diff --git a/backend/internal/database/migrations/009_users_username_active_unique.sql b/backend/internal/database/migrations/009_users_username_active_unique.sql new file mode 100644 index 0000000..f749921 --- /dev/null +++ b/backend/internal/database/migrations/009_users_username_active_unique.sql @@ -0,0 +1,3 @@ +-- Soft-deleted accounts must not permanently reserve their login usernames. +DROP INDEX IF EXISTS idx_users_username; +CREATE UNIQUE INDEX idx_users_username ON users (username) WHERE deleted_at IS NULL; diff --git a/backend/internal/model/models.go b/backend/internal/model/models.go index 46b8449..c862170 100644 --- a/backend/internal/model/models.go +++ b/backend/internal/model/models.go @@ -19,7 +19,9 @@ type User struct { UpdatedAt time.Time `json:"updated_at"` DeletedAt gorm.DeletedAt `gorm:"index" json:"-"` - Username string `gorm:"uniqueIndex;size:64;not null" json:"username"` + // Username uniqueness is enforced by a partial database index for active + // accounts, allowing a username to be reused after its old account is soft deleted. + Username string `gorm:"size:64;not null" json:"username"` PasswordHash string `gorm:"size:255;not null" json:"-"` Nickname string `gorm:"size:64" json:"nickname"` Role string `gorm:"size:32;not null;default:merchant" json:"role"` diff --git a/backend/internal/service/merchant_test.go b/backend/internal/service/merchant_test.go index ade2a7a..139aa1d 100644 --- a/backend/internal/service/merchant_test.go +++ b/backend/internal/service/merchant_test.go @@ -373,3 +373,26 @@ func TestDeleteMerchantAccountRemovesAllMemberships(t *testing.T) { t.Fatal("platform administrator should not be deletable from merchant account endpoint") } } + +func TestUsernameCanBeReusedAfterMerchantAccountSoftDelete(t *testing.T) { + db := newServiceTestDB(t) + svc := NewUserService(db, nil) + admin := model.User{Username: "reuse-account-admin", PasswordHash: "hash", Role: model.RoleAdmin, Status: 1} + if err := db.Create(&admin).Error; err != nil { + t.Fatalf("create admin: %v", err) + } + account, err := svc.Create("reusable-username", "password123", "旧账号", model.RoleMerchant, 0) + if err != nil { + t.Fatalf("create merchant account: %v", err) + } + if err := svc.DeleteMerchantAccount(account.ID, admin.ID); err != nil { + t.Fatalf("soft delete merchant account: %v", err) + } + recreated, err := svc.Create("reusable-username", "password123", "新账号", model.RoleMerchant, 0) + if err != nil { + t.Fatalf("recreate account with soft-deleted username: %v", err) + } + if recreated.ID == account.ID { + t.Fatalf("expected a new account record, got id=%d", recreated.ID) + } +}