Merge remote-tracking branch 'origin/develop' into develop

frontend/app/components/admin/UserManagementPage.tsx

@@ -79,6 +79,27 @@ export function UserManagementPage({
       onNotify({ tone: "error", message: "请输入密码" });
       return;
     }
+    // 编辑自身或管理员时,前端二次拦截禁用 status / role_code 的修改
+    if (editing) {
+      const editingSelf = editing.user_id === user?.user_id;
+      const targetIsAdmin = editing.role_code === "admin";
+      if (editingSelf && form.status !== editing.status) {
+        onNotify({ tone: "error", message: "不能停用当前登录账号" });
+        return;
+      }
+      if (targetIsAdmin && form.status !== editing.status) {
+        onNotify({ tone: "error", message: "不能停用或锁定管理员账号" });
+        return;
+      }
+      if (targetIsAdmin && form.role_code !== editing.role_code) {
+        onNotify({ tone: "error", message: "不能降级管理员账号" });
+        return;
+      }
+      if (editingSelf && form.role_code !== editing.role_code) {
+        onNotify({ tone: "error", message: "不能降级自身管理员角色" });
+        return;
+      }
+    }
     // 密码长度校验 8~72 字符
     if (form.password && (form.password.length < 8 || form.password.length > 72)) {
       onNotify({ tone: "error", message: "密码长度必须在 8~72 字符之间" });
@@ -245,7 +266,7 @@ export function UserManagementPage({
               </label>
               <label className="form-field">
                 <span>角色</span>
-                <select value={form.role_code} onChange={(event) => setForm({ ...form, role_code: event.target.value as "admin" | "developer" })}>
+                <select value={form.role_code} disabled={Boolean(editing) && ((editing as Employee).user_id === user?.user_id || (editing as Employee).role_code === "admin")} onChange={(event) => setForm({ ...form, role_code: event.target.value as "admin" | "developer" })}>
                   <option value="developer">开发人员</option>
                   <option value="admin">管理员</option>
                 </select>
@@ -253,7 +274,7 @@ export function UserManagementPage({
               {editing && (
                 <label className="form-field">
                   <span>状态</span>
-                  <select value={form.status} onChange={(event) => setForm({ ...form, status: event.target.value as typeof form.status })}>
+                  <select value={form.status} disabled={Boolean(editing) && ((editing as Employee).user_id === user?.user_id || (editing as Employee).role_code === "admin")} onChange={(event) => setForm({ ...form, status: event.target.value as typeof form.status })}>
                     <option value="active">正常</option>
                     <option value="disabled">停用</option>
                     <option value="locked">锁定</option>

frontend/app/context/AuthContext.tsx

@@ -19,6 +19,7 @@ export type AuthUser = {
   email: string | null;
   status: string;
   role_code: string | null;
+  is_system_admin: boolean;
 };
 
 export type AuthWorkspace = {