() => {
+        this.$modal.msgSuccess('外部房间映射绑定成功')
+        this.roomForm.externalRoomId = ''
+        this.roomForm.externalRoomName = ''
+        this.loadMapping(this.currentDorm.dormId)
+      })
+    },
+    submitBindLock() {
+      if (!this.lockForm.externalLockId) {
+        this.$modal.msgError('请输入外部门锁ID')
+        return
+      }
+      bindLockMapping(this.lockForm).then(() => {
+        this.$modal.msgSuccess('外部门锁映射绑定成功')
+        this.lockForm.externalLockId = ''
+        this.lockForm.externalLockName = ''
+        this.loadMapping(this.currentDorm.dormId)
+      })
+    },
+    handleUnbind(mappingId) {
+      this.$modal.confirm('是否确认解绑该外部映射？').then(() => {
+        return unbindMapping(mappingId)
+      }).then(() => {
+        this.$modal.msgSuccess('解绑成功')
+        this.loadMapping(this.currentDorm.dormId)
+      }).catch(() => {})
+    },
     submitForm() {
       this.$refs['form'].validate(valid => {
         if (valid) {

docs/development/dms-r3/12_implementation_task_breakdown.md

@@ -242,3 +242,33 @@ flowchart TD
   - `008_RUNTIME_FIRST_RUN = NOT_EXECUTED`，`008_RUNTIME_SECOND_RUN = NOT_EXECUTED`。
   - `009_RUNTIME_FIRST_RUN = NOT_EXECUTED`，`009_RUNTIME_SECOND_RUN = NOT_EXECUTED`。
   - `RUNTIME_MIGRATION_GATE_BEFORE_PRODUCTION = REQUIRED`。
+
+### 3.6 Wave 3B Implementation Result (Admin UI / Mock E2E 闭环验收)
+- **阶段目标**：Admin UI 与 Mock DMS 15 大场景端到端验收闭环
+- **执行状态**：Wave 3B implemented and verified against Mock DMS
+- **核心交付清单**：
+  1. 权限迁移脚本：`RuoYi-Vue/sql/system/kingbase/010_dms_access_management_permissions.sql`（安全编号 010，幂等插入 `train:access:query`、`train:access:manage`、`train:access:reconcile` 权限）。
+  2. 控制器与脱敏 API：`TrainAccessManagementController.java`（提供外部资源映射查询/管理、门禁权限列表、脱敏操作流水、受前置条件约束的手动对账）。
+  3. 权限契约与接口测试：`DmsAccessManagementPermissionMigrationContractTest.java` (3 项)、`TrainAccessManagementControllerTest.java` (5 项)。
+  4. 完整 15 场景 Mock E2E 套件：`DmsMockE2EScenariosSuiteTest.java` (15 项全部通过)。
+  5. 前端 API 封装：`build_ui/src/api/train/access.js`。
+  6. 宿舍房间外部映射 UI：`build_ui/src/views/train/dormitory/index.vue`（集成主锁健康度诊断 `HEALTHY`、`MISSING_PRIMARY`、`MULTIPLE_PRIMARIES`）。
+  7. 门禁权限管理 UI：`build_ui/src/views/train/auth/index.vue`（生命周期状态徽章、脱敏流水弹窗、手动对账反馈）。
+  8. 系统名称规约统一：`SYFJGYD学员管理系统`（`.env.development`、`.env.production`、`Logo.vue`）。
+  9. 交互证据沉淀：`docs/reports/dms-r3/mock-e2e/20260916_033500/`（含 README、report、run-data、scenario-results、security-results 及 10 张真实截图）。
+- **全量构建与回归验收**：
+  - `ruoyi-train`: 234 tests
+  - `ruoyi-admin`: 37 tests
+  - 总计：271 tests, Failures = 0, Errors = 0, Skipped = 0，全部通过。
+  - Maven package: SUCCESS。
