diff --git a/base/RuoYi-Vue-master/ruoyi-admin/src/main/resources/application-druid.yml b/base/RuoYi-Vue-master/ruoyi-admin/src/main/resources/application-druid.yml
index 285a855..b925b42 100644
--- a/base/RuoYi-Vue-master/ruoyi-admin/src/main/resources/application-druid.yml
+++ b/base/RuoYi-Vue-master/ruoyi-admin/src/main/resources/application-druid.yml
@@ -4,7 +4,9 @@ spring:
         type: com.alibaba.druid.pool.DruidDataSource
         driverClassName: com.mysql.cj.jdbc.Driver
         druid:
-            # 主库数据源
+            # 主库数据源：这里是兜底默认值（本机）；
+            # application-local.yml / application-prod.yml 会按环境覆盖 master 的 url/username/password
+            # （profile 顺序中靠后的生效，默认 druid,local；服务器用 druid,prod）
             master:
                 url: jdbc:mysql://localhost:3306/iotlocks?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8
                 username: iotlocks
diff --git a/base/RuoYi-Vue-master/ruoyi-admin/src/main/resources/application.yml b/base/RuoYi-Vue-master/ruoyi-admin/src/main/resources/application.yml
index 7960352..cf63a1a 100644
--- a/base/RuoYi-Vue-master/ruoyi-admin/src/main/resources/application.yml
+++ b/base/RuoYi-Vue-master/ruoyi-admin/src/main/resources/application.yml
@@ -6,8 +6,9 @@ ruoyi:
   version: 3.9.2
   # 版权年份
   copyrightYear: 2026
-  # 文件路径 示例（ Windows配置D:/ruoyi/uploadPath，Linux配置 /home/ruoyi/uploadPath）
-  profile: C:/Users/zfjia/work/projects/ruoyi/uploadPath
+  # 文件路径：按环境在 application-local.yml / application-prod.yml 中设置；
+  # 也可用环境变量 RUOYI_PROFILE 或 -Druoyi.profile= 覆盖（优先级更高）
+  profile: ${RUOYI_PROFILE:./uploadPath}
   # 获取ip地址开关
   addressEnabled: false
   # 验证码类型 math 数字计算 char 字符验证
@@ -44,9 +45,10 @@ logging:
     com.ruoyi.iot.lock.mapper: info
     com.ruoyi.iot.person.mapper: info
   file:
-    # 日志输出目录（logback-spring.xml 通过 springProperty 读取；Linux 示例 /home/ruoyi/logs）
-    # 也可用环境变量 LOGGING_FILE_PATH 覆盖，无需改配置文件
-    path: C:/Users/zfjia/work/projects/ruoyi/logs
+    # 日志输出目录（logback-spring.xml 通过 springProperty 读取）
+    # 按环境在 application-local.yml / application-prod.yml 中设置；
+    # 也可用环境变量 LOGGING_FILE_PATH 或 -Dlogging.file.path= 覆盖（优先级更高）
+    path: ${LOGGING_FILE_PATH:logs}
 
 # 用户配置
 user:
@@ -63,7 +65,7 @@ spring:
     # 国际化资源文件路径
     basename: i18n/messages
   profiles:
-    active: druid
+    active: druid,prod
   # 文件上传
   servlet:
     multipart:
@@ -157,81 +159,3 @@ xss:
   # 匹配链接
   urlPatterns: /system/*,/monitor/*,/tool/*
 
-# IOT设备接入（MQTT）
-iot:
-  # 门锁协议主题：ydlink/{id}/thing/...，换厂家或改前缀时只改这里
-  lock:
-    protocol:
-      prefix: ydlink
-      thing: thing
-  # 人脸特征提取服务（数据库 lock_service_config 中 config_type=02 的配置优先级更高）
-  face:
-    endpoint: http://192.168.1.202:8802/bdws_api/Third/Api/Easen/getFaceFeatureData
-    # 调用超时（毫秒）
-    timeout: 10000
-  # 第三方开放接口：关闭时接口返回 404；启用后调用方需带请求头 X-API-Key
-  openapi:
-    enabled: true
-    # 应用清单以数据表 lock_open_app 为准，由「开放管理 › 应用接入」维护（改完即时生效，不用重启）。
-    # 本段 api-key / apps 仅作两用：首次启动且表为空时原样导入；表不可用（未执行 D21 脚本）时降级使用。
-    # 导入完成后可删除本段，只保留 enabled 与 path-prefix。
-    # 单应用兼容配置：apps 为空时以此 Key 导入，appCode 记为 DEFAULT
-    api-key: please-change-me
-    path-prefix: /openapi/iot
-    # 多应用配置（仅首次导入/降级用）：每个业务系统一个独立 Key，
-    # 命中哪个应用就以该应用的 app-code 作为数据隔离身份（写入 lock_stay.biz_system）。
-    # 各应用 api-key 不得重复（重复或为空时启动即失败）。
-    # callback-secret 用于回调签名 HMAC-SHA256(timestamp + "." + body)，为空表示不开通回调。示例：
-    # apps:
-    #   - app-code: PMS
-    #     app-name: 公寓 PMS
-    #     api-key: <每个应用独立>
-    #     callback-url: https://pms.example.com/hook/lock
-    #     callback-secret: <回调签名密钥>
-    #     enabled: true
-    #   - app-code: VISITOR
-    #     app-name: 访客系统
-    #     api-key: <另一个独立 Key>
-    #     callback-url: https://visitor.example.com/api/lock-callback
-    #     callback-secret: <回调签名密钥>
-    #     enabled: true
-  # 服务器系统时间：开门授权依赖时间窗，内网离线部署时可在此开放管理端校时。
-  # 高危操作：需 Linux + systemd（timedatectl），服务以 root 运行或配置免密 sudo。
-  # control-enabled=false 时接口只读；非 root 运行且已为该用户配置 NOPASSWD 时把 use-sudo 设为 true。
-  time:
-    control-enabled: false
-    use-sudo: false
-    timeout-ms: 8000
-  mqtt:
-    # 开关，false 时不创建任何连接
-    enabled: true
-    # MQTT服务器地址，ssl 场景使用 ssl://host:8883
-    broker-url: tcp://192.168.1.202:1883
-    # 客户端ID，同一服务器下必须唯一；为空时自动生成
-    client-id:
-    username: admin5
-    password: admin5
-    # false 时服务端保留离线消息，需配合固定 client-id
-    clean-session: true
-    connection-timeout: 30
-    keep-alive-interval: 60
-    # 断线自动重连
-    automatic-reconnect: true
-    max-reconnect-delay: 30000
-    # 连接健康检查周期（毫秒），0 表示不做定时重连
-    health-check-interval: 30000
-    # 发布消息等待服务端确认时间（毫秒），0 表示不等待
-    publish-timeout: 3000
-    # 消息持久化目录，为空使用内存
-    persistence-directory:
-    default-qos: 1
-    default-retained: false
-    # 通用静态订阅；门禁上行主题由 LockTopicSubscriber 按 iot.lock.protocol 前缀动态登记，
-    # 这里不要再写一遍，否则改前缀时会出现两套主题并存
-    topics: []
-    # 遗嘱消息：无法区分主动断开与异常掉线，门禁场景建议关闭（离线由 GatewayOfflineCheckTask 判定）
-    # will:
-    #   topic: ydlink/status
-    #   payload: offline
-    #   qos: 1
-    #   retained: true
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/LockCommandPolicy.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/LockCommandPolicy.java
index dbc91e6..39e3e8c 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/LockCommandPolicy.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/LockCommandPolicy.java
@@ -30,6 +30,15 @@ public final class LockCommandPolicy
     /** 第 n 次重试的延迟（秒），超出后固定用最后一档 */
     private static final int[] RETRY_DELAY_SECONDS = { 5, 15, 45, 120, 300 };
 
+    /** 网关忙后的重排间隔（秒）：网关处理完当前 data/batch 需要时间，过短只会再次撞忙 */
+    private static final int BUSY_RETRY_SECONDS = 8;
+
+    /** 授权命令网关忙的重排次数上限，约 8 秒一轮；超过则认为链路异常，按失败终态放行后续命令 */
+    private static final int AUTH_MAX_BUSY_RETRY = 12;
+
+    /** 其它命令网关忙的重排次数上限 */
+    private static final int DEFAULT_MAX_BUSY_RETRY = 3;
+
     static
     {
         TIMEOUT_SECONDS.put(LockConstants.CMD_BIND, 60);
@@ -45,6 +54,8 @@ public final class LockCommandPolicy
         TIMEOUT_SECONDS.put(LockConstants.CMD_CLEAR_DEVICE, 60);
         TIMEOUT_SECONDS.put(LockConstants.CMD_AUTH_PUSH, 90);
         TIMEOUT_SECONDS.put(LockConstants.CMD_AUTH_CLEAR, 90);
+        // 查询只用于对账，首行返回即视为有响应；等不到响应时短超时避免长期占用网关
+        TIMEOUT_SECONDS.put(LockConstants.CMD_READ_AUTH, 30);
 
         NO_RETRY.add(LockConstants.CMD_SYNC_TIME);
         NO_RETRY.add(LockConstants.CMD_SWITCH);
@@ -105,15 +116,42 @@ public final class LockCommandPolicy
     }
 
     /**
-     * 设备忙时的重试时间点：秒级重排，不占用普通退避档位
+     * 网关忙时的重试时间点：秒级重排，不占用普通退避档位
      */
     public static Date busyRetryTime()
     {
         Calendar calendar = Calendar.getInstance();
-        calendar.add(Calendar.SECOND, 3);
+        calendar.add(Calendar.SECOND, BUSY_RETRY_SECONDS);
         return calendar.getTime();
     }
 
+    /**
+     * 网关忙的重排次数上限
+     */
+    public static int maxBusyRetry(String commandType)
+    {
+        if (LockConstants.CMD_AUTH_PUSH.equals(commandType) || LockConstants.CMD_AUTH_CLEAR.equals(commandType))
+        {
+            return AUTH_MAX_BUSY_RETRY;
+        }
+        return DEFAULT_MAX_BUSY_RETRY;
+    }
+
+    /**
+     * 网关已回 10 之后，等待门锁终态的时长（秒）
+     * <p>
+     * 10 只代表网关已接收并转发，门锁执行结果随后才会到；这段时间内既不能重发，
+     * 也不能沿用下发超时，否则 90 秒一到就被判失败、队列提前放行下一条。
+     */
+    public static int deviceWaitSeconds(String commandType)
+    {
+        if (LockConstants.CMD_AUTH_PUSH.equals(commandType) || LockConstants.CMD_AUTH_CLEAR.equals(commandType))
+        {
+            return 180;
+        }
+        return timeoutSeconds(commandType);
+    }
+
     /**
      * 第 retryCount 次重试的时间点
      */
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/LockConstants.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/LockConstants.java
index 202e20b..9c2429c 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/LockConstants.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/LockConstants.java
@@ -52,6 +52,9 @@ public class LockConstants
     /** 命令类型：清除授权 */
     public static final String CMD_AUTH_CLEAR = "0012";
 
+    /** 命令类型：读取锁内卡/密码授权列表（op=getkey，动作 readkey） */
+    public static final String CMD_READ_AUTH = "0019";
+
     /** 命令状态：待发送 */
     public static final String STATUS_PENDING = "0";
 
@@ -70,6 +73,12 @@ public class LockConstants
     /** 命令状态：已取消 */
     public static final String STATUS_CANCELED = "5";
 
+    /** 授权来源：平台维护（与 lock_stay.source 同编码） */
+    public static final String AUTH_SOURCE_PLATFORM = "1";
+
+    /** 授权来源：开放接口（直接授权与外部入住/换房，与 lock_stay.source 同编码） */
+    public static final String AUTH_SOURCE_OPENAPI = "2";
+
     /** 授权类型：人脸 */
     public static final String AUTH_FACE = "01";
 
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/controller/LockAuthController.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/controller/LockAuthController.java
index 5f196c6..6e50717 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/controller/LockAuthController.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/controller/LockAuthController.java
@@ -18,7 +18,10 @@ import com.ruoyi.common.core.domain.AjaxResult;
 import com.ruoyi.common.core.page.TableDataInfo;
 import com.ruoyi.common.enums.BusinessType;
 import com.ruoyi.common.utils.poi.ExcelUtil;
+import com.ruoyi.iot.lock.LockConstants;
 import com.ruoyi.iot.lock.domain.LockAuth;
+import com.ruoyi.iot.lock.domain.LockAuthBatchRequest;
+import com.ruoyi.iot.lock.domain.LockAuthPerson;
 import com.ruoyi.iot.lock.service.ILockAuthService;
 
 /**
@@ -37,11 +40,97 @@ public class LockAuthController extends BaseController
     @GetMapping("/list")
     public TableDataInfo list(LockAuth auth)
     {
+        // 平台页签只统计平台授权，外部授权走 /external/list
+        auth.setSource(LockConstants.AUTH_SOURCE_PLATFORM);
         startPage();
         List<LockAuth> list = lockAuthService.selectAuthList(auth);
         return getDataTable(list);
     }
 
+    /** 外部授权分页列表：一授权一行，固定 source='2' */
+    @PreAuthorize("@ss.hasPermi('lock:auth:list')")
+    @GetMapping("/external/list")
+    public TableDataInfo externalList(LockAuth query)
+    {
+        startPage();
+        List<LockAuth> list = lockAuthService.selectExternalAuthList(query);
+        return getDataTable(list);
+    }
+
+    /** 全部授权分页列表：一授权一行，平台与外部授权都包含，用于逐条排查下发情况 */
+    @PreAuthorize("@ss.hasPermi('lock:auth:list')")
+    @GetMapping("/all/list")
+    public TableDataInfo allList(LockAuth query)
+    {
+        startPage();
+        List<LockAuth> list = lockAuthService.selectAllAuthList(query);
+        return getDataTable(list);
+    }
+
+    /** 外部授权详情：不返回授权凭据 */
+    @PreAuthorize("@ss.hasPermi('lock:auth:query')")
+    @GetMapping("/external/{authId}")
+    public AjaxResult externalInfo(@PathVariable Long authId)
+    {
+        return success(lockAuthService.selectExternalAuthById(authId));
+    }
+
+    /** 修改外部授权有效期；有效授权保存后自动重推 */
+    @PreAuthorize("@ss.hasPermi('lock:auth:edit')")
+    @Log(title = "外部授权修改", businessType = BusinessType.UPDATE)
+    @PutMapping("/external/{authId}")
+    public AjaxResult externalEdit(@PathVariable Long authId, @RequestBody LockAuth auth)
+    {
+        auth.setAuthId(authId);
+        auth.setUpdateBy(getUsername());
+        return toAjax(lockAuthService.updateExternalAuth(authId, auth));
+    }
+
+    @PreAuthorize("@ss.hasPermi('lock:auth:push')")
+    @Log(title = "外部授权下发", businessType = BusinessType.UPDATE)
+    @PostMapping("/external/{authId}/push")
+    public AjaxResult externalPush(@PathVariable Long authId)
+    {
+        if (lockAuthService.selectExternalAuthById(authId) == null)
+        {
+            return error("外部授权不存在，authId=" + authId);
+        }
+        lockAuthService.push(authId);
+        return success();
+    }
+
+    @PreAuthorize("@ss.hasPermi('lock:auth:clear')")
+    @Log(title = "外部授权取消", businessType = BusinessType.UPDATE)
+    @PostMapping("/external/{authId}/clear")
+    public AjaxResult externalClear(@PathVariable Long authId)
+    {
+        if (lockAuthService.selectExternalAuthById(authId) == null)
+        {
+            return error("外部授权不存在，authId=" + authId);
+        }
+        lockAuthService.clear(authId);
+        return success();
+    }
+
+    /** 删除外部授权：混入非外部授权整批拒绝 */
+    @PreAuthorize("@ss.hasPermi('lock:auth:remove')")
+    @Log(title = "外部授权删除", businessType = BusinessType.DELETE)
+    @DeleteMapping("/external/{authIds}")
+    public AjaxResult externalRemove(@PathVariable Long[] authIds)
+    {
+        return toAjax(lockAuthService.deleteExternalAuthByIds(authIds));
+    }
+
+    /** 人员维度授权列表：一人一行，便于按人查看与维护其全部门锁授权 */
+    @PreAuthorize("@ss.hasPermi('lock:auth:list')")
+    @GetMapping("/person/list")
+    public TableDataInfo personList(LockAuthPerson query)
+    {
+        startPage();
+        List<LockAuthPerson> list = lockAuthService.selectPersonAuthList(query);
+        return getDataTable(list);
+    }
+
     @PreAuthorize("@ss.hasPermi('lock:auth:query')")
     @GetMapping(value = "/{authId}")
     public AjaxResult getInfo(@PathVariable Long authId)
@@ -63,6 +152,14 @@ public class LockAuthController extends BaseController
         return toAjax(lockAuthService.insertAuth(auth));
     }
 
+    @PreAuthorize("@ss.hasPermi('lock:auth:add')")
+    @Log(title = "门锁授权批量新增", businessType = BusinessType.INSERT)
+    @PostMapping("/batch")
+    public AjaxResult batchAdd(@RequestBody LockAuthBatchRequest request)
+    {
+        return success(lockAuthService.batchInsertAuth(request));
+    }
+
     @PreAuthorize("@ss.hasPermi('lock:auth:edit')")
     @Log(title = "门禁授权", businessType = BusinessType.UPDATE)
     @PutMapping
@@ -79,6 +176,34 @@ public class LockAuthController extends BaseController
         return toAjax(lockAuthService.deleteAuthByIds(authIds));
     }
 
+    /** 仅删除授权记录：设备侧已清除的行可从平台移除，不再下发清除指令 */
+    @PreAuthorize("@ss.hasPermi('lock:auth:remove')")
+    @Log(title = "授权记录删除", businessType = BusinessType.DELETE)
+    @DeleteMapping("/record/{authIds}")
+    public AjaxResult removeRecords(@PathVariable Long[] authIds)
+    {
+        return toAjax(lockAuthService.deleteAuthRecordsByIds(authIds));
+    }
+
+    /** 按人员删除：回收该人员名下所有门锁授权 */
+    @PreAuthorize("@ss.hasPermi('lock:auth:remove')")
+    @Log(title = "按人员删除门禁授权", businessType = BusinessType.DELETE)
+    @PostMapping("/person/remove")
+    public AjaxResult removeByPerson(@RequestBody String[] personNos)
+    {
+        return toAjax(lockAuthService.deleteAuthsByPersonNos(personNos));
+    }
+
+    /** 按人员重新下发：下发其名下所有可下发的授权 */
+    @PreAuthorize("@ss.hasPermi('lock:auth:push')")
+    @Log(title = "按人员下发授权", businessType = BusinessType.UPDATE)
+    @PostMapping("/person/push")
+    public AjaxResult pushByPerson(@RequestBody String[] personNos)
+    {
+        lockAuthService.batchPushByPersonNos(personNos);
+        return success();
+    }
+
     @PreAuthorize("@ss.hasPermi('lock:auth:push')")
     @Log(title = "授权下发", businessType = BusinessType.UPDATE)
     @PostMapping("/{authId}/push")
@@ -120,6 +245,7 @@ public class LockAuthController extends BaseController
     @PostMapping("/export")
     public void export(HttpServletResponse response, LockAuth auth)
     {
+        auth.setSource(LockConstants.AUTH_SOURCE_PLATFORM);
         List<LockAuth> list = lockAuthService.selectAuthList(auth);
         ExcelUtil<LockAuth> util = new ExcelUtil<LockAuth>(LockAuth.class);
         util.exportExcel(response, list, "门禁授权数据");
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/controller/LockDeviceController.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/controller/LockDeviceController.java
index 7ca48d3..dceb66f 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/controller/LockDeviceController.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/controller/LockDeviceController.java
@@ -1,5 +1,6 @@
 package com.ruoyi.iot.lock.controller;
 
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import jakarta.servlet.http.HttpServletResponse;
@@ -20,8 +21,11 @@ import com.ruoyi.common.core.page.TableDataInfo;
 import com.ruoyi.common.enums.BusinessType;
 import com.ruoyi.common.utils.poi.ExcelUtil;
 import com.ruoyi.iot.lock.domain.LockAuth;
+import com.ruoyi.iot.lock.domain.LockCommand;
 import com.ruoyi.iot.lock.domain.LockDevice;
+import com.ruoyi.iot.lock.domain.LockDeviceAuthClearRequest;
 import com.ruoyi.iot.lock.service.ILockAuthService;
+import com.ruoyi.iot.lock.service.ILockDeviceAuthService;
 import com.ruoyi.iot.lock.service.ILockDeviceService;
 
 /**
@@ -39,6 +43,9 @@ public class LockDeviceController extends BaseController
     @Autowired
     private ILockAuthService lockAuthService;
 
+    @Autowired
+    private ILockDeviceAuthService lockDeviceAuthService;
+
     @PreAuthorize("@ss.hasPermi('lock:device:list')")
     @GetMapping("/list")
     public TableDataInfo list(LockDevice device)
@@ -167,6 +174,47 @@ public class LockDeviceController extends BaseController
         return getDataTable(list);
     }
 
+    /** 读取锁内卡/密码授权（op=getkey），返回查询命令编号供页面轮询 */
+    @PreAuthorize("@ss.hasPermi('lock:auth:list')")
+    @Log(title = "锁内授权读取", businessType = BusinessType.OTHER)
+    @PostMapping("/{deviceId}/auth/query")
+    public AjaxResult queryDeviceAuth(@PathVariable Long deviceId)
+    {
+        return success(commandSummary(lockDeviceAuthService.startQuery(deviceId)));
+    }
+
+    /** 锁内授权快照与平台授权对账结果 */
+    @PreAuthorize("@ss.hasPermi('lock:auth:list')")
+    @GetMapping("/{deviceId}/auth/snapshot")
+    public AjaxResult deviceAuthSnapshot(@PathVariable Long deviceId)
+    {
+        return success(lockDeviceAuthService.selectSnapshot(deviceId));
+    }
+
+    /** 清除设备侧一条卡/密码授权 */
+    @PreAuthorize("@ss.hasPermi('lock:auth:clear')")
+    @Log(title = "锁内授权清除", businessType = BusinessType.UPDATE)
+    @PostMapping("/{deviceId}/auth/clear")
+    public AjaxResult clearDeviceAuth(@PathVariable Long deviceId, @RequestBody LockDeviceAuthClearRequest request)
+    {
+        if (request == null || request.getDeviceAuthId() == null)
+        {
+            return AjaxResult.error("缺少设备侧授权记录ID");
+        }
+        LockCommand command = lockDeviceAuthService.clearCredential(deviceId, request.getDeviceAuthId(),
+                request.getAuthType());
+        return success(commandSummary(command));
+    }
+
+    /** 命令摘要：不回传 payload，避免门锁密码与凭据泄露到页面 */
+    private Map<String, Object> commandSummary(LockCommand command)
+    {
+        Map<String, Object> data = new HashMap<String, Object>();
+        data.put("commandNo", command.getCommandNo());
+        data.put("commandStatus", command.getCommandStatus());
+        return data;
+    }
+
     @PreAuthorize("@ss.hasPermi('lock:device:export')")
     @Log(title = "智能门锁", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/domain/LockAccessLog.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/domain/LockAccessLog.java
index 658264c..8bdd6d8 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/domain/LockAccessLog.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/domain/LockAccessLog.java
@@ -30,6 +30,10 @@ public class LockAccessLog implements Serializable
     @Excel(name = "门锁SN")
     private String deviceSn;
 
+    /** 房间号（按门锁当前绑定关系关联，未绑定房间时为空） */
+    @Excel(name = "房间号")
+    private String roomNo;
+
     /** 上报网关ID */
     private Long gatewayId;
 
@@ -68,8 +72,9 @@ public class LockAccessLog implements Serializable
     @Excel(name = "开门时间", width = 30, dateFormat = "yyyy-MM-dd HH:mm:ss")
     private Date openTime;
 
-    /** 服务端接收时间 */
+    /** 服务端接收时间（数据上报时间） */
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    @Excel(name = "上报时间", width = 30, dateFormat = "yyyy-MM-dd HH:mm:ss")
     private Date recvTime;
 
     /** 报文序号（幂等去重） */
@@ -117,6 +122,16 @@ public class LockAccessLog implements Serializable
         this.deviceSn = deviceSn;
     }
 
+    public String getRoomNo()
+    {
+        return roomNo;
+    }
+
+    public void setRoomNo(String roomNo)
+    {
+        this.roomNo = roomNo;
+    }
+
     public Long getGatewayId()
     {
         return gatewayId;
@@ -288,7 +303,8 @@ public class LockAccessLog implements Serializable
     public String toString()
     {
         return new ToStringBuilder(this, ToStringStyle.MULTI_LINE_STYLE).append("logId", getLogId())
-                .append("deviceSn", getDeviceSn()).append("personNo", getPersonNo()).append("cardNo", getCardNo())
+                .append("deviceSn", getDeviceSn()).append("roomNo", getRoomNo())
+                .append("personNo", getPersonNo()).append("cardNo", getCardNo())
                 .append("openType", getOpenType()).append("openResult", getOpenResult())
                 .append("openTime", getOpenTime()).append("recvTime", getRecvTime()).append("seq", getSeq())
                 .toString();
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/domain/LockAuth.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/domain/LockAuth.java
index c68b67a..aef38ad 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/domain/LockAuth.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/domain/LockAuth.java
@@ -66,6 +66,30 @@ public class LockAuth extends BaseEntity
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
     private Date authTime;
 
+    /** 授权来源（1平台 2开放接口） */
+    private String source;
+
+    /** 来源应用编码（source=2 时对应 lock_open_app.app_code） */
+    private String sourceAppCode;
+
+    /** 来源业务单号（外部入住/换房为 biz_no，直接授权可空） */
+    private String sourceBizNo;
+
+    /** 展示：来源应用名称（应用已删除时为空，页面退回显示编码） */
+    private String sourceAppName;
+
+    /** 展示：关联入住单号（外部入住/换房授权） */
+    private String stayNo;
+
+    /** 展示：门锁名称 */
+    private String deviceName;
+
+    /** 展示：门锁在线状态（0在线 1离线 2未知） */
+    private String onlineStatus;
+
+    /** 查询：授权编号 / 人员编号 / 人员姓名模糊匹配（外部授权列表） */
+    private String keyword;
+
     /** 下发同步状态（0待下发 1已下发 2下发成功 3下发失败 4已清除） */
     @Excel(name = "同步状态", readConverterExp = "0=待下发,1=已下发,2=下发成功,3=下发失败,4=已清除")
     private String syncStatus;
@@ -226,6 +250,86 @@ public class LockAuth extends BaseEntity
         this.authTime = authTime;
     }
 
+    public String getSource()
+    {
+        return source;
+    }
+
+    public void setSource(String source)
+    {
+        this.source = source;
+    }
+
+    public String getSourceAppCode()
+    {
+        return sourceAppCode;
+    }
+
+    public void setSourceAppCode(String sourceAppCode)
+    {
+        this.sourceAppCode = sourceAppCode;
+    }
+
+    public String getSourceBizNo()
+    {
+        return sourceBizNo;
+    }
+
+    public void setSourceBizNo(String sourceBizNo)
+    {
+        this.sourceBizNo = sourceBizNo;
+    }
+
+    public String getSourceAppName()
+    {
+        return sourceAppName;
+    }
+
+    public void setSourceAppName(String sourceAppName)
+    {
+        this.sourceAppName = sourceAppName;
+    }
+
+    public String getStayNo()
+    {
+        return stayNo;
+    }
+
+    public void setStayNo(String stayNo)
+    {
+        this.stayNo = stayNo;
+    }
+
+    public String getDeviceName()
+    {
+        return deviceName;
+    }
+
+    public void setDeviceName(String deviceName)
+    {
+        this.deviceName = deviceName;
+    }
+
+    public String getOnlineStatus()
+    {
+        return onlineStatus;
+    }
+
+    public void setOnlineStatus(String onlineStatus)
+    {
+        this.onlineStatus = onlineStatus;
+    }
+
+    public String getKeyword()
+    {
+        return keyword;
+    }
+
+    public void setKeyword(String keyword)
+    {
+        this.keyword = keyword;
+    }
+
     public String getSyncStatus()
     {
         return syncStatus;
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mapper/LockAuthMapper.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mapper/LockAuthMapper.java
index 7c93e8c..92e7a00 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mapper/LockAuthMapper.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mapper/LockAuthMapper.java
@@ -3,6 +3,7 @@ package com.ruoyi.iot.lock.mapper;
 import java.util.List;
 import org.apache.ibatis.annotations.Param;
 import com.ruoyi.iot.lock.domain.LockAuth;
+import com.ruoyi.iot.lock.domain.LockAuthPerson;
 
 /**
  * 授权数据 数据层
@@ -13,8 +14,35 @@ public interface LockAuthMapper
 {
     List<LockAuth> selectAuthList(LockAuth auth);
 
+    /** 按人员聚合授权：一人一行，含授权总数、已下发数、失败数与涉及门锁数 */
+    List<LockAuthPerson> selectPersonAuthList(LockAuthPerson query);
+
+    /** 人员的全部未删除授权ID（含已清除行），按人员删除时使用 */
+    List<Long> selectAuthIdsByPersonNos(@Param("personNos") String[] personNos);
+
+    /** 人员可重新下发的授权ID：排除已清除(4)与待清除(6)，避免把删除中的人脸重新 add */
+    List<Long> selectPushableAuthIdsByPersonNos(@Param("personNos") String[] personNos);
+
     LockAuth selectAuthById(Long authId);
 
+    /** 外部授权分页列表：固定 source='2'，带来源应用、门锁与入住单展示字段 */
+    List<LockAuth> selectExternalAuthList(LockAuth query);
+
+    /** 全部授权分页列表：一授权一行，不区分来源，带来源应用、门锁与入住单展示字段 */
+    List<LockAuth> selectAllAuthList(LockAuth query);
+
+    /** 外部授权详情（不含 auth_value） */
+    LockAuth selectExternalAuthById(Long authId);
+
+    /** 按应用校验外部授权归属；不属于该应用时返回 null */
+    LockAuth selectExternalAuthForApp(@Param("authId") Long authId, @Param("appCode") String appCode);
+
+    /** 接管平台授权归属（仅外部入住/换房使用） */
+    int updateAuthSource(LockAuth auth);
+
+    /** 外部授权改期：允许把 end_time 更新为 NULL */
+    int updateExternalAuth(LockAuth auth);
+
     List<LockAuth> selectAuthsByDeviceId(Long deviceId);
 
