功能：优化账号分层与管理员初始化

backend/cmd/server/main.go

@@ -84,7 +84,7 @@ func main() {
 		cfg.DeliveryLinkTTLMinutes,
 	)
 
-	if err := authSvc.EnsureAdmin(); err != nil {
+	if err := authSvc.EnsureAdmin(cfg.InitialAdminUsername, cfg.InitialAdminPassword); err != nil {
 		log.Fatalf("ensure admin: %v", err)
 	}
 

backend/internal/config/config.go

@@ -14,6 +14,9 @@ type Config struct {
 	JWTSecret   string
 	DatabaseURL string
 	Mode        string // debug / release
+	// InitialAdminUsername 和 InitialAdminPassword 仅用于空数据库首次创建平台管理员。
+	InitialAdminUsername string
+	InitialAdminPassword string
 	// DataEncryptionKey 用于加密保存 API/回调密钥；为空时由 JWT_SECRET 派生。
 	DataEncryptionKey string
 	// OpenAPIKey 皮肤源头开放接口标识（Header: X-Api-Key，可公开给对接方）
@@ -67,6 +70,8 @@ func Load() *Config {
 		JWTSecret:                             getEnv("JWT_SECRET", "affiliate-dash-dev-secret-change-me"),
 		DatabaseURL:                           getEnv("DATABASE_URL", "postgres://affiliate:affiliate_dev_password@127.0.0.1:15432/affiliate_dash?sslmode=disable&TimeZone=Asia/Shanghai"),
 		Mode:                                  mode,
+		InitialAdminUsername:                  getEnv("INITIAL_ADMIN_USERNAME", ""),
+		InitialAdminPassword:                  getEnv("INITIAL_ADMIN_PASSWORD", ""),
 		DataEncryptionKey:                     getEnv("DATA_ENCRYPTION_KEY", getEnv("JWT_SECRET", "affiliate-dash-dev-secret-change-me")),
 		OpenAPIKey:                            getEnv("OPEN_API_KEY", "sk_source_dev_key_change_me"),
 		OpenAPISecret:                         getEnv("OPEN_API_SECRET", "sk_source_dev_secret_change_me"),

backend/internal/handler/user.go

@@ -43,6 +43,17 @@ func (h *UserHandler) List(c *gin.Context) {
 	response.Page(c, list, total, page, size)
 }
 
+func (h *UserHandler) ListMerchantMembers(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	size, _ := strconv.Atoi(c.DefaultQuery("size", "20"))
+	list, total, err := h.svc.ListMerchantMembers(page, size)
+	if err != nil {
+		response.ServerError(c, err.Error())
+		return
+	}
+	response.Page(c, list, total, page, size)
+}
+
 type createUserReq struct {
 	Username string `json:"username" binding:"required"`
 	Password string `json:"password" binding:"required,min=6"`
@@ -82,6 +93,24 @@ func (h *UserHandler) UpdateStatus(c *gin.Context) {
 	response.OK(c, nil)
 }
 
+type userRoleReq struct {
+	Role string `json:"role" binding:"required"`
+}
+
+func (h *UserHandler) UpdateRole(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	var req userRoleReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "参数错误：角色必填")
+		return
+	}
+	if err := h.svc.UpdateRole(uint(id), req.Role, middleware.GetUserID(c)); err != nil {
+		response.BadRequest(c, err.Error())
+		return
+	}
+	response.OK(c, nil)
+}
+
 func (h *UserHandler) Delete(c *gin.Context) {
 	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
 	if err := h.svc.Delete(uint(id), middleware.GetUserID(c)); err != nil {

backend/internal/router/router.go

@@ -193,8 +193,10 @@ func Setup(h *Handlers) *gin.Engine {
 			admin.Use(middleware.RequireRole(model.RoleAdmin))
 			{
 				admin.GET("/users", h.User.List)
+				admin.GET("/platform/members", h.User.ListMerchantMembers)
 				admin.POST("/users", h.User.Create)
 				admin.PATCH("/users/:id/status", h.User.UpdateStatus)
+				admin.PATCH("/users/:id/role", h.User.UpdateRole)
 				admin.DELETE("/users/:id", h.User.Delete)
 				admin.GET("/platform/merchants", h.Merchant.ListPlatformMerchants)
 				admin.POST("/platform/merchants", h.Merchant.CreateMerchant)

backend/internal/service/auth.go

@@ -86,7 +86,9 @@ func (s *AuthService) ChangePassword(userID uint, currentPassword, newPassword s
 	return s.db.Model(&user).Update("password_hash", string(hash)).Error
 }
 