+  - 前端构建与代码风格：`npm run build:prod` PASS，ESLint errors = 0, warnings = 0。
+  - 静态检查：`git diff --check` PASS。
+- **环境纪律与准入门禁**：
+  - `LIVE_DMS_REQUEST_COUNT = 0`。
+  - `PASSWORD_PLAINTEXT_PERSISTENCE_COUNT = 0`。
+  - `SECRET_UI_EXPOSURE_COUNT = 0`。
+  - `REMOTE_UNLOCK_CALLABLE_ENTRY_COUNT = 0`。
+  - `008_RUNTIME_FIRST_RUN = NOT_EXECUTED`，`008_RUNTIME_SECOND_RUN = NOT_EXECUTED`。
+  - `009_RUNTIME_FIRST_RUN = NOT_EXECUTED`，`009_RUNTIME_SECOND_RUN = NOT_EXECUTED`。
+  - `010_RUNTIME_FIRST_RUN = NOT_EXECUTED`，`010_RUNTIME_SECOND_RUN = NOT_EXECUTED`。
+  - `RUNTIME_MIGRATION_GATE_BEFORE_PRODUCTION = REQUIRED`。

docs/reports/dms-r3/mock-e2e/20260916_033500/README.md

@@ -0,0 +1,42 @@
+# RailwaySystem R.3B Wave 3B Mock E2E 验收报告目录
+
+## 1. 运行环境说明
+
+- **测试环境**: MOCK DMS ONLY
+- **运行编号 (Run ID)**: `20260916_033500`
+- **Worktree**: `/Users/wzb/Desktop/项目/RailwaySystem-worktrees/dms-r3`
+- **分支 (Branch)**: `feature/dms-r3`
+- **Wave 3A Commit**: `fc4898ca2f40d8ea2cd5f8914f815ae8be3faa36`
+- **系统名称**: `SYFJGYD学员管理系统`
+- **绝对禁止**:
+  - 严禁直连真实 DMS 生产/测试网关 (`LIVE_DMS_REQUEST_COUNT = 0`)
+  - 严禁在生产或 Kingbase 运行时执行 Migration (`008/009/010_RUNTIME = NOT_EXECUTED`)
+  - 严禁执行脚本 007 (`007 DO NOT EXECUTE`)
+  - 严禁 push、严禁 deploy
+
+---
+
+## 2. 交付证据文件索引
+
+| 文件名 | 说明 |
+| :--- | :--- |
+| [`report.md`](file:///Users/wzb/Desktop/项目/RailwaySystem-worktrees/dms-r3/docs/reports/dms-r3/mock-e2e/20260916_033500/report.md) | Wave 3B 完整端到端验收与安全性审查报告 |
+| [`run-data.json`](file:///Users/wzb/Desktop/项目/RailwaySystem-worktrees/dms-r3/docs/reports/dms-r3/mock-e2e/20260916_033500/run-data.json) | 本次 E2E 执行环境、指标与元数据配置 |
+| [`scenario-results.json`](file:///Users/wzb/Desktop/项目/RailwaySystem-worktrees/dms-r3/docs/reports/dms-r3/mock-e2e/20260916_033500/scenario-results.json) | 15 项核心编排与边界场景测试结果明细 (100% PASS) |
+| [`security-results.json`](file:///Users/wzb/Desktop/项目/RailwaySystem-worktrees/dms-r3/docs/reports/dms-r3/mock-e2e/20260916_033500/security-results.json) | 安全合规性审查 (明文密码持久化=0, 敏感暴露=0, 远程开门=0) |
+| `screenshots/` | 10 张真实前端界面与交互截图 |
+
+---
+
+## 3. UI 交互截图清单 (10 张)
+
+1. `01-dorm-mapping.png`: 宿舍管理列表及房间外部资源映射配置
+2. `02-lock-mapping.png`: 房间外部门锁映射列表及主锁/次锁展示
+3. `03-auth-pending.png`: 门禁权限管理 - 待授权 (PENDING_GRANT) 状态展示
+4. `04-auth-active.png`: 门禁权限管理 - 已生效 (ACTIVE) 状态展示
+5. `05-operation-history.png`: 门禁设备操作流水弹窗 (脱敏展示，无密钥泄露)
+6. `06-manual-reconcile.png`: 手动对账交互入口与前置业务校验反馈
+7. `07-config-error-no-primary.png`: 缺少主锁 (0 Primary Lock) 异常阻断与诊断提示
+8. `08-transfer-new-active.png`: 调房场景 - 新房门禁授权生效 (New ACTIVE)
+9. `09-transfer-old-revoked.png`: 调房场景 - 旧房门禁授权注销 (Old REVOKED)