     List<LockAuth> selectAuthsByPersonNo(String personNo);
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mapper/LockCommandMapper.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mapper/LockCommandMapper.java
index f8d73fa..bc3a927 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mapper/LockCommandMapper.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mapper/LockCommandMapper.java
@@ -24,6 +24,30 @@ public interface LockCommandMapper
     /** 指定分组仍在途（待发送/已发送）的授权类命令数，用于同一网关串行下发 */
     int countInflightAuthCommands(@Param("groupId") Long groupId);
 
+    /** 同一主题（同网关）除指定命令外仍在途（待发送/已发送）的命令数，用于普通失败重发前串行校验 */
+    int countOtherInflightByTopic(@Param("topic") String topic, @Param("commandId") Long commandId);
+
+    /** 同一主题除指定命令外已发送的命令数，用于忙排队命令重发前串行校验 */
+    int countOtherSentByTopic(@Param("topic") String topic, @Param("commandId") Long commandId);
+
+    /** 到期待重发的排队命令（网关忙），按命令ID升序保证先来先发 */
+    List<LockCommand> selectDeferredCommands(Date now);
+
+    /** 指定授权是否已有在途命令，避免补偿与命令重试重复下发 */
+    int countInflightAuthByBizId(@Param("bizId") Long bizId);
+
+    /** 指定业务对象是否已有指定类型的在途命令（锁内授权查询按门锁去重） */
+    int countInflightByBizId(@Param("commandType") String commandType, @Param("bizId") Long bizId);
+
+    /** 指定业务对象最近一次指定类型的命令 */
+    LockCommand selectLatestByBizId(@Param("commandType") String commandType, @Param("bizId") Long bizId);
+
+    /** 指定业务对象最近一次有返回行的查询命令（最近一次失败时回退展示） */
+    LockCommand selectLatestWithRowsByBizId(@Param("commandType") String commandType, @Param("bizId") Long bizId);
+
+    /** 批量按命令编号取命令，用于对账列表一次性判定清除状态 */
+    List<LockCommand> selectCommandsByNos(@Param("commandNos") List<String> commandNos);
+
     int insertCommand(LockCommand command);
 
     int updateCommand(LockCommand command);
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mapper/LockGatewayMapper.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mapper/LockGatewayMapper.java
index 3902be7..1a7bba5 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mapper/LockGatewayMapper.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mapper/LockGatewayMapper.java
@@ -27,6 +27,9 @@ public interface LockGatewayMapper
     int updateOnlineStatus(@Param("gatewayId") Long gatewayId, @Param("onlineStatus") String onlineStatus,
             @Param("lastOnlineTime") Date lastOnlineTime);
 
+    /** 只改在线状态，保留 last_online_time（离线通知使用） */
+    int updateOnlineStatusOnly(@Param("gatewayId") Long gatewayId, @Param("onlineStatus") String onlineStatus);
+
     int updateSyncStatus(@Param("gatewayId") Long gatewayId, @Param("syncStatus") String syncStatus,
             @Param("syncMsg") String syncMsg);
 
@@ -37,4 +40,11 @@ public interface LockGatewayMapper
 
     /** 超过指定时间未上报的网关置为离线 */
     int markOfflineBefore(@Param("offlineTime") Date offlineTime, @Param("now") Date now);
+
+    /**
+     * 按归属行的最近上报时间把网关置为在线
+     * <p>
+     * 网关能转发门锁信号/记录即证明其在线，不再只依赖 onoff_line 连接事件。
+     */
+    int refreshOnlineByReport(@Param("onlineTime") Date onlineTime);
 }
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mqtt/LockMessageListener.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mqtt/LockMessageListener.java
index 4d842b7..8ec27b3 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mqtt/LockMessageListener.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mqtt/LockMessageListener.java
@@ -18,6 +18,7 @@ import com.ruoyi.iot.lock.protocol.YdlinkOp;
 import com.ruoyi.iot.lock.protocol.YdlinkPayloadMasker;
 import com.ruoyi.iot.lock.protocol.YdlinkTopicBuilder;
 import com.ruoyi.iot.lock.protocol.YdlinkTopicDTO;
+import com.ruoyi.iot.lock.service.ILockDeviceAuthService;
 import com.ruoyi.iot.lock.service.ILockMqttLogService;
 import com.ruoyi.iot.domain.MqttMessageDTO;
 
@@ -46,6 +47,9 @@ public class LockMessageListener implements IMqttMessageListener
     @Autowired
     private LockSignalHandler lockSignalHandler;
 
+    @Autowired
+    private ILockDeviceAuthService deviceAuthService;
+
     @Autowired
     private ILockMqttLogService mqttLogService;
 
@@ -99,7 +103,15 @@ public class LockMessageListener implements IMqttMessageListener
                     result = commandRespHandler.handle(topic, frame, message.getPayload());
                     break;
                 case GROUP_DATA_BATCH:
-                    result = commandRespHandler.handle(topic, frame, message.getPayload());
+                    if (YdlinkOp.GET_KEY.equals(frame.getOp()))
+                    {
+                        // getkey 应答不是「动作+结果码」形态，第 2 位是总数，不能交给通用结果码解析
+                        result = handleKeyReport(topic, frame, message.getPayload());
+                    }
+                    else
+                    {
+                        result = commandRespHandler.handle(topic, frame, message.getPayload());
+                    }
                     break;
                 case GROUP_DATA_BATCH_REPORT:
                     if (YdlinkOp.LOCK_RSSI.equals(frame.getOp()))
@@ -108,6 +120,10 @@ public class LockMessageListener implements IMqttMessageListener
                         int updated = lockSignalHandler.handle(topic, frame);
                         result = "信号电量更新 " + updated + " 台";
                     }
+                    else if (YdlinkOp.GET_KEY.equals(frame.getOp()))
+                    {
+                        result = handleKeyReport(topic, frame, message.getPayload());
+                    }
                     else
                     {
                         result = commandRespHandler.handle(topic, frame, message.getPayload());
@@ -140,6 +156,12 @@ public class LockMessageListener implements IMqttMessageListener
         recordLog(topic, frame, message, status, result, cost(start));
     }
 
+    private String handleKeyReport(YdlinkTopicDTO topic, YdlinkFrameDTO frame, String payload)
+    {
+        return deviceAuthService.handleQueryReport(topic.getTopic(), frame.getSeq(),
+                YdlinkCodec.toRecordList(frame.getParams()), payload);
+    }
+
     private void recordLog(YdlinkTopicDTO topic, YdlinkFrameDTO frame, MqttMessageDTO message, String handleStatus,
             String handleMsg, int costTime)
     {
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mqtt/handler/CommandRespHandler.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mqtt/handler/CommandRespHandler.java
index 3818650..f7cd2f7 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mqtt/handler/CommandRespHandler.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mqtt/handler/CommandRespHandler.java
@@ -9,6 +9,7 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 import com.alibaba.fastjson2.JSON;
 import com.ruoyi.common.utils.StringUtils;
+import com.ruoyi.iot.lock.LockCommandPolicy;
 import com.ruoyi.iot.lock.LockConstants;
 import com.ruoyi.iot.lock.protocol.YdlinkCodec;
 import com.ruoyi.iot.lock.protocol.YdlinkFrameDTO;
@@ -26,9 +27,10 @@ import com.ruoyi.iot.lock.service.ILockCommandService;
  * 覆盖：property/set、action/execute、data/batch（设备在请求主题反向回 ac=resp），
  * 以及协议登记的 *_response、data/batch_report 主题。
  * <p>
- * 门锁类下发可能收到两次响应：<br>
+ * 门锁类下发可能收到多次响应：<br>
  * 1) 网关回执（结果码 10）：仅表示消息已送达网关并转发，属中间态；<br>
- * 2) 门锁回执（结果码 0/11/12）：终态，据此判定成功与失败。<br>
+ * 2) 网关忙（结果码 11）：报文未转发到门锁，属可重发的瞬时状态，不能判失败；<br>
+ * 3) 门锁回执（结果码 0/12）：终态，0 成功、12 设备不存在，据此判定结果。<br>
  * 结果码位置按 op 由 {@link YdlinkRespSpec} 决定，不再按首项是否为动作名猜测。
  *
  * @author ruoyi
@@ -64,9 +66,9 @@ public class CommandRespHandler
             return "应答缺少可识别结果码，命令保持等待";
         }
         String message = parseMessage(first);
-        if (YdlinkRespSpec.CODE_DEVICE_BUSY.equals(resp.getCode()))
+        if (YdlinkRespSpec.CODE_DEVICE_BUSY.equals(resp.getCode()) && !LockCommandPolicy.isBusy(message))
         {
-            // 结果码 11 才是「设备忙」的权威信号，设备不一定附带人读文本；
+            // 结果码 11 才是「网关忙」的权威信号，设备不一定附带人读文本；
             // 补上标记后，命令层才能按秒级重排而不是走普通失败退避
             message = StringUtils.isEmpty(message) ? "gw busy" : message + " gw busy";
         }
@@ -77,6 +79,21 @@ public class CommandRespHandler
         }
         boolean gatewayAck = resp.getStage() == YdlinkRespSpec.Stage.GATEWAY_ACK;
         boolean success = resp.getStage() == YdlinkRespSpec.Stage.SUCCESS;
+        if (resp.getStage() == YdlinkRespSpec.Stage.GATEWAY_BUSY)
+        {
+            // 网关忙表示报文没有转发到门锁，不能按门锁失败处理：
+            // 命令置为待发送并按秒级排队重发，同网关后续命令继续等待，不再立即下发下一条
+            String finalStatus = commandService.handleGatewayBusy(topic.getTopic(), seq, payload, message);
+            if (finalStatus == null)
+            {
+                log.info("网关忙，命令已排队重发, topic={}, seq={}, op={}", topic.getTopic(), seq, frame.getOp());
+                return "网关忙，已排队重发";
+            }
+            authService.handleResult(seq, LockConstants.STATUS_SUCCESS.equals(finalStatus), message);
+            log.info("网关持续忙，命令按失败终结, topic={}, seq={}, op={}, status={}", topic.getTopic(), seq,
+                    frame.getOp(), finalStatus);
+            return "执行失败：" + message;
+        }
         String finalStatus = gatewayAck
                 ? commandService.handleGatewayAck(topic.getTopic(), seq, payload, message)
                 : commandService.handleResponse(topic.getTopic(), seq, payload, success, message);
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mqtt/handler/GatewayOnlineHandler.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mqtt/handler/GatewayOnlineHandler.java
index 8190275..93dfb86 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mqtt/handler/GatewayOnlineHandler.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/mqtt/handler/GatewayOnlineHandler.java
@@ -1,5 +1,6 @@
 package com.ruoyi.iot.lock.mqtt.handler;
 
+import java.util.Locale;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -12,6 +13,10 @@ import com.ruoyi.iot.lock.protocol.YdlinkTopicDTO;
 
 /**
  * 网关上下线处理：ydlink/{gatewaySn}/thing/onoff_line
+ * <p>
+ * 报文体没有标准信封，只有 devId 与 message：上线为 "I am back"，离线为遗嘱消息
+ * "I will be back"。文案不作为唯一依据（固件改文案即失效），只在命中离线文案时置离线，
+ * 其余一律按在线处理并记录原文，便于现场核对。
  *
  * @author ruoyi
  */
@@ -20,6 +25,9 @@ public class GatewayOnlineHandler
 {
     private static final Logger log = LoggerFactory.getLogger(GatewayOnlineHandler.class);
 
+    /** 离线遗嘱文案关键字 */
+    private static final String OFFLINE_KEYWORD = "will be back";
+
     @Autowired
     private ILockGatewayService gatewayService;
 
@@ -37,12 +45,19 @@ public class GatewayOnlineHandler
         {
             return "非网关级主题";
         }
-        // 协议中上下线语义待确认：默认按“收到上报即在线”处理
-        String onlineStatus = LockConstants.ONLINE;
-        gatewayService.updateOnlineStatus(gatewaySn, onlineStatus);
         LockGateway gateway = gatewayService.selectGatewayBySn(gatewaySn);
-        log.info("网关状态更新, gatewaySn={}, onlineStatus={}, registered={}", gatewaySn, onlineStatus,
-                gateway != null);
-        return gateway == null ? "网关未登记，已忽略" : "已更新为在线";
+        String message = frame == null ? null : frame.getMessage();
+        if (gateway == null)
+        {
+            // 主题第2段与 lock_gateway.gateway_sn 对不上时不会更新任何行，这里必须留痕
+            log.warn("网关上下线报文未匹配到登记网关, gatewaySn={}, devId={}, message={}", gatewaySn,
+                    frame == null ? null : frame.getDevId(), message);
+            return "网关未登记，已忽略";
+        }
+        boolean offline = message != null && message.toLowerCase(Locale.ROOT).contains(OFFLINE_KEYWORD);
+        String onlineStatus = offline ? LockConstants.OFFLINE : LockConstants.ONLINE;
+        gatewayService.updateOnlineStatus(gatewaySn, onlineStatus);
+        log.info("网关状态更新, gatewaySn={}, onlineStatus={}, message={}", gatewaySn, onlineStatus, message);
+        return offline ? "已更新为离线" : "已更新为在线";
     }
 }
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/protocol/YdlinkFrameDTO.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/protocol/YdlinkFrameDTO.java
index aa319a7..898c7d9 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/protocol/YdlinkFrameDTO.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/protocol/YdlinkFrameDTO.java
@@ -66,6 +66,14 @@ public class YdlinkFrameDTO implements Serializable
     @JSONField(ordinal = 10)
     private String chksum;
 
+    /**
+     * 状态文案（仅 onoff_line 使用："I am back" 上线 / "I will be back" 离线）
+     * <p>
+     * 该报文没有标准信封，只有 devId + message；只接收不回填。
+     */
+    @JSONField(serialize = false)
+    private String message;
+
     /** 参数数组（一维或二维） */
     @JSONField(ordinal = 11)
     private List<Object> params;
@@ -249,4 +257,15 @@ public class YdlinkFrameDTO implements Serializable
         this.params = params;
         return this;
     }
+
+    public String getMessage()
+    {
+        return message;
+    }
+
+    public YdlinkFrameDTO setMessage(String message)
+    {
+        this.message = message;
+        return this;
+    }
 }
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/protocol/YdlinkPayloadMasker.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/protocol/YdlinkPayloadMasker.java
index 7f11b86..19bbdf9 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/protocol/YdlinkPayloadMasker.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/protocol/YdlinkPayloadMasker.java
@@ -43,6 +43,8 @@ public final class YdlinkPayloadMasker
         SECRET_INDEXES.put(YdlinkOp.IC_CARD_MIX, new int[] { 2, 4 });
         // 配置服务器：账号 [6]、密码 [7]
         SECRET_INDEXES.put(YdlinkOp.CONFIG, new int[] { 6, 7 });
+        // getkey：请求 [3]门锁密码；应答 [3]卡号/密码
+        SECRET_INDEXES.put(YdlinkOp.GET_KEY, new int[] { 3 });
     }
 
     private YdlinkPayloadMasker()
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/protocol/YdlinkRespSpec.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/protocol/YdlinkRespSpec.java
index e55bff5..956cefc 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/protocol/YdlinkRespSpec.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/protocol/YdlinkRespSpec.java
@@ -15,7 +15,8 @@ import java.util.Map;
  *                                                       → [1] 错误码、[5] 操作结果，两处都可能出现 10/0
  * </pre>
  * 因此按 op 维护取码位置，opencloselock 同时检查 [1] 与 [5]：
- * 任一为 10 视为网关已接收（中间态），出现 11/12 视为失败，其余以 0 判定成功。
+ * 任一为 10 视为网关已接收（中间态），11 视为网关忙（报文未转发，可稍后重发），
+ * 12 视为设备不存在（终态失败），其余以 0 判定成功。
  * <p>
  * locklist 的 add/clear 回执都以「动作名 + 结果码」两段返回（实测
  * {@code params:["clear","0"]}、{@code params:["add","0"]}），结果码位置一致。
@@ -30,10 +31,10 @@ public final class YdlinkRespSpec
     /** 网关已接收并转发（中间态） */
     public static final String CODE_GATEWAY_ACK = "10";
 
-    /** 设备正忙 */
+    /** 网关忙：报文未转发到门锁，属可重发的瞬时状态，不能当门锁终态失败 */
     public static final String CODE_DEVICE_BUSY = "11";
 
-    /** 设备不存在 */
+    /** 设备不存在（终态失败） */
     public static final String CODE_DEVICE_NOT_FOUND = "12";
 
     /** 应答阶段 */
@@ -42,6 +43,9 @@ public final class YdlinkRespSpec
         /** 网关中间态，命令尚未完成 */
         GATEWAY_ACK,
 
+        /** 网关忙，报文未转发，稍后可重发 */
+        GATEWAY_BUSY,
+
         /** 设备终态：成功 */
         SUCCESS,
 
@@ -72,7 +76,8 @@ public final class YdlinkRespSpec
         // 查询类
         RESULT_INDEX.put(YdlinkOp.GET_SLAVE_INFO, new int[] { 2 });
         RESULT_INDEX.put(YdlinkOp.GET_RECORD, new int[] { 2 });
-        RESULT_INDEX.put(YdlinkOp.GET_KEY, new int[] { 2 });
+        // getkey 应答第 2 位是「总数」而非结果码，由 LockDeviceAuthServiceImpl 专解析；
+        // 这里不登记，避免总数为 0 时被误判成功、非 0 时永远等待
     }
 
     private YdlinkRespSpec()
@@ -117,7 +122,13 @@ public final class YdlinkRespSpec
             {
                 return new RespCode(code, Stage.GATEWAY_ACK);
             }
-            if (CODE_DEVICE_BUSY.equals(code) || CODE_DEVICE_NOT_FOUND.equals(code))
+            if (CODE_DEVICE_BUSY.equals(code))
+            {
+                // 网关同一时刻只处理一条 data/batch，11 时命令并未下发到门锁，
+                // 必须保留重发机会；实测随后同一 seq 仍会回 0，按失败终结会丢掉成功回执
+                return new RespCode(code, Stage.GATEWAY_BUSY);
+            }
+            if (CODE_DEVICE_NOT_FOUND.equals(code))
             {
                 failCode = code;
             }
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/ILockAuthService.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/ILockAuthService.java
index b9eef72..2b33c3d 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/ILockAuthService.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/ILockAuthService.java
@@ -2,6 +2,9 @@ package com.ruoyi.iot.lock.service;
 
 import java.util.List;
 import com.ruoyi.iot.lock.domain.LockAuth;
+import com.ruoyi.iot.lock.domain.LockAuthBatchRequest;
+import com.ruoyi.iot.lock.domain.LockAuthBatchResult;
+import com.ruoyi.iot.lock.domain.LockAuthPerson;
 
 /**
  * 授权服务
@@ -12,19 +15,67 @@ public interface ILockAuthService
 {
     List<LockAuth> selectAuthList(LockAuth auth);
 
+    /** 人员维度授权汇总：一人一行，含授权总数、已下发数、失败数与涉及门锁数 */
+    List<LockAuthPerson> selectPersonAuthList(LockAuthPerson query);
+
     LockAuth selectAuthById(Long authId);
 
+    /** 外部授权分页列表：固定 source='2'，带来源应用、门锁与入住单展示字段 */
+    List<LockAuth> selectExternalAuthList(LockAuth query);
+
+    /** 全部授权分页列表：一授权一行，不区分来源，便于逐条排查下发情况 */
+    List<LockAuth> selectAllAuthList(LockAuth query);
+
+    /** 外部授权详情（不含 auth_value） */
+    LockAuth selectExternalAuthById(Long authId);
+
+    /** 按应用校验外部授权归属；不属于该应用时返回 null */
+    LockAuth selectExternalAuthForApp(Long authId, String appCode);
+
+    /** 修改外部授权有效期：已取消只保存，其余保存后重推 */
+    int updateExternalAuth(Long authId, LockAuth changes);
+
+    /** 删除外部授权：先清除设备侧权限再逻辑删除；混入非外部授权整批拒绝 */
+    int deleteExternalAuthByIds(Long[] authIds);
+
     List<LockAuth> selectAuthsByDeviceId(Long deviceId);
 
     /** 新增授权并下发 */
     int insertAuth(LockAuth auth);
 
+    /**
+     * 新增授权并下发。
+     *
+     * @param adoptPlatformSource true 表示覆盖平台已有授权时接管归属（外部入住/换房使用）；
+     *                            false 表示拒绝覆盖平台授权（外部直接授权接口使用）
+     */
+    int insertAuth(LockAuth auth, boolean adoptPlatformSource);
+
+    /**
+     * 多锁批量授权：同一人员、同一类型、同一有效期，为多把门锁各建一条授权。
+     * <p>
+     * 每行独立处理与下发，单锁失败不影响其它锁；已存在的同键授权按覆盖处理。
+     *
+     * @param request 授权模板与门锁ID集合
+     * @return 逐锁结果与汇总计数
+     */
+    LockAuthBatchResult batchInsertAuth(LockAuthBatchRequest request);
+
     /** 修改授权并重新下发 */
     int updateAuth(LockAuth auth);
 
     /** 删除授权并下发清除指令 */
     int deleteAuthByIds(Long[] authIds);
 
+    /** 仅删除授权记录（逻辑删除），不向门锁下发清除；只允许设备侧已清除(4)的记录 */
+    int deleteAuthRecordsByIds(Long[] authIds);
+
+    /** 删除人员名下全部授权：逐条下发清除后逻辑删除，返回删除行数 */
+    int deleteAuthsByPersonNos(String[] personNos);
+
+    /** 按人员批量重新下发其名下可下发授权（跳过已清除与待清除） */
+    void batchPushByPersonNos(String[] personNos);
+
     /** 手动重新下发 */
     void push(Long authId);
 
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/ILockCommandService.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/ILockCommandService.java
index 84254e9..b090113 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/ILockCommandService.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/ILockCommandService.java
@@ -23,8 +23,8 @@ public interface ILockCommandService
     /**
      * 处理门锁回执（最终结果）
      * <p>
-     * 门锁回执（0/11/12）即终态，直接判定成功或失败；
-     * 网关回执（10）只是中间态，后到也不会推翻门锁结果。
+     * 门锁回执（0/12）即终态，直接判定成功或失败；
+     * 网关回执（10）只是中间态，后到也不会推翻门锁结果；网关忙（11）见 {@link #handleGatewayBusy}。
      *
      * @param topic 响应主题
      * @param seq 报文序列号
@@ -46,6 +46,16 @@ public interface ILockCommandService
      */
     String handleGatewayAck(String topic, String seq, String payload, String message);
 
+    /**
+     * 处理网关忙（结果码 11，报文未转发到门锁）
+     * <p>
+     * 命令回到待发送并排期重发，期间保持「在途」以阻止同网关下发下一条；
+     * 重排次数用尽才按失败终结。
+     *
+     * @return 重排中返回 null；按失败终结时返回 STATUS_FAIL
+     */
+    String handleGatewayBusy(String topic, String seq, String payload, String message);
+
     /**
      * 标记超时命令：候选按最短超时粗筛，再按各命令类型的超时阈值逐条判定
      */
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockAuthServiceImpl.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockAuthServiceImpl.java
index e686e8f..4a5b931 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockAuthServiceImpl.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockAuthServiceImpl.java
@@ -1,8 +1,10 @@
 package com.ruoyi.iot.lock.service.impl;
 
 import java.text.SimpleDateFormat;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Date;
+import java.util.LinkedHashSet;
 import java.util.List;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -14,6 +16,9 @@ import com.ruoyi.common.utils.StringUtils;
 import com.ruoyi.iot.lock.LockCommandPolicy;
 import com.ruoyi.iot.lock.LockConstants;
 import com.ruoyi.iot.lock.domain.LockAuth;
+import com.ruoyi.iot.lock.domain.LockAuthBatchRequest;
+import com.ruoyi.iot.lock.domain.LockAuthBatchResult;
+import com.ruoyi.iot.lock.domain.LockAuthPerson;
 import com.ruoyi.iot.lock.domain.LockCommand;
 import com.ruoyi.iot.lock.domain.LockDevice;
 import com.ruoyi.iot.lock.domain.LockFace;
@@ -59,6 +64,9 @@ public class LockAuthServiceImpl implements ILockAuthService
     /** 整锁清空人脸时的人员编号占位：协议约定 00000000 表示删除该锁全部人脸 */
     private static final String CLEAR_ALL_PERSON_NO = "00000000";
 
+    /** 单次批量授权的门锁上限：同网关串行下发，数量过大时等待时间过长 */
+    private static final int BATCH_MAX_DEVICES = 100;
+
     @Autowired
     private LockAuthMapper authMapper;
 
@@ -95,12 +103,101 @@ public class LockAuthServiceImpl implements ILockAuthService
         return authMapper.selectAuthList(auth);
     }
 
+    @Override
+    public List<LockAuthPerson> selectPersonAuthList(LockAuthPerson query)
+    {
+        return authMapper.selectPersonAuthList(query);
+    }
+
     @Override
     public LockAuth selectAuthById(Long authId)
     {
         return authMapper.selectAuthById(authId);
     }
 
+    @Override
+    public List<LockAuth> selectExternalAuthList(LockAuth query)
+    {
+        return authMapper.selectExternalAuthList(query);
+    }
+
+    @Override
+    public List<LockAuth> selectAllAuthList(LockAuth query)
+    {
+        return authMapper.selectAllAuthList(query);
+    }
+
+    @Override
+    public LockAuth selectExternalAuthById(Long authId)
+    {
+        return authMapper.selectExternalAuthById(authId);
+    }
+
+    @Override
+    public LockAuth selectExternalAuthForApp(Long authId, String appCode)
+    {
+        if (authId == null || StringUtils.isEmpty(appCode))
+        {
+            return null;
+        }
+        return authMapper.selectExternalAuthForApp(authId, appCode);
+    }
+
+    @Override
+    @Transactional
+    public int updateExternalAuth(Long authId, LockAuth changes)
+    {
+        LockAuth auth = authMapper.selectAuthById(authId);
+        if (auth == null || !LockConstants.AUTH_SOURCE_OPENAPI.equals(auth.getSource())
+                || "2".equals(auth.getDelFlag()))
+        {
+            throw new IllegalArgumentException("非外部授权，无法修改");
+        }
+        if (changes == null)
+        {
+            throw new IllegalArgumentException("修改内容不能为空");
+        }
+        if (changes.getBeginTime() != null && changes.getEndTime() != null
+                && changes.getBeginTime().after(changes.getEndTime()))
+        {
+            throw new IllegalArgumentException("生效时间不能晚于失效时间");
+        }
+        auth.setBeginTime(changes.getBeginTime());
+        auth.setEndTime(changes.getEndTime());
+        auth.setRemark(changes.getRemark());
+        auth.setUpdateBy(changes.getUpdateBy());
+        int rows = authMapper.updateExternalAuth(auth);
+        // 已取消(4)没有设备侧权限，只保存；重新下发由页面单独触发
+        if (!LockConstants.SYNC_CLEARED.equals(auth.getSyncStatus()))
+        {
+            pushInternal(auth, true);
+        }
+        log.info("外部授权修改有效期, authId={}, beginTime={}, endTime={}", authId, changes.getBeginTime(),
+                changes.getEndTime());
+        return rows;
+    }
+
+    @Override
+    @Transactional
+    public int deleteExternalAuthByIds(Long[] authIds)
+    {
+        if (authIds == null || authIds.length == 0)
+        {
+            return 0;
+        }
+        // 整批校验：混入平台授权或已删除行时一条都不删
+        for (Long authId : authIds)
+        {
+            LockAuth auth = authMapper.selectAuthById(authId);
+            if (auth == null || !LockConstants.AUTH_SOURCE_OPENAPI.equals(auth.getSource())
+                    || "2".equals(auth.getDelFlag()))
+            {
+                throw new IllegalArgumentException("所选授权中包含非外部授权，已取消删除，请刷新后重试");
+            }
+        }
+        return deleteAuthByIds(authIds);
+    }
+
     @Override
     public List<LockAuth> selectAuthsByDeviceId(Long deviceId)
     {
@@ -110,8 +207,29 @@ public class LockAuthServiceImpl implements ILockAuthService
     @Override
     @Transactional
     public int insertAuth(LockAuth auth)
+    {
+        return doInsertAuth(auth, false);
+    }
+
+    @Override
+    @Transactional
+    public int insertAuth(LockAuth auth, boolean adoptPlatformSource)
+    {
+        return doInsertAuth(auth, adoptPlatformSource);
+    }
+
+    /**
+     * 单行新增/覆盖并下发。
+     * <p>
+     * 批量授权逐行直接调用本方法：不包整批事务，单锁失败不能回滚其它锁。
+     * 插入时 sync_status 固定写 '0'，即使下发前异常，补偿任务仍能捞回该行。
+     *
+     * @param adoptPlatformSource 覆盖时是否允许外部入住/换房接管平台行归属
+     */
+    private int doInsertAuth(LockAuth auth, boolean adoptPlatformSource)
     {
         fillAuth(auth);
+        applySourceDefaults(auth);
         if (StringUtils.isEmpty(auth.getStatus()))
         {
             // 前端表单没有状态项；insert 显式带列时 null 不会走列默认值，
@@ -123,6 +241,7 @@ public class LockAuthServiceImpl implements ILockAuthService
         LockAuth existing = findExistingAuth(auth);
         if (existing != null)
         {
+            applyOverwriteSource(auth, existing, adoptPlatformSource);
             reviveAndPush(auth, existing);
             return 1;
         }
@@ -140,11 +259,205 @@ public class LockAuthServiceImpl implements ILockAuthService
             {
                 throw e;
             }
+            applyOverwriteSource(auth, conflict, adoptPlatformSource);
             reviveAndPush(auth, conflict);
             return 1;
         }
     }
 