-func (s *AuthService) EnsureAdmin() error {
+// EnsureAdmin creates the first platform administrator for an empty database.
+// Existing administrator accounts are never changed by environment variables.
+func (s *AuthService) EnsureAdmin(username, password string) error {
 	var count int64
 	s.db.Model(&model.User{}).Where("role = ?", model.RoleAdmin).Count(&count)
 	if count > 0 {
@@ -103,14 +105,21 @@ func (s *AuthService) EnsureAdmin() error {
 		}
 		return nil
 	}
-	hash, err := bcrypt.GenerateFromPassword([]byte("admin123"), bcrypt.DefaultCost)
+	username = strings.TrimSpace(username)
+	if len(username) < 3 {
+		return errors.New("空数据库首次启动必须设置 INITIAL_ADMIN_USERNAME（至少 3 位）")
+	}
+	if len(password) < 8 {
+		return errors.New("空数据库首次启动必须设置 INITIAL_ADMIN_PASSWORD（至少 8 位）")
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
 	if err != nil {
 		return err
 	}
 	admin := &model.User{
-		Username:     "admin",
+		Username:     username,
 		PasswordHash: string(hash),
-		Nickname:     "管理员",
+		Nickname:     username,
 		Role:         model.RoleAdmin,
 		Status:       1,
 	}

backend/internal/service/merchant_test.go

@@ -224,3 +224,57 @@ func TestUserServiceCannotDeleteOrDisableLastAdmin(t *testing.T) {
 		t.Fatal("should not delete the last enabled admin")
 	}
 }
+
+func TestUserServicePromotesMerchantAccountToPlatformAdmin(t *testing.T) {
+	db := newServiceTestDB(t)
+	var merchant model.Merchant
+	if err := db.Where("code = ?", model.MerchantCodeSelfOperated).First(&merchant).Error; err != nil {
+		t.Fatalf("load self-operated merchant: %v", err)
+	}
+	svc := NewUserService(db, NewTenantService(db))
+	actor, err := svc.Create("existing-admin", "password123", "现有管理员", model.RoleAdmin, 0)
+	if err != nil {
+		t.Fatalf("create actor: %v", err)
+	}
+	member, err := svc.Create("skin_nh_admin", "password123", "新管理员", model.RoleMerchant, 0)
+	if err != nil {
+		t.Fatalf("create merchant user: %v", err)
+	}
+	if err := svc.UpdateRole(member.ID, model.RoleAdmin, actor.ID); err != nil {
+		t.Fatalf("promote account: %v", err)
+	}
+	var promoted model.User
+	if err := db.First(&promoted, member.ID).Error; err != nil || promoted.Role != model.RoleAdmin {
+		t.Fatalf("account should be admin, user=%+v err=%v", promoted, err)
+	}
+	var membership model.MerchantMember
+	if err := db.Where("merchant_id = ? AND user_id = ?", merchant.ID, member.ID).First(&membership).Error; err != nil {
+		t.Fatalf("promoted account should join self-operated merchant: %v", err)
+	}
+	if membership.Role != model.MemberRoleOwner || !membership.IsDefault {
+		t.Fatalf("unexpected promoted membership: %+v", membership)
+	}
+}
+
+func TestEnsureAdminUsesConfiguredCredentialsOnlyForEmptyDatabase(t *testing.T) {
+	db := newServiceTestDB(t)
+	tenant := NewTenantService(db)
+	auth := NewAuthService(db, nil, tenant)
+	if err := auth.EnsureAdmin("skin_nh_admin", "secure-password"); err != nil {
+		t.Fatalf("create configured admin: %v", err)
+	}
+	var created model.User
+	if err := db.Where("username = ?", "skin_nh_admin").First(&created).Error; err != nil {
+		t.Fatalf("configured admin should exist: %v", err)
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(created.PasswordHash), []byte("secure-password")); err != nil {
+		t.Fatalf("configured password should match: %v", err)
+	}
+	if err := auth.EnsureAdmin("replacement-admin", "another-password"); err != nil {
+		t.Fatalf("existing admin should not be replaced: %v", err)
+	}
+	var count int64
+	if err := db.Model(&model.User{}).Where("role = ?", model.RoleAdmin).Count(&count).Error; err != nil || count != 1 {
+		t.Fatalf("existing admin should remain unchanged, count=%d err=%v", count, err)
+	}
+}

