feat: 全局数据隔离 + 响应结构统一 + 交接文档

1. 新增SysOrgService业务数据隔离工具方法(applyBusinessOrgScope/getUserOrgMpath)
2. 10个Controller接入组织数据隔离(设备/订单/退款/统计/定价/支付配置/激活码/用户)
3. 统一响应结构：写操作从R.ok()改为R.dataSuccess(data)
4. 修复5处data.data双层嵌套
5. 修复SysUserController.info()不一致
6. 修复循环依赖(@Lazy)
7. 新增交接文档HANDOVER.md

src/main/java/io/as/modules/device/controller/DeviceController.java

@@ -5,6 +5,8 @@ import io.as.common.utils.PageUtils;
 import io.as.common.utils.R;
 import io.as.modules.device.entity.DeviceEntity;
 import io.as.modules.device.service.DeviceService;
+import io.as.modules.sys.controller.AbstractController;
+import io.as.modules.sys.service.SysOrgService;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -19,18 +21,21 @@ import java.util.Map;
 @Api(tags = "终端管理")
 @RestController
 @RequestMapping("/manage/device")
-public class DeviceController {
+public class DeviceController extends AbstractController {
 
 	@Autowired
 	private DeviceService deviceService;
 
+	@Autowired
+	private SysOrgService sysOrgService;
+
 	/**
 	 * 分页查询设备列表
 	 */
 	@ApiOperation("分页查询设备列表")
 	@GetMapping("/list")
 	public R list(@RequestParam Map<String, Object> params) {
-		PageUtils page = deviceService.queryPage(params);
+		PageUtils page = deviceService.queryPage(params, getUserId());
 		Map<String, Object> data = new HashMap<>();
 		data.put("page", page);
 		return R.dataSuccess(data);
@@ -43,6 +48,9 @@ public class DeviceController {
 	@GetMapping("/info/{id}")
 	public R info(@PathVariable("id") Long id) {
 		DeviceEntity device = deviceService.getById(id);
+		if (device != null && !sysOrgService.isOrgInScope(device.getStoreOrgId(), getUserId())) {
+			return R.error(403, "无权限查看该设备");
+		}
 		Map<String, Object> data = new HashMap<>();
 		data.put("device", device);
 		return R.dataSuccess(data);
@@ -55,8 +63,13 @@ public class DeviceController {
 	@AuditAction(value = "DEVICE_SAVE", description = "新增设备")
 	@PostMapping("/save")
 	public R save(@RequestBody DeviceEntity device) {
+		if (device.getStoreOrgId() != null && !sysOrgService.isOrgInScope(device.getStoreOrgId(), getUserId())) {
+			return R.error(403, "无权限操作该门店");
+		}
 		deviceService.saveDevice(device);
-		return R.ok();
+		Map<String, Object> data = new HashMap<>();
+		data.put("id", device.getId());
+		return R.dataSuccess(data);
 	}
 
 	/**
@@ -66,8 +79,12 @@ public class DeviceController {
 	@AuditAction(value = "DEVICE_UPDATE", description = "修改设备")
 	@PostMapping("/update")
 	public R update(@RequestBody DeviceEntity device) {
+		DeviceEntity existing = deviceService.getById(device.getId());
+		if (existing != null && !sysOrgService.isOrgInScope(existing.getStoreOrgId(), getUserId())) {
+			return R.error(403, "无权限操作该设备");
+		}
 		deviceService.updateDevice(device);
-		return R.ok();
+		return R.dataSuccess(new HashMap<>());
 	}
 
 	/**
@@ -77,8 +94,14 @@ public class DeviceController {
 	@AuditAction(value = "DEVICE_DELETE", description = "删除设备")
 	@PostMapping("/delete")
 	public R delete(@RequestBody Long[] ids) {
+		for (Long id : ids) {
+			DeviceEntity device = deviceService.getById(id);
+			if (device != null && !sysOrgService.isOrgInScope(device.getStoreOrgId(), getUserId())) {
+				return R.error(403, "无权限删除该设备");
+			}
+		}
 		deviceService.delete(ids);
-		return R.ok();
+		return R.dataSuccess(new HashMap<>());
 	}
 
 	/**
@@ -88,7 +111,10 @@ public class DeviceController {
 	@AuditAction(value = "DEVICE_BIND_STORE", description = "设备绑定门店")
 	@PostMapping("/bindStore")
 	public R bindStore(@RequestParam("deviceId") Long deviceId, @RequestParam("storeOrgId") Long storeOrgId) {
+		if (!sysOrgService.isOrgInScope(storeOrgId, getUserId())) {
+			return R.error(403, "无权限绑定到此门店");
+		}
 		deviceService.bindStore(deviceId, storeOrgId);
-		return R.ok();
+		return R.dataSuccess(new HashMap<>());
 	}
 }