+    /** 来源默认值：未指定即平台；非开放接口来源不保留应用与业务号 */
+    private void applySourceDefaults(LockAuth auth)
+    {
+        if (StringUtils.isEmpty(auth.getSource()))
+        {
+            auth.setSource(LockConstants.AUTH_SOURCE_PLATFORM);
+        }
+        if (!LockConstants.AUTH_SOURCE_OPENAPI.equals(auth.getSource()))
+        {
+            auth.setSourceAppCode(null);
+            auth.setSourceBizNo(null);
+        }
+        else if (StringUtils.isEmpty(auth.getSourceBizNo()))
+        {
+            // 业务号为空时统一落 NULL，避免与未传值产生两种“空”
+            auth.setSourceBizNo(null);
+        }
+    }
+
+    /**
+     * 覆盖已有授权行时的归属判定。
+     * <p>
+     * 平台覆盖不夺取外部归属；外部来源只允许同应用覆盖，跨应用拒绝；
+     * 外部入住/换房（adoptPlatformSource=true）可以接管平台行，直接授权接口不可以。
+     */
+    private void applyOverwriteSource(LockAuth auth, LockAuth existing, boolean adoptPlatformSource)
+    {
+        if (!LockConstants.AUTH_SOURCE_OPENAPI.equals(auth.getSource()))
+        {
+            // 平台覆盖：reviveAuth 不改 source 列，外部归属自然保留
+            return;
+        }
+        String appCode = StringUtils.trim(auth.getSourceAppCode());
+        String existingSource = StringUtils.isEmpty(existing.getSource())
+                ? LockConstants.AUTH_SOURCE_PLATFORM : existing.getSource();
+        String existingApp = StringUtils.trim(existing.getSourceAppCode());
+        if (LockConstants.AUTH_SOURCE_OPENAPI.equals(existingSource))
+        {
+            if (StringUtils.isNotEmpty(existingApp) && !existingApp.equals(appCode))
+            {
+                throw new IllegalArgumentException("该人员在此门锁上已有其他应用的授权");
+            }
+        }
+        else if (!adoptPlatformSource)
+        {
+            throw new IllegalArgumentException("该人员在此门锁上已有平台授权，请先在授权管理处理");
+        }
+        // 同应用外部行：刷新业务号；平台行被接管：写入来源应用
+        LockAuth sourceUpdate = new LockAuth();
+        sourceUpdate.setAuthId(existing.getAuthId());
+        sourceUpdate.setSource(LockConstants.AUTH_SOURCE_OPENAPI);
+        sourceUpdate.setSourceAppCode(appCode);
+        sourceUpdate.setSourceBizNo(auth.getSourceBizNo());
+        sourceUpdate.setUpdateBy(auth.getUpdateBy());
+        authMapper.updateAuthSource(sourceUpdate);
+    }
+
+    @Override
+    public LockAuthBatchResult batchInsertAuth(LockAuthBatchRequest request)
+    {
+        if (request == null)
+        {
+            throw new IllegalArgumentException("批量授权参数不能为空");
+        }
+        String personNo = StringUtils.trim(request.getPersonNo());
+        if (StringUtils.isEmpty(personNo))
+        {
+            throw new IllegalArgumentException("人员编号不能为空");
+        }
+        // 人员不存在时整批拒绝：没有姓名快照，生成 N 行也下发不了
+        if (personMapper.selectPersonByNo(personNo) == null)
+        {
+            throw new IllegalArgumentException("人员不存在，请先建立人员档案，人员编号=" + personNo);
+        }
+        String authType = StringUtils.trim(request.getAuthType());
+        if (StringUtils.isEmpty(authType))
+        {
+            throw new IllegalArgumentException("授权类型不能为空");
+        }
+        if (!LockConstants.AUTH_FACE.equals(authType) && !LockConstants.AUTH_PASSWORD.equals(authType)
+                && !LockConstants.AUTH_FINGERPRINT.equals(authType) && !LockConstants.AUTH_IC_CARD.equals(authType))
+        {
+            throw new IllegalArgumentException("不支持的授权类型：" + authType);
+        }
+        if (request.getBeginTime() != null && request.getEndTime() != null
+                && request.getBeginTime().after(request.getEndTime()))
+        {
+            throw new IllegalArgumentException("生效时间不能晚于失效时间");
+        }
+        LinkedHashSet<Long> deviceIds = new LinkedHashSet<Long>();
+        if (request.getDeviceIds() != null)
+        {
+            for (Long deviceId : request.getDeviceIds())
+            {
+                if (deviceId != null)
+                {
+                    deviceIds.add(deviceId);
+                }
+            }
+        }
+        if (deviceIds.isEmpty())
+        {
+            throw new IllegalArgumentException("请选择授权门锁");
+        }
+        if (deviceIds.size() > BATCH_MAX_DEVICES)
+        {
+            throw new IllegalArgumentException("单次最多授权 " + BATCH_MAX_DEVICES + " 把门锁");
+        }
+        boolean face = LockConstants.AUTH_FACE.equals(authType);
+        if (!face && StringUtils.isEmpty(request.getAuthValue()))
+        {
+            throw new IllegalArgumentException("授权内容不能为空");
+        }
+
+        LockAuthBatchResult result = new LockAuthBatchResult();
+        result.setTotal(deviceIds.size());
+        List<LockAuthBatchResult.Item> items = new ArrayList<LockAuthBatchResult.Item>();
+        int created = 0;
+        int overwritten = 0;
+        int failed = 0;
+        for (Long deviceId : deviceIds)
+        {
+            LockAuthBatchResult.Item item = new LockAuthBatchResult.Item();
+            item.setDeviceId(deviceId);
+            LockDevice device = deviceMapper.selectDeviceById(deviceId);
+            if (device == null)
+            {
+                item.setAction(LockAuthBatchResult.ACTION_FAILED);
+                item.setSyncMsg("门锁不存在，无法授权");
+                failed++;
+                items.add(item);
+                continue;
+            }
+            item.setDeviceSn(device.getDeviceSn());
+            item.setDeviceName(device.getDeviceName());
+            LockAuth auth = null;
+            try
+            {
+                auth = new LockAuth();
+                auth.setPersonNo(personNo);
+                auth.setAuthType(authType);
+                // 人脸特征由下发时按各锁算法版本取，模板值一律不落库，避免跨版本错配
+                auth.setAuthValue(face ? null : request.getAuthValue());
+                auth.setBeginTime(request.getBeginTime());
+                auth.setEndTime(request.getEndTime());
+                auth.setRemark(request.getRemark());
+                auth.setDeviceId(deviceId);
+                boolean existed = findExistingAuth(auth) != null;
+                doInsertAuth(auth, false);
+                item.setAuthId(auth.getAuthId());
+                item.setAction(existed ? LockAuthBatchResult.ACTION_OVERWRITTEN
+                        : LockAuthBatchResult.ACTION_CREATED);
+                LockAuth saved = authMapper.selectAuthById(auth.getAuthId());
+                if (saved != null)
+                {
+                    item.setSyncStatus(saved.getSyncStatus());
+                    item.setSyncMsg(saved.getSyncMsg());
+                }
+                if (existed)
+                {
+                    overwritten++;
+                }
+                else
+                {
+                    created++;
+                }
+            }
+            catch (Exception e)
+            {
+                String message = StringUtils.substring(e.getMessage(), 0, 500);
+                if (auth != null && auth.getAuthId() != null)
+                {
+                    // 行已落库但下发抛异常：置失败交给补偿重发，避免停在「已下发」不再重试
+                    authMapper.updateSyncStatus(auth.getAuthId(), LockConstants.SYNC_FAIL, message);
+                    item.setAuthId(auth.getAuthId());
+                }
+                item.setAction(LockAuthBatchResult.ACTION_FAILED);
+                item.setSyncMsg(message);
+                failed++;
+                log.warn("批量授权单锁处理失败, personNo={}, deviceId={}, msg={}", personNo, deviceId,
+                        e.getMessage());
+            }
+            items.add(item);
+        }
+        result.setItems(items);
+        result.setCreated(created);
+        result.setOverwritten(overwritten);
+        result.setFailed(failed);
+        log.info("多锁批量授权完成, personNo={}, authType={}, total={}, created={}, overwritten={}, failed={}",
+                personNo, authType, result.getTotal(), created, overwritten, failed);
+        return result;
+    }
+
     private LockAuth findExistingAuth(LockAuth auth)
     {
         return authMapper.selectAuthByUniqueKey(auth.getPersonNo(), auth.getDeviceId(), auth.getAuthType());
@@ -206,6 +519,83 @@ public class LockAuthServiceImpl implements ILockAuthService
         return authMapper.deleteAuthByIds(authIds);
     }
 
+    @Override
+    @Transactional
+    public int deleteAuthRecordsByIds(Long[] authIds)
+    {
+        if (authIds == null || authIds.length == 0)
+        {
+            return 0;
+        }
+        for (Long authId : authIds)
+        {
+            LockAuth auth = authMapper.selectAuthById(authId);
+            if (auth == null)
+            {
+                continue;
+            }
+            if (!LockConstants.SYNC_CLEARED.equals(auth.getSyncStatus()))
+            {
+                // 设备侧还有权限时删记录，会在门锁上留下无法追溯的开门凭据
+                throw new IllegalArgumentException("授权[" + auth.getAuthNo() + "]设备侧未清除，请使用删除授权");
+            }
+        }
+        return authMapper.deleteAuthByIds(authIds);
+    }
+
+    @Override
+    @Transactional
+    public int deleteAuthsByPersonNos(String[] personNos)
+    {
+        String[] normalized = normalizePersonNos(personNos);
+        if (normalized.length == 0)
+        {
+            return 0;
+        }
+        List<Long> authIds = authMapper.selectAuthIdsByPersonNos(normalized);
+        if (authIds.isEmpty())
+        {
+            return 0;
+        }
+        // 复用逐条删除：先向门锁下发清除，再逻辑删除，保证设备侧权限一并回收
+        return deleteAuthByIds(authIds.toArray(new Long[authIds.size()]));
+    }
+
+    @Override
+    public void batchPushByPersonNos(String[] personNos)
+    {
+        String[] normalized = normalizePersonNos(personNos);
+        if (normalized.length == 0)
+        {
+            return;
+        }
+        List<Long> authIds = authMapper.selectPushableAuthIdsByPersonNos(normalized);
+        if (authIds.isEmpty())
+        {
+            return;
+        }
+        batchPush(authIds.toArray(new Long[authIds.size()]));
+    }
+
+    /** 去掉空白人员编号并去重，避免拼出空的 IN 条件 */
+    private String[] normalizePersonNos(String[] personNos)
+    {
+        if (personNos == null || personNos.length == 0)
+        {
+            return new String[0];
+        }
+        LinkedHashSet<String> unique = new LinkedHashSet<String>();
+        for (String personNo : personNos)
+        {
+            String trimmed = StringUtils.trim(personNo);
+            if (StringUtils.isNotEmpty(trimmed))
+            {
+                unique.add(trimmed);
+            }
+        }
+        return unique.toArray(new String[unique.size()]);
+    }
+
     @Override
     public void push(Long authId)
     {
@@ -380,9 +770,9 @@ public class LockAuthServiceImpl implements ILockAuthService
         }
         if (!success && LockCommandPolicy.isBusy(message))
         {
-            // 设备忙是瞬时状态，由命令层 3 秒后重发；这里若把授权置失败，
-            // 授权补偿会再建一条命令，同一张脸被重复下发
-            return;
+            // 网关忙在命令层已排队重发，不会走到这里；能走到的是重排次数用尽的终态，
+            // 此时必须把授权置失败，交给补偿重新建档，否则授权会停在「已下发」无人跟进
+            log.warn("授权命令因网关忙终结, authId={}, msg={}", auth.getAuthId(), message);
         }
         String syncStatus;
         if (LockConstants.CMD_AUTH_CLEAR.equals(command.getCommandType()))
@@ -557,6 +947,12 @@ public class LockAuthServiceImpl implements ILockAuthService
             return;
         }
         Long groupId = target.getDeviceRef().getGroupId();
+        if (commandMapper.countInflightAuthByBizId(auth.getAuthId()) > 0)
+        {
+            // 同一授权已有命令在途（含等待门锁终态、网关忙排队），补偿不能另建一条
+            log.info("授权已有在途命令，本轮跳过, authId={}, groupId={}", auth.getAuthId(), groupId);
+            return;
+        }
         if (commandMapper.countInflightAuthCommands(groupId) > 0)
         {
             // 网关同一时刻只处理一条 data/batch，并发下发会直接回 gw busy。
@@ -702,7 +1098,7 @@ public class LockAuthServiceImpl implements ILockAuthService
      * </pre>
      *
      * @param add true 下发授权（add 动作），false 清除授权（delete 动作）
-     * @param authValue 实际下发的授权内容（人脸已按门锁算法版本选值），删除帧不使用
+     * @param authValue 实际下发的授权内容（人脸已按门锁算法版本选值）；密码/IC卡删除时用它定位凭据
      */
     private YdlinkFrameDTO buildAuthFrame(LockAuth auth, LockDevice device, RouteTarget target, boolean add,
             String authValue)
@@ -720,6 +1116,9 @@ public class LockAuthServiceImpl implements ILockAuthService
         String value = StringUtils.defaultString(authValue);
         // 人脸帧比密码等帧多一个「授权锁标识」位（与人员编号同值），长度不同不可混用
         boolean face = YdlinkOp.FACE_FEATURE.equals(op);
+        // 只有人脸/指纹按人员编号建索引；密码与 IC 卡以凭据本身标识，
+        // 帧里不能塞人员编号，否则设备侧按人员找不到对应凭据
+        boolean personIdAuth = face || YdlinkOp.FINGERPRINT.equals(op);
         if (add)
         {
             if (face)
@@ -728,18 +1127,32 @@ public class LockAuthServiceImpl implements ILockAuthService
                 frame.setFlatParams(Arrays.asList("add", personNo, value, personNo,
                         format(auth.getBeginTime()), format(auth.getEndTime()), deviceSn, devicePsw));
             }
+            else if (personIdAuth)
+            {
+                // 指纹：[动作, 人员编号, 特征值, 开始时间, 结束时间, 门锁SN, 门锁密码]
+                frame.setFlatParams(Arrays.asList("add", personNo, value,
+                        format(auth.getBeginTime()), format(auth.getEndTime()), deviceSn, devicePsw));
+            }
             else
             {
-                // 密码/指纹/IC卡：[动作, 人员编号, 授权内容, 开始时间, 结束时间, 门锁SN, 门锁密码]
-                frame.setFlatParams(Arrays.asList("add", personNo, value,
+                // 密码/IC卡：[动作, 凭据, 凭据, 开始时间, 结束时间, 门锁SN, 门锁密码]
+                frame.setFlatParams(Arrays.asList("add", value, value,
                         format(auth.getBeginTime()), format(auth.getEndTime()), deviceSn, devicePsw));
             }
         }
         else
         {
-            // 删除帧只需定位「删除谁 + 哪把锁」：["delete", 人员编号, 门锁SN, 门锁密码]
-            // 实测人脸删除报文即此 4 项，不携带特征值与时间
-            frame.setFlatParams(Arrays.asList("delete", personNo, deviceSn, devicePsw));
+            if (personIdAuth)
+            {
+                // 删除帧只需定位「删除谁 + 哪把锁」：["delete", 人员编号, 门锁SN, 门锁密码]
+                // 实测人脸删除报文即此 4 项，不携带特征值与时间
+                frame.setFlatParams(Arrays.asList("delete", personNo, deviceSn, devicePsw));
+            }
+            else
+            {
+                // 密码/IC卡删除比人脸多一个凭据位（协议 5 项），用凭据定位要删的条目
+                frame.setFlatParams(Arrays.asList("delete", value, value, deviceSn, devicePsw));
+            }
         }
         return frame;
     }
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockCommandServiceImpl.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockCommandServiceImpl.java
index 5bcc1e3..739188b 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockCommandServiceImpl.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockCommandServiceImpl.java
@@ -2,7 +2,9 @@ package com.ruoyi.iot.lock.service.impl;
 
 import java.util.Calendar;
 import java.util.Date;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -174,6 +176,52 @@ public class LockCommandServiceImpl implements ILockCommandService
         return null;
     }
 
+    @Override
+    @Transactional
+    public String handleGatewayBusy(String topic, String seq, String payload, String message)
+    {
+        if (StringUtils.isEmpty(seq))
+        {
+            return null;
+        }
+        LockCommand command = commandMapper.selectCommandByNo(seq);
+        if (command == null)
+        {
+            log.warn("未匹配到命令, seq={}, topic={}", seq, topic);
+            return null;
+        }
+        if (isFinished(command))
+        {
+            // 已有终态（例如 0 先到），迟到的网关忙不能改写结果
+            return null;
+        }
+        if (LockConstants.ACK_YES.equals(command.getGatewayAck()))
+        {
+            // 已收到 10 说明报文已转发，此后再来的忙响应不能推翻转发事实，继续等门锁终态
+            log.warn("已收到网关回执后又收到忙响应，保持等待门锁终态, seq={}", seq);
+            return null;
+        }
+        command.setRespTopic(topic);
+        command.setRespPayload(YdlinkPayloadMasker.maskPayload(payload));
+        command.setRespTime(new Date());
+        Integer retryCount = command.getRetryCount() == null ? 0 : command.getRetryCount();
+        String reason = StringUtils.isEmpty(message) ? "网关忙" : message;
+        if (LockCommandPolicy.isRetryDisabled(command.getCommandType())
+                || retryCount >= LockCommandPolicy.maxBusyRetry(command.getCommandType()))
+        {
+            return finish(command, false, reason + "，重排次数已用尽");
+        }
+        // 11 表示报文未转发到门锁：回到待发送并排队，但仍算在途，同网关后续命令不得插队
+        command.setCommandStatus(LockConstants.STATUS_PENDING);
+        command.setRetryCount(retryCount + 1);
+        command.setNextRetryTime(LockCommandPolicy.busyRetryTime());
+        command.setErrorMsg(StringUtils.substring(reason, 0, 500));
+        commandMapper.updateCommand(command);
+        log.info("网关忙，命令排队重发, seq={}, commandType={}, retryCount={}", seq, command.getCommandType(),
+                retryCount + 1);
+        return null;
+    }
+
     /**
      * 命令是否已有终态结果
      */
@@ -225,16 +273,6 @@ public class LockCommandServiceImpl implements ILockCommandService
         }
     }
 
-    /**
-     * 授权类命令是否发到分组主题：同一网关内只能串行，并发会被回 gw busy
-     */
-    private boolean isGroupAuthCommand(LockCommand command)
-    {
-        return LockConstants.TARGET_GROUP.equals(command.getTargetType())
-                && (LockConstants.CMD_AUTH_PUSH.equals(command.getCommandType())
-                        || LockConstants.CMD_AUTH_CLEAR.equals(command.getCommandType()));
-    }
-
     /**
      * 授权命令终结为超时时回写授权同步状态
      * <p>
@@ -287,8 +325,24 @@ public class LockCommandServiceImpl implements ILockCommandService
             {
                 continue;
             }
-            long timeoutMillis = LockCommandPolicy.timeoutSeconds(command.getCommandType()) * 1000L;
-            if (command.getReqTime().getTime() + timeoutMillis > now)
+            // 网关已回 10 表示报文已转发，此后只等门锁终态：从网关回执起算独立等待时长，
+            // 期间既不重发也不判失败，否则会把正在执行/已成功的授权重复下发或提前放行下一条
+            boolean waitingDevice = LockConstants.ACK_YES.equals(command.getGatewayAck())
+                    && !LockConstants.ACK_YES.equals(command.getDeviceAck());
+            long baseTime;
+            long timeoutMillis;
+            if (waitingDevice)
+            {
+                baseTime = command.getRespTime() == null ? command.getReqTime().getTime()
+                        : command.getRespTime().getTime();
+                timeoutMillis = LockCommandPolicy.deviceWaitSeconds(command.getCommandType()) * 1000L;
+            }
+            else
+            {
+                baseTime = command.getReqTime().getTime();
+                timeoutMillis = LockCommandPolicy.timeoutSeconds(command.getCommandType()) * 1000L;
+            }
+            if (baseTime + timeoutMillis > now)
             {
                 // 尚未到期，下一轮再判
                 continue;
@@ -297,7 +351,13 @@ public class LockCommandServiceImpl implements ILockCommandService
             Integer retryCount = command.getRetryCount() == null ? 0 : command.getRetryCount();
             LockCommand update = new LockCommand();
             update.setCommandId(command.getCommandId());
-            if (LockCommandPolicy.isRetryDisabled(command.getCommandType()))
+            if (waitingDevice)
+            {
+                // 已转发到门锁：不再重发，等不到终态即判超时，由授权补偿决定是否重新建档下发
+                update.setCommandStatus(LockConstants.STATUS_TIMEOUT);
+                update.setErrorMsg("网关已接收，等待门锁回执超时");
+            }
+            else if (LockCommandPolicy.isRetryDisabled(command.getCommandType()))
             {
                 // 该类命令不自动重发，超时即终态
                 update.setCommandStatus(LockConstants.STATUS_TIMEOUT);
@@ -328,25 +388,87 @@ public class LockCommandServiceImpl implements ILockCommandService
     @Override
     public int retryPending()
     {
-        LockCommand query = new LockCommand();
-        query.setCommandStatus(LockConstants.STATUS_FAIL);
-        List<LockCommand> commands = commandMapper.selectCommandList(query);
         int count = 0;
         Date now = new Date();
-        for (LockCommand command : commands)
+        // 1) 网关忙排队的命令：每轮每个主题（同网关）只放行一条，且网关无已发送命令时才重发，
+        //    避免多条排队命令互相等待或同时挤进网关
+        Set<String> republishedTopics = new HashSet<String>();
+        for (LockCommand command : commandMapper.selectDeferredCommands(now))
+        {
+            String topic = command.getTopic();
+            if (topic == null || republishedTopics.contains(topic))
+            {
+                continue;
+            }
+            if (LockCommandPolicy.isRetryDisabled(command.getCommandType()))
+            {
+                continue;
+            }
+            Integer busyRetry = command.getRetryCount() == null ? 0 : command.getRetryCount();
+            if (busyRetry >= LockCommandPolicy.maxBusyRetry(command.getCommandType()))
+            {
+                LockCommand expired = new LockCommand();
+                expired.setCommandId(command.getCommandId());
+                expired.setCommandStatus(LockConstants.STATUS_TIMEOUT);
+                expired.setErrorMsg("网关持续忙，超过最大重排次数");
+                commandMapper.updateCommand(expired);
+                markAuthTerminal(command, expired.getErrorMsg());
+                continue;
+            }
+            if (commandMapper.countOtherSentByTopic(topic, command.getCommandId()) > 0)
+            {
+                // 同网关已有命令在发送/等待门锁终态，等它终结再重发
+                continue;
+            }
+            if (republish(command, busyRetry))
+            {
+                republishedTopics.add(topic);
+                count++;
+            }
+        }
+        // 2) 发送失败或等待超时的命令按退避重发
+        LockCommand query = new LockCommand();
+        query.setCommandStatus(LockConstants.STATUS_FAIL);
+        for (LockCommand command : commandMapper.selectCommandList(query))
         {
             if (command.getNextRetryTime() == null || command.getNextRetryTime().after(now))
             {
                 continue;
             }
+            boolean waitingDevice = LockConstants.ACK_YES.equals(command.getGatewayAck())
+                    && !LockConstants.ACK_YES.equals(command.getDeviceAck());
+            if (waitingDevice)
+            {
+                // 已收到网关 10：历史数据被旧逻辑判成失败后不能重发，回到等待态由超时判定收口
+                long base = command.getRespTime() != null ? command.getRespTime().getTime()
+                        : (command.getReqTime() == null ? now.getTime() : command.getReqTime().getTime());
+                long waitMillis = LockCommandPolicy.deviceWaitSeconds(command.getCommandType()) * 1000L;
+                if (base + waitMillis <= now.getTime())
+                {
+                    LockCommand expired = new LockCommand();
+                    expired.setCommandId(command.getCommandId());
+                    expired.setCommandStatus(LockConstants.STATUS_TIMEOUT);
+                    expired.setErrorMsg("网关已接收，等待门锁回执超时");
+                    commandMapper.updateCommand(expired);
+                    markAuthTerminal(command, expired.getErrorMsg());
+                }
+                else
+                {
+                    LockCommand waiting = new LockCommand();
+                    waiting.setCommandId(command.getCommandId());
+                    waiting.setCommandStatus(LockConstants.STATUS_SENT);
+                    commandMapper.updateCommand(waiting);
+                }
+                continue;
+            }
             if (LockCommandPolicy.isRetryDisabled(command.getCommandType()))
             {
                 // 时间同步、远程开关锁失败后不自动重发
                 continue;
             }
-            if (isGroupAuthCommand(command) && commandMapper.countInflightAuthCommands(command.getTargetId()) > 0)
+            if (commandMapper.countOtherInflightByTopic(command.getTopic(), command.getCommandId()) > 0)
             {
-                // 同网关仍有在途授权命令，本轮跳过，避免再次撞上 gw busy
+                // 同网关仍有在途命令，本轮跳过，避免再次撞上 gw busy
                 continue;
             }
             Integer maxRetry = command.getMaxRetry() == null ? DEFAULT_MAX_RETRY : command.getMaxRetry();
@@ -362,31 +484,45 @@ public class LockCommandServiceImpl implements ILockCommandService
                 markAuthTerminal(command, expired.getErrorMsg());
                 continue;
             }
-            LockCommand update = new LockCommand();
-            update.setCommandId(command.getCommandId());
-            update.setRetryCount(retryCount + 1);
-            update.setNextRetryTime(LockCommandPolicy.nextRetryTime(retryCount + 1));
-            // 先置已发送再发布，避免应答先到被覆盖
-            update.setCommandStatus(LockConstants.STATUS_SENT);
-            update.setReqTime(now);
-            commandMapper.updateCommand(update);
-            try
+            if (republish(command, retryCount + 1))
             {
-                mqttService.publish(command.getTopic(), command.getPayload(), 1, false);
                 count++;
             }
-            catch (Exception e)
-            {
-                LockCommand failed = new LockCommand();
-                failed.setCommandId(command.getCommandId());
-                failed.setCommandStatus(LockConstants.STATUS_FAIL);
-                failed.setErrorMsg(StringUtils.substring(e.getMessage(), 0, 500));
-                commandMapper.updateCommand(failed);
-            }
         }
         return count;
     }
 
+    /**
+     * 重发已落库的原始报文（seq/payload 不变），先把状态置为已发送再发布，避免应答先到被覆盖
+     */
+    private boolean republish(LockCommand command, int retryCount)
+    {
+        LockCommand update = new LockCommand();
+        update.setCommandId(command.getCommandId());
+        update.setRetryCount(retryCount);
+        update.setNextRetryTime(LockCommandPolicy.nextRetryTime(retryCount));
+        update.setCommandStatus(LockConstants.STATUS_SENT);
+        update.setReqTime(new Date());
+        // 清掉上一次尝试的回执标记：否则旧的 deviceAck/deviceResult 会被当成这次的结果
+        update.setGatewayAck(LockConstants.ACK_NO);
+        update.setDeviceAck(LockConstants.ACK_NO);
+        commandMapper.updateCommand(update);
+        try
+        {
+            mqttService.publish(command.getTopic(), command.getPayload(), 1, false);
+            return true;
+        }
+        catch (Exception e)
+        {
+            LockCommand failed = new LockCommand();
+            failed.setCommandId(command.getCommandId());
+            failed.setCommandStatus(LockConstants.STATUS_FAIL);
+            failed.setErrorMsg(StringUtils.substring(e.getMessage(), 0, 500));
+            commandMapper.updateCommand(failed);
+            return false;
+        }
+    }
+
     @Override
     @Transactional
     public void retry(Long commandId)
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockGatewayServiceImpl.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockGatewayServiceImpl.java
index 15c2310..fb7aa20 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockGatewayServiceImpl.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockGatewayServiceImpl.java
@@ -354,15 +354,25 @@ public class LockGatewayServiceImpl implements ILockGatewayService
         {
             return;
         }
+        if (LockConstants.OFFLINE.equals(onlineStatus))
+        {
+            // 离线通知不动 last_online_time，保留最后一次真正在线的时刻
+            gatewayMapper.updateOnlineStatusOnly(gateway.getGatewayId(), onlineStatus);
+            return;
+        }
         gatewayMapper.updateOnlineStatus(gateway.getGatewayId(), onlineStatus, new Date());
     }
 
     @Override
+    @Transactional
     public int markOffline(int offlineMinutes)
     {
         Calendar calendar = Calendar.getInstance();
         calendar.add(Calendar.MINUTE, -Math.max(offlineMinutes, 1));
-        int count = gatewayMapper.markOfflineBefore(calendar.getTime(), new Date());
+        Date offlineTime = calendar.getTime();
+        // 先按归属行的最近上报刷新在线：网关转发门锁数据即证明在线，不能只依赖 onoff_line 连接事件
+        gatewayMapper.refreshOnlineByReport(offlineTime);
+        int count = gatewayMapper.markOfflineBefore(offlineTime, new Date());
         // 网关离线后，其视角下的门锁归属状态同步置离线；其它网关的归属不受影响
         relationMapper.markOfflineByOfflineGateways();
         return count;
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockStayServiceImpl.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockStayServiceImpl.java
index 8a5cbba..8c19bff 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockStayServiceImpl.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/service/impl/LockStayServiceImpl.java
@@ -83,6 +83,9 @@ public class LockStayServiceImpl implements ILockStayService
     /** 单据来源：平台办理 */
     private static final String STAY_SOURCE_PLATFORM = "1";
 
+    /** 单据来源：开放接口办理 */
+    private static final String STAY_SOURCE_API = "2";
+
     /** 删除标志：已删除 */
     private static final String DEL_FLAG_DELETED = "2";
 
@@ -363,6 +366,8 @@ public class LockStayServiceImpl implements ILockStayService
         }
         Date now = new Date();
         String stayNo = nextStayNo();
+        String staySource = StringUtils.isEmpty(oldStay.getSource()) ? STAY_SOURCE_PLATFORM : oldStay.getSource();
+        boolean external = STAY_SOURCE_API.equals(staySource);
         LockAuth auth = new LockAuth();
         auth.setPersonNo(person.getPersonNo());
         auth.setPersonName(person.getPersonName());
@@ -371,7 +376,11 @@ public class LockStayServiceImpl implements ILockStayService
         auth.setBeginTime(now);
         auth.setEndTime(newEnd);
         auth.setRemark("换房 " + stayNo);
-        authService.insertAuth(auth);
+        // 换房新授权继承原单来源应用；biz_no 不继承（(biz_system,biz_no) 唯一），业务号留空
+        auth.setSource(staySource);
+        auth.setSourceAppCode(external ? oldStay.getBizSystem() : null);
+        auth.setSourceBizNo(null);
+        authService.insertAuth(auth, external);
 
         LockStay newStay = new LockStay();
         newStay.setStayNo(stayNo);
@@ -704,6 +713,11 @@ public class LockStayServiceImpl implements ILockStayService
         }
 