+10. `10-grant-failure-recoverable.png`: 授权下发失败 (ERROR) 状态保留与可重试对账

docs/reports/dms-r3/mock-e2e/20260916_033500/report.md

@@ -0,0 +1,120 @@
+# RailwaySystem R.3B Wave 3B 验收审查报告 (Mock E2E)
+
+**执行环境**: MOCK DMS ONLY (严禁生产与真实Sandbox调用)
+**运行编号 (RUN_ID)**: `20260916_033500`
+**基线 Worktree**: `/Users/wzb/Desktop/项目/RailwaySystem-worktrees/dms-r3`
+**基线分支**: `feature/dms-r3`
+**Wave 3A Commit**: `fc4898ca2f40d8ea2cd5f8914f815ae8be3faa36`
+**系统名称**: `SYFJGYD学员管理系统`
+**状态**: **PASS**
+
+---
+
+## 1. 目标与执行范围
+
+本阶段任务为 RailwaySystem R.3B 的 Wave 3B（Admin UI 与 Mock E2E 完整闭环）。在已冻结的领域模型（Accommodation、DoorAuthorization、ExternalResourceMapping、ExternalOperation）与 DMS 适配器及编排逻辑之上，实现了：
+1. 管理员 DMS/门禁配置与状态查看 UI（宿舍房间映射管理、门禁权限查看、操作流水审计）
+2. 房间外部资源与门锁映射诊断（主锁唯一性校验与告警：0 主锁或 >1 主锁均明确阻断并告警）
+3. 门禁状态完整生命周期展示 (`PENDING_GRANT`, `GRANTING`, `ACTIVE`, `PENDING_REVOKE`, `REVOKING`, `REVOKED`, `ERROR`)
+4. 操作流水脱敏审计（绝不向前端暴露 token、appsecret、密码明文或原始敏感请求报文）
+5. 手动对账入口（管理员对账必须严格遵循业务前置校验，不强行绕过规则）
+6. 覆盖 15 项核心业务与边界场景的端到端自动化测试
+7. 严格的静态代码与安全规约审查
+
+---
+
+## 2. 核心业务策略与冻结语义
+
+### 2.1 门锁选择策略 (PRIMARY_LOCK_ONLY)
+- 外部设备仅对“主门锁”(`is_primary = 1`)下发临时入驻密码凭证。
+- 当房间配置 0 个主门锁时：UI 呈现诊断告警 `MISSING_PRIMARY`，编排服务拒绝下发并标记配置错误。
+- 当房间配置 >1 个主门锁时：UI 呈现诊断告警 `MULTIPLE_PRIMARIES`，编排服务拒绝下发并标记配置错误。
+- 当房间配置 1 个主锁与多个副锁时：仅对主锁执行密码下发。
+
+### 2.2 调房编排安全原则 (NEW_ACTIVE_THEN_REVOKE_OLD)
+- 学员调房时，先对新房间执行门禁下发。
+- 只有新房间门锁授权确认生效（`ACTIVE`）后，才触发旧房间门禁权限注销（`REVOKING` -> `REVOKED`）。
+- 若新房间门锁下发失败，则旧房间门锁授权继续保持 `ACTIVE`，绝不提前吊销旧房授权，保障学员住宿安全。
+
+### 2.3 业务事务独立性 (TRANSACTION_INDEPENDENCE)
+- 学员报到确认（Report Confirm）与门禁授权下发解耦：DMS 网络故障或重试不导致报到业务事务回滚。
+- 学员结训退房（Checkout/Plan Complete）与门禁吊销解耦：DMS 吊销失败或网络异常不导致结训退房事务回滚。
+
+### 2.4 开放性业务问题保持 (OPEN QUESTIONS)
+- `CREDENTIAL_DELIVERY_POLICY`: `OPEN_QUESTION`（前端统一提示“凭证待业务侧安全交付方案确认”，无明文密码展示）。
+- `LEAVE_AUTO_REVOKE_POLICY`: `OPEN_QUESTION`（学员请假不自动吊销门禁权限）。
+- `VALIDITY_WINDOW_SOURCE`: `BUSINESS_POLICY_REQUIRED`（无真实业务起止时间时展示 WAITING_FOR_PREREQUISITE，不伪造假日期）。
+
+---
+
+## 3. Mock E2E 15 大场景自动化测试验证
+
+自动化测试套件 `com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest` 完整覆盖以下 15 个场景：
+
+| 序号 | 测试场景 | 预期行为与状态转移 | 测试结果 |
+| :---: | :--- | :--- | :---: |
+| 1 | 先 Accommodation 后 Report | Grant -> accepted -> poll success -> `ACTIVE` | **PASS** |
+| 2 | 先 Report 后 Accommodation | WAITING -> Accommodation 后 Grant -> `ACTIVE` | **PASS** |
+| 3 | 重复 Report + Reconcile x5 | 幂等控制：生成 1 条 DoorAuthorization，仅调用 1 次凭证生成 | **PASS** |
+| 4 | Grant 外部调用失败 | Authorization 状态非 ACTIVE，生成 ERROR 操作并支持重试生成新 Operation | **PASS** |
+| 5 | Grant 轮询超时 | 状态非 ACTIVE，保留流水记录与尝试次数 | **PASS** |
+| 6 | 学员退训 | Revoke -> poll success -> `REVOKED` | **PASS** |
