功能：增加平台账号管理与管理员保护

backend/internal/handler/user.go

@@ -4,6 +4,7 @@ import (
 	"strconv"
 
 	"affiliate_dash/internal/middleware"
+	"affiliate_dash/internal/model"
 	"affiliate_dash/internal/pkg/response"
 	"affiliate_dash/internal/service"
 
@@ -22,11 +23,13 @@ func (h *UserHandler) List(c *gin.Context) {
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
 	size, _ := strconv.Atoi(c.DefaultQuery("size", "20"))
 	q := service.UserListQuery{
-		MerchantID: middleware.GetMerchantID(c),
-		Page:       page,
-		Size:       size,
-		Keyword:    c.Query("keyword"),
-		Role:       c.Query("role"),
+		Page:    page,
+		Size:    size,
+		Keyword: c.Query("keyword"),
+		Role:    c.Query("role"),
+	}
+	if middleware.GetRole(c) != model.RoleAdmin {
+		q.MerchantID = middleware.GetMerchantID(c)
 	}
 	if s := c.Query("status"); s != "" {
 		v, _ := strconv.Atoi(s)
@@ -78,3 +81,12 @@ func (h *UserHandler) UpdateStatus(c *gin.Context) {
 	}
 	response.OK(c, nil)
 }
+
+func (h *UserHandler) Delete(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err := h.svc.Delete(uint(id), middleware.GetUserID(c)); err != nil {
+		response.BadRequest(c, err.Error())
+		return
+	}
+	response.OK(c, nil)
+}

backend/internal/router/router.go

@@ -195,6 +195,7 @@ func Setup(h *Handlers) *gin.Engine {
 				admin.GET("/users", h.User.List)
 				admin.POST("/users", h.User.Create)
 				admin.PATCH("/users/:id/status", h.User.UpdateStatus)
+				admin.DELETE("/users/:id", h.User.Delete)
 				admin.GET("/platform/merchants", h.Merchant.ListPlatformMerchants)
 				admin.POST("/platform/merchants", h.Merchant.CreateMerchant)
 				admin.PATCH("/platform/merchants/:id", h.Merchant.UpdateMerchantSettings)

backend/internal/service/merchant_test.go

@@ -202,3 +202,25 @@ func TestAuthServiceChangePasswordVerifiesCurrentPassword(t *testing.T) {
 		t.Fatal("old password should no longer match")
 	}
 }
+
+func TestUserServiceCannotDeleteOrDisableLastAdmin(t *testing.T) {
+	db := newServiceTestDB(t)
+	svc := NewUserService(db, nil)
+	admin, err := svc.Create("only-admin", "password123", "唯一管理员", model.RoleAdmin, 0)
+	if err != nil {
+		t.Fatalf("create admin: %v", err)
+	}
+	if err := svc.UpdateStatus(admin.ID, 0); err == nil {
+		t.Fatal("should not disable the last enabled admin")
+	}
+	other, err := svc.Create("other-admin", "password123", "另一管理员", model.RoleAdmin, 0)
+	if err != nil {
+		t.Fatalf("create second admin: %v", err)
+	}
+	if err := svc.Delete(other.ID, admin.ID); err != nil {
+		t.Fatalf("delete non-current admin: %v", err)
+	}
+	if err := svc.Delete(admin.ID, other.ID); err == nil {
+		t.Fatal("should not delete the last enabled admin")
+	}
+}

backend/internal/service/user.go

@@ -113,12 +113,59 @@ func (s *UserService) Create(username, password, nickname, role string, merchant
 }
 
 func (s *UserService) UpdateStatus(id uint, status int) error {
-	res := s.db.Model(&model.User{}).Where("id = ?", id).Update("status", status)
-	if res.Error != nil {
-		return res.Error
+	if status != 0 && status != 1 {
+		return errors.New("用户状态无效")
 	}
-	if res.RowsAffected == 0 {
+	return s.db.Transaction(func(tx *gorm.DB) error {
+		var user model.User
+		if err := tx.First(&user, id).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return errors.New("用户不存在")
+			}
+			return err
+		}
+		if user.Role == model.RoleAdmin && user.Status == 1 && status == 0 {
+			var admins int64
+			if err := tx.Model(&model.User{}).Where("role = ? AND status = ?", model.RoleAdmin, 1).Count(&admins).Error; err != nil {
+				return err
+			}
+			if admins <= 1 {
+				return errors.New("至少保留一个启用的平台管理员")
+			}
+		}
+		return tx.Model(&user).Update("status", status).Error
+	})
+}
+
+// Delete removes a platform account and its merchant memberships. It protects the current
+// account and the final enabled platform administrator so the platform cannot be locked out.
+func (s *UserService) Delete(id, actorUserID uint) error {
+	if id == 0 {
 		return errors.New("用户不存在")
 	}
-	return nil
+	if id == actorUserID {
+		return errors.New("不能删除当前登录账号")
+	}
+	return s.db.Transaction(func(tx *gorm.DB) error {
+		var user model.User
+		if err := tx.First(&user, id).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return errors.New("用户不存在")
+			}
+			return err
+		}
+		if user.Role == model.RoleAdmin && user.Status == 1 {
+			var admins int64
+			if err := tx.Model(&model.User{}).Where("role = ? AND status = ?", model.RoleAdmin, 1).Count(&admins).Error; err != nil {
+				return err
+			}
+			if admins <= 1 {
+				return errors.New("至少保留一个启用的平台管理员")
+			}
+		}
+		if err := tx.Where("user_id = ?", id).Delete(&model.MerchantMember{}).Error; err != nil {
+			return err
+		}
+		return tx.Delete(&user).Error
+	})
 }