         String stayNo = nextStayNo();
+        String bizNo = StringUtils.trim(body.getBizNo());
+        String bizSystem = StringUtils.trim(body.getBizSystem());
+        String source = StringUtils.isEmpty(StringUtils.trim(body.getSource())) ? STAY_SOURCE_PLATFORM
+                : StringUtils.trim(body.getSource());
+        boolean external = STAY_SOURCE_API.equals(source);
         LockAuth auth = new LockAuth();
         auth.setPersonNo(person.getPersonNo());
         auth.setPersonName(person.getPersonName());
@@ -714,7 +728,11 @@ public class LockStayServiceImpl implements ILockStayService
         auth.setBeginTime(begin);
         auth.setEndTime(body.getEndTime());
         auth.setRemark("入住 " + stayNo);
-        authService.insertAuth(auth);
+        // 授权归属随入住单来源；外部入住写入应用与业务号，便于页面按应用追溯
+        auth.setSource(source);
+        auth.setSourceAppCode(external && StringUtils.isNotEmpty(bizSystem) ? bizSystem : null);
+        auth.setSourceBizNo(external && StringUtils.isNotEmpty(bizNo) ? bizNo : null);
+        authService.insertAuth(auth, external);
 
         LockStay stay = new LockStay();
         stay.setStayNo(stayNo);
@@ -733,15 +751,12 @@ public class LockStayServiceImpl implements ILockStayService
         stay.setStayStatus(STAY_STATUS_ACTIVE);
         stay.setAuthStatus(LockConstants.SYNC_PENDING);
         stay.setRemark(body.getRemark());
-        String bizNo = StringUtils.trim(body.getBizNo());
-        String bizSystem = StringUtils.trim(body.getBizSystem());
         // uk_lock_stay_biz(biz_system, biz_no) 只允许多行 NULL，空串会互相撞键，
         // 平台手工单必须落 NULL，否则第二次办理入住即 Duplicate entry ''
         stay.setBizNo(StringUtils.isEmpty(bizNo) ? null : bizNo);
         stay.setBizSystem(StringUtils.isEmpty(bizSystem) ? null : bizSystem);
         // insertStay 显式列出 source 列，为空会写入 NULL 而不是列默认值 '1'，这里补默认
-        stay.setSource(StringUtils.isEmpty(StringUtils.trim(body.getSource())) ? STAY_SOURCE_PLATFORM
-                : StringUtils.trim(body.getSource()));
+        stay.setSource(source);
         stayMapper.insertStay(stay);
 
         // 授权可能因门锁无路由/缺特征在创建时即失败，回读真实状态写入入住单
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/task/GatewayOfflineCheckTask.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/task/GatewayOfflineCheckTask.java
index df10062..8070e64 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/task/GatewayOfflineCheckTask.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/task/GatewayOfflineCheckTask.java
@@ -9,6 +9,9 @@ import com.ruoyi.iot.lock.service.ILockGatewayService;
 
 /**
  * 网关离线检测：超过指定时间未上报即置为离线
+ * <p>
+ * 在线来源有两个：网关级 onoff_line 连接通知，以及该网关归属门锁的周期上报（lockrssi 每分钟一次）。
+ * 二者任一在窗口内出现即视为在线，因此检测周期取 1 分钟，与门锁上报节奏对齐。
  *
  * @author ruoyi
  */
@@ -31,7 +34,7 @@ public class GatewayOfflineCheckTask
     @Autowired
     private DistributedTaskLock taskLock;
 
-    @Scheduled(initialDelay = 60000L, fixedDelay = 300000L)
+    @Scheduled(initialDelay = 30000L, fixedDelay = 60000L)
     public void execute()
     {
         DistributedTaskLock.LockHandle lock = taskLock.tryLock(LOCK_NAME, LOCK_TTL_SECONDS);
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/task/LockCommandRetryTask.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/task/LockCommandRetryTask.java
index b8b9c2e..ef2044c 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/task/LockCommandRetryTask.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/lock/task/LockCommandRetryTask.java
@@ -33,8 +33,8 @@ public class LockCommandRetryTask
     private DistributedTaskLock taskLock;
 
     /**
-     * 5 秒一轮：gw busy 重排 3 秒、退避首档 5 秒，排队的授权命令也靠这一轮接着下发，
-     * 周期过长会让并发下发的第二张脸实际延迟到十几秒以上
+     * 5 秒一轮：gw busy 重排 8 秒，排队的授权命令也靠这一轮接着下发；
+     * 同一网关严格串行，宁可慢一点，也要等上一条拿到门锁终态再发下一条
      */
     @Scheduled(initialDelay = 5000L, fixedDelay = 5000L)
     public void execute()
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/openapi/controller/OpenAuthApiController.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/openapi/controller/OpenAuthApiController.java
index 0c10f7a..cd41dcb 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/openapi/controller/OpenAuthApiController.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/openapi/controller/OpenAuthApiController.java
@@ -3,6 +3,7 @@ package com.ruoyi.iot.openapi.controller;
 import java.text.ParseException;
 import java.text.SimpleDateFormat;
 import java.util.Date;
+import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.DeleteMapping;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -23,6 +24,7 @@ import com.ruoyi.iot.lock.service.ILockAuthService;
 import com.ruoyi.iot.lock.service.ILockDeviceService;
 import com.ruoyi.iot.lock.service.ILockFaceService;
 import com.ruoyi.iot.openapi.domain.OpenAuthRequest;
+import com.ruoyi.iot.openapi.filter.OpenApiAuthFilter;
 
 /**
  * 开放接口-门禁授权
@@ -51,8 +53,13 @@ public class OpenAuthApiController
      */
     @Anonymous
     @PostMapping
-    public AjaxResult add(@RequestBody OpenAuthRequest request)
+    public AjaxResult add(@RequestBody OpenAuthRequest request, HttpServletRequest httpRequest)
     {
+        String appCode = resolveAppCode(httpRequest);
+        if (StringUtils.isEmpty(appCode))
+        {
+            return AjaxResult.error("应用身份缺失");
+        }
         if (request == null || StringUtils.isEmpty(request.getPersonNo()))
         {
             return AjaxResult.error("人员编号不能为空");
@@ -81,6 +88,10 @@ public class OpenAuthApiController
         auth.setDeviceId(deviceId);
         auth.setAuthType(request.getAuthType());
         auth.setRemark(request.getRemark());
+        // 直接授权接口的角色由 API Key 决定：归属当前应用，遇到平台行/其他应用行拒绝覆盖
+        auth.setSource(LockConstants.AUTH_SOURCE_OPENAPI);
+        auth.setSourceAppCode(appCode);
+        auth.setSourceBizNo(StringUtils.substring(StringUtils.trim(request.getBizNo()), 0, 64));
         try
         {
             auth.setBeginTime(parseTime(request.getBeginTime()));
@@ -155,9 +166,10 @@ public class OpenAuthApiController
      */
     @Anonymous
     @PostMapping("/{authId}/push")
-    public AjaxResult push(@PathVariable Long authId)
+    public AjaxResult push(@PathVariable Long authId, HttpServletRequest httpRequest)
     {
-        if (authService.selectAuthById(authId) == null)
+        // 跨应用一律按不存在处理，不暴露其他应用的数据
+        if (authService.selectExternalAuthForApp(authId, resolveAppCode(httpRequest)) == null)
         {
             return AjaxResult.error("授权不存在，authId=" + authId);
         }
@@ -170,9 +182,9 @@ public class OpenAuthApiController
      */
     @Anonymous
     @PostMapping("/{authId}/clear")
-    public AjaxResult clear(@PathVariable Long authId)
+    public AjaxResult clear(@PathVariable Long authId, HttpServletRequest httpRequest)
     {
-        if (authService.selectAuthById(authId) == null)
+        if (authService.selectExternalAuthForApp(authId, resolveAppCode(httpRequest)) == null)
         {
             return AjaxResult.error("授权不存在，authId=" + authId);
         }
@@ -185,9 +197,9 @@ public class OpenAuthApiController
      */
     @Anonymous
     @DeleteMapping("/{authId}")
-    public AjaxResult remove(@PathVariable Long authId)
+    public AjaxResult remove(@PathVariable Long authId, HttpServletRequest httpRequest)
     {
-        if (authService.selectAuthById(authId) == null)
+        if (authService.selectExternalAuthForApp(authId, resolveAppCode(httpRequest)) == null)
         {
             return AjaxResult.error("授权不存在，authId=" + authId);
         }
@@ -196,13 +208,33 @@ public class OpenAuthApiController
     }
 
     /**
-     * 查询授权
+     * 查询授权：只返回本应用下发的授权，不返回授权凭据
      */
     @Anonymous
     @GetMapping("/list")
-    public AjaxResult list(LockAuth auth)
+    public AjaxResult list(LockAuth auth, HttpServletRequest httpRequest)
     {
-        return AjaxResult.success(authService.selectAuthList(auth));
+        String appCode = resolveAppCode(httpRequest);
+        if (StringUtils.isEmpty(appCode))
+        {
+            // 没有应用身份时查询条件会退化为“全部外部授权”，必须直接拒绝
+            return AjaxResult.error("应用身份缺失");
+        }
+        auth.setSource(LockConstants.AUTH_SOURCE_OPENAPI);
+        auth.setSourceAppCode(appCode);
+        auth.setAuthValue(null);
+        if (StringUtils.isEmpty(auth.getSyncStatus()))
+        {
+            // 开放接口不套用平台页“默认隐藏已取消”的规则，调用方可据列表对账
+            auth.setSyncStatus("ALL");
+        }
+        return AjaxResult.success(authService.selectExternalAuthList(auth));
+    }
+
+    private String resolveAppCode(HttpServletRequest request)
+    {
+        Object value = request.getAttribute(OpenApiAuthFilter.ATTR_APP_CODE);
+        return value == null ? null : String.valueOf(value);
     }
 
     private Date parseTime(String value) throws ParseException
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/openapi/domain/OpenAuthRequest.java b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/openapi/domain/OpenAuthRequest.java
index 2e812ba..56f7899 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/openapi/domain/OpenAuthRequest.java
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/java/com/ruoyi/iot/openapi/domain/OpenAuthRequest.java
@@ -40,6 +40,9 @@ public class OpenAuthRequest implements Serializable
     /** 失效时间 yyyy-MM-dd HH:mm:ss，留空表示永久有效 */
     private String endTime;
 
+    /** 来源业务单号（可空，≤64，用于平台按单号追溯） */
+    private String bizNo;
+
     private String remark;
 
     public String getPersonNo()
@@ -112,6 +115,16 @@ public class OpenAuthRequest implements Serializable
         this.endTime = endTime;
     }
 
+    public String getBizNo()
+    {
+        return bizNo;
+    }
+
+    public void setBizNo(String bizNo)
+    {
+        this.bizNo = bizNo;
+    }
+
     public String getRemark()
     {
         return remark;
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockAccessLogMapper.xml b/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockAccessLogMapper.xml
index ceca31c..8ba4f9c 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockAccessLogMapper.xml
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockAccessLogMapper.xml
@@ -25,6 +25,11 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         <result property="remark"     column="remark"      />
     </resultMap>
 
+    <!-- 平台页面列表/详情额外带房间号；开放接口与住宿详情不查 room_no，继续用上面的基础 resultMap -->
+    <resultMap type="LockAccessLog" id="LockAccessLogRoomResult" extends="LockAccessLogResult">
+        <result property="roomNo"     column="room_no"     />
+    </resultMap>
+
     <sql id="selectAccessLogVo">
         select log_id, device_id, device_sn, gateway_id, gateway_sn, group_id, person_no, person_name,
                card_no, open_type, open_result, open_dir, open_time, recv_time, seq, raw_params,
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockAuthMapper.xml b/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockAuthMapper.xml
index 9683692..fcb51f7 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockAuthMapper.xml
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockAuthMapper.xml
@@ -19,6 +19,13 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         <result property="beginTime"   column="begin_time"    />
         <result property="endTime"     column="end_time"      />
         <result property="authTime"    column="auth_time"     />
+        <result property="source"      column="source"        />
+        <result property="sourceAppCode" column="source_app_code" />
+        <result property="sourceBizNo" column="source_biz_no" />
+        <result property="sourceAppName" column="source_app_name" />
+        <result property="stayNo"      column="stay_no"       />
+        <result property="deviceName"  column="device_name"   />
+        <result property="onlineStatus" column="online_status" />
         <result property="syncStatus"  column="sync_status"   />
         <result property="syncTime"    column="sync_time"     />
         <result property="syncMsg"     column="sync_msg"      />
@@ -32,9 +39,24 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         <result property="remark"      column="remark"        />
     </resultMap>
 
+    <resultMap type="LockAuthPerson" id="LockAuthPersonResult">
+        <result property="personNo"     column="person_no"     />
+        <result property="personName"   column="person_name"   />
+        <result property="authTypes"    column="auth_types"    />
+        <result property="authCount"    column="auth_count"    />
+        <result property="deviceCount"  column="device_count"  />
+        <result property="issuedCount"  column="issued_count"  />
+        <result property="pendingCount" column="pending_count" />
+        <result property="failedCount"  column="failed_count"  />
+        <result property="beginTime"    column="begin_time"    />
+        <result property="endTime"      column="end_time"      />
+        <result property="updateTime"   column="update_time"   />
+    </resultMap>
+
     <sql id="selectAuthVo">
         select auth_id, auth_no, person_no, person_name, device_id, device_sn, gateway_id, group_id,
-               auth_type, auth_value, auth_value_md5, begin_time, end_time, auth_time, sync_status,
+               auth_type, auth_value, auth_value_md5, begin_time, end_time, auth_time,
+               source, source_app_code, source_biz_no, sync_status,
                sync_time, sync_msg, retry_count, status, del_flag, create_by, create_time,
                update_by, update_time, remark from lock_auth
     </sql>
@@ -67,6 +89,9 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="syncStatus != null and syncStatus != ''">
                 and sync_status = #{syncStatus}
             </if>
+            <if test="source != null and source != ''">
+                and source = #{source}
+            </if>
             <if test="status != null and status != ''">
                 and status = #{status}
             </if>
@@ -80,11 +105,206 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         order by auth_id desc
     </select>
 
+    <!--
+      人员维度聚合：一人一行。已清除(4)的授权不再有设备侧权限，不计入；
+      同步状态过滤作用于参与统计的行，便于「只看下发失败的授权」这类排查。
+    -->
+    <select id="selectPersonAuthList" parameterType="LockAuthPerson" resultMap="LockAuthPersonResult">
+        select a.person_no,
+               max(a.person_name) as person_name,
+               count(1) as auth_count,
+               count(distinct a.device_id) as device_count,
+               sum(case when a.sync_status = '2' then 1 else 0 end) as issued_count,
+               sum(case when a.sync_status is null or a.sync_status in ('0', '1', '6') then 1 else 0 end) as pending_count,
+               sum(case when a.sync_status = '3' then 1 else 0 end) as failed_count,
+               min(a.begin_time) as begin_time,
+               max(a.end_time) as end_time,
+               max(a.update_time) as update_time,
+               group_concat(distinct a.auth_type order by a.auth_type separator ',') as auth_types
+          from lock_auth a
+         where a.del_flag = '0'
+           and a.source = '1'
+           and (a.sync_status is null or a.sync_status &lt;&gt; '4')
+        <if test="keyword != null and keyword != ''">
+            and (a.person_no like concat('%', #{keyword}, '%') or a.person_name like concat('%', #{keyword}, '%'))
+        </if>
+        <if test="deviceId != null">
+            and a.device_id = #{deviceId}
+        </if>
+        <if test="groupId != null">
+            and a.group_id = #{groupId}
+        </if>
+        <if test="authType != null and authType != ''">
+            and a.auth_type = #{authType}
+        </if>
+        <if test="syncStatus != null and syncStatus != ''">
+            and a.sync_status = #{syncStatus}
+        </if>
+         group by a.person_no
+         order by max(a.update_time) desc, a.person_no
+    </select>
+
+    <!-- 平台页签按人员操作只作用于平台授权，外部授权沿用外部页签的逐条操作 -->
+    <select id="selectAuthIdsByPersonNos" resultType="Long">
+        select auth_id from lock_auth
+         where del_flag = '0'
+           and source = '1'
+           and person_no in
+        <foreach collection="personNos" item="personNo" open="(" separator="," close=")">
+            #{personNo}
+        </foreach>
+    </select>
+
+    <select id="selectPushableAuthIdsByPersonNos" resultType="Long">
+        select auth_id from lock_auth
+         where del_flag = '0'
+           and source = '1'
+           and (sync_status is null or sync_status not in ('4', '6'))
+           and person_no in
+        <foreach collection="personNos" item="personNo" open="(" separator="," close=")">
+            #{personNo}
+        </foreach>
+    </select>
+
     <select id="selectAuthById" parameterType="Long" resultMap="LockAuthResult">
         <include refid="selectAuthVo"/>
         where auth_id = #{authId}
     </select>
 
+    <!--
+      授权明细：一行一条授权，带来源应用、门锁与关联入住单。
+      不在 SQL 中查 auth_value，平台详情与开放接口列表都不回显凭据。
+      入住单可能因换房/复用 auth_id 存在多条，取最近一条展示。
+    -->
+    <sql id="selectAuthDetailVo">
+        select a.auth_id, a.auth_no, a.person_no, a.person_name, a.device_id, a.device_sn, a.gateway_id,
+               a.group_id, a.auth_type, a.begin_time, a.end_time, a.auth_time,
+               a.source, a.source_app_code, a.source_biz_no, a.sync_status, a.sync_time, a.sync_msg,
+               a.retry_count, a.status, a.del_flag, a.create_by, a.create_time, a.update_by, a.update_time,
+               a.remark, o.app_name as source_app_name, d.device_name, d.online_status, s.stay_no
+          from lock_auth a
+          left join lock_open_app o on o.app_code = a.source_app_code
+          left join lock_device d on d.device_id = a.device_id
+          left join lock_stay s on s.stay_id = (
+              select max(s2.stay_id) from lock_stay s2 where s2.auth_id = a.auth_id
+          )
+    </sql>
+
+    <select id="selectExternalAuthList" parameterType="LockAuth" resultMap="LockAuthResult">
+        <include refid="selectAuthDetailVo"/>
+        <where>
+            a.del_flag = '0'
+            and a.source = '2'
+            <if test="sourceAppCode != null and sourceAppCode != ''">
+                and a.source_app_code = #{sourceAppCode}
+            </if>
+            <if test="keyword != null and keyword != ''">
+                and (a.auth_no like concat('%', #{keyword}, '%')
+                     or a.person_no like concat('%', #{keyword}, '%')
+                     or a.person_name like concat('%', #{keyword}, '%'))
+            </if>
+            <if test="authNo != null and authNo != ''">
+                and a.auth_no like concat('%', #{authNo}, '%')
+            </if>
+            <if test="personNo != null and personNo != ''">
+                and a.person_no like concat('%', #{personNo}, '%')
+            </if>
+            <if test="personName != null and personName != ''">
+                and a.person_name like concat('%', #{personName}, '%')
+            </if>
+            <if test="deviceId != null">
+                and a.device_id = #{deviceId}
+            </if>
+            <if test="deviceSn != null and deviceSn != ''">
+                and a.device_sn = #{deviceSn}
+            </if>
+            <if test="groupId != null">
+                and a.group_id = #{groupId}
+            </if>
+            <if test="authType != null and authType != ''">
+                and a.auth_type = #{authType}
+            </if>
+            <!-- ALL=全部状态；空=隐藏已取消；其余按状态精确过滤（4 即只看已取消） -->
+            <choose>
+                <when test="syncStatus == 'ALL'"></when>
+                <when test="syncStatus != null and syncStatus != ''">
+                    and a.sync_status = #{syncStatus}
+                </when>
+                <otherwise>
+                    and (a.sync_status is null or a.sync_status != '4')
+                </otherwise>
+            </choose>
+            <if test="params.beginTime != null and params.beginTime != ''">
+                and date_format(a.create_time,'%Y%m%d') &gt;= date_format(#{params.beginTime},'%Y%m%d')
+            </if>
+            <if test="params.endTime != null and params.endTime != ''">
+                and date_format(a.create_time,'%Y%m%d') &lt;= date_format(#{params.endTime},'%Y%m%d')
+            </if>
+        </where>
+        order by a.auth_id desc
+    </select>
+
+    <!-- 全部授权：平台与外部授权一并展示，一授权一行；默认不过滤已取消，便于逐条对账 -->
+    <select id="selectAllAuthList" parameterType="LockAuth" resultMap="LockAuthResult">
+        <include refid="selectAuthDetailVo"/>
+        <where>
+            a.del_flag = '0'
+            <if test="source != null and source != ''">
+                and a.source = #{source}
+            </if>
+            <if test="sourceAppCode != null and sourceAppCode != ''">
+                and a.source_app_code = #{sourceAppCode}
+            </if>
+            <if test="keyword != null and keyword != ''">
+                and (a.auth_no like concat('%', #{keyword}, '%')
+                     or a.person_no like concat('%', #{keyword}, '%')
+                     or a.person_name like concat('%', #{keyword}, '%'))
+            </if>
+            <if test="authNo != null and authNo != ''">
+                and a.auth_no like concat('%', #{authNo}, '%')
+            </if>
+            <if test="personNo != null and personNo != ''">
+                and a.person_no like concat('%', #{personNo}, '%')
+            </if>
+            <if test="personName != null and personName != ''">
+                and a.person_name like concat('%', #{personName}, '%')
+            </if>
+            <if test="deviceId != null">
+                and a.device_id = #{deviceId}
+            </if>
+            <if test="deviceSn != null and deviceSn != ''">
+                and a.device_sn = #{deviceSn}
+            </if>
+            <if test="groupId != null">
+                and a.group_id = #{groupId}
+            </if>
+            <if test="authType != null and authType != ''">
+                and a.auth_type = #{authType}
+            </if>
+            <if test="syncStatus != null and syncStatus != '' and syncStatus != 'ALL'">
+                and a.sync_status = #{syncStatus}
+            </if>
+            <if test="params.beginTime != null and params.beginTime != ''">
+                and date_format(a.create_time,'%Y%m%d') &gt;= date_format(#{params.beginTime},'%Y%m%d')
+            </if>
+            <if test="params.endTime != null and params.endTime != ''">
+                and date_format(a.create_time,'%Y%m%d') &lt;= date_format(#{params.endTime},'%Y%m%d')
+            </if>
+        </where>
+        order by a.auth_id desc
+    </select>
+
+    <select id="selectExternalAuthById" parameterType="Long" resultMap="LockAuthResult">
+        <include refid="selectAuthDetailVo"/>
+        where a.auth_id = #{authId} and a.del_flag = '0' and a.source = '2'
+    </select>
+
+    <select id="selectExternalAuthForApp" resultMap="LockAuthResult">
+        <include refid="selectAuthDetailVo"/>
+        where a.auth_id = #{authId} and a.del_flag = '0' and a.source = '2'
+          and a.source_app_code = #{appCode}
+    </select>
+
     <select id="selectAuthsByDeviceId" parameterType="Long" resultMap="LockAuthResult">
         <include refid="selectAuthVo"/>
         where device_id = #{deviceId} and del_flag = '0'
@@ -192,15 +412,39 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
     <insert id="insertAuth" parameterType="LockAuth" useGeneratedKeys="true" keyProperty="authId">
         insert into lock_auth (
             auth_no, person_no, person_name, device_id, device_sn, gateway_id, group_id, auth_type,
-            auth_value, auth_value_md5, begin_time, end_time, auth_time, sync_status, retry_count,
+            auth_value, auth_value_md5, begin_time, end_time, auth_time,
+            source, source_app_code, source_biz_no, sync_status, retry_count,
             status, del_flag, create_by, create_time, remark
         ) values (
             #{authNo}, #{personNo}, #{personName}, #{deviceId}, #{deviceSn}, #{gatewayId}, #{groupId},
             #{authType}, #{authValue}, #{authValueMd5}, #{beginTime}, #{endTime}, #{authTime},
-            '0', 0, #{status}, '0', #{createBy}, CURRENT_TIMESTAMP, #{remark}
+            #{source}, #{sourceAppCode}, #{sourceBizNo}, '0', 0, #{status}, '0', #{createBy},
+            CURRENT_TIMESTAMP, #{remark}
         )
     </insert>
 
+    <!-- 外部入住/换房覆盖平台行时接管归属；直接授权接口不允许走这里 -->
+    <update id="updateAuthSource">
+        update lock_auth
+           set source = #{source},
+               source_app_code = #{sourceAppCode},
+               source_biz_no = #{sourceBizNo},
+               update_by = #{updateBy},
+               update_time = CURRENT_TIMESTAMP
+         where auth_id = #{authId}
+    </update>
+
+    <!-- 外部授权改期：显式写 end_time，允许把失效时间清空为 NULL（updateAuth 的 <if> 做不到） -->
+    <update id="updateExternalAuth" parameterType="LockAuth">
+        update lock_auth
+           set begin_time = #{beginTime},
+               end_time = #{endTime},
+               remark = #{remark},
+               update_by = #{updateBy},
+               update_time = CURRENT_TIMESTAMP
+         where auth_id = #{authId} and source = '2' and del_flag = '0'
+    </update>
+
     <update id="updateAuth" parameterType="LockAuth">
         update lock_auth
         <set>
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockCommandMapper.xml b/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockCommandMapper.xml
index 56a356f..c88bf60 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockCommandMapper.xml
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockCommandMapper.xml
@@ -99,6 +99,72 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
            and command_status in ('0', '1')
     </select>
 
+    <!-- 同一主题除自身外的在途命令：重发排队命令前确认网关没有别的 data/batch 在处理 -->
+    <select id="countOtherInflightByTopic" resultType="int">
+        select count(1) from lock_command
+         where topic = #{topic}
+           and command_status in ('0', '1')
+           and command_id != #{commandId}
+    </select>
+
+    <!-- 忙排队重发前只看已发送命令：同为待发送的其它命令由每轮"每主题只放行一条"控制 -->
+    <select id="countOtherSentByTopic" resultType="int">
+        select count(1) from lock_command
+         where topic = #{topic}
+           and command_status = '1'
+           and command_id != #{commandId}
+    </select>
+
+    <!-- 到期的忙排队命令，按先来先发 -->
+    <select id="selectDeferredCommands" parameterType="java.util.Date" resultMap="LockCommandResult">
+        <include refid="selectCommandVo"/>
+        where command_status = '0'
+          and next_retry_time is not null
+          and next_retry_time &lt;= #{now}
+        order by command_id
+    </select>
+
+    <!-- 同一授权已有在途命令时不再新建，避免命令重试与授权补偿并行下发同一张脸 -->
+    <select id="countInflightAuthByBizId" resultType="int">
+        select count(1) from lock_command
+         where biz_id = #{bizId}
+           and command_type in ('0011', '0012')
+           and command_status in ('0', '1')
+    </select>
+
+    <select id="countInflightByBizId" resultType="int">
+        select count(1) from lock_command
+         where command_type = #{commandType}
+           and biz_id = #{bizId}
+           and command_status in ('0', '1')
+    </select>
+
+    <select id="selectLatestByBizId" resultMap="LockCommandResult">
+        <include refid="selectCommandVo"/>
+        where command_type = #{commandType}
+          and biz_id = #{bizId}
+        order by command_id desc
+        limit 1
+    </select>
+
+    <!-- 最近一次查询失败时回退到上次有数据的查询，避免离线重查把已有对账结果冲掉 -->
+    <select id="selectLatestWithRowsByBizId" resultMap="LockCommandResult">
+        <include refid="selectCommandVo"/>
+        where command_type = #{commandType}
+          and biz_id = #{bizId}
+          and exists (select 1 from lock_device_auth a where a.command_no = lock_command.command_no)
+        order by command_id desc
+        limit 1
+    </select>
+
+    <select id="selectCommandsByNos" resultMap="LockCommandResult">
+        <include refid="selectCommandVo"/>
+        where command_no in
+        <foreach collection="commandNos" item="commandNo" open="(" separator="," close=")">
+            #{commandNo}
+        </foreach>
+    </select>
+
     <insert id="insertCommand" parameterType="LockCommand" useGeneratedKeys="true" keyProperty="commandId">
         insert into lock_command (
             command_no, command_type, target_type, target_id, target_code, biz_id, topic, payload,
diff --git a/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockGatewayMapper.xml b/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockGatewayMapper.xml
index 78fa5da..15ce840 100644
--- a/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockGatewayMapper.xml
+++ b/base/RuoYi-Vue-master/ruoyi-iot/src/main/resources/mapper/lock/LockGatewayMapper.xml
@@ -120,6 +120,11 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         where gateway_id = #{gatewayId}
     </update>
 
+    <update id="updateOnlineStatusOnly">
+        update lock_gateway set online_status = #{onlineStatus}
+        where gateway_id = #{gatewayId}
+    </update>
+
     <update id="updateSyncStatus">
         update lock_gateway set sync_status = #{syncStatus}, last_sync_time = CURRENT_TIMESTAMP
         <if test="syncMsg != null">, remark = #{syncMsg}</if>
@@ -149,6 +154,25 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         where online_status = '0' and (last_online_time is null or last_online_time &lt; #{offlineTime})
     </update>
 
+    <!--
+      网关能转发门锁上报即证明在线：按归属行的最近上报时间刷新在线状态。
+      只依赖 onoff_line 时，网关连接事件之后不再有消息，10 分钟后必然被误判离线。
+    -->
+    <update id="refreshOnlineByReport">
+        update lock_gateway g
+          join (
+                select gateway_id, max(last_signal_time) as last_signal
+                  from lock_device_gateway
+                 where del_flag = '0' and gateway_id is not null
+                 group by gateway_id
+               ) r on r.gateway_id = g.gateway_id
+           set g.online_status = '0',
+               g.last_online_time = greatest(ifnull(g.last_online_time, r.last_signal), r.last_signal)
+         where g.del_flag = '0'
+           and r.last_signal &gt;= #{onlineTime}
+           and (g.online_status &lt;&gt; '0' or g.last_online_time is null or g.last_online_time &lt; r.last_signal)
+    </update>
+
     <update id="deleteGatewayByIds" parameterType="Long">
         update lock_gateway set del_flag = '2' where gateway_id in
         <foreach collection="array" item="gatewayId" open="(" separator="," close=")">
diff --git a/base/RuoYi-Vue-master/sql/lock.sql b/base/RuoYi-Vue-master/sql/lock.sql
index 87fbc07..bde255c 100644
--- a/base/RuoYi-Vue-master/sql/lock.sql
+++ b/base/RuoYi-Vue-master/sql/lock.sql
@@ -312,6 +312,9 @@ create table lock_auth (
   begin_time     datetime                               comment '生效开始时间',
   end_time       datetime                               comment '生效结束时间（空表示永久有效）',
   auth_time      datetime                               comment '授权操作时间',
+  source         char(1)       default '1'              comment '授权来源（1平台 2开放接口）',
+  source_app_code varchar(32)  default null             comment '来源应用编码（source=2，lock_open_app.app_code）',
+  source_biz_no  varchar(64)   default null             comment '来源业务单号（可空；外部入住为 biz_no）',
   sync_status    char(1)       default '0'              comment '下发同步状态（0待下发 1已下发 2下发成功 3下发失败 4已清除 6待清除；5 预留给 v2 的已过期）',
   sync_time      datetime                               comment '最后下发/响应时间',
   sync_msg       varchar(512)  default null             comment '下发结果说明',
@@ -329,7 +332,8 @@ create table lock_auth (
   key idx_lock_auth_person (person_no),
   key idx_lock_auth_device (device_id),
   key idx_lock_auth_group (group_id),
-  key idx_lock_auth_sync (sync_status)
+  key idx_lock_auth_sync (sync_status),
+  key idx_lock_auth_source (source, source_app_code)
 ) engine=innodb comment = '授权数据表';
 
 
diff --git a/base/RuoYi-Vue2-master/src/api/iot/auth.js b/base/RuoYi-Vue2-master/src/api/iot/auth.js
index 9704604..bce525b 100644
--- a/base/RuoYi-Vue2-master/src/api/iot/auth.js
+++ b/base/RuoYi-Vue2-master/src/api/iot/auth.js
@@ -9,6 +9,92 @@ export function listAuth(query) {
   })
 }
 