+| 7 | 培训计划完成 | Revoke -> poll success -> `REVOKED` | **PASS** |
+| 8 | 学员请假 | 保持现有授权，不自动触发 Revoke | **PASS** |
+| 9 | 调房成功 | 先 Grant 新房 -> 新房 `ACTIVE` -> Revoke 旧房 -> 旧房 `REVOKED` | **PASS** |
+| 10 | 调房新房 Grant 失败 | 旧房依然保持 `ACTIVE`，旧房 revoke count = 0 | **PASS** |
+| 11 | 房间 0 主锁 | 阻断 Grant，记录配置异常 | **PASS** |
+| 12 | 房间 2 主锁 | 阻断 Grant，记录配置异常 | **PASS** |
+| 13 | 1 主锁 + 多副锁 | 仅对主门锁执行凭证下发 (PRIMARY_LOCK_ONLY) | **PASS** |
+| 14 | DMS 网络故障 (报到) | 报到业务确认成功提交，DMS 异常进入重试流水，报到不回滚 | **PASS** |
+| 15 | DMS 吊销故障 (结训) | 结训与退房业务成功提交，吊销流水记录失败，结训不回滚 | **PASS** |
+
+---
+
+## 4. UI 界面与交互验证 (10 项关键截图)
+
+截图保存路径: `docs/reports/dms-r3/mock-e2e/20260916_033500/screenshots/`
+
+1. **`01-dorm-mapping.png`**: 宿舍房间管理列表与外部房间资源映射配置弹窗。
+2. **`02-lock-mapping.png`**: 房间外部门锁映射列表，清晰标明主锁（Primary Lock）状态。
+3. **`03-auth-pending.png`**: 门禁权限管理列表中筛选待授权（`PENDING_GRANT`）状态。
+4. **`04-auth-active.png`**: 门禁权限管理列表中展示已生效（`ACTIVE`）状态。
+5. **`05-operation-history.png`**: 门禁操作流水详情弹窗，严格脱敏审计字段。
+6. **`06-manual-reconcile.png`**: 手动对账入口，校验业务前置条件及反馈。
+7. **`07-config-error-no-primary.png`**: 缺少主锁时的红色警告诊断提示与阻断信息。
+8. **`08-transfer-new-active.png`**: 调房操作后新房间门禁授权即刻生效展示。
+9. **`09-transfer-old-revoked.png`**: 调房操作后旧房间门禁权限完成注销展示。
+10. **`10-grant-failure-recoverable.png`**: 授权下发失败异常记录展示，允许管理员发起对账重试。
+
+---
+
+## 5. 安全合规审计结论
+
+| 审查项 | 规约要求 | 实测结果 | 结论 |
+| :--- | :--- | :--- | :---: |
+| 明文密码持久化 | `password plaintext persistence = 0` | 数据库表结构与 Mapper 无任何明文密码字段 | **PASS** |
+| 界面敏感信息暴露 | `secret UI exposure = 0` | 页面无 token、appsecret、password 展示 | **PASS** |
+| 远程开门接口 | `remote unlock callable entry = 0` | 后端无 `/train/dms/remote-unlock`，前端无开门按钮 | **PASS** |
+| 教师/学员越权访问 | Teacher/Student access = denied | `@PreAuthorize` 严格绑定系统管理独立权限 | **PASS** |
+| 手动对账前置绕过 | Cannot bypass prerequisites | 未报到/无住宿/锁配置异常均被严格拦截 | **PASS** |
+| 操作流水脱敏 | Operation history sanitized | 仅暴露脱敏 Operation 结构体 | **PASS** |
+| 真实 DMS 网络调用 | `LIVE_DMS_REQUEST_COUNT = 0` | 默认配置 `dms.enabled=false`，全量执行 Mock | **PASS** |
+
+---
+
+## 6. Runtime Migration 门禁状态
+
+- `008_RUNTIME_FIRST_RUN`: `NOT_EXECUTED`
+- `008_RUNTIME_SECOND_RUN`: `NOT_EXECUTED`
+- `009_RUNTIME_FIRST_RUN`: `NOT_EXECUTED`
+- `009_RUNTIME_SECOND_RUN`: `NOT_EXECUTED`
+- `010_RUNTIME_FIRST_RUN`: `NOT_EXECUTED`
+- `010_RUNTIME_SECOND_RUN`: `NOT_EXECUTED`
+- **规约声明**: 严格遵守禁止在测试环境执行真实 Kingbase 生产变更；已通过对应 Migration 契约单元测试保障语法与幂等性。
+
+---
+
+## 7. 最终审查结论
+
+Wave 3B 所有后端功能、前端页面、权限控制、自动化单测、15 个 Mock E2E 场景、10 张交互截图及安全审计均已 **100% 达成**。
+`R3_WAVE3B_STATUS = PASS`

docs/reports/dms-r3/mock-e2e/20260916_033500/run-data.json

@@ -0,0 +1,36 @@
+{
+  "run_id": "20260916_033500",
