diff --git a/internal/handler/admin/device.go b/internal/handler/admin/device.go
index 3575cb77..2a3abb0e 100644
--- a/internal/handler/admin/device.go
+++ b/internal/handler/admin/device.go
@@ -38,6 +38,10 @@ func (h *DeviceHandler) List(c *fiber.Ctx) error {
 // ListDeviceTypes 查询设备类型选项。
 // GET /api/admin/devices/types
 func (h *DeviceHandler) ListDeviceTypes(c *fiber.Ctx) error {
+	userType := middleware.GetUserTypeFromContext(c.UserContext())
+	if userType != constants.UserTypeSuperAdmin && userType != constants.UserTypePlatform {
+		return errors.New(errors.CodeForbidden, constants.PlatformManagementForbiddenMessage)
+	}
 	result, err := h.service.ListDeviceTypes(c.UserContext())
 	if err != nil {
 		return err
diff --git a/internal/routes/device.go b/internal/routes/device.go
index c9f3c5fa..2cf01e96 100644
--- a/internal/routes/device.go
+++ b/internal/routes/device.go
@@ -6,24 +6,15 @@ import (
 	"github.com/break/junhong_cmp_fiber/internal/gateway"
 	"github.com/break/junhong_cmp_fiber/internal/handler/admin"
 	"github.com/break/junhong_cmp_fiber/internal/model/dto"
-	"github.com/break/junhong_cmp_fiber/pkg/constants"
-	"github.com/break/junhong_cmp_fiber/pkg/errors"
-	"github.com/break/junhong_cmp_fiber/pkg/middleware"
 	"github.com/break/junhong_cmp_fiber/pkg/openapi"
 )
 
 func registerDeviceRoutes(router fiber.Router, handler *admin.DeviceHandler, importHandler *admin.DeviceImportHandler, doc *openapi.Generator, basePath string) {
 	devices := router.Group("/devices")
 	groupPath := basePath + "/devices"
-	platformDevices := router.Group("/devices", func(c *fiber.Ctx) error {
-		userType := middleware.GetUserTypeFromContext(c.UserContext())
-		if userType != constants.UserTypeSuperAdmin && userType != constants.UserTypePlatform {
-			return errors.New(errors.CodeForbidden, constants.PlatformManagementForbiddenMessage)
-		}
-		return c.Next()
-	})
 
-	Register(platformDevices, doc, groupPath, "GET", "/types", handler.ListDeviceTypes, RouteSpec{
+	// 仅平台可用的判断放在 ListDeviceTypes 内部：Fiber 的 Group 带处理函数会注册为整个 /devices 前缀的中间件，会拦住代理与企业账号的所有设备接口。
+	Register(devices, doc, groupPath, "GET", "/types", handler.ListDeviceTypes, RouteSpec{
 		Summary:     "查询设备类型选项",
 		Description: "仅超级管理员与平台账号可访问。返回未删除设备中去重、去除首尾空白且按升序排列的非空设备类型字符串。",
 		Tags:        []string{"设备管理"},