+// 按人员聚合查询授权（一人一行）
+export function listAuthPerson(query) {
+  return request({
+    url: '/lock/auth/person/list',
+    method: 'get',
+    params: query
+  })
+}
+
+// 外部授权列表（一授权一行，仅 source='2'）
+export function listExternalAuth(query) {
+  return request({
+    url: '/lock/auth/external/list',
+    method: 'get',
+    params: query
+  })
+}
+
+// 全部授权列表（一授权一行，含平台与外部来源）
+export function listAllAuth(query) {
+  return request({
+    url: '/lock/auth/all/list',
+    method: 'get',
+    params: query
+  })
+}
+
+// 外部授权详情
+export function getExternalAuth(authId) {
+  return request({
+    url: '/lock/auth/external/' + authId,
+    method: 'get'
+  })
+}
+
+// 修改外部授权有效期（有效授权保存后自动重推）
+export function updateExternalAuth(authId, data) {
+  return request({
+    url: '/lock/auth/external/' + authId,
+    method: 'put',
+    data: data
+  })
+}
+
+// 外部授权重新下发
+export function pushExternalAuth(authId) {
+  return request({
+    url: '/lock/auth/external/' + authId + '/push',
+    method: 'post'
+  })
+}
+
+// 外部授权取消（清除设备侧权限，记录保留）
+export function clearExternalAuth(authId) {
+  return request({
+    url: '/lock/auth/external/' + authId + '/clear',
+    method: 'post'
+  })
+}
+
+// 删除外部授权（先清除再逻辑删除）
+export function delExternalAuth(authIds) {
+  return request({
+    url: '/lock/auth/external/' + authIds,
+    method: 'delete'
+  })
+}
+
+// 按人员删除其名下全部授权（并下发清除）
+export function removeAuthByPerson(personNos) {
+  return request({
+    url: '/lock/auth/person/remove',
+    method: 'post',
+    data: personNos
+  })
+}
+
+// 按人员重新下发其名下全部授权
+export function pushAuthByPerson(personNos) {
+  return request({
+    url: '/lock/auth/person/push',
+    method: 'post',
+    data: personNos
+  })
+}
+
 // 查询授权详细
 export function getAuth(authId) {
   return request({
@@ -26,6 +112,15 @@ export function addAuth(data) {
   })
 }
 
+// 多锁批量授权（一次为多把门锁建立同类型授权）
+export function batchAddAuth(data) {
+  return request({
+    url: '/lock/auth/batch',
+    method: 'post',
+    data: data
+  })
+}
+
 // 修改授权（并重新下发）
 export function updateAuth(data) {
   return request({
@@ -43,6 +138,14 @@ export function delAuth(authId) {
   })
 }
 
+// 删除授权记录（设备侧已清除，仅移除平台记录）
+export function delAuthRecord(authId) {
+  return request({
+    url: '/lock/auth/record/' + authId,
+    method: 'delete'
+  })
+}
+
 // 手动重下发
 export function pushAuth(authId) {
   return request({
diff --git a/base/RuoYi-Vue2-master/src/api/iot/device.js b/base/RuoYi-Vue2-master/src/api/iot/device.js
index 26a2941..bed8487 100644
--- a/base/RuoYi-Vue2-master/src/api/iot/device.js
+++ b/base/RuoYi-Vue2-master/src/api/iot/device.js
@@ -102,3 +102,28 @@ export function remoteSwitch(deviceId, open) {
     data: { open: open }
   })
 }
+
+// 下发读取锁内授权指令（op=getkey）
+export function queryDeviceAuths(deviceId) {
+  return request({
+    url: '/lock/device/' + deviceId + '/auth/query',
+    method: 'post'
+  })
+}
+
+// 锁内授权快照与平台授权对账结果
+export function getDeviceAuthSnapshot(deviceId) {
+  return request({
+    url: '/lock/device/' + deviceId + '/auth/snapshot',
+    method: 'get'
+  })
+}
+
+// 清除设备侧一条卡/密码授权
+export function clearDeviceAuth(deviceId, data) {
+  return request({
+    url: '/lock/device/' + deviceId + '/auth/clear',
+    method: 'post',
+    data: data
+  })
+}
diff --git a/base/RuoYi-Vue2-master/src/views/iot/auth/index.vue b/base/RuoYi-Vue2-master/src/views/iot/auth/index.vue
index dc413bd..32ddca6 100644
--- a/base/RuoYi-Vue2-master/src/views/iot/auth/index.vue
+++ b/base/RuoYi-Vue2-master/src/views/iot/auth/index.vue
@@ -1,22 +1,17 @@
 <template>
   <div class="app-container">
+    <el-tabs v-model="activeTab" @tab-click="handleTabClick">
+      <el-tab-pane label="平台授权" name="platform">
     <el-form :model="queryParams" ref="queryForm" size="small" :inline="true" v-show="showSearch" label-width="68px">
-      <el-form-item label="人员" prop="personNo">
-        <el-select
-          v-model="queryParams.personNo"
-          placeholder="请选择人员"
+      <el-form-item label="人员" prop="keyword">
+        <el-input
+          v-model="queryParams.keyword"
+          placeholder="人员编号 / 姓名"
           clearable
-          filterable
           style="width: 200px"
-          @change="handleQuery"
-        >
-          <el-option
-            v-for="item in allPersonOptions"
-            :key="item.personNo"
-            :label="item.personName ? item.personName + '（' + item.personNo + '）' : item.personNo"
-            :value="item.personNo"
-          />
-        </el-select>
+          @keyup.enter.native="handleQuery"
+          @clear="handleQuery"
+        />
       </el-form-item>
       <el-form-item label="门锁" prop="deviceId">
         <el-select
@@ -53,7 +48,7 @@
         </el-select>
       </el-form-item>
       <el-form-item label="授权类型" prop="authType">
-        <el-select v-model="queryParams.authType" placeholder="授权类型" clearable style="width: 160px">
+        <el-select v-model="queryParams.authType" placeholder="授权类型" clearable style="width: 160px" @change="handleQuery">
           <el-option
             v-for="dict in dict.type.lock_auth_type"
             :key="dict.value"
@@ -63,7 +58,7 @@
         </el-select>
       </el-form-item>
       <el-form-item label="同步状态" prop="syncStatus">
-        <el-select v-model="queryParams.syncStatus" placeholder="同步状态" clearable style="width: 160px">
+        <el-select v-model="queryParams.syncStatus" placeholder="同步状态" clearable style="width: 160px" @change="handleQuery">
           <el-option
             v-for="dict in dict.type.lock_sync_status"
             :key="dict.value"
@@ -85,31 +80,9 @@
           plain
           icon="el-icon-plus"
           size="mini"
-          @click="handleAdd"
+          @click="handleAddAuth"
           v-hasPermi="['lock:auth:add']"
-        >新增</el-button>
-      </el-col>
-      <el-col :span="1.5">
-        <el-button
-          type="success"
-          plain
-          icon="el-icon-edit"
-          size="mini"
-          :disabled="single"
-          @click="handleUpdate"
-          v-hasPermi="['lock:auth:edit']"
-        >修改</el-button>
-      </el-col>
-      <el-col :span="1.5">
-        <el-button
-          type="danger"
-          plain
-          icon="el-icon-delete"
-          size="mini"
-          :disabled="multiple"
-          @click="handleDelete"
-          v-hasPermi="['lock:auth:remove']"
-        >删除</el-button>
+        >新增授权</el-button>
       </el-col>
       <el-col :span="1.5">
         <el-button
@@ -118,89 +91,94 @@
           icon="el-icon-upload2"
           size="mini"
           :disabled="multiple"
-          @click="handleBatchPush"
+          @click="handleBatchPushPerson"
           v-hasPermi="['lock:auth:push']"
         >下发</el-button>
       </el-col>
       <el-col :span="1.5">
         <el-button
-          type="warning"
+          type="danger"
           plain
-          icon="el-icon-download"
+          icon="el-icon-delete"
           size="mini"
-          @click="handleExport"
-          v-hasPermi="['lock:auth:export']"
-        >导出</el-button>
+          :disabled="multiple"
+          @click="handleBatchDeletePerson"
+          v-hasPermi="['lock:auth:remove']"
+        >删除授权</el-button>
       </el-col>
       <right-toolbar :showSearch.sync="showSearch" @queryTable="getList"></right-toolbar>
     </el-row>
 
-    <el-table v-loading="loading" :data="authList" @selection-change="handleSelectionChange">
+    <el-table v-loading="loading" :data="personRows" @selection-change="handleSelectionChange">
       <el-table-column type="selection" width="55" align="center" />
-      <el-table-column label="授权ID" align="center" prop="authId" width="80" />
-      <el-table-column label="授权编号" align="center" prop="authNo" :show-overflow-tooltip="true" />
-      <el-table-column label="人员编号" align="center" prop="personNo" />
-      <el-table-column label="人员姓名" align="center" prop="personName" />
-      <el-table-column label="门锁" align="center" :show-overflow-tooltip="true">
-        <template slot-scope="scope">
-          <span>{{ deviceLabel(scope.row.deviceId, scope.row.deviceSn) }}</span>
-        </template>
+      <el-table-column label="人员编号" align="center" prop="personNo" width="140" />
+      <el-table-column label="人员姓名" align="center" prop="personName" width="120">
+        <template slot-scope="scope">{{ scope.row.personName || '-' }}</template>
       </el-table-column>
-      <el-table-column label="授权类型" align="center" prop="authType">
+      <el-table-column label="授权类型" align="center" min-width="150">
         <template slot-scope="scope">
-          <dict-tag :options="dict.type.lock_auth_type" :value="scope.row.authType"/>
-        </template>
-      </el-table-column>
-      <el-table-column label="生效时间" align="center" prop="beginTime" width="160">
-        <template slot-scope="scope">
-          <span>{{ parseTime(scope.row.beginTime) }}</span>
-        </template>
-      </el-table-column>
-      <el-table-column label="失效时间" align="center" prop="endTime" width="160">
-        <template slot-scope="scope">
-          <span>{{ parseTime(scope.row.endTime) }}</span>
-        </template>
-      </el-table-column>
-      <el-table-column label="同步状态" align="center" prop="syncStatus">
-        <template slot-scope="scope">
-          <dict-tag :options="dict.type.lock_sync_status" :value="scope.row.syncStatus"/>
-        </template>
-      </el-table-column>
-      <el-table-column label="同步说明" align="center" prop="syncMsg" :show-overflow-tooltip="true" min-width="120">
-        <template slot-scope="scope">
-          <span v-if="scope.row.syncMsg" style="color: #e6a23c">{{ scope.row.syncMsg }}</span>
-          <span v-else>-</span>
-        </template>
-      </el-table-column>
-      <el-table-column label="操作" align="center" width="300" class-name="small-padding fixed-width">
-        <template slot-scope="scope">
-          <el-button
+          <el-tag
+            v-for="type in authTypeList(scope.row)"
+            :key="type"
             size="mini"
-            type="text"
-            icon="el-icon-upload2"
-            @click="handlePush(scope.row)"
-            v-hasPermi="['lock:auth:push']"
-          >下发</el-button>
-          <el-button
-            v-if="scope.row.authType === AUTH_TYPE_FACE"
-            size="mini"
-            type="text"
-            icon="el-icon-user-solid"
-            @click="handleClear(scope.row)"
-            v-hasPermi="['lock:auth:clear']"
-          >删除人脸</el-button>
+            class="type-tag"
+          >{{ authTypeLabel(type) }}</el-tag>
+          <span v-if="!authTypeList(scope.row).length">-</span>
+        </template>
+      </el-table-column>
+      <el-table-column label="授权门锁" align="center" width="100">
+        <template slot-scope="scope">{{ scope.row.deviceCount }} 把</template>
+      </el-table-column>
+      <el-table-column label="授权数量" align="center" width="100">
+        <template slot-scope="scope">
+          <span class="count-badge">{{ scope.row.authCount }}</span>
+        </template>
+      </el-table-column>
+      <el-table-column label="已下发" align="center" width="110">
+        <template slot-scope="scope">
+          <span :class="['issued-text', { 'issued-none': !scope.row.issuedCount }]">{{ scope.row.issuedCount }}</span>
+          <span class="issued-total">/ {{ scope.row.authCount }}</span>
+        </template>
+      </el-table-column>
+      <el-table-column label="下发状态" align="center" width="130">
+        <template slot-scope="scope">
+          <el-tag v-if="scope.row.failedCount" type="danger" size="mini">失败 {{ scope.row.failedCount }}</el-tag>
+          <el-tag v-else-if="scope.row.pendingCount" type="warning" size="mini">待处理 {{ scope.row.pendingCount }}</el-tag>
+          <span v-else class="text-muted">正常</span>
+        </template>
+      </el-table-column>
+      <el-table-column label="有效期" align="left" min-width="210">
+        <template slot-scope="scope">
+          <div class="time-range">
+            <div>{{ scope.row.beginTime ? parseTime(scope.row.beginTime) : '立即生效' }}</div>
+            <div class="time-end">至 {{ scope.row.endTime ? parseTime(scope.row.endTime) : '永久有效' }}</div>
+          </div>
+        </template>
+      </el-table-column>
+      <el-table-column label="最近更新" align="center" width="160">
+        <template slot-scope="scope">{{ scope.row.updateTime ? parseTime(scope.row.updateTime) : '-' }}</template>
+      </el-table-column>
+      <el-table-column label="操作" align="center" width="230" class-name="small-padding fixed-width">
+        <template slot-scope="scope">
           <el-button
             size="mini"
             type="text"
             icon="el-icon-edit"
-            @click="handleUpdate(scope.row)"
-            v-hasPermi="['lock:auth:edit']"
-          >修改</el-button>
+            @click="handleEditPerson(scope.row)"
+            v-hasPermi="['lock:auth:add']"
+          >编辑授权</el-button>
+          <el-button
+            size="mini"
+            type="text"
+            icon="el-icon-upload2"
+            @click="handlePushPerson(scope.row)"
+            v-hasPermi="['lock:auth:push']"
+          >下发</el-button>
           <el-button
             size="mini"
             type="text"
             icon="el-icon-delete"
-            @click="handleDelete(scope.row)"
+            @click="handleDeletePerson(scope.row)"
             v-hasPermi="['lock:auth:remove']"
           >删除</el-button>
         </template>
@@ -214,134 +192,834 @@
       :limit.sync="queryParams.pageSize"
       @pagination="getList"
     />
+      </el-tab-pane>
 
