功能：增加平台账号管理与管理员保护

backend/internal/handler/user.go

@@ -4,6 +4,7 @@ import (
 	"strconv"
 
 	"affiliate_dash/internal/middleware"
+	"affiliate_dash/internal/model"
 	"affiliate_dash/internal/pkg/response"
 	"affiliate_dash/internal/service"
 
@@ -22,11 +23,13 @@ func (h *UserHandler) List(c *gin.Context) {
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
 	size, _ := strconv.Atoi(c.DefaultQuery("size", "20"))
 	q := service.UserListQuery{
-		MerchantID: middleware.GetMerchantID(c),
-		Page:       page,
-		Size:       size,
-		Keyword:    c.Query("keyword"),
-		Role:       c.Query("role"),
+		Page:    page,
+		Size:    size,
+		Keyword: c.Query("keyword"),
+		Role:    c.Query("role"),
+	}
+	if middleware.GetRole(c) != model.RoleAdmin {
+		q.MerchantID = middleware.GetMerchantID(c)
 	}
 	if s := c.Query("status"); s != "" {
 		v, _ := strconv.Atoi(s)
@@ -78,3 +81,12 @@ func (h *UserHandler) UpdateStatus(c *gin.Context) {
 	}
 	response.OK(c, nil)
 }
+
+func (h *UserHandler) Delete(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err := h.svc.Delete(uint(id), middleware.GetUserID(c)); err != nil {
+		response.BadRequest(c, err.Error())
+		return
+	}
+	response.OK(c, nil)
+}

backend/internal/router/router.go

@@ -195,6 +195,7 @@ func Setup(h *Handlers) *gin.Engine {
 				admin.GET("/users", h.User.List)
 				admin.POST("/users", h.User.Create)
 				admin.PATCH("/users/:id/status", h.User.UpdateStatus)
+				admin.DELETE("/users/:id", h.User.Delete)
 				admin.GET("/platform/merchants", h.Merchant.ListPlatformMerchants)
 				admin.POST("/platform/merchants", h.Merchant.CreateMerchant)
 				admin.PATCH("/platform/merchants/:id", h.Merchant.UpdateMerchantSettings)

backend/internal/service/merchant_test.go

@@ -202,3 +202,25 @@ func TestAuthServiceChangePasswordVerifiesCurrentPassword(t *testing.T) {
 		t.Fatal("old password should no longer match")
 	}
 }
+
+func TestUserServiceCannotDeleteOrDisableLastAdmin(t *testing.T) {
+	db := newServiceTestDB(t)
+	svc := NewUserService(db, nil)
+	admin, err := svc.Create("only-admin", "password123", "唯一管理员", model.RoleAdmin, 0)
+	if err != nil {
+		t.Fatalf("create admin: %v", err)
+	}
+	if err := svc.UpdateStatus(admin.ID, 0); err == nil {
+		t.Fatal("should not disable the last enabled admin")
+	}
+	other, err := svc.Create("other-admin", "password123", "另一管理员", model.RoleAdmin, 0)
+	if err != nil {
+		t.Fatalf("create second admin: %v", err)
+	}
+	if err := svc.Delete(other.ID, admin.ID); err != nil {
+		t.Fatalf("delete non-current admin: %v", err)
+	}
+	if err := svc.Delete(admin.ID, other.ID); err == nil {
+		t.Fatal("should not delete the last enabled admin")
+	}
+}

backend/internal/service/user.go

@@ -113,12 +113,59 @@ func (s *UserService) Create(username, password, nickname, role string, merchant
 }
 
 func (s *UserService) UpdateStatus(id uint, status int) error {
-	res := s.db.Model(&model.User{}).Where("id = ?", id).Update("status", status)
-	if res.Error != nil {
-		return res.Error
+	if status != 0 && status != 1 {
+		return errors.New("用户状态无效")
 	}
-	if res.RowsAffected == 0 {
+	return s.db.Transaction(func(tx *gorm.DB) error {
+		var user model.User
+		if err := tx.First(&user, id).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return errors.New("用户不存在")
+			}
+			return err
+		}
+		if user.Role == model.RoleAdmin && user.Status == 1 && status == 0 {
+			var admins int64
+			if err := tx.Model(&model.User{}).Where("role = ? AND status = ?", model.RoleAdmin, 1).Count(&admins).Error; err != nil {
+				return err
+			}
+			if admins <= 1 {
+				return errors.New("至少保留一个启用的平台管理员")
+			}
+		}
+		return tx.Model(&user).Update("status", status).Error
+	})
+}
+
+// Delete removes a platform account and its merchant memberships. It protects the current
+// account and the final enabled platform administrator so the platform cannot be locked out.
+func (s *UserService) Delete(id, actorUserID uint) error {
+	if id == 0 {
 		return errors.New("用户不存在")
 	}
-	return nil
+	if id == actorUserID {
+		return errors.New("不能删除当前登录账号")
+	}
+	return s.db.Transaction(func(tx *gorm.DB) error {
+		var user model.User
+		if err := tx.First(&user, id).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return errors.New("用户不存在")
+			}
+			return err
+		}
+		if user.Role == model.RoleAdmin && user.Status == 1 {
+			var admins int64
+			if err := tx.Model(&model.User{}).Where("role = ? AND status = ?", model.RoleAdmin, 1).Count(&admins).Error; err != nil {
+				return err
+			}
+			if admins <= 1 {
+				return errors.New("至少保留一个启用的平台管理员")
+			}
+		}
+		if err := tx.Where("user_id = ?", id).Delete(&model.MerchantMember{}).Error; err != nil {
+			return err
+		}
+		return tx.Delete(&user).Error
+	})
 }

