feat: 实现 Admin 采购员账号管理 (#51)

admin/handler/web/user.go

@@ -0,0 +1,128 @@
+package web
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"cmautobuy/admin/model"
+	"cmautobuy/admin/repository"
+	"cmautobuy/admin/service"
+)
+
+// AdminRequired 叠加在已认证的 /users 路由上。采购员能使用业务页，但不能管理账号。
+func AdminRequired() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		user := currentUser(c)
+		if user != nil && user.IsAdmin() {
+			c.Next()
+			return
+		}
+		fail(c, http.StatusForbidden, "只有管理员可以访问用户管理。当前账号仍可使用其他业务页面。")
+		c.Abort()
+	}
+}
+
+// UserList 显示用户搜索、分页和管理操作。
+func (h *Handler) UserList(c *gin.Context) {
+	h.renderUserList(c, http.StatusOK, c.Query("msg"), c.Query("error"), false, "")
+}
+
+func (h *Handler) renderUserList(c *gin.Context, httpStatus int, message, errorMessage string, needCreate bool, createUsername string) {
+	keyword := strings.TrimSpace(c.Query("q"))
+	result, err := service.ListUsers(h.db, currentUser(c), keyword,
+		model.UserStatus(c.Query("status")), service.ParsePage(c.Query("page")))
+	if err != nil {
+		fail(c, http.StatusInternalServerError, "读取用户列表失败，账号数据没有被改动。刷新后重试。")
+		return
+	}
+	values := url.Values{}
+	if keyword != "" {
+		values.Set("q", keyword)
+	}
+	if result.Status != "" {
+		values.Set("status", string(result.Status))
+	}
+	status := fmt.Sprintf("共 %d 个用户 · 第 %d/%d 页", result.Total, result.Page, result.TotalPages)
+	c.HTML(httpStatus, "user/list", page(c, "users", "用户管理", gin.H{
+		"Rows": result.Rows, "Keyword": result.Keyword, "Status": status,
+		"Pagination":   service.NewPaginationView(result.Page, result.TotalPages, values.Encode()),
+		"StatusFilter": result.Status, "Message": message, "Error": errorMessage,
+		"NeedCreate": needCreate, "CreateUsername": createUsername,
+	}))
+}
+
+// UserCreate 只创建固定 purchaser 角色，密码不写入 URL、不回显。
+func (h *Handler) UserCreate(c *gin.Context) {
+	err := service.CreatePurchaser(h.db, currentUser(c), c.PostForm("username"),
+		c.PostForm("password"), c.PostForm("password_confirm"), time.Now())
+	if err != nil {
+		if isExpectedUserError(err) {
+			h.renderUserList(c, http.StatusBadRequest, "", err.Error(), true,
+				strings.TrimSpace(c.PostForm("username")))
+			return
+		}
+		fail(c, http.StatusInternalServerError, "创建采购员失败，已有账号数据保持不变。刷新后重试。")
+		return
+	}
+	redirectUsers(c, "采购员创建成功", "")
+}
+
+// UserSetStatus 启用或禁用账号，并由 Repository 在同一事务撤销全部 Session。
+func (h *Handler) UserSetStatus(c *gin.Context) {
+	status := model.UserStatus(c.PostForm("status"))
+	err := service.ChangeUserStatus(h.db, currentUser(c), c.PostForm("user_id"), status, time.Now())
+	if err != nil {
+		h.userActionFailure(c, err, "修改账号状态失败")
+		return
+	}
+	message := "账号已启用"
+	if status == model.UserDisabled {
+		message = "账号已禁用，原有登录已撤销"
+	}
+	redirectUsers(c, message, "")
+}
+
+// UserResetPassword 重置密码并撤销目标用户全部 Session。密码不会回显。
+func (h *Handler) UserResetPassword(c *gin.Context) {
+	err := service.ResetUserPassword(h.db, currentUser(c), c.PostForm("user_id"),
+		c.PostForm("password"), c.PostForm("password_confirm"), time.Now())
+	if err != nil {
+		h.userActionFailure(c, err, "重置密码失败")
+		return
+	}
+	redirectUsers(c, "密码已重置，原有登录已撤销", "")
+}
+
+func (h *Handler) userActionFailure(c *gin.Context, err error, fallback string) {
+	if isExpectedUserError(err) {
+		redirectUsers(c, "", err.Error())
+		return
+	}
+	fail(c, http.StatusInternalServerError, fallback+"，已有账号数据保持不变。刷新后重试。")
+}
+
+func isExpectedUserError(err error) bool {
+	return service.IsValidationError(err) || errors.Is(err, repository.ErrUsernameExists) ||