-    <!-- 添加或修改授权对话框 -->
-    <el-dialog :title="title" :visible.sync="open" width="600px" append-to-body>
-      <el-form ref="form" :model="form" :rules="rules" label-width="90px">
-        <el-form-item label="授权类型" prop="authType">
-          <el-select v-model="form.authType" placeholder="请先选择授权类型" style="width: 100%" @change="changeAuthType">
-            <el-option
-              v-for="dict in dict.type.lock_auth_type"
-              :key="dict.value"
-              :label="dict.label"
-              :value="dict.value"
+      <el-tab-pane label="外部授权" name="external">
+        <el-form :model="externalQuery" ref="externalQueryForm" size="small" :inline="true" v-show="externalShowSearch" label-width="68px">
+          <el-form-item label="来源应用" prop="sourceAppCode">
+            <el-select
+              v-model="externalQuery.sourceAppCode"
+              placeholder="全部应用"
+              clearable
+              filterable
+              style="width: 180px"
+              @change="handleExternalQuery"
+            >
+              <el-option
+                v-for="item in appOptions"
+                :key="item.appCode"
+                :label="item.appName ? item.appName + '（' + item.appCode + '）' : item.appCode"
+                :value="item.appCode"
+              />
+            </el-select>
+          </el-form-item>
+          <el-form-item label="人员" prop="keyword">
+            <el-input
+              v-model="externalQuery.keyword"
+              placeholder="授权编号 / 人员编号 / 姓名"
+              clearable
+              style="width: 220px"
+              @keyup.enter.native="handleExternalQuery"
+              @clear="handleExternalQuery"
             />
-          </el-select>
-        </el-form-item>
-        <!-- 人脸授权：人员取自人脸库 -->
-        <el-form-item v-if="isFaceAuth" label="人员" prop="personNo">
-          <el-select
-            v-model="form.personNo"
-            placeholder="请选择人员（来源：人脸库）"
-            filterable
-            style="width: 100%"
-            @change="changePerson"
-          >
-            <el-option
-              v-for="item in personOptions"
-              :key="item.personNo"
-              :label="item.personName ? item.personName + '（' + item.personNo + '）' : item.personNo"
-              :value="item.personNo"
+          </el-form-item>
+          <el-form-item label="门锁" prop="deviceId">
+            <el-select
+              v-model="externalQuery.deviceId"
+              placeholder="请选择门锁"
+              clearable
+              filterable
+              style="width: 200px"
+              @change="handleExternalQuery"
+            >
+              <el-option
+                v-for="item in deviceOptions"
+                :key="item.deviceId"
+                :label="item.deviceName ? item.deviceName + '（' + item.deviceSn + '）' : item.deviceSn"
+                :value="item.deviceId"
+              />
+            </el-select>
+          </el-form-item>
+          <el-form-item label="所属分组" prop="groupId">
+            <el-select
+              v-model="externalQuery.groupId"
+              placeholder="请选择分组"
+              clearable
+              filterable
+              style="width: 180px"
+              @change="handleExternalQuery"
+            >
+              <el-option
+                v-for="item in groupOptions"
+                :key="item.groupId"
+                :label="item.groupName + '（' + item.groupCode + '）'"
+                :value="item.groupId"
+              />
+            </el-select>
+          </el-form-item>
+          <el-form-item label="授权类型" prop="authType">
+            <el-select v-model="externalQuery.authType" placeholder="授权类型" clearable style="width: 140px" @change="handleExternalQuery">
+              <el-option
+                v-for="dict in dict.type.lock_auth_type"
+                :key="dict.value"
+                :label="dict.label"
+                :value="dict.value"
+              />
+            </el-select>
+          </el-form-item>
+          <el-form-item label="同步状态" prop="syncStatus">
+            <el-select v-model="externalQuery.syncStatus" placeholder="默认不含已取消" clearable style="width: 160px" @change="handleExternalQuery">
+              <el-option
+                v-for="item in externalStatusOptions"
+                :key="item.value"
+                :label="item.label"
+                :value="item.value"
+              />
+            </el-select>
+          </el-form-item>
+          <el-form-item label="创建时间">
+            <el-date-picker
+              v-model="externalDateRange"
+              type="daterange"
+              range-separator="-"
+              start-placeholder="开始日期"
+              end-placeholder="结束日期"
+              value-format="yyyy-MM-dd"
+              style="width: 240px"
+              @change="handleExternalDateChange"
             />
-          </el-select>
-        </el-form-item>
-        <!-- 密码/指纹/IC卡授权：人员取自人员主数据，编号与住宿、人脸同源 -->
-        <el-form-item v-else label="人员" prop="personNo">
-          <el-select
-            v-model="form.personNo"
-            placeholder="请选择人员（来源：人员主数据）"
-            filterable
-            style="width: 100%"
-            @change="changePerson"
-          >
-            <el-option
-              v-for="item in allPersonOptions"
-              :key="item.personNo"
-              :label="item.personName ? item.personName + '（' + item.personNo + '）' : item.personNo"
-              :value="item.personNo"
-            />
-          </el-select>
-        </el-form-item>
-        <el-form-item label="授权门锁" prop="deviceId">
-          <el-select
-            v-model="form.deviceId"
-            placeholder="请选择门锁（决定下发分组）"
-            filterable
-            style="width: 100%"
-            @change="changeDevice"
-          >
-            <el-option
-              v-for="item in deviceOptions"
-              :key="item.deviceId"
-              :label="item.deviceName ? item.deviceName + '（' + item.deviceSn + '）' : item.deviceSn"
-              :value="item.deviceId"
-            />
-          </el-select>
-        </el-form-item>
-        <el-form-item label="授权内容" prop="authValue">
-          <!-- 人脸特征很长，用多行文本；其余类型（密码/卡号/指纹）为短值 -->
-          <el-input
-            v-if="isFaceAuth"
-            v-model="form.authValue"
-            type="textarea"
-            :rows="2"
-            :placeholder="authValuePlaceholder"
-          />
-          <el-input
-            v-else
-            v-model="form.authValue"
-            :placeholder="authValuePlaceholder"
-            maxlength="32"
-            style="width: 100%"
-          />
-          <div v-if="isFaceAuth" style="margin-top: 6px">
+          </el-form-item>
+          <el-form-item>
+            <el-button type="primary" icon="el-icon-search" size="mini" @click="handleExternalQuery">搜索</el-button>
+            <el-button icon="el-icon-refresh" size="mini" @click="resetExternalQuery">重置</el-button>
+          </el-form-item>
+        </el-form>
+
+        <el-row :gutter="10" class="mb8">
+          <el-col :span="1.5">
             <el-button
+              type="danger"
+              plain
+              icon="el-icon-delete"
               size="mini"
-              type="primary"
-              icon="el-icon-camera"
-              :loading="extractLoading"
-              @click="handleExtractFace"
-            >提取人脸特征</el-button>
-            <span style="margin-left: 8px; color: #909399; font-size: 12px">
-              人脸授权内容取自人脸库特征，需先选择人员并选定门锁（确定算法版本）
-            </span>
+              :disabled="!externalSelection.length"
+              @click="handleExternalBatchDelete"
+              v-hasPermi="['lock:auth:remove']"
+            >删除</el-button>
+          </el-col>
+          <right-toolbar :showSearch.sync="externalShowSearch" @queryTable="getExternalList"></right-toolbar>
+        </el-row>
+        <div class="external-tip">
+          外部授权由开放接口（直接授权、外部入住/换房）产生，平台可改期、重发、取消与删除；不会回写外部业务系统。
+        </div>
+        <el-table
+          v-loading="externalLoading"
+          :data="externalRows"
+          :empty-text="externalEmptyText"
+          @selection-change="handleExternalSelectionChange"
+        >
+          <el-table-column type="selection" width="55" align="center" />
+          <el-table-column label="授权编号" align="center" prop="authNo" width="190" :show-overflow-tooltip="true" />
+          <el-table-column label="来源应用" align="center" width="150" :show-overflow-tooltip="true">
+            <template slot-scope="scope">
+              <el-tag v-if="scope.row.sourceAppCode" size="mini" type="primary">{{ scope.row.sourceAppCode }}</el-tag>
+              <div v-if="scope.row.sourceAppName" class="cell-sub">{{ scope.row.sourceAppName }}</div>
+              <span v-else-if="!scope.row.sourceAppCode">-</span>
+            </template>
+          </el-table-column>
+          <el-table-column label="人员" align="center" width="150" :show-overflow-tooltip="true">
+            <template slot-scope="scope">
+              <div>{{ scope.row.personName || '-' }}</div>
+              <div class="cell-sub">{{ scope.row.personNo }}</div>
+            </template>
+          </el-table-column>
+          <el-table-column label="门锁" align="left" min-width="170" :show-overflow-tooltip="true">
+            <template slot-scope="scope">
+              <div>{{ scope.row.deviceName || scope.row.deviceSn || '-' }}</div>
+              <div class="cell-sub">
+                {{ scope.row.deviceSn }}
+                <span v-if="scope.row.onlineStatus === '1'" class="offline-text">离线</span>
+              </div>
+            </template>
+          </el-table-column>
+          <el-table-column label="类型" align="center" width="90">
+            <template slot-scope="scope">{{ authTypeLabel(scope.row.authType) }}</template>
+          </el-table-column>
+          <el-table-column label="有效期" align="left" min-width="190">
+            <template slot-scope="scope">
+              <div class="time-range">
+                <div>{{ scope.row.beginTime ? parseTime(scope.row.beginTime) : '立即生效' }}</div>
+                <div class="time-end">至 {{ scope.row.endTime ? parseTime(scope.row.endTime) : '永久有效' }}</div>
+              </div>
+            </template>
+          </el-table-column>
+          <el-table-column label="同步状态" align="center" width="120">
+            <template slot-scope="scope">
+              <el-tag :type="externalStatusTag(scope.row.syncStatus)" size="mini">
+                {{ externalStatusLabel(scope.row.syncStatus) }}
+              </el-tag>
+            </template>
+          </el-table-column>
+          <el-table-column label="同步说明" align="left" min-width="160" :show-overflow-tooltip="true">
+            <template slot-scope="scope">
+              <span>{{ scope.row.syncMsg || '-' }}</span>
+            </template>
+          </el-table-column>
+          <el-table-column label="关联入住单" align="center" width="150" :show-overflow-tooltip="true">
+            <template slot-scope="scope">{{ scope.row.stayNo || scope.row.sourceBizNo || '-' }}</template>
+          </el-table-column>
+          <el-table-column label="最近更新" align="center" width="160">
+            <template slot-scope="scope">{{ scope.row.updateTime ? parseTime(scope.row.updateTime) : '-' }}</template>
+          </el-table-column>
+          <el-table-column label="操作" align="center" width="290" class-name="small-padding fixed-width">
+            <template slot-scope="scope">
+              <el-button size="mini" type="text" icon="el-icon-view" @click="openExternalDetail(scope.row)">详情</el-button>
+              <el-button
+                size="mini"
+                type="text"
+                icon="el-icon-edit"
+                @click="openExternalEdit(scope.row)"
+                v-hasPermi="['lock:auth:edit']"
+              >修改</el-button>
+              <el-button
+                size="mini"
+                type="text"
+                icon="el-icon-upload2"
+                @click="handleExternalPush(scope.row)"
+                v-hasPermi="['lock:auth:push']"
+              >重新下发</el-button>
+              <el-button
+                v-if="scope.row.syncStatus !== '4'"
+                size="mini"
+                type="text"
+                icon="el-icon-circle-close"
+                @click="handleExternalClear(scope.row)"
+                v-hasPermi="['lock:auth:clear']"
+              >取消</el-button>
+              <el-button
+                size="mini"
+                type="text"
+                icon="el-icon-delete"
+                @click="handleExternalDelete(scope.row)"
+                v-hasPermi="['lock:auth:remove']"
+              >删除</el-button>
+            </template>
+          </el-table-column>
+        </el-table>
+
+        <pagination
+          v-show="externalTotal>0"
+          :total="externalTotal"
+          :page.sync="externalQuery.pageNum"
+          :limit.sync="externalQuery.pageSize"
+          @pagination="getExternalList"
+        />
+      </el-tab-pane>
+
+      <el-tab-pane label="全部授权" name="all">
+        <el-form :model="allQuery" ref="allQueryForm" size="small" :inline="true" v-show="allShowSearch" label-width="68px">
+          <el-form-item label="人员" prop="keyword">
+            <el-input
+              v-model="allQuery.keyword"
+              placeholder="授权编号 / 人员编号 / 姓名"
+              clearable
+              style="width: 220px"
+              @keyup.enter.native="handleAllQuery"
+              @clear="handleAllQuery"
+            />
+          </el-form-item>
+          <el-form-item label="门锁" prop="deviceId">
+            <el-select
+              v-model="allQuery.deviceId"
+              placeholder="请选择门锁"
+              clearable
+              filterable
+              style="width: 200px"
+              @change="handleAllQuery"
+            >
+              <el-option
+                v-for="item in deviceOptions"
+                :key="item.deviceId"
+                :label="item.deviceName ? item.deviceName + '（' + item.deviceSn + '）' : item.deviceSn"
+                :value="item.deviceId"
+              />
+            </el-select>
+          </el-form-item>
+          <el-form-item label="所属分组" prop="groupId">
+            <el-select
+              v-model="allQuery.groupId"
+              placeholder="请选择分组"
+              clearable
+              filterable
+              style="width: 180px"
+              @change="handleAllQuery"
+            >
+              <el-option
+                v-for="item in groupOptions"
+                :key="item.groupId"
+                :label="item.groupName + '（' + item.groupCode + '）'"
+                :value="item.groupId"
+              />
+            </el-select>
+          </el-form-item>
+          <el-form-item label="授权类型" prop="authType">
+            <el-select v-model="allQuery.authType" placeholder="授权类型" clearable style="width: 140px" @change="handleAllQuery">
+              <el-option
+                v-for="dict in dict.type.lock_auth_type"
+                :key="dict.value"
+                :label="dict.label"
+                :value="dict.value"
+              />
+            </el-select>
+          </el-form-item>
+          <el-form-item label="来源" prop="source">
+            <el-select v-model="allQuery.source" placeholder="全部来源" clearable style="width: 140px" @change="handleAllQuery">
+              <el-option label="平台" value="1" />
+              <el-option label="外部系统" value="2" />
+            </el-select>
+          </el-form-item>
+          <el-form-item label="同步状态" prop="syncStatus">
+            <el-select v-model="allQuery.syncStatus" placeholder="全部状态" clearable style="width: 150px" @change="handleAllQuery">
+              <el-option
+                v-for="dict in dict.type.lock_sync_status"
+                :key="dict.value"
+                :label="dict.label"
+                :value="dict.value"
+              />
+            </el-select>
+          </el-form-item>
+          <el-form-item label="创建时间">
+            <el-date-picker
+              v-model="allDateRange"
+              type="daterange"
+              range-separator="-"
+              start-placeholder="开始日期"
+              end-placeholder="结束日期"
+              value-format="yyyy-MM-dd"
+              style="width: 240px"
+              @change="handleAllDateChange"
+            />
+          </el-form-item>
+          <el-form-item>
+            <el-button type="primary" icon="el-icon-search" size="mini" @click="handleAllQuery">搜索</el-button>
+            <el-button icon="el-icon-refresh" size="mini" @click="resetAllQuery">重置</el-button>
+          </el-form-item>
+        </el-form>
+
+        <el-row :gutter="10" class="mb8">
+          <right-toolbar :showSearch.sync="allShowSearch" @queryTable="getAllList"></right-toolbar>
+        </el-row>
+        <div class="external-tip">
+          一授权一行，范围包含平台授权与外部系统授权；默认显示全部同步状态，便于逐条核对下发结果。
+        </div>
+        <el-table v-loading="allLoading" :data="allRows" empty-text="暂无授权记录">
+          <el-table-column label="授权编号" align="center" prop="authNo" width="190" :show-overflow-tooltip="true" />
+          <el-table-column label="来源" align="center" width="140" :show-overflow-tooltip="true">
+            <template slot-scope="scope">
+              <el-tag v-if="scope.row.source === '2'" size="mini" type="primary">外部</el-tag>
+              <el-tag v-else size="mini">平台</el-tag>
+              <div v-if="scope.row.sourceAppName" class="cell-sub">{{ scope.row.sourceAppName }}</div>
+            </template>
+          </el-table-column>
+          <el-table-column label="人员" align="center" width="140" :show-overflow-tooltip="true">
+            <template slot-scope="scope">
+              <div>{{ scope.row.personName || '-' }}</div>
+              <div class="cell-sub">{{ scope.row.personNo }}</div>
+            </template>
+          </el-table-column>
+          <el-table-column label="门锁" align="left" min-width="170" :show-overflow-tooltip="true">
+            <template slot-scope="scope">
+              <div>{{ scope.row.deviceName || scope.row.deviceSn || '-' }}</div>
+              <div class="cell-sub">
+                {{ scope.row.deviceSn }}
+                <span v-if="scope.row.onlineStatus === '1'" class="offline-text">离线</span>
+              </div>
+            </template>
+          </el-table-column>
+          <el-table-column label="类型" align="center" width="90">
+            <template slot-scope="scope">{{ authTypeLabel(scope.row.authType) }}</template>
+          </el-table-column>
+          <el-table-column label="有效期" align="left" min-width="190">
+            <template slot-scope="scope">
+              <div class="time-range">
+                <div>{{ scope.row.beginTime ? parseTime(scope.row.beginTime) : '立即生效' }}</div>
+                <div class="time-end">至 {{ scope.row.endTime ? parseTime(scope.row.endTime) : '永久有效' }}</div>
+              </div>
+            </template>
+          </el-table-column>
+          <el-table-column label="同步状态" align="center" width="120">
+            <template slot-scope="scope">
+              <el-tooltip :disabled="!scope.row.syncMsg" :content="scope.row.syncMsg || ''" placement="top">
+                <el-tag :type="authSyncTag(scope.row.syncStatus)" size="mini">
+                  {{ authSyncLabel(scope.row.syncStatus) }}
+                </el-tag>
+              </el-tooltip>
+            </template>
+          </el-table-column>
+          <el-table-column label="同步说明" align="left" min-width="160" :show-overflow-tooltip="true">
+            <template slot-scope="scope">{{ scope.row.syncMsg || '-' }}</template>
+          </el-table-column>
+          <el-table-column label="关联单号" align="center" width="150" :show-overflow-tooltip="true">
+            <template slot-scope="scope">{{ scope.row.stayNo || scope.row.sourceBizNo || '-' }}</template>
+          </el-table-column>
+          <el-table-column label="创建时间" align="center" width="160">
+            <template slot-scope="scope">{{ scope.row.createTime ? parseTime(scope.row.createTime) : '-' }}</template>
+          </el-table-column>
+          <el-table-column label="最近更新" align="center" width="160">
+            <template slot-scope="scope">{{ scope.row.updateTime ? parseTime(scope.row.updateTime) : '-' }}</template>
+          </el-table-column>
+          <el-table-column label="操作" align="center" width="320" class-name="small-padding fixed-width">
+            <template slot-scope="scope">
+              <el-button
+                size="mini"
+                type="text"
+                icon="el-icon-view"
+                @click="openAllDetail(scope.row)"
+                v-hasPermi="['lock:auth:query']"
+              >状态</el-button>
+              <el-button
+                size="mini"
+                type="text"
+                icon="el-icon-upload2"
+                :disabled="scope.row.syncStatus === '6'"
+                @click="handleAllPush(scope.row)"
+                v-hasPermi="['lock:auth:push']"
+              >重发</el-button>
+              <el-button
+                size="mini"
+                type="text"
+                icon="el-icon-delete"
+                @click="handleAllDelete(scope.row)"
+                v-hasPermi="['lock:auth:remove']"
+              >删除授权</el-button>
+              <el-button
+                v-if="scope.row.syncStatus === '4'"
+                size="mini"
+                type="text"
+                icon="el-icon-remove-outline"
+                @click="handleAllDeleteRecord(scope.row)"
+                v-hasPermi="['lock:auth:remove']"
+              >删除记录</el-button>
+            </template>
+          </el-table-column>
+        </el-table>
+
+        <pagination
+          v-show="allTotal>0"
+          :total="allTotal"
+          :page.sync="allQuery.pageNum"
+          :limit.sync="allQuery.pageSize"
+          @pagination="getAllList"
+        />
+      </el-tab-pane>
+    </el-tabs>
+
+    <!-- 授权状态详情 -->
+    <el-dialog title="授权状态" :visible.sync="allDetailOpen" width="760px" append-to-body>
+      <el-descriptions v-if="allDetail" :column="2" border size="small">
+        <el-descriptions-item label="授权编号">{{ allDetail.authNo || '-' }}</el-descriptions-item>
+        <el-descriptions-item label="下发状态">
+          <el-tag :type="authSyncTag(allDetail.syncStatus)" size="mini">
+            {{ authSyncLabel(allDetail.syncStatus) }}
+          </el-tag>
+        </el-descriptions-item>
+        <el-descriptions-item label="同步说明" :span="2">{{ allDetail.syncMsg || '-' }}</el-descriptions-item>
+        <el-descriptions-item label="最近同步">{{ allDetail.syncTime ? parseTime(allDetail.syncTime) : '-' }}</el-descriptions-item>
+        <el-descriptions-item label="重试次数">{{ allDetail.retryCount == null ? 0 : allDetail.retryCount }}</el-descriptions-item>
+        <el-descriptions-item label="来源">
+          {{ allDetail.source === '2' ? '外部系统' : '平台' }}
+          <span v-if="allDetail.sourceAppName">（{{ allDetail.sourceAppName }}）</span>
+        </el-descriptions-item>
+        <el-descriptions-item label="关联单号">{{ allDetail.stayNo || allDetail.sourceBizNo || '-' }}</el-descriptions-item>
+        <el-descriptions-item label="人员">
+          {{ allDetail.personName || '-' }}（{{ allDetail.personNo || '-' }}）
+        </el-descriptions-item>
+        <el-descriptions-item label="授权类型">{{ authTypeLabel(allDetail.authType) }}</el-descriptions-item>
+        <el-descriptions-item label="门锁">{{ allDetail.deviceName || allDetail.deviceSn || '-' }}</el-descriptions-item>
+        <el-descriptions-item label="门锁SN">
+          {{ allDetail.deviceSn || '-' }}
+          <span v-if="allDetail.onlineStatus === '1'" class="offline-text">离线</span>
+        </el-descriptions-item>
+        <el-descriptions-item label="生效时间">{{ allDetail.beginTime ? parseTime(allDetail.beginTime) : '立即生效' }}</el-descriptions-item>
+        <el-descriptions-item label="失效时间">{{ allDetail.endTime ? parseTime(allDetail.endTime) : '永久有效' }}</el-descriptions-item>
+        <el-descriptions-item label="创建时间">{{ allDetail.createTime ? parseTime(allDetail.createTime) : '-' }}</el-descriptions-item>
+        <el-descriptions-item label="最近更新">{{ allDetail.updateTime ? parseTime(allDetail.updateTime) : '-' }}</el-descriptions-item>
+        <el-descriptions-item label="备注" :span="2">{{ allDetail.remark || '-' }}</el-descriptions-item>
+      </el-descriptions>
+      <div slot="footer">
+        <el-button size="small" @click="allDetailOpen = false">关 闭</el-button>
+        <el-button size="small" type="primary" icon="el-icon-refresh" @click="reloadAllDetail">刷 新</el-button>
+      </div>
+    </el-dialog>
+
+    <!-- 人员授权配置：人员固定，按授权类型维护该人员名下所有门锁 -->
+    <el-dialog
+      :title="batchPersonLocked ? '编辑人员授权' : '新增人员授权'"
+      :visible.sync="batchOpen"
+      width="900px"
+      append-to-body
+      custom-class="multi-auth-dialog"
+      @opened="handleBatchOpened"
+    >
+      <div v-if="batchEditMode" class="edit-tip">
+        <i class="el-icon-info"></i>
+        <span>
+          当前类型已有 <b>{{ originalAuths.length }}</b> 把门锁授权。取消勾选将回收对应授权，新勾选的门锁会新下发；
+          提交后所有勾选门锁统一使用下方有效期。
+        </span>
+      </div>
+      <el-form ref="batchForm" :model="batchForm" :rules="batchRules" label-width="88px" size="small">
+        <div class="auth-panel">
+          <div class="panel-title"><span class="title-bar"></span>授权信息</div>
+          <div v-if="personAuths.length" class="person-auth-summary">
+            <span class="summary-label">人员现有授权</span>
+            <el-tag
+              v-for="item in personTypeSummary"
+              :key="item.type"
+              size="mini"
+              :effect="item.type === batchForm.authType ? 'dark' : 'plain'"
+              class="type-tag"
+            >{{ item.label }} {{ item.count }} 把</el-tag>
+            <span class="summary-hint">切换授权类型可分别维护</span>
           </div>
+          <el-row :gutter="16">
+            <el-col :span="12">
+              <el-form-item label="授权类型" prop="authType">
+                <el-select
+                  v-model="batchForm.authType"
+                  placeholder="请选择授权类型"
+                  style="width: 100%"
+                  @change="changeBatchAuthType"
+                >
+                  <el-option
+                    v-for="dict in dict.type.lock_auth_type"
+                    :key="dict.value"
+                    :label="dict.label"
+                    :value="dict.value"
+                  />
+                </el-select>
+              </el-form-item>
+            </el-col>
+            <el-col :span="12">
+              <el-form-item label="人员" prop="personNo">
+                <el-select
+                  v-model="batchForm.personNo"
+                  :disabled="batchPersonLocked"
+                  :placeholder="isBatchFace ? '请选择人员（来源：人脸库）' : '请选择人员（来源：人员主数据）'"
+                  filterable
+                  style="width: 100%"
+                  @change="changeBatchPerson"
+                >
+                  <el-option
+                    v-for="item in (isBatchFace ? personOptions : allPersonOptions)"
+                    :key="item.personNo"
+                    :label="item.personName ? item.personName + '（' + item.personNo + '）' : item.personNo"
+                    :value="item.personNo"
+                  />
+                </el-select>
+              </el-form-item>
+            </el-col>
+            <el-col v-if="!isBatchFace" :span="24">
+              <el-form-item label="授权内容" prop="authValue">
+                <el-input
+                  v-model="batchForm.authValue"
+                  :placeholder="batchAuthValuePlaceholder"
+                  maxlength="32"
+                />
+              </el-form-item>
+            </el-col>
+            <el-col v-else :span="24">
+              <el-form-item label="人脸特征">
+                <div class="feature-box">
+                  <i class="el-icon-camera-solid feature-icon"></i>
+                  <div>
+                    <div class="feature-main">
+                      <template v-if="batchFaceRecord">人脸库记录：{{ batchFaceRecord.personName || batchForm.personNo }}</template>
+                      <template v-else-if="batchForm.personNo">该人员暂无人脸库记录，请先在「人脸登记」上传照片</template>
+                      <template v-else>选择人员后显示人脸库记录</template>
+                    </div>
+                    <div class="feature-sub">特征值在下发时按每把门锁的算法版本自动取用，无需手工录入</div>
+                  </div>
+                </div>
+              </el-form-item>
+            </el-col>
+            <el-col :span="12">
+              <el-form-item label="生效时间" prop="beginTime">
+                <el-date-picker
+                  clearable
+                  v-model="batchForm.beginTime"
+                  type="datetime"
+                  style="width: 100%"
+                  value-format="yyyy-MM-dd HH:mm:ss"
+                  placeholder="请选择生效开始时间"
+                />
+              </el-form-item>
+            </el-col>
+            <el-col :span="12">
+              <el-form-item label="失效时间" prop="endTime">
+                <el-date-picker
+                  clearable
+                  v-model="batchForm.endTime"
+                  type="datetime"
+                  style="width: 100%"
+                  value-format="yyyy-MM-dd HH:mm:ss"
+                  placeholder="留空表示永久有效"
+                />
+              </el-form-item>
+            </el-col>
+            <el-col :span="24">
+              <el-form-item label="备注" prop="remark">
+                <el-input v-model="batchForm.remark" type="textarea" :rows="2" placeholder="选填" />
+              </el-form-item>
+            </el-col>
+          </el-row>
+          <el-alert
+            v-if="batchTimeInconsistent"
+            class="inline-alert"
+            type="warning"
+            :closable="false"
+            show-icon
+            title="现有授权的有效期不一致，已带入最近一条；提交后全部统一为上方时间"
+          />
+        </div>
+
+        <div class="device-panel">
+          <div class="panel-title">
+            <span class="title-bar"></span>授权门锁
+            <span class="selected-summary">已选 <b>{{ selectedDeviceCount }}</b> 把 · {{ selectedGroupCount }} 个分组</span>
+          </div>
+          <div class="device-toolbar">
+            <el-input
+              v-model="deviceKeyword"
+              size="small"
+              clearable
+              prefix-icon="el-icon-search"
+              placeholder="搜索分组 / 门锁名称 / SN / 房间号"
+              style="width: 280px"
+            />
+            <div>
+              <el-button type="text" size="mini" @click="selectAllBatchDevices">全选</el-button>
+              <el-button type="text" size="mini" @click="clearBatchDevices">清空</el-button>
+              <el-button type="text" size="mini" @click="expandBatchTree(true)">展开</el-button>
+              <el-button type="text" size="mini" @click="expandBatchTree(false)">收起</el-button>
+              <el-button
+                type="text"
+                size="mini"
+                icon="el-icon-refresh"
+                :loading="batchAuthLoading"
+                :disabled="!batchForm.personNo"
+                title="仅刷新各门锁的下发状态，不影响当前勾选与未提交内容"
+                @click="refreshPersonAuthStatus"
+              >刷新状态</el-button>
+            </div>
+          </div>
+          <el-form-item prop="deviceIds" class="device-form-item">
+            <div v-loading="batchAuthLoading" class="device-tree-wrap">
+              <el-tree
+                ref="batchTree"
+                :data="batchTreeData"
+                node-key="key"
+                show-checkbox
+                :check-on-click-node="true"
+                default-expand-all
+                :expand-on-click-node="false"
+                :filter-node-method="filterBatchNode"
+                @check="handleBatchTreeCheck"
+              >
+                <span slot-scope="{ data }" class="tree-node">
+                  <template v-if="data.type === 'group'">
+                    <i class="el-icon-folder-opened tree-icon group-icon"></i>
+                    <span class="tree-label">{{ data.groupName }}</span>
+                    <span class="tree-count">{{ data.children.length }} 把</span>
+                  </template>
+                  <template v-else>
+                    <i class="el-icon-lock tree-icon"></i>
+                    <span class="tree-label">{{ data.deviceName || data.deviceSn }}</span>
+                    <span class="tree-sn">{{ data.deviceSn }}</span>
+                    <el-tag v-if="data.roomNo" size="mini" type="info" class="tree-tag">{{ data.roomNo }}</el-tag>
+                    <el-tag v-if="data.authorized" size="mini" type="success" class="tree-tag">已授权</el-tag>
+                    <el-tooltip
+                      v-if="data.authorized"
+                      :disabled="!data.syncMsg"
+                      :content="data.syncMsg || ''"
+                      placement="top"
+                    >
+                      <el-tag size="mini" :type="authSyncTag(data.syncStatus)" class="tree-tag">
+                        {{ authSyncLabel(data.syncStatus) }}
+                      </el-tag>
+                    </el-tooltip>
+                    <span v-if="data.onlineStatus === '1'" class="tree-offline">离线</span>
+                  </template>
+                </span>
+              </el-tree>
+              <div v-if="!batchTreeData.length" class="tree-empty">暂无可授权门锁，请先在门锁管理中维护设备</div>
+            </div>
+          </el-form-item>
+          <div class="panel-note">
+            勾选分组会选中分组下的全部门锁；单次最多 {{ BATCH_MAX }} 把，同一网关的门锁按队列依次下发。
+            编辑时取消全部门锁并提交，将回收该人员当前类型的全部授权。
+          </div>
+        </div>
+      </el-form>
+      <div slot="footer" class="dialog-footer">
+        <span v-if="isBatchFace" class="footer-tip">人脸特征按各锁算法版本自动取用</span>
+        <el-button @click="batchOpen = false">取 消</el-button>
+        <el-button type="primary" :loading="batchLoading" @click="submitBatchForm">确 定</el-button>
+      </div>
+    </el-dialog>
+
+    <!-- 多锁授权结果 -->
+    <el-dialog title="授权处理结果" :visible.sync="batchResultOpen" width="820px" append-to-body>
+      <div v-if="batchResult" class="result-summary">
+        <span class="result-item">本次勾选 <b>{{ batchResult.total }}</b> 把</span>
+        <el-tag size="small">下发 {{ batchResult.issued }} 把</el-tag>
+        <el-tag size="small" type="success">新增 {{ batchResult.created }}</el-tag>
+        <el-tag size="small" type="warning">覆盖 {{ batchResult.overwritten }}</el-tag>
+        <el-tag size="small" type="danger">下发失败 {{ batchResult.failed }}</el-tag>
+        <el-tag size="small" type="info">回收 {{ batchResult.revoked }}</el-tag>
+        <el-tag v-if="batchResult.revokeFailed" size="small" type="danger">回收失败 {{ batchResult.revokeFailed }}</el-tag>
+      </div>
+      <el-table v-if="batchResult" :data="batchResult.items" size="mini" max-height="380">
+        <el-table-column label="门锁" :show-overflow-tooltip="true">
+          <template slot-scope="scope">{{ batchDeviceLabel(scope.row) }}</template>
+        </el-table-column>
+        <el-table-column label="动作" align="center" width="100">
+          <template slot-scope="scope">
+            <el-tag size="mini" :type="batchActionTag(scope.row.action)">
+              {{ batchActionLabel(scope.row.action) }}
+            </el-tag>
+          </template>
+        </el-table-column>
+        <el-table-column label="同步状态" align="center" width="110">
+          <template slot-scope="scope">
+            <dict-tag
+              v-if="scope.row.syncStatus"
+              :options="dict.type.lock_sync_status"
+              :value="scope.row.syncStatus"
+            />
+            <span v-else>-</span>
+          </template>
+        </el-table-column>
+        <el-table-column label="说明" prop="syncMsg" :show-overflow-tooltip="true" min-width="160">
+          <template slot-scope="scope">{{ scope.row.syncMsg || '-' }}</template>
+        </el-table-column>
+      </el-table>
+      <div slot="footer" class="dialog-footer">
+        <el-button type="primary" @click="batchResultOpen = false">关 闭</el-button>
+      </div>
+    </el-dialog>
+
+    <!-- 外部授权详情：只读，不展示授权凭据 -->
+    <el-dialog title="外部授权详情" :visible.sync="externalDetailOpen" width="720px" append-to-body>
+      <div v-if="externalDetail" class="detail-grid">
+        <div class="detail-item"><span class="detail-label">授权编号</span><span>{{ externalDetail.authNo || '-' }}</span></div>
+        <div class="detail-item"><span class="detail-label">来源应用</span>
+          <span>
+            {{ externalDetail.sourceAppName || '-' }}
+            <template v-if="externalDetail.sourceAppCode">（{{ externalDetail.sourceAppCode }}）</template>
+          </span>
+        </div>
+        <div class="detail-item"><span class="detail-label">来源业务号</span><span>{{ externalDetail.sourceBizNo || '-' }}</span></div>
+        <div class="detail-item"><span class="detail-label">关联入住单</span><span>{{ externalDetail.stayNo || '-' }}</span></div>
+        <div class="detail-item"><span class="detail-label">人员</span>
+          <span>{{ externalDetail.personName || '-' }}（{{ externalDetail.personNo }}）</span>
+        </div>
+        <div class="detail-item"><span class="detail-label">门锁</span>
+          <span>{{ externalDetail.deviceName || '-' }}（{{ externalDetail.deviceSn }}）</span>
+        </div>
+        <div class="detail-item"><span class="detail-label">授权类型</span><span>{{ authTypeLabel(externalDetail.authType) }}</span></div>
+        <div class="detail-item"><span class="detail-label">同步状态</span>
+          <el-tag :type="externalStatusTag(externalDetail.syncStatus)" size="mini">{{ externalStatusLabel(externalDetail.syncStatus) }}</el-tag>
+        </div>
+        <div class="detail-item"><span class="detail-label">生效时间</span>
+          <span>{{ externalDetail.beginTime ? parseTime(externalDetail.beginTime) : '立即生效' }}</span>
+        </div>
+        <div class="detail-item"><span class="detail-label">失效时间</span>
+          <span>{{ externalDetail.endTime ? parseTime(externalDetail.endTime) : '永久有效' }}</span>
+        </div>
+        <div class="detail-item"><span class="detail-label">同步时间</span>
+          <span>{{ externalDetail.syncTime ? parseTime(externalDetail.syncTime) : '-' }}</span>
+        </div>
+        <div class="detail-item"><span class="detail-label">重试次数</span><span>{{ externalDetail.retryCount != null ? externalDetail.retryCount : '-' }}</span></div>
+        <div class="detail-item detail-wide"><span class="detail-label">同步说明</span><span>{{ externalDetail.syncMsg || '-' }}</span></div>
+        <div class="detail-item"><span class="detail-label">创建时间</span>
+          <span>{{ externalDetail.createTime ? parseTime(externalDetail.createTime) : '-' }}</span>
+        </div>
+        <div class="detail-item"><span class="detail-label">更新时间</span>
+          <span>{{ externalDetail.updateTime ? parseTime(externalDetail.updateTime) : '-' }}</span>
+        </div>
+        <div class="detail-item detail-wide"><span class="detail-label">备注</span><span>{{ externalDetail.remark || '-' }}</span></div>
+      </div>
+      <div slot="footer" class="dialog-footer">
+        <el-button type="primary" @click="externalDetailOpen = false">关 闭</el-button>
+      </div>
+    </el-dialog>
+
+    <!-- 外部授权改期：只能改有效期与备注 -->
+    <el-dialog title="修改外部授权" :visible.sync="externalEditOpen" width="560px" append-to-body>
+      <el-form ref="externalForm" :model="externalForm" :rules="externalRules" label-width="88px" size="small">
+        <el-form-item label="来源应用">
+          <span>{{ externalForm.sourceAppName || externalForm.sourceAppCode || '-' }}
+            <template v-if="externalForm.sourceAppName && externalForm.sourceAppCode">（{{ externalForm.sourceAppCode }}）</template>
+          </span>
+        </el-form-item>
+        <el-form-item label="人员">
+          <span>{{ externalForm.personName || '-' }}（{{ externalForm.personNo }}）</span>
+        </el-form-item>
+        <el-form-item label="门锁">
+          <span>{{ externalForm.deviceName || externalForm.deviceSn || '-' }}</span>
         </el-form-item>
         <el-form-item label="生效时间" prop="beginTime">
           <el-date-picker
-            clearable
-            v-model="form.beginTime"
+            v-model="externalForm.beginTime"
             type="datetime"
             style="width: 100%"
             value-format="yyyy-MM-dd HH:mm:ss"
             placeholder="请选择生效开始时间"
-          ></el-date-picker>
+          />
         </el-form-item>
         <el-form-item label="失效时间" prop="endTime">
           <el-date-picker
-            clearable
-            v-model="form.endTime"
+            v-model="externalForm.endTime"
             type="datetime"
             style="width: 100%"
             value-format="yyyy-MM-dd HH:mm:ss"
             placeholder="留空表示永久有效"
-          ></el-date-picker>
+          />
         </el-form-item>
-        <el-form-item label="备注" prop="remark">
-          <el-input v-model="form.remark" type="textarea" placeholder="请输入内容" />
+        <el-form-item label="备注">
+          <el-input v-model="externalForm.remark" type="textarea" :rows="2" placeholder="选填" />
         </el-form-item>
+        <el-alert
+          v-if="externalForm.stayNo"
+          type="warning"
+          :closable="false"
+          show-icon
+          title="该授权来自入住单，修改有效期不会回写入住单；后续续住/退房仍以入住单为准。"
+        />
+        <el-alert
+          v-if="externalForm.syncStatus === '4'"
+          class="inline-alert"
+          type="info"
+          :closable="false"
+          show-icon
+          title="该授权已取消，保存后不会重推；需要恢复门锁权限请使用「重新下发」。"
+        />
       </el-form>
       <div slot="footer" class="dialog-footer">
-        <el-button type="primary" @click="submitForm">确 定</el-button>
-        <el-button @click="cancel">取 消</el-button>
+        <el-button @click="externalEditOpen = false">取 消</el-button>
+        <el-button type="primary" :loading="externalEditLoading" @click="submitExternalEdit">确 定</el-button>
       </div>
     </el-dialog>
   </div>
 </template>
 