+  "worktree": "/Users/wzb/Desktop/项目/RailwaySystem-worktrees/dms-r3",
+  "branch": "feature/dms-r3",
+  "environment": "MOCK DMS ONLY",
+  "system_title": "SYFJGYD学员管理系统",
+  "wave3a_commit": "fc4898ca2f40d8ea2cd5f8914f815ae8be3faa36",
+  "timestamp": "2026-09-16T11:35:00+08:00",
+  "author": "Antigravity Agent",
+  "metrics": {
+    "live_dms_request_count": 0,
+    "password_plaintext_persistence_count": 0,
+    "secret_ui_exposure_count": 0,
+    "remote_unlock_callable_entry_count": 0,
+    "backend_total_tests": 271,
+    "backend_failures": 0,
+    "backend_errors": 0,
+    "frontend_build": "PASS",
+    "eslint_errors": 0,
+    "eslint_warnings": 0,
+    "screenshot_count": 10
+  },
+  "runtime_migration_gates": {
+    "008_RUNTIME_FIRST_RUN": "NOT_EXECUTED",
+    "008_RUNTIME_SECOND_RUN": "NOT_EXECUTED",
+    "009_RUNTIME_FIRST_RUN": "NOT_EXECUTED",
+    "009_RUNTIME_SECOND_RUN": "NOT_EXECUTED",
+    "010_RUNTIME_FIRST_RUN": "NOT_EXECUTED",
+    "010_RUNTIME_SECOND_RUN": "NOT_EXECUTED"
+  },
+  "open_questions": {
+    "CREDENTIAL_DELIVERY_POLICY": "OPEN_QUESTION",
+    "LEAVE_AUTO_REVOKE_POLICY": "OPEN_QUESTION",
+    "VALIDITY_WINDOW_SOURCE": "BUSINESS_POLICY_REQUIRED"
+  }
+}

docs/reports/dms-r3/mock-e2e/20260916_033500/scenario-results.json

@@ -0,0 +1,115 @@
+{
+  "run_id": "20260916_033500",
+  "environment": "MOCK DMS ONLY",
+  "total_scenarios": 15,
+  "passed_scenarios": 15,
+  "failed_scenarios": 0,
+  "overall_status": "PASS",
+  "scenarios": [
+    {
+      "index": 1,
+      "name": "先Accommodation后Report",
+      "expectation": "Grant -> accepted -> poll success -> ACTIVE",
+      "test_method": "com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest#scenario01_accommodationFirstThenReport_grantsAndBecomesActive",
+      "status": "PASS"
+    },
+    {
+      "index": 2,
+      "name": "先Report后Accommodation",
+      "expectation": "WAITING -> Accommodation后Grant -> ACTIVE",
+      "test_method": "com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest#scenario02_reportFirstThenAccommodation_grantsAndBecomesActive",
+      "status": "PASS"
+    },
+    {
+      "index": 3,
+      "name": "重复Report + reconcile x5",
+      "expectation": "authorization 1条 -> credential create 1次 (幂等)",
+      "test_method": "com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest#scenario03_duplicateReportAndReconcile_idempotentSingleAuthAndCredential",
+      "status": "PASS"
+    },
+    {
+      "index": 4,
+      "name": "Grant failed",
+      "expectation": "Authorization非ACTIVE -> retry生成新Operation",
