feat: add customer authentication and scoped RBAC

vehicle-data-platform/apps/api/internal/platform/alert.go

@@ -41,6 +41,19 @@ func (s *Service) AlertSummary(ctx context.Context, query AlertQuery) (AlertSumm
 }
 
 func (s *Service) AlertEvents(ctx context.Context, query AlertQuery) (Page[AlertEvent], error) {
+	if principal, ok := PrincipalFromContext(ctx); ok && principal.UserType == "customer" {
+		if strings.TrimSpace(query.Keyword) == "" {
+			return Page[AlertEvent]{}, clientError{Code: "VEHICLE_PERMISSION_DENIED", Message: "客户账号仅可查询已授权车辆的告警"}
+		}
+		vin, err := s.resolveVehicleVIN(ctx, query.Keyword, query.Protocol)
+		if err != nil {
+			return Page[AlertEvent]{}, err
+		}
+		if err := authorizeVehicleVIN(ctx, vin); err != nil {
+			return Page[AlertEvent]{}, err
+		}
+		query.Keyword = vin
+	}
 	store, err := s.alertStore()
 	if err != nil {
 		return Page[AlertEvent]{}, err