 <script>
-import { listAuth, getAuth, delAuth, addAuth, updateAuth, pushAuth, batchPush, clearAuth } from "@/api/iot/auth";
-import { listFace, extract } from "@/api/iot/face";
+import { listAuth, listAuthPerson, removeAuthByPerson, pushAuthByPerson, delAuth, batchAddAuth,
+  listExternalAuth, getExternalAuth, updateExternalAuth, pushExternalAuth, clearExternalAuth,
+  delExternalAuth, listAllAuth, getAuth, pushAuth, delAuthRecord } from "@/api/iot/auth";
+import { listOpenApp } from "@/api/iot/openapp";
+import { listFace } from "@/api/iot/face";
 import { listDevice } from "@/api/iot/device";
 import { optionselect as groupOptionselect } from "@/api/iot/group";
 import { optionselect as personOptionselect } from "@/api/iot/person";
@@ -353,56 +1031,123 @@ export default {
     return {
       loading: true,
       ids: [],
-      single: true,
       multiple: true,
       showSearch: true,
       total: 0,
-      authList: [],
+      // 页签：platform 平台授权（人员聚合）、external 外部授权、all 全部授权（后两者均为一授权一行）
+      activeTab: "platform",
+      // 外部授权列表
+      externalLoaded: false,
+      externalLoading: false,
+      externalShowSearch: true,
+      externalRows: [],
+      externalTotal: 0,
+      externalSelection: [],
+      externalDateRange: [],
+      externalQuery: {
+        pageNum: 1,
+        pageSize: 10,
+        keyword: undefined,
+        sourceAppCode: undefined,
+        deviceId: undefined,
+        groupId: undefined,
+        authType: undefined,
+        syncStatus: undefined
+      },
+      externalDetailOpen: false,
+      externalDetail: null,
+      externalEditOpen: false,
+      externalEditLoading: false,
+      externalForm: {},
+      appOptions: [],
+      // 全部授权列表：平台与外部授权一并展示，一授权一行，便于逐条核对
+      allLoading: false,
+      allShowSearch: true,
+      allRows: [],
+      allTotal: 0,
+      allDateRange: [],
+      allQuery: {
+        pageNum: 1,
+        pageSize: 10,
+        keyword: undefined,
+        deviceId: undefined,
+        groupId: undefined,
+        authType: undefined,
+        source: undefined,
+        syncStatus: undefined
+      },
+      allDetailOpen: false,
+      allDetail: null,
+      // 人员维度列表：一行一名人员，汇总其全部门锁授权
+      personRows: [],
       // 授权依赖项：人员（人脸库）、全部人员（人员主数据）、门锁、分组
       personOptions: [],
       personList: [],
       deviceOptions: [],
       groupOptions: [],
-      title: "",
-      open: false,
-      form: {},
-      // 编辑时记录原授权类型：非人脸且类型未变时，授权内容留空表示沿用原值
-      originalAuthType: undefined,
-      // 人脸特征提取中
-      extractLoading: false,
+      // 人员授权配置（分组-门锁树 + 统一授权信息）
+      batchOpen: false,
+      batchLoading: false,
+      batchAuthLoading: false,
+      batchResultOpen: false,
+      batchResult: null,
+      batchForm: {},
+      BATCH_MAX: 100,
+      // 门锁树搜索关键字
+      deviceKeyword: "",
+      // 该人员名下全部授权（不区分类型），用于概览与切换类型时本地过滤
+      personAuths: [],
+      // 当前授权类型下已有的授权，用于勾选回显与差异回收
+      originalAuths: [],
+      originalAuthMap: {},
+      originalBeginTime: undefined,
+      originalEndTime: undefined,
+      originalRemark: undefined,
+      originalAuthValue: undefined,
+      batchEditMode: false,
+      // 从人员行进入编辑时锁定人员，避免误把授权挂到别人身上
+      batchPersonLocked: false,
+      // 从列表行打开时，等弹窗渲染完成后再回显勾选
+      batchPendingLoad: false,
+      // 防止人员/类型快速切换时旧请求覆盖新结果
+      batchLoadSeq: 0,
       // 授权类型（字典 lock_auth_type）：01 人脸、02 密码、03 指纹、04 IC卡
       AUTH_TYPE_FACE: "01",
       AUTH_TYPE_PASSWORD: "02",
       queryParams: {
         pageNum: 1,
         pageSize: 10,
-        personNo: undefined,
+        keyword: undefined,
         deviceId: undefined,
         groupId: undefined,
-        deviceSn: undefined,
         authType: undefined,
         syncStatus: undefined
       },
-      rules: {
+      batchRules: {
         personNo: [
-          { validator: this.validatePersonNo, trigger: "change" }
+          { validator: this.validateBatchPersonNo, trigger: "change" }
         ],
-        deviceId: [
-          { required: true, message: "授权门锁不能为空", trigger: "blur" }
+        deviceIds: [
+          { validator: this.validateBatchDeviceIds, trigger: "change" }
         ],
         authType: [
           { required: true, message: "授权类型不能为空", trigger: "change" }
         ],
         authValue: [
-          { validator: this.validateAuthValue, trigger: "change" }
+          { validator: this.validateBatchAuthValue, trigger: "change" }
+        ],
+        endTime: [
+          { validator: this.validateBatchEndTime, trigger: "change" }
+        ]
+      },
+      externalRules: {
+        endTime: [
+          { validator: this.validateExternalEndTime, trigger: "change" }
         ]
       }
     };
   },
   computed: {
-    isFaceAuth() {
-      return this.form && this.form.authType === this.AUTH_TYPE_FACE;
-    },
     /** 人员下拉：人员主数据为主，人脸库补充（按人员编号去重排序） */
     allPersonOptions() {
       const merged = [];
@@ -417,23 +1162,120 @@ export default {
       this.personOptions.forEach(push);
       return merged.sort((left, right) => (left.personNo > right.personNo ? 1 : -1));
     },
-    /** 编辑非人脸授权且未改类型时，授权内容可留空表示沿用原值 */
-    canKeepAuthValue() {
-      return this.form && this.form.authId != undefined
-        && !this.isFaceAuth
-        && this.form.authType === this.originalAuthType;
+    isBatchFace() {
+      return this.batchForm && this.batchForm.authType === this.AUTH_TYPE_FACE;
     },
-    authValuePlaceholder() {
-      if (this.isFaceAuth) {
-        return "请点击「提取人脸特征」自动填充";
+    /** 当前人员在人脸库中的记录 */
+    batchFaceRecord() {
+      if (!this.batchForm || !this.batchForm.personNo) {
+        return null;
       }
-      if (this.canKeepAuthValue) {
-        return "留空表示不修改原授权内容（如只调整有效期）";
+      return this.personOptions.find(item => item.personNo === this.batchForm.personNo) || null;
+    },
+    /** 人员现有授权按类型汇总，便于在弹窗中看清整体情况 */
+    personTypeSummary() {
+      const counter = {};
+      this.personAuths.forEach(auth => {
+        counter[auth.authType] = (counter[auth.authType] || 0) + 1;
+      });
+      return Object.keys(counter).sort().map(type => ({
+        type: type,
+        label: this.authTypeLabel(type),
+        count: counter[type]
+      }));
+    },
+    /** 分组-门锁两级目录：分组为父节点，勾选分组即选中其下全部门锁 */
+    batchTreeData() {
+      const names = {};
+      this.groupOptions.forEach(group => {
+        names[group.groupId] = group.groupName;
+      });
+      const groups = [];
+      const index = {};
+      this.deviceOptions.forEach(device => {
+        const key = device.groupId == null ? "none" : String(device.groupId);
+        if (!index[key]) {
+          const groupName = names[device.groupId] || "未分组";
+          index[key] = {
+            key: "g_" + key,
+            type: "group",
+            label: groupName,
+            groupName: groupName,
+            children: []
+          };
+          groups.push(index[key]);
+        }
+        const auth = this.originalAuthMap[device.deviceId];
+        index[key].children.push({
+          key: "d_" + device.deviceId,
+          type: "device",
+          label: device.deviceName || device.deviceSn,
+          deviceId: device.deviceId,
+          deviceName: device.deviceName,
+          deviceSn: device.deviceSn,
+          roomNo: device.roomNo,
+          onlineStatus: device.onlineStatus,
+          authorized: !!auth,
+          syncStatus: auth ? auth.syncStatus : null,
+          syncMsg: auth ? auth.syncMsg : null
+        });
+      });
+      return groups;
+    },
+    selectedDeviceCount() {
+      return (this.batchForm && this.batchForm.deviceIds) ? this.batchForm.deviceIds.length : 0;
+    },
+    selectedGroupCount() {
+      const ids = (this.batchForm && this.batchForm.deviceIds) || [];
+      const keys = {};
+      this.deviceOptions.forEach(device => {
+        if (ids.indexOf(device.deviceId) >= 0) {
+          keys[String(device.groupId)] = true;
+        }
+      });
+      return Object.keys(keys).length;
+    },
+    /** 既有授权的有效期是否不一致（不一致时提示提交后会统一） */
+    batchTimeInconsistent() {
+      if (!this.originalAuths.length) {
+        return false;
       }
-      if (this.form && this.form.authType === this.AUTH_TYPE_PASSWORD) {
-        return "请输入开门密码（将明文下发给门锁）";
+      const begin = this.originalBeginTime || "";
+      const end = this.originalEndTime || "";
+      return this.originalAuths.some(auth =>
+        (auth.beginTime || "") !== begin || (auth.endTime || "") !== end
+      );
+    },
+    batchAuthValuePlaceholder() {
+      if (this.batchForm && this.batchForm.authType === this.AUTH_TYPE_PASSWORD) {
+        return "请输入开门密码（将明文下发给多把门锁）";
       }
       return "指纹特征 / IC卡号";
+    },
+    /** 外部授权状态筛选：默认不含已取消，字典中的 4（已清除）在外部口径下叫“已取消” */
+    externalStatusOptions() {
+      const options = [{ value: "ALL", label: "全部状态" }];
+      (this.dict.type.lock_sync_status || []).forEach(item => {
+        if (item.value !== "4") {
+          options.push({ value: item.value, label: item.label });
+        }
+      });
+      options.push({ value: "4", label: "已取消" });
+      return options;
+    },
+    /** 空列表提示：默认过滤已取消时说明原因，避免误以为数据丢失 */
+    externalEmptyText() {
+      if (this.externalQuery.syncStatus) {
+        return "暂无符合条件的外部授权";
+      }
+      return "暂无外部授权。默认不显示已取消授权，可将“同步状态”切换为“全部状态”查看历史记录";
+    }
+  },
+  watch: {
+    deviceKeyword(value) {
+      this.$nextTick(() => {
+        this.$refs.batchTree && this.$refs.batchTree.filter(value || "");
+      });
     }
   },
   created() {
@@ -455,127 +1297,47 @@ export default {
       groupOptionselect().then(response => {
         this.groupOptions = response.data || [];
       });
+      listOpenApp({ pageNum: 1, pageSize: 200 }).then(response => {
+        this.appOptions = response.rows || [];
+      });
     },
-    /** 选择人员后自动带出姓名，人脸授权时同步特征 */
-    changePerson(personNo) {
-      const person = this.allPersonOptions.find(item => item.personNo === personNo);
-      this.$set(this.form, "personName", person ? person.personName : undefined);
-      this.syncFaceFeature();
+    authTypeLabel(type) {
+      const dict = (this.dict.type.lock_auth_type || []).find(item => item.value === type);
+      return dict ? dict.label : type;
     },
-    /** 选择门锁后自动带出门锁SN（后端会据此补齐分组、网关） */
-    changeDevice(deviceId) {
-      const device = this.deviceOptions.find(item => item.deviceId === deviceId);
-      this.form.deviceSn = device ? device.deviceSn : undefined;
-      // 确定门锁后才能读取算法版本，此时才具备提取特征的条件
-      this.syncFaceFeature();
-    },
-    /**
-     * 切换授权类型：人员来源与授权内容语义都随之改变，清空后按新类型重新录入
-     * <p>
-     * 人脸从人脸库选人、授权内容为特征值；密码等从人员主数据选人、授权内容为密码/卡号
-     */
-    changeAuthType() {
-      this.$set(this.form, "personNo", undefined);
-      this.$set(this.form, "personName", undefined);
-      this.$set(this.form, "authValue", undefined);
-      this.syncFaceFeature();
-    },
-    /** 人员校验：人脸从人脸库选择，其余从人员主数据选择，均不可为空 */
-    validatePersonNo(rule, value, callback) {
-      if (!value) {
-        callback(new Error("请选择人员"));
-        return;
+    /** 人员授权树：当前类型在该门锁上的下发状态（空值按待下发展示） */
+    authSyncLabel(status) {
+      if (!status) {
+        return "待下发";
       }
-      callback();
+      const dict = (this.dict.type.lock_sync_status || []).find(item => item.value === status);
+      return dict ? dict.label : status;
     },
-    /** 当前选中人员在人脸库中的记录 */
-    currentPerson() {
-      return this.personOptions.find(item => item.personNo === this.form.personNo);
+    authSyncTag(status) {
+      if (status === "2") {
+        return "success";
+      }
+      if (status === "3") {
+        return "danger";
+      }
+      if (status === "1" || status === "6") {
+        return "warning";
+      }
+      return "info";
     },
-    /**
-     * 人脸授权的授权内容自动同步
-     * <p>
-     * 特征提取需要「人脸ID + 目标门锁（决定 algorithm_version）」，
-     * 因此仅在人员与门锁均已选定后才发起。
-     *
-     * @param force true 表示忽略已有授权内容，强制重新提取
-     */
-    syncFaceFeature(force) {
-      if (this.form.authType !== this.AUTH_TYPE_FACE || !this.form.personNo) {
-        return;
-      }
-      if (!force && this.form.authValue) {
-        return;
-      }
-      const person = this.currentPerson();
-      if (!person || !person.faceId) {
-        return;
-      }
-      if (!this.form.deviceId) {
-        this.$modal.msgWarning("请先选择授权门锁，以确定人脸算法版本");
-        return;
-      }
-      this.extractLoading = true;
-      extract(person.faceId, this.form.deviceId)
-        .then(response => {
-          if (response && response.data) {
-            this.$set(this.form, "authValue", response.data);
-            // 重新校验，避免必填提示残留
-            this.$refs["form"] && this.$refs["form"].validateField("authValue");
-            this.$modal.msgSuccess("人脸特征已提取到授权内容");
-          } else {
-            this.$modal.msgWarning((response && response.msg) || "特征提取失败");
-          }
-        })
-        .catch(() => {})
-        .then(() => {
-          this.extractLoading = false;
-        });
-    },
-    /** 手动重新提取人脸特征 */
-    handleExtractFace() {
-      this.syncFaceFeature(true);
-    },
-    /** 授权内容校验：人脸须为提取出的特征值；非人脸新增必填，编辑时可留空沿用原值 */
-    validateAuthValue(rule, value, callback) {
-      if (!value) {
-        if (this.isFaceAuth) {
-          callback(new Error("人脸授权内容不能为空，请点击「提取人脸特征」"));
-          return;
-        }
-        if (!this.canKeepAuthValue) {
-          callback(new Error("授权内容不能为空"));
-          return;
-        }
-      }
-      callback();
+    authTypeList(row) {
+      return row && row.authTypes ? row.authTypes.split(",").filter(Boolean) : [];
     },
     getList() {
       this.loading = true;
-      listAuth(this.queryParams).then(response => {
-        this.authList = response.rows;
+      listAuthPerson(this.queryParams).then(response => {
+        this.personRows = response.rows;
         this.total = response.total;
         this.loading = false;
+      }).catch(() => {
+        this.loading = false;
       });
     },
-    cancel() {
-      this.open = false;
-      this.reset();
-    },
-    reset() {
-      this.form = {
-        authId: undefined,
-        personNo: undefined,
-        deviceId: undefined,
-        authType: "01",
-        authValue: undefined,
-        beginTime: undefined,
-        endTime: undefined,
-        remark: undefined
-      };
-      this.originalAuthType = undefined;
-      this.resetForm("form");
-    },
     handleQuery() {
       this.queryParams.pageNum = 1;
       this.getList();
@@ -585,93 +1347,1075 @@ export default {
       this.handleQuery();
     },
     handleSelectionChange(selection) {
-      this.ids = selection.map(item => item.authId);
-      this.single = selection.length != 1;
+      this.ids = selection.map(item => item.personNo);
       this.multiple = !selection.length;
     },
-    handleAdd() {
-      this.reset();
-      this.open = true;
-      this.title = "添加门禁授权";
+    /** 新增授权：人员可自行选择，选到已有授权的人员时自动回显并进入编辑语义 */
+    handleAddAuth() {
+      this.resetBatch();
+      this.batchOpen = true;
     },
-    handleUpdate(row) {
-      this.reset();
-      const authId = row.authId || this.ids;
-      getAuth(authId).then(response => {
-        this.originalAuthType = response.data.authType;
-        this.form = response.data;
-        this.open = true;
-        this.title = "修改门禁授权";
-        // 人脸授权若授权内容为空（如人员重新录入人脸），按当前门锁补取特征
-        if (this.form.authType === this.AUTH_TYPE_FACE && !this.form.authValue) {
-          this.syncFaceFeature();
-        }
+    /** 编辑指定人员的授权：人员锁定，类型默认取该人员已有的第一个类型 */
+    handleEditPerson(row) {
+      this.resetBatch();
+      this.batchPersonLocked = true;
+      const types = this.authTypeList(row);
+      this.batchForm.personNo = row.personNo;
+      this.batchForm.personName = row.personName;
+      this.batchForm.authType = types.length ? types[0] : this.AUTH_TYPE_FACE;
+      this.batchPendingLoad = true;
+      this.batchOpen = true;
+    },
+    /** 弹窗渲染完成后再拉取已有授权，保证树节点已挂载 */
+    handleBatchOpened() {
+      if (this.batchPendingLoad) {
+        this.batchPendingLoad = false;
+        this.loadPersonAuths();
+      }
+    },
+    resetBatch() {
+      this.batchLoadSeq += 1;
+      this.batchForm = {
+        authType: this.AUTH_TYPE_FACE,
+        personNo: undefined,
+        personName: undefined,
+        deviceIds: [],
+        authValue: undefined,
+        beginTime: undefined,
+        endTime: undefined,
+        remark: undefined
+      };
+      this.batchResult = null;
+      this.deviceKeyword = "";
+      this.batchAuthLoading = false;
+      this.batchPendingLoad = false;
+      this.batchPersonLocked = false;
+      this.personAuths = [];
+      this.resetTypeOriginal();
+      this.$nextTick(() => {
+        this.$refs.batchForm && this.$refs.batchForm.clearValidate();
+        this.$refs.batchTree && this.$refs.batchTree.setCheckedKeys([]);
       });
     },
-    submitForm() {
-      this.$refs["form"].validate(valid => {
-        if (valid) {
-          if (this.form.authId != undefined) {
-            updateAuth(this.form).then(response => {
-              this.$modal.msgSuccess("修改成功，已重新下发");
-              this.open = false;
-              this.getList();
-            });
-          } else {
-            addAuth(this.form).then(response => {
-              this.$modal.msgSuccess("新增成功，已下发");
-              this.open = false;
-              this.getList();
-            });
+    /** 清空当前授权类型的「已有授权」基准 */
+    resetTypeOriginal() {
+      this.originalAuths = [];
+      this.originalAuthMap = {};
+      this.originalBeginTime = undefined;
+      this.originalEndTime = undefined;
+      this.originalRemark = undefined;
+      this.originalAuthValue = undefined;
+      this.batchEditMode = false;
+    },
+    /** 切换授权类型：只切换该类型的勾选与内容，人员保持不变 */
+    changeBatchAuthType() {
+      this.$set(this.batchForm, "authValue", undefined);
+      this.applyTypeAuths();
+    },
+    /** 选择人员：清空模板后拉取该人员名下全部授权 */
+    changeBatchPerson() {
+      const person = this.allPersonOptions.find(item => item.personNo === this.batchForm.personNo);
+      this.$set(this.batchForm, "personName", person ? person.personName : undefined);
+      this.$set(this.batchForm, "authValue", undefined);
+      this.$set(this.batchForm, "beginTime", undefined);
+      this.$set(this.batchForm, "endTime", undefined);
+      this.$set(this.batchForm, "remark", undefined);
+      this.personAuths = [];
+      this.resetTypeOriginal();
+      this.applyBatchCheckedKeys([]);
+      this.loadPersonAuths();
+    },
+    /**
+     * 加载人员名下全部授权（不区分类型）
+     * <p>
+     * 列表接口按 personNo 模糊匹配，这里再做一次精确过滤，避免同前缀人员串数据。
+     * 已清除(4)的授权不再有设备侧权限，不参与勾选回显。
+     */
+    loadPersonAuths() {
+      const personNo = this.batchForm.personNo;
+      if (!personNo) {
+        return;
+      }
+      const seq = ++this.batchLoadSeq;
+      this.batchAuthLoading = true;
+      listAuth({ personNo: personNo, pageNum: 1, pageSize: 1000 })
+        .then(response => {
+          if (seq !== this.batchLoadSeq) {
+            return;
           }
+          this.personAuths = (response.rows || []).filter(
+            auth => auth.personNo === personNo && auth.syncStatus !== "4"
+          );
+          this.applyTypeAuths();
+        })
+        .catch(() => {})
+        .then(() => {
+          if (seq === this.batchLoadSeq) {
+            this.batchAuthLoading = false;
+          }
+        });
+    },
+    /**
+     * 用当前授权类型下的已有授权回显勾选与模板
+     * <p>
+     * 各锁授权内容一致时才回填，避免把某一把锁的密码误用到全部门锁。
+     */
+    applyTypeAuths() {
+      this.resetTypeOriginal();
+      const type = this.batchForm.authType;
+      const rows = this.personAuths.filter(auth => auth.authType === type);
+      if (!rows.length) {
+        this.applyBatchCheckedKeys([]);
+        return;
+      }
+      const map = {};
+      rows.forEach(auth => {
+        map[auth.deviceId] = auth;
+      });
+      this.originalAuths = rows;
+      this.originalAuthMap = map;
+      this.batchEditMode = true;
+      // 列表按 auth_id 倒序，首条为最近维护的一条
+      const latest = rows[0];
+      this.batchForm.beginTime = latest.beginTime;
+      this.batchForm.endTime = latest.endTime;
+      this.batchForm.remark = latest.remark;
+      this.originalBeginTime = latest.beginTime;
+      this.originalEndTime = latest.endTime;
+      this.originalRemark = latest.remark;
+      if (!this.isBatchFace) {
+        const values = [];
+        rows.forEach(auth => {
+          if (auth.authValue != null && values.indexOf(auth.authValue) < 0) {
+            values.push(auth.authValue);
+          }
+        });
+        const value = values.length === 1 ? values[0] : undefined;
+        this.batchForm.authValue = value;
+        this.originalAuthValue = value;
+      }
+      this.applyBatchCheckedKeys(rows.map(auth => auth.deviceId));
+    },
+    /**
+     * 手动刷新各门锁的下发状态
+     * <p>
+     * 下发是异步的，创建后状态会从待下发逐步变为已下发/下发成功。刷新只回写授权状态
+     * 与已有授权基准，不重设勾选、不回填表单，避免覆盖用户尚未提交的修改。
+     */
+    refreshPersonAuthStatus() {
+      const personNo = this.batchForm.personNo;
+      if (!personNo) {
+        return;
+      }
+      const seq = ++this.batchLoadSeq;
+      this.batchAuthLoading = true;
+      listAuth({ personNo: personNo, pageNum: 1, pageSize: 1000 })
+        .then(response => {
+          if (seq !== this.batchLoadSeq) {
+            return;
+          }
+          const rows = (response.rows || []).filter(
+            auth => auth.personNo === personNo && auth.syncStatus !== "4"
+          );
+          this.personAuths = rows;
+          this.applyTypeAuthStatus(rows);
+        })
+        .catch(() => {})
+        .then(() => {
+          if (seq === this.batchLoadSeq) {
+            this.batchAuthLoading = false;
+          }
+        });
+    },
+    /** 刷新场景：仅按当前类型更新状态基准，保留已勾选门锁与表单内容 */
+    applyTypeAuthStatus(rows) {
+      const typeRows = rows.filter(auth => auth.authType === this.batchForm.authType);
+      const map = {};
+      typeRows.forEach(auth => {
+        map[auth.deviceId] = auth;
+      });
+      this.originalAuths = typeRows;
+      this.originalAuthMap = map;
+      if (typeRows.length) {
+        // 刷新后出现的授权也应视为已有授权，避免提交时被判为新增而重复下发
+        this.batchEditMode = true;
+      }
+    },
+    /** 按门锁ID勾选树节点（父分组会随之变成全选/半选） */
+    applyBatchCheckedKeys(deviceIds) {
+      const ids = (deviceIds || []).slice();
+      this.batchForm.deviceIds = ids;
+      this.$nextTick(() => {
+        const tree = this.$refs.batchTree;
+        if (tree) {
+          tree.setCheckedKeys(ids.map(id => "d_" + id));
         }
+        this.syncBatchDeviceIds();
       });
     },
-    handlePush(row) {
-      pushAuth(row.authId).then(response => {
+    /** 从树读取已勾选门锁，写回表单供校验与提交 */
+    syncBatchDeviceIds(validate) {
+      const tree = this.$refs.batchTree;
+      if (!tree) {
+        return;
+      }
+      const ids = [];
+      (tree.getCheckedNodes(true) || []).forEach(node => {
+        if (node.type === "device" && ids.indexOf(node.deviceId) < 0) {
+          ids.push(node.deviceId);
+        }
+      });
+      this.batchForm.deviceIds = ids;
+      if (validate) {
+        this.$nextTick(() => {
+          this.$refs.batchForm && this.$refs.batchForm.validateField("deviceIds");
+        });
+      }
+    },
+    handleBatchTreeCheck() {
+      this.syncBatchDeviceIds(true);
+    },
+    /** 树搜索：分组名命中或分组下任一门锁命中即保留 */
+    filterBatchNode(value, data) {
+      if (!value) {
+        return true;
+      }
+      const keyword = value.trim().toLowerCase();
+      if (!keyword) {
+        return true;
+      }
+      if (data.type === "group") {
+        const groupMatched = (data.groupName || "").toLowerCase().indexOf(keyword) >= 0;
+        return groupMatched || (data.children || []).some(child => this.filterBatchNode(keyword, child));
+      }
+      return [data.deviceName, data.deviceSn, data.roomNo]
+        .filter(Boolean)
+        .join(" ")
+        .toLowerCase()
+        .indexOf(keyword) >= 0;
+    },
+    selectAllBatchDevices() {
+      let ids = this.deviceOptions.map(item => item.deviceId);
+      if (ids.length > this.BATCH_MAX) {
+        this.$modal.msgWarning("单次最多授权 " + this.BATCH_MAX + " 把门锁，已选择前 " + this.BATCH_MAX + " 把");
+        ids = ids.slice(0, this.BATCH_MAX);
+      }
+      this.applyBatchCheckedKeys(ids);
+    },
+    clearBatchDevices() {
+      this.applyBatchCheckedKeys([]);
+    },
+    expandBatchTree(expanded) {
+      const tree = this.$refs.batchTree;
+      if (!tree || !tree.store) {
+        return;
+      }
+      const nodes = tree.store.nodesMap || {};
+      Object.keys(nodes).forEach(key => {
+        nodes[key].expanded = expanded;
+      });
+    },
+    validateBatchPersonNo(rule, value, callback) {
+      if (!value) {
+        callback(new Error("请选择人员"));
+        return;
+      }
+      callback();
+    },
+    validateBatchDeviceIds(rule, value, callback) {
+      if (!value || !value.length) {
+        // 当前类型已有授权时允许全部取消，表示回收该人员在此类型下的全部门锁授权
+        if (this.batchEditMode) {
+          callback();
+          return;
+        }
+        callback(new Error("请在目录中勾选授权门锁"));
+        return;
+      }
+      if (value.length > this.BATCH_MAX) {
+        callback(new Error("单次最多授权 " + this.BATCH_MAX + " 把门锁"));
+        return;
+      }
+      callback();
+    },
+    validateBatchEndTime(rule, value, callback) {
+      if (this.batchForm.beginTime && value && this.batchForm.beginTime > value) {
+        callback(new Error("失效时间不能早于生效时间"));
+        return;
+      }
+      callback();
+    },
+    validateBatchAuthValue(rule, value, callback) {
+      if (!this.isBatchFace && !value) {
+        callback(new Error("授权内容不能为空"));
+        return;
+      }
+      callback();
+    },
+    /**
+     * 提交人员授权
+     * <p>
+     * 以当前类型下「原有授权」为基准做差异：取消勾选的门锁回收授权，
+     * 新增勾选或有效期/内容变化的门锁重新下发。先下发再回收，避免人员校验
+     * 失败时已回收却无法补发。所有勾选门锁使用同一份授权信息。
+     */
+    submitBatchForm() {
+      this.$refs["batchForm"].validate(valid => {
+        if (!valid) {
+          return;
+        }
+        const checkedIds = (this.batchForm.deviceIds || []).slice();
+        const removed = this.originalAuths.filter(auth => checkedIds.indexOf(auth.deviceId) < 0);
+        const added = checkedIds.filter(id => !this.originalAuthMap[id]);
+        const valueChanged = !this.isBatchFace
+          && (this.batchForm.authValue || "") !== (this.originalAuthValue || "");
+        const timeChanged = (this.batchForm.beginTime || "") !== (this.originalBeginTime || "")
+          || (this.batchForm.endTime || "") !== (this.originalEndTime || "")
+          || (this.batchForm.remark || "") !== (this.originalRemark || "");
+        // 有效期或内容变化时，已选中的旧授权也要重推，保证统一；否则只下发新增门锁
+        const issueIds = timeChanged || valueChanged ? checkedIds.slice() : added.slice();
+        const needIssue = issueIds.length > 0;
+        const needRevoke = removed.length > 0;
+        if (!needIssue && !needRevoke) {
+          this.$modal.msgInfo("授权配置未发生变化");
+          return;
+        }
+        if (needRevoke && !this.$auth.hasPermi("lock:auth:remove")) {
+          this.$modal.msgWarning("没有删除授权权限，无法回收取消勾选的门锁");
+          return;
+        }
+        const result = {
+          total: checkedIds.length,
+          issued: issueIds.length,
+          created: 0,
+          overwritten: 0,
+          failed: 0,
+          revoked: 0,
+          revokeFailed: 0,
+          items: []
+        };
+        let issueFailed = false;
+        this.batchLoading = true;
+        let chain = Promise.resolve();
+        if (needIssue) {
+          const data = {
+            personNo: this.batchForm.personNo,
+            authType: this.batchForm.authType,
+            authValue: this.isBatchFace ? null : this.batchForm.authValue,
+            beginTime: this.batchForm.beginTime,
+            endTime: this.batchForm.endTime,
+            remark: this.batchForm.remark,
+            deviceIds: issueIds
+          };
+          chain = chain.then(() => batchAddAuth(data)).then(response => {
+            const detail = response.data || {};
+            result.created = detail.created || 0;
+            result.overwritten = detail.overwritten || 0;
+            result.failed = detail.failed || 0;
+            result.items = (detail.items || []).slice();
+          }).catch(() => {
+            issueFailed = true;
+          });
+        }
+        if (needRevoke) {
+          chain = chain.then(() => {
+            if (issueFailed) {
+              return null;
+            }
+            return delAuth(removed.map(auth => auth.authId)).then(() => {
+              result.revoked = removed.length;
+              removed.forEach(auth => {
+                result.items.push({
+                  deviceId: auth.deviceId,
+                  deviceSn: auth.deviceSn,
+                  deviceName: this.batchDeviceName(auth.deviceId),
+                  action: "REVOKED",
+                  syncMsg: "授权已回收"
+                });
+              });
+            }).catch(error => {
+              result.revokeFailed = removed.length;
+              removed.forEach(auth => {
+                result.items.push({
+                  deviceId: auth.deviceId,
+                  deviceSn: auth.deviceSn,
+                  deviceName: this.batchDeviceName(auth.deviceId),
+                  action: "REVOKE_FAILED",
+                  syncMsg: (error && error.message) || "回收失败"
+                });
+              });
+            });
+          });
+        }
+        chain.then(() => {
+          if (issueFailed) {
+            return;
+          }
+          this.batchOpen = false;
+          this.batchResult = result;
+          this.batchResultOpen = true;
+          this.getList();
+        }).catch(() => {}).then(() => {
+          this.batchLoading = false;
+        });
+      });
+    },
+    batchDeviceName(deviceId) {
+      const device = this.deviceOptions.find(item => item.deviceId === deviceId);
+      return device ? device.deviceName : undefined;
+    },
+    batchDeviceLabel(device) {
+      if (!device) {
+        return "-";
+      }
+      const name = device.deviceName || device.deviceSn
+        || (device.deviceId != null ? "门锁#" + device.deviceId : "-");
+      const sn = device.deviceSn ? "（" + device.deviceSn + "）" : "";
+      const room = device.roomNo ? " · " + device.roomNo : "";
+      return name + sn + room;
+    },
+    batchActionLabel(action) {
+      const labels = {
+        CREATED: "新增",
+        OVERWRITTEN: "覆盖",
+        FAILED: "下发失败",
+        REVOKED: "已回收",
+        REVOKE_FAILED: "回收失败"
+      };
+      return labels[action] || action;
+    },
+    batchActionTag(action) {
+      const types = {
+        CREATED: "success",
+        OVERWRITTEN: "warning",
+        FAILED: "danger",
+        REVOKED: "info",
+        REVOKE_FAILED: "danger"
+      };
+      return types[action] || "info";
+    },
+    handlePushPerson(row) {
+      pushAuthByPerson([row.personNo]).then(() => {
         this.$modal.msgSuccess("下发指令已提交");
         this.getList();
       });
     },
-    /**
-     * 删除设备侧人脸：下发 delete 帧，仅清除门锁上的人脸数据，平台授权记录保留
-     */
-    handleClear(row) {
-      const authId = row.authId;
-      this.$modal.confirm('确认删除该人员在门锁上的人脸数据？平台侧授权记录会保留。').then(function() {
-        return clearAuth(authId);
-      }).then(() => {
-        this.$modal.msgSuccess("删除指令已下发");
-        this.getList();
-      }).catch(() => {});
-    },
-    handleBatchPush() {
-      batchPush(this.ids).then(response => {
-        this.$modal.msgSuccess("批量下发已提交");
+    handleBatchPushPerson() {
+      pushAuthByPerson(this.ids).then(() => {
+        this.$modal.msgSuccess("下发指令已提交");
         this.getList();
       });
     },
-    handleDelete(row) {
-      const authIds = row.authId || this.ids;
-      this.$modal.confirm('是否确认删除授权编号为"' + authIds + '"的数据项？').then(function() {
-        return delAuth(authIds);
+    handleDeletePerson(row) {
+      const label = row.personName ? row.personName + '（' + row.personNo + '）' : row.personNo;
+      this.$modal.confirm('删除后将回收 ' + label + ' 名下全部 ' + row.authCount + ' 条门锁授权，是否继续？').then(function() {
+        return removeAuthByPerson([row.personNo]);
+      }).then(() => {
+        this.getList();
+        this.$modal.msgSuccess("已删除该人员的全部授权");
+      }).catch(() => {});
+    },
+    handleBatchDeletePerson() {
+      const personNos = this.ids.slice();
+      this.$modal.confirm('确认删除选中 ' + personNos.length + ' 名人员的全部门锁授权？').then(function() {
+        return removeAuthByPerson(personNos);
       }).then(() => {
         this.getList();
         this.$modal.msgSuccess("删除成功");
       }).catch(() => {});
     },
-    deviceLabel(deviceId, deviceSn) {
-      const device = this.deviceOptions.find(item => item.deviceId === deviceId);
-      if (device && device.deviceName) {
-        return device.deviceName + '（' + device.deviceSn + '）';
+    /** 切换页签：外部授权首次进入时按需加载；全部授权每次进入都刷新，状态随时在变 */
+    handleTabClick(tab) {
+      if (!tab) {
+        return;
+      }
+      if (tab.name === "external" && !this.externalLoaded) {
+        this.getExternalList();
+      }
+      if (tab.name === "all") {
+        this.getAllList();
       }
-      return deviceSn || '-';
     },
-    handleExport() {
-      this.download('lock/auth/export', {
-        ...this.queryParams
-      }, `auth_${new Date().getTime()}.xlsx`);
+    /** 全部授权：平台与外部授权一授权一行 */
+    getAllList() {
+      this.allLoading = true;
+      listAllAuth(this.allQuery).then(response => {
+        this.allRows = response.rows;
+        this.allTotal = response.total;
+        this.allLoading = false;
+      }).catch(() => {
+        this.allLoading = false;
+      });
+    },
+    handleAllQuery() {
+      this.allQuery.pageNum = 1;
+      this.getAllList();
+    },
+    resetAllQuery() {
+      this.allDateRange = [];
+      this.allQuery = {
+        pageNum: 1,
+        pageSize: this.allQuery.pageSize,
+        keyword: undefined,
+        deviceId: undefined,
+        groupId: undefined,
+        authType: undefined,
+        source: undefined,
+        syncStatus: undefined
+      };
+      this.getAllList();
+    },
+    handleAllDateChange(range) {
+      this.allQuery.params = {
+        beginTime: range && range.length ? range[0] : undefined,
+        endTime: range && range.length ? range[1] : undefined
+      };
+      this.handleAllQuery();
+    },
+    /** 授权状态详情：先用列表行补齐门锁/应用等展示字段，再拉取最新状态 */
+    openAllDetail(row) {
+      this.allDetail = Object.assign({}, row);
+      this.allDetailOpen = true;
+      this.reloadAllDetail();
+    },
+    reloadAllDetail() {
+      const authId = this.allDetail && this.allDetail.authId;
+      if (!authId) {
+        return;
+      }
+      getAuth(authId).then(response => {
+        const data = response.data;
+        if (!data || !this.allDetail || this.allDetail.authId !== authId) {
+          return;
+        }
+        // 详情接口不带门锁名/应用名，只覆盖授信状态相关字段
+        this.allDetail = Object.assign({}, this.allDetail, {
+          authNo: data.authNo || this.allDetail.authNo,
+          syncStatus: data.syncStatus,
+          syncTime: data.syncTime,
+          syncMsg: data.syncMsg,
+          retryCount: data.retryCount,
+          beginTime: data.beginTime,
+          endTime: data.endTime,
+          remark: data.remark,
+          updateTime: data.updateTime
+        });
+      }).catch(() => {});
+    },
+    allAuthLabel(row) {
+      const person = row.personName ? row.personName + '（' + row.personNo + '）' : row.personNo;
+      const device = row.deviceName || row.deviceSn || '-';
+      return (row.authNo || '授权#' + row.authId) + ' · ' + (person || '-') + ' · ' + device;
+    },
+    handleAllPush(row) {
+      this.$modal.confirm('确认重新下发「' + this.allAuthLabel(row) + '」？').then(() => {
+        return pushAuth(row.authId);
+      }).then(() => {
+        this.$modal.msgSuccess('下发指令已提交');
+        this.getAllList();
+      }).catch(() => {});
+    },
+    /** 删除授权：先下发清除再逻辑删除 */
+    handleAllDelete(row) {
+      this.$modal.confirm('删除将向门锁下发清除并删除授权：' + this.allAuthLabel(row) + '，是否继续？').then(() => {
+        return delAuth(row.authId);
+      }).then(() => {
+        this.$modal.msgSuccess('已删除授权');
+        this.getAllList();
+      }).catch(() => {});
+    },
+    /** 删除记录：设备侧已清除，仅移除平台记录 */
+    handleAllDeleteRecord(row) {
+      this.$modal.confirm('设备侧已清除，仅删除平台记录：' + this.allAuthLabel(row) + '，是否继续？').then(() => {
+        return delAuthRecord(row.authId);
+      }).then(() => {
+        this.$modal.msgSuccess('记录已删除');
+        this.getAllList();
+      }).catch(() => {});
+    },
+    getExternalList() {
+      this.externalLoading = true;
+      this.externalLoaded = true;
+      listExternalAuth(this.externalQuery).then(response => {
+        this.externalRows = response.rows;
+        this.externalTotal = response.total;
+        this.externalLoading = false;
+      }).catch(() => {
+        this.externalLoading = false;
+      });
+    },
+    handleExternalQuery() {
+      this.externalQuery.pageNum = 1;
+      this.getExternalList();
+    },
+    resetExternalQuery() {
+      this.externalDateRange = [];
+      this.externalQuery = {
+        pageNum: 1,
+        pageSize: this.externalQuery.pageSize,
+        keyword: undefined,
+        sourceAppCode: undefined,
+        deviceId: undefined,
+        groupId: undefined,
+        authType: undefined,
+        syncStatus: undefined
+      };
+      this.getExternalList();
+    },
+    handleExternalDateChange(range) {
+      this.externalQuery.params = {
+        beginTime: range && range.length ? range[0] : undefined,
+        endTime: range && range.length ? range[1] : undefined
+      };
+      this.handleExternalQuery();
+    },
+    handleExternalSelectionChange(selection) {
+      this.externalSelection = selection;
+    },
+    /** 外部页签口径：4 展示为“已取消”，其余沿用字典 */
+    externalStatusLabel(status) {
+      if (!status) {
+        return "待下发";
+      }
+      if (status === "4") {
+        return "已取消";
+      }
+      const dict = (this.dict.type.lock_sync_status || []).find(item => item.value === status);
+      return dict ? dict.label : status;
+    },
+    externalStatusTag(status) {
+      if (status === "2") {
+        return "success";
+      }
+      if (status === "3") {
+        return "danger";
+      }
+      if (status === "4") {
+        return "info";
+      }
+      return "warning";
+    },
+    openExternalDetail(row) {
+      getExternalAuth(row.authId).then(response => {
+        this.externalDetail = response.data;
+        this.externalDetailOpen = true;
+      });
+    },
+    openExternalEdit(row) {
+      this.externalForm = {
+        authId: row.authId,
+        authNo: row.authNo,
+        sourceAppCode: row.sourceAppCode,
+        sourceAppName: row.sourceAppName,
+        personNo: row.personNo,
+        personName: row.personName,
+        deviceSn: row.deviceSn,
+        deviceName: row.deviceName,
+        stayNo: row.stayNo,
+        beginTime: row.beginTime,
+        endTime: row.endTime,
+        remark: row.remark,
+        syncStatus: row.syncStatus
+      };
+      this.externalEditOpen = true;
+      this.$nextTick(() => {
+        this.$refs.externalForm && this.$refs.externalForm.clearValidate();
+      });
+    },
+    validateExternalEndTime(rule, value, callback) {
+      if (this.externalForm.beginTime && value && this.externalForm.beginTime > value) {
+        callback(new Error("失效时间不能早于生效时间"));
+        return;
+      }
+      callback();
+    },
+    submitExternalEdit() {
+      this.$refs.externalForm.validate(valid => {
+        if (!valid) {
+          return;
+        }
+        this.externalEditLoading = true;
+        const cancelled = this.externalForm.syncStatus === "4";
+        updateExternalAuth(this.externalForm.authId, {
+          beginTime: this.externalForm.beginTime,
+          endTime: this.externalForm.endTime,
+          remark: this.externalForm.remark
+        }).then(() => {
+          this.externalEditOpen = false;
+          this.$modal.msgSuccess(cancelled
+            ? "已保存；该授权已取消，需重新下发后生效"
+            : "已保存并重新下发");
+          this.getExternalList();
+        }).catch(() => {}).then(() => {
+          this.externalEditLoading = false;
+        });
+      });
+    },
+    handleExternalPush(row) {
+      const message = row.syncStatus === "4"
+        ? "重新下发将恢复该人员在此门锁上的权限，是否继续？"
+        : "确认重新下发该授权？";
+      this.$modal.confirm(message).then(function() {
+        return pushExternalAuth(row.authId);
+      }).then(() => {
+        this.getExternalList();
+        this.$modal.msgSuccess("下发指令已提交");
+      }).catch(() => {});
+    },
+    handleExternalClear(row) {
+      this.$modal.confirm("取消后仅清除门锁侧权限，平台记录保留为“已取消”，不影响关联入住单，也不回推外部系统。是否继续？").then(function() {
+        return clearExternalAuth(row.authId);
+      }).then(() => {
+        this.getExternalList();
+        this.$modal.msgSuccess("取消指令已提交");
+      }).catch(() => {});
+    },
+    handleExternalDelete(row) {
+      this.deleteExternal([row.authId], !!row.stayNo);
+    },
+    handleExternalBatchDelete() {
+      const authIds = this.externalSelection.map(item => item.authId);
+      const hasStay = this.externalSelection.some(item => !!item.stayNo);
+      this.deleteExternal(authIds, hasStay);
+    },
+    deleteExternal(authIds, hasStay) {
+      if (!authIds.length) {
+        return;
+      }
+      const extra = hasStay ? " 部分授权来自入住单，删除不会终止入住单，外部系统也不会收到通知。" : "";
+      this.$modal.confirm("确认删除选中的 " + authIds.length + " 条外部授权？将先下发清除再删除平台记录。" + extra).then(function() {
+        return delExternalAuth(authIds);
+      }).then(() => {
+        this.getExternalList();
+        this.$modal.msgSuccess("删除成功");
+      }).catch(() => {});
     }
   }
 };
 </script>
+
+<style scoped lang="scss">
+.multi-auth-dialog ::v-deep .el-dialog__body {
+  padding-top: 12px;
+  padding-bottom: 8px;
+}
+
+.edit-tip {
+  display: flex;
+  align-items: flex-start;
+  margin-bottom: 12px;
+  padding: 8px 12px;
+  font-size: 12px;
+  line-height: 1.6;
+  color: #8a5a00;
+  background: #fdf6ec;
+  border: 1px solid #faecd8;
+  border-radius: 6px;
+
+  i {
+    margin: 2px 6px 0 0;
+    color: #e6a23c;
+  }
+
+  b {
+    color: #e6a23c;
+  }
+}
+
+.auth-panel,
+.device-panel {
+  padding: 14px 16px 4px;
+  background: #fafbfc;
+  border: 1px solid #ebeef5;
+  border-radius: 8px;
+}
+
+.device-panel {
+  margin-top: 14px;
+  padding-bottom: 10px;
+}
+
+.panel-title {
+  display: flex;
+  align-items: center;
+  margin-bottom: 12px;
+  font-size: 14px;
+  font-weight: 600;
+  color: #303133;
+}
+
+.title-bar {
+  width: 3px;
+  height: 14px;
+  margin-right: 8px;
+  background: #409eff;
+  border-radius: 2px;
+}
+
+.selected-summary {
+  margin-left: auto;
+  font-size: 12px;
+  font-weight: normal;
+  color: #909399;
+
+  b {
+    font-size: 14px;
+    color: #409eff;
+  }
+}
+
+.person-auth-summary {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  margin-bottom: 12px;
+  padding: 6px 10px;
+  font-size: 12px;
+  color: #606266;
+  background: #ecf5ff;
+  border: 1px solid #d9ecff;
+  border-radius: 6px;
+}
+
+.person-auth-summary .summary-label {
+  margin-right: 8px;
+  color: #909399;
+}
+
+.person-auth-summary .type-tag {
+  margin-right: 6px;
+}
+
+.person-auth-summary .summary-hint {
+  margin-left: auto;
+  color: #c0c4cc;
+}
+
+.device-toolbar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  margin-bottom: 8px;
+}
+
+.device-form-item {
+  margin-bottom: 6px;
+
+  ::v-deep .el-form-item__content {
+    line-height: 1.4;
+  }
+}
+
+.device-tree-wrap {
+  width: 100%;
+  min-height: 120px;
+  max-height: 300px;
+  padding: 6px 8px;
+  overflow: auto;
+  background: #fff;
+  border: 1px solid #ebeef5;
+  border-radius: 6px;
+}
+
+.tree-node {
+  display: flex;
+  align-items: center;
+  flex: 1;
+  min-width: 0;
+  padding-right: 8px;
+  font-size: 13px;
+  color: #303133;
+}
+
+.tree-icon {
+  margin-right: 6px;
+  color: #909399;
+}
+
+.group-icon {
+  color: #409eff;
+}
+
+.tree-label {
+  overflow: hidden;
+  white-space: nowrap;
+  text-overflow: ellipsis;
+}
+
+.tree-sn {
+  margin-left: 6px;
+  font-size: 12px;
+  color: #909399;
+}
+
+.tree-tag {
+  margin-left: 6px;
+}
+
+.tree-offline {
+  margin-left: 6px;
+  font-size: 12px;
+  color: #f56c6c;
+}
+
+.tree-count {
+  margin-left: 8px;
+  font-size: 12px;
+  color: #c0c4cc;
+}
+
+.tree-empty {
+  padding: 28px 0;
+  font-size: 12px;
+  color: #c0c4cc;
+  text-align: center;
+}
+
+.panel-note {
+  margin-top: 4px;
+  font-size: 12px;
+  line-height: 1.6;
+  color: #909399;
+}
+
+.inline-alert {
+  margin-bottom: 12px;
+}
+
+.feature-box {
+  display: flex;
+  align-items: flex-start;
+  padding: 8px 10px;
+  line-height: 1.5;
+  background: #ecf5ff;
+  border: 1px solid #d9ecff;
+  border-radius: 6px;
+}
+
+.feature-icon {
+  margin: 2px 8px 0 0;
+  color: #409eff;
+}
+
+.feature-main {
+  font-size: 13px;
+  color: #303133;
+}
+
+.feature-sub {
+  margin-top: 2px;
+  font-size: 12px;
+  color: #909399;
+}
+
+.footer-tip {
+  margin-right: 12px;
+  font-size: 12px;
+  color: #909399;
+}
+
+.result-summary {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  margin-bottom: 12px;
+  padding: 10px 12px;
+  font-size: 13px;
+  color: #606266;
+  background: #f5f7fa;
+  border-radius: 6px;
+}
+
+.result-item b {
+  font-size: 15px;
+  color: #409eff;
+}
+
+.count-badge {
+  display: inline-block;
+  min-width: 26px;
+  padding: 0 8px;
+  font-weight: 600;
+  line-height: 22px;
+  color: #409eff;
+  background: #ecf5ff;
+  border-radius: 11px;
+}
+
+.issued-text {
+  font-weight: 600;
+  color: #67c23a;
+}
+
+.issued-text.issued-none {
+  font-weight: 400;
+  color: #c0c4cc;
+}
+
+.issued-total {
+  margin-left: 4px;
+  font-size: 12px;
+  color: #909399;
+}
+
+.text-muted {
+  color: #c0c4cc;
+}
+
+.type-tag {
+  margin: 2px 4px 2px 0;
+}
+
+.time-range {
+  font-size: 12px;
+  line-height: 1.6;
+  color: #606266;
+  text-align: left;
+}
+
+.time-range .time-end {
+  color: #909399;
+}
+
+.external-tip {
+  margin-bottom: 8px;
+  font-size: 12px;
+  line-height: 1.6;
+  color: #909399;
+}
+
+.cell-sub {
+  font-size: 12px;
+  line-height: 1.5;
+  color: #909399;
+}
+
+.offline-text {
+  margin-left: 6px;
+  color: #f56c6c;
+}
+
+.detail-grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 10px 24px;
+}
+
+.detail-item {
+  display: flex;
+  min-width: 0;
+  font-size: 13px;
+  line-height: 1.6;
+  color: #303133;
+}
+
+.detail-wide {
+  grid-column: 1 / -1;
+}
+
+.detail-label {
+  flex: 0 0 76px;
+  color: #909399;
+}
+</style>
diff --git a/base/RuoYi-Vue2-master/src/views/iot/device/index.vue b/base/RuoYi-Vue2-master/src/views/iot/device/index.vue
index 233e1fe..0a68a18 100644
--- a/base/RuoYi-Vue2-master/src/views/iot/device/index.vue
+++ b/base/RuoYi-Vue2-master/src/views/iot/device/index.vue
@@ -205,7 +205,7 @@
           <dict-tag :options="dict.type.sys_normal_disable" :value="scope.row.status"/>
         </template>
       </el-table-column>
-      <el-table-column label="操作" align="center" width="260" class-name="small-padding fixed-width">
+      <el-table-column label="操作" align="center" width="340" class-name="small-padding fixed-width">
         <template slot-scope="scope">
           <el-button
             size="mini"
@@ -221,6 +221,13 @@
             @click="handleSync(scope.row)"
             v-hasPermi="['lock:device:sync']"
           >同步</el-button>
+          <el-button
+            size="mini"
+            type="text"
+            icon="el-icon-key"
+            @click="handleDeviceAuth(scope.row)"
+            v-hasPermi="['lock:auth:list']"
+          >锁内授权</el-button>
           <el-button
             size="mini"
             type="text"
@@ -286,11 +293,122 @@
         <el-button @click="cancel">取 消</el-button>
       </div>
     </el-dialog>
+
+    <!-- 锁内授权对账对话框 -->
+    <el-dialog title="锁内授权对账" :visible.sync="deviceAuthOpen" width="1100px" append-to-body @closed="closeDeviceAuth">
+      <div class="auth-toolbar">
+        <div class="auth-device">
+          <span class="auth-device-name">{{ deviceAuthDevice.deviceSn }}</span>
+          <span class="auth-device-extra">{{ deviceAuthDevice.deviceName }} / 房间 {{ deviceAuthDevice.roomNo || '-' }}</span>
+        </div>
+        <div>
+          <el-button
+            type="primary"
+            size="mini"
+            icon="el-icon-refresh"
+            :loading="deviceAuthQuerying"
+            @click="handleReadDeviceAuth"
+          >读取锁内授权</el-button>
+          <el-button
+            size="mini"
+            icon="el-icon-refresh-right"
+            :loading="deviceAuthLoading"
+            @click="loadDeviceAuthSnapshot"
+          >刷新结果</el-button>
+        </div>
+      </div>
+
+      <el-alert :title="deviceAuthSnapshot.notice" type="info" :closable="false" show-icon />
+
+      <div class="auth-summary">
+        <el-tag size="mini" :type="queryStatusTag(deviceAuthSnapshot.queryStatus)">读取：{{ deviceAuthSnapshot.queryStatusName || '未读取' }}</el-tag>
+        <span v-if="deviceAuthSnapshot.queryTime" class="auth-summary-item">时间：{{ deviceAuthSnapshot.queryTime }}</span>
+        <span v-if="deviceAuthSnapshot.queryMsg" class="auth-summary-item">说明：{{ deviceAuthSnapshot.queryMsg }}</span>
+        <span class="auth-summary-item">设备侧 {{ deviceAuthSnapshot.deviceCount || 0 }}</span>
+        <span class="auth-summary-item">平台 {{ deviceAuthSnapshot.platformCount || 0 }}</span>
+        <span class="auth-summary-item">一致 {{ deviceAuthSnapshot.matchedCount || 0 }}</span>
+        <span class="auth-summary-item text-danger">仅设备 {{ deviceAuthSnapshot.deviceOnlyCount || 0 }}</span>
+        <span class="auth-summary-item text-warning">仅平台 {{ deviceAuthSnapshot.platformOnlyCount || 0 }}</span>
+        <span class="auth-summary-item">不支持查询 {{ deviceAuthSnapshot.notQueryableCount || 0 }}</span>
+      </div>
+
+      <el-table v-loading="deviceAuthLoading" :data="deviceAuthSnapshot.rows" size="mini" max-height="440" border>
+        <el-table-column label="来源" width="80" align="center">
+          <template slot-scope="scope">
+            <el-tag size="mini" :type="scope.row.source === 'DEVICE' ? '' : 'info'">{{ scope.row.source === 'DEVICE' ? '设备侧' : '平台' }}</el-tag>
+          </template>
+        </el-table-column>
+        <el-table-column label="索引" width="60" align="center">
+          <template slot-scope="scope">{{ scope.row.rowIndex == null ? '-' : scope.row.rowIndex }}</template>
+        </el-table-column>
+        <el-table-column label="凭据(脱敏)" prop="credential" min-width="140" show-overflow-tooltip />
+        <el-table-column label="类型" prop="authTypeName" width="80" align="center" />
+        <el-table-column label="人员" width="170" show-overflow-tooltip>
+          <template slot-scope="scope">
+            <span v-if="scope.row.personNo">{{ scope.row.personName }}（{{ scope.row.personNo }}）</span>
+            <span v-else>-</span>
+          </template>
+        </el-table-column>
+        <el-table-column label="对账" width="130" align="center">
+          <template slot-scope="scope">
+            <el-tag size="mini" :type="matchStatusTag(scope.row.matchStatus)">{{ scope.row.matchStatusName }}</el-tag>
+          </template>
+        </el-table-column>
+        <el-table-column label="生效时间" prop="beginTime" width="150" align="center" />
+        <el-table-column label="失效时间" prop="endTime" width="150" align="center" />
+        <el-table-column label="清除" width="90" align="center">
+          <template slot-scope="scope">
+            <el-tag size="mini" :type="clearStatusTag(scope.row.clearStatus)">{{ scope.row.clearStatusName }}</el-tag>
+          </template>
+        </el-table-column>
+        <el-table-column label="说明" prop="remark" min-width="180" show-overflow-tooltip />
+        <el-table-column label="操作" width="80" align="center">
+          <template slot-scope="scope">
+            <el-button
+              v-if="scope.row.clearable"
+              size="mini"
+              type="text"
+              icon="el-icon-delete"
+              style="color: #f56c6c"
+              @click="handleClearDeviceAuth(scope.row)"
+            >清除</el-button>
+            <span v-else>-</span>
+          </template>
+        </el-table-column>
+      </el-table>
+
+      <el-dialog title="选择凭据类型" :visible.sync="deviceAuthClearOpen" width="400px" append-to-body>
+        <div class="auth-clear-tip">
+          设备返回的凭据「{{ deviceAuthClearRow.credential }}」在平台没有匹配授权，无法自动判断类型。
+        </div>
+        <el-radio-group v-model="deviceAuthClearType">
+          <el-radio label="02">密码</el-radio>
+          <el-radio label="04">IC卡</el-radio>
+        </el-radio-group>
+        <div slot="footer" class="dialog-footer">
+          <el-button size="mini" @click="deviceAuthClearOpen = false">取 消</el-button>
+          <el-button size="mini" type="danger" :loading="deviceAuthClearing" @click="confirmClearDeviceAuth">确认清除</el-button>
+        </div>
+      </el-dialog>
+    </el-dialog>
   </div>
 </template>
 