backend/internal/service/user.go

@@ -7,6 +7,7 @@ import (
 
 	"golang.org/x/crypto/bcrypt"
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 )
 
 type UserService struct {
@@ -58,6 +59,23 @@ func (s *UserService) List(q UserListQuery) ([]model.User, int64, error) {
 	return list, total, err
 }
 
+// ListMerchantMembers returns employee assignments across merchants for platform operations.
+func (s *UserService) ListMerchantMembers(page, size int) ([]model.MerchantMember, int64, error) {
+	page, size = normalizePage(page, size)
+	tx := s.db.Model(&model.MerchantMember{}).
+		Joins("JOIN users ON users.id = merchant_members.user_id AND users.deleted_at IS NULL").
+		Where("users.role = ?", model.RoleMerchant)
+	var total int64
+	if err := tx.Count(&total).Error; err != nil {
+		return nil, 0, err
+	}
+	var members []model.MerchantMember
+	err := tx.Preload("Merchant").Preload("User").
+		Order("merchant_members.merchant_id ASC, merchant_members.id ASC").
+		Offset((page - 1) * size).Limit(size).Find(&members).Error
+	return members, total, err
+}
+
 func (s *UserService) Create(username, password, nickname, role string, merchantID uint) (*model.User, error) {
 	var count int64
 	s.db.Model(&model.User{}).Where("username = ?", username).Count(&count)
@@ -137,6 +155,58 @@ func (s *UserService) UpdateStatus(id uint, status int) error {
 	})
 }
 
+// UpdateRole changes the platform-level account role. Promoted administrators are
+// also made owners of the self-operated merchant for a consistent merchant context.
+func (s *UserService) UpdateRole(id uint, role string, actorUserID uint) error {
+	if id == 0 {
+		return errors.New("用户不存在")
+	}
+	if id == actorUserID {
+		return errors.New("不能修改当前登录账号的系统角色")
+	}
+	if role != model.RoleAdmin && role != model.RoleMerchant {
+		return errors.New("无效的账号角色")
+	}
+	return s.db.Transaction(func(tx *gorm.DB) error {
+		var user model.User
+		if err := tx.First(&user, id).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return errors.New("用户不存在")
+			}
+			return err
+		}
+		if user.Role == role {
+			return nil
+		}
+		if user.Role == model.RoleAdmin && user.Status == 1 && role != model.RoleAdmin {
+			var admins int64
+			if err := tx.Model(&model.User{}).Where("role = ? AND status = ?", model.RoleAdmin, 1).Count(&admins).Error; err != nil {
+				return err
+			}
+			if admins <= 1 {
+				return errors.New("至少保留一个启用的平台管理员")
+			}
+		}
+		if err := tx.Model(&user).Update("role", role).Error; err != nil {
+			return err
+		}
+		if role != model.RoleAdmin {
+			return nil
+		}
+		var merchant model.Merchant
+		if err := tx.Where("code = ?", model.MerchantCodeSelfOperated).First(&merchant).Error; err != nil {
+			return err
+		}
+		member := model.MerchantMember{MerchantID: merchant.ID, UserID: user.ID, Role: model.MemberRoleOwner, Status: user.Status, IsDefault: true}
+		return tx.Clauses(clause.OnConflict{
+			Columns: []clause.Column{{Name: "merchant_id"}, {Name: "user_id"}},
+			DoUpdates: clause.Assignments(map[string]interface{}{
+				"role": model.MemberRoleOwner, "status": user.Status, "is_default": true,
+			}),
+		}).Create(&member).Error
+	})
+}
+
 // Delete removes a platform account and its merchant memberships. It protects the current
 // account and the final enabled platform administrator so the platform cannot be locked out.
 func (s *UserService) Delete(id, actorUserID uint) error {