frontend/src/App.tsx

@@ -12,6 +12,7 @@ import MerchantCenter from './pages/MerchantCenter'
 import MerchantRecharge from './pages/MerchantRecharge'
 import AlertSettings from './pages/AlertSettings'
 import PlatformMerchants from './pages/PlatformMerchants'
+import PlatformUsers from './pages/PlatformUsers'
 import type { ReactNode } from 'react'
 function PrivateRoute({ children }: { children: ReactNode }) {
   const { token } = useAuth()
@@ -85,6 +86,7 @@ function AppRoutes() {
             </AdminRoute>
           }
         />
+        <Route path="platform-users" element={<AdminRoute><PlatformUsers /></AdminRoute>} />
         <Route path="open-api" element={<MerchantPermissionRoute permission="api:manage"><OpenApiDocs /></MerchantPermissionRoute>} />
         <Route
           path="api-debug"

frontend/src/api/index.ts

@@ -53,6 +53,8 @@ export const userApi = {
     request.post('/users', data).then((r) => r.data.data as User),
   updateStatus: (id: number, status: number) =>
     request.patch(`/users/${id}/status`, { status }).then((r) => r.data.data),
+  remove: (id: number) =>
+    request.delete(`/users/${id}`).then((r) => r.data.data),
 }
 
 export const merchantApi = {

frontend/src/layouts/MainLayout.tsx

@@ -74,6 +74,12 @@ const adminSections: SidebarSection[] = [
     icon: <ShopOutlined />,
     children: [{ key: 'shop-list', label: '平台商户', path: '/platform-merchants' }],
   },
+  {
+    key: 'accounts',
+    label: '账号管理',
+    icon: <UserOutlined />,
+    children: [{ key: 'platform-users', label: '平台账号', path: '/platform-users' }],
+  },
   {
     key: 'orders',
     label: '订单管理',
@@ -180,6 +186,7 @@ function getSelectedKey(pathname: string, search: string) {
   if (pathname.startsWith('/open-api')) return 'api-docs'
   if (pathname.startsWith('/api-debug')) return 'api-debug'
   if (pathname.startsWith('/platform-merchants')) return 'shop-list'
+  if (pathname.startsWith('/platform-users')) return 'platform-users'
   return 'dashboard'
 }
 

frontend/src/pages/PlatformUsers.tsx

@@ -0,0 +1,64 @@
+import { useCallback, useEffect, useState } from 'react'
+import { Button, Popconfirm, Table, Tag, Typography, message } from 'antd'
+import { DeleteOutlined, ReloadOutlined } from '@ant-design/icons'
+import type { ColumnsType } from 'antd/es/table'
+import { userApi } from '../api'
+import { PageHeader } from '../components/PageHeader'
+import type { PageResult, User } from '../types'
+import { formatDateTime } from '../utils/time'
+import { useAuth } from '../store/auth'
+
+export default function PlatformUsers() {
+  const { user: currentUser } = useAuth()
+  const [data, setData] = useState<PageResult<User>>({ list: [], total: 0, page: 1, size: 20 })
+  const [loading, setLoading] = useState(false)
+
+  const load = useCallback(async (page = data.page, size = data.size) => {
+    setLoading(true)
+    try {
+      setData(await userApi.list({ page, size }))
+    } catch (e) {
+      message.error(e instanceof Error ? e.message : '加载失败')
+    } finally {
+      setLoading(false)
+    }
+  }, [data.page, data.size])
+
+  useEffect(() => {
+    void load()
+  }, [load])
+
+  const remove = async (record: User) => {
+    try {
+      await userApi.remove(record.id)
+      message.success('账号已删除')
+      load()
+    } catch (e) {
+      message.error(e instanceof Error ? e.message : '删除失败')
+    }
+  }
+
+  const columns: ColumnsType<User> = [
+    { title: '用户名', dataIndex: 'username', width: 220, render: (value) => <Typography.Text strong>{value}</Typography.Text> },
+    { title: '昵称', dataIndex: 'nickname', width: 180, render: (value) => value || '-' },
+    { title: '账号类型', dataIndex: 'role', width: 140, render: (value) => <Tag color={value === 'admin' ? 'blue' : 'default'}>{value === 'admin' ? '平台管理员' : '商户账号'}</Tag> },
+    { title: '状态', dataIndex: 'status', width: 100, render: (value) => value === 1 ? <Tag color="green">启用</Tag> : <Tag>停用</Tag> },
+    { title: '创建时间', dataIndex: 'created_at', width: 180, render: formatDateTime },
+    {
+      title: '操作',
+      width: 120,
+      render: (_, record) => record.id === currentUser?.id ? <Typography.Text type="secondary">当前账号</Typography.Text> : (
+        <Popconfirm title={`确认删除账号「${record.username}」？`} description="账号及其全部商户成员关系会被删除。" onConfirm={() => remove(record)} okButtonProps={{ danger: true }}>
+          <Button type="link" danger size="small" icon={<DeleteOutlined />}>删除</Button>
+        </Popconfirm>
+      ),
+    },
+  ]
+
+  return (
+    <div>
+      <PageHeader title="账号管理" subtitle="管理平台管理员与商户登录账号；删除会同时解除该账号的商户成员关系。" breadcrumbs={[{ title: '账号管理' }]} extra={<Button icon={<ReloadOutlined />} loading={loading} onClick={() => load()}>刷新</Button>} />
+      <Table rowKey="id" loading={loading} columns={columns} dataSource={data.list} pagination={{ current: data.page, pageSize: data.size, total: data.total, showSizeChanger: true, onChange: (page, size) => load(page, size) }} />
+    </div>
+  )
+}