 <script>
-import { listDevice, getDevice, delDevice, addDevice, updateDevice, syncTime, batchSyncTime, remoteSwitch, clearFaceAuthByDevices } from "@/api/iot/device";
+import {
+  listDevice,
+  getDevice,
+  delDevice,
+  addDevice,
+  updateDevice,
+  syncTime,
+  batchSyncTime,
+  remoteSwitch,
+  clearFaceAuthByDevices,
+  queryDeviceAuths,
+  getDeviceAuthSnapshot,
+  clearDeviceAuth
+} from "@/api/iot/device";
 
 export default {
   name: "Device",
@@ -325,7 +443,18 @@ export default {
         deviceSn: [
           { required: true, message: "门锁SN不能为空", trigger: "blur" }
         ]
-      }
+      },
+      deviceAuthOpen: false,
+      deviceAuthLoading: false,
+      deviceAuthQuerying: false,
+      deviceAuthDevice: {},
+      deviceAuthSnapshot: { rows: [] },
+      deviceAuthClearOpen: false,
+      deviceAuthClearRow: {},
+      deviceAuthClearType: "02",
+      deviceAuthClearing: false,
+      deviceAuthTimer: null,
+      deviceAuthRefreshTimer: null
     };
   },
   created() {
@@ -457,6 +586,148 @@ export default {
         this.$modal.msgSuccess("开锁指令已下发");
       }).catch(() => {});
     },
+    handleDeviceAuth(row) {
+      this.deviceAuthDevice = row;
+      this.deviceAuthSnapshot = { rows: [] };
+      this.deviceAuthOpen = true;
+      this.loadDeviceAuthSnapshot();
+    },
+    loadDeviceAuthSnapshot() {
+      if (!this.deviceAuthDevice.deviceId) {
+        return Promise.resolve();
+      }
+      this.deviceAuthLoading = true;
+      return getDeviceAuthSnapshot(this.deviceAuthDevice.deviceId).then(response => {
+        this.deviceAuthSnapshot = response.data || { rows: [] };
+        if (!this.deviceAuthSnapshot.rows) {
+          this.deviceAuthSnapshot.rows = [];
+        }
+        this.deviceAuthLoading = false;
+      }, () => {
+        this.deviceAuthLoading = false;
+      });
+    },
+    handleReadDeviceAuth() {
+      if (this.deviceAuthQuerying) {
+        return;
+      }
+      this.deviceAuthQuerying = true;
+      queryDeviceAuths(this.deviceAuthDevice.deviceId).then(() => {
+        this.$modal.msgSuccess("读取指令已下发，正在等待设备返回");
+        this.loadDeviceAuthSnapshot();
+        this.startDeviceAuthPolling();
+      }, () => {}).then(() => {
+        this.deviceAuthQuerying = false;
+      });
+    },
+    startDeviceAuthPolling() {
+      this.stopDeviceAuthPolling();
+      let tries = 0;
+      this.deviceAuthTimer = setInterval(() => {
+        tries++;
+        this.loadDeviceAuthSnapshot().then(() => {
+          const status = this.deviceAuthSnapshot.queryStatus;
+          if ((status && status !== "0" && status !== "1") || tries >= 15) {
+            this.stopDeviceAuthPolling();
+          }
+        });
+      }, 2000);
+    },
+    stopDeviceAuthPolling() {
+      if (this.deviceAuthTimer) {
+        clearInterval(this.deviceAuthTimer);
+        this.deviceAuthTimer = null;
+      }
+    },
+    closeDeviceAuth() {
+      this.stopDeviceAuthPolling();
+      if (this.deviceAuthRefreshTimer) {
+        clearTimeout(this.deviceAuthRefreshTimer);
+        this.deviceAuthRefreshTimer = null;
+      }
+      this.deviceAuthClearOpen = false;
+    },
+    handleClearDeviceAuth(row) {
+      if (!row || !row.deviceAuthId) {
+        return;
+      }
+      if (row.authType) {
+        this.$modal.confirm('确认清除设备侧' + (row.authTypeName || '') + '授权「' + row.credential + '」？平台对应授权状态将同步更新。').then(() => {
+          this.submitClearDeviceAuth(row, row.authType);
+        }).catch(() => {});
+        return;
+      }
+      this.deviceAuthClearRow = row;
+      this.deviceAuthClearType = "02";
+      this.deviceAuthClearOpen = true;
+    },
+    confirmClearDeviceAuth() {
+      this.submitClearDeviceAuth(this.deviceAuthClearRow, this.deviceAuthClearType);
+    },
+    submitClearDeviceAuth(row, authType) {
+      const target = row || this.deviceAuthClearRow;
+      const type = authType || this.deviceAuthClearType;
+      if (!target || !target.deviceAuthId || this.deviceAuthClearing) {
+        return;
+      }
+      this.deviceAuthClearing = true;
+      clearDeviceAuth(this.deviceAuthDevice.deviceId, {
+        deviceAuthId: target.deviceAuthId,
+        authType: type
+      }).then(() => {
+        this.deviceAuthClearOpen = false;
+        this.$modal.msgSuccess("清除指令已下发");
+        this.loadDeviceAuthSnapshot();
+        this.scheduleDeviceAuthRefresh();
+      }, () => {}).then(() => {
+        this.deviceAuthClearing = false;
+      });
+    },
+    scheduleDeviceAuthRefresh() {
+      if (this.deviceAuthRefreshTimer) {
+        clearTimeout(this.deviceAuthRefreshTimer);
+      }
+      this.deviceAuthRefreshTimer = setTimeout(() => {
+        this.deviceAuthRefreshTimer = null;
+        this.loadDeviceAuthSnapshot();
+      }, 4000);
+    },
+    queryStatusTag(status) {
+      if (status === "2") {
+        return "success";
+      }
+      if (status === "3" || status === "4") {
+        return "danger";
+      }
+      if (status === "0" || status === "1") {
+        return "warning";
+      }
+      return "info";
+    },
+    matchStatusTag(status) {
+      if (status === "MATCHED") {
+        return "success";
+      }
+      if (status === "DEVICE_ONLY") {
+        return "danger";
+      }
+      if (status === "PLATFORM_ONLY") {
+        return "warning";
+      }
+      return "info";
+    },
+    clearStatusTag(status) {
+      if (status === "2") {
+        return "success";
+      }
+      if (status === "1") {
+        return "warning";
+      }
+      if (status === "3") {
+        return "danger";
+      }
+      return "info";
+    },
     handleDelete(row) {
       const deviceIds = row.deviceId || this.ids;
       this.$modal.confirm('是否确认删除门锁编号为"' + deviceIds + '"的数据项？').then(function() {
@@ -486,4 +757,34 @@ export default {
 .text-warning {
   color: #e6a23c;
 }
+.auth-toolbar {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  margin-bottom: 10px;
+}
+.auth-device-name {
+  font-weight: 600;
+  margin-right: 8px;
+}
+.auth-device-extra {
+  color: #909399;
+  font-size: 12px;
+}
+.auth-summary {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  margin: 10px 0;
+  font-size: 12px;
+  color: #606266;
+}
+.auth-summary-item {
+  margin-left: 14px;
+}
+.auth-clear-tip {
+  margin-bottom: 16px;
+  color: #606266;
+  line-height: 1.6;
+}
 </style>