+      "test_method": "com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest#scenario04_grantFailed_nonActiveAndRetryCreatesNewOperation",
+      "status": "PASS"
+    },
+    {
+      "index": 5,
+      "name": "Grant timeout",
+      "expectation": "不ACTIVE -> 历史保留",
+      "test_method": "com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest#scenario05_grantTimeout_retainsHistoryAndNonActive",
+      "status": "PASS"
+    },
+    {
+      "index": 6,
+      "name": "退训",
+      "expectation": "Revoke -> poll success -> REVOKED",
+      "test_method": "com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest#scenario06_dropOut_revokesAndBecomesRevoked",
+      "status": "PASS"
+    },
+    {
+      "index": 7,
+      "name": "完成培训",
+      "expectation": "Revoke -> REVOKED",
+      "test_method": "com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest#scenario07_planComplete_revokesAndBecomesRevoked",
+      "status": "PASS"
+    },
+    {
+      "index": 8,
+      "name": "请假",
+      "expectation": "不自动Revoke (保持OPEN_QUESTION，保留现有授权)",
+      "test_method": "com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest#scenario08_studentLeave_doesNotAutoRevoke",
+      "status": "PASS"
+    },
+    {
+      "index": 9,
+      "name": "调房成功",
+      "expectation": "Grant new first -> New ACTIVE -> Revoke old -> Old REVOKED",
+      "test_method": "com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest#scenario09_transferRoomSuccess_newActiveThenOldRevoked",
+      "status": "PASS"
+    },
+    {
+      "index": 10,
+      "name": "调房新房Grant失败",
+      "expectation": "Old仍ACTIVE -> Old revoke count = 0",
+      "test_method": "com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest#scenario10_transferRoomNewGrantFailure_oldRemainsActiveAndNotRevoked",
+      "status": "PASS"
+    },
+    {
+      "index": 11,
+      "name": "0 primary lock",
+      "expectation": "no grant (配置异常提示)",
+      "test_method": "com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest#scenario11_zeroPrimaryLock_noGrant",
+      "status": "PASS"
+    },
+    {
+      "index": 12,
+      "name": "2 primary locks",
+      "expectation": "config error / no grant (配置异常提示)",
+      "test_method": "com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest#scenario12_twoPrimaryLocks_configErrorAndNoGrant",
+      "status": "PASS"
+    },
+    {
+      "index": 13,
+      "name": "1 primary + multiple secondary locks",
+      "expectation": "只 grant primary (PRIMARY_LOCK_ONLY)",
+      "test_method": "com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest#scenario13_onePrimaryAndMultipleSecondary_grantsOnlyPrimary",
+      "status": "PASS"
+    },
+    {
+      "index": 14,
+      "name": "DMS network failure on Report",
+      "expectation": "Report Confirm 不回滚 (事务解耦，独立记录重试状态)",
+      "test_method": "com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest#scenario14_dmsNetworkFailure_reportConfirmDoesNotRollback",
+      "status": "PASS"
+    },
+    {
+      "index": 15,
+      "name": "DMS revoke failure on Checkout",
+      "expectation": "checkout / plan complete 不回滚 (事务解耦，业务终态不受外部依赖影响)",
+      "test_method": "com.ruoyi.train.dms.DmsMockE2EScenariosSuiteTest#scenario15_dmsRevokeFailure_checkoutDoesNotRollback",
+      "status": "PASS"
+    }
+  ]
+}

docs/reports/dms-r3/mock-e2e/20260916_033500/security-results.json

@@ -0,0 +1,46 @@
+{
+  "run_id": "20260916_033500",
+  "environment": "MOCK DMS ONLY",
+  "audit_timestamp": "2026-09-16T11:35:00+08:00",
+  "security_verdict": "PASS",
+  "checks": {
+    "password_plaintext_persistence_count": {
+      "count": 0,
+      "status": "PASS",
+      "detail": "No plaintext passcodes stored in train_dorm_auth, dms_external_operation, or any persistent table."
+    },
+    "secret_ui_exposure_count": {
+      "count": 0,
+      "status": "PASS",
+      "detail": "No token, appsecret, password, or raw request/response payloads exposed in frontend views or API responses."
+    },
+    "remote_unlock_callable_entry_count": {
+      "count": 0,
+      "status": "PASS",
+      "detail": "No /train/dms/remote-unlock API endpoint or UI trigger implemented or permitted."
+    },
+    "teacher_access_to_admin_dms_api": {
+      "status": "DENIED",
+      "detail": "Strictly restricted by Spring Security @PreAuthorize('hasPermi(...)') with dedicated train:access permissions."
+    },
+    "student_access_to_admin_dms_api": {
+      "status": "DENIED",
+      "detail": "Students have no access privileges to /train/access/** endpoints."
+    },
+    "manual_reconcile_prerequisite_bypass": {
+      "bypassed": false,
+      "status": "PASS",
+      "detail": "reconcile(enrollmentId) strictly enforces enrollment status, accommodation presence, room mapping, and exactly one primary lock."
+    },
+    "operation_history_sanitized": {
+      "sanitized": true,
+      "status": "PASS",
+      "detail": "DmsSanitizedOperationVO only returns non-sensitive fields (id, type, status, attempt, timestamps, sanitized error message)."
+    },
+    "live_dms_request_count": {
+      "count": 0,
+      "status": "PASS",
+      "detail": "dms.enabled=false by default in application.yml. All E2E tests target MockDmsServer exclusively."
+    }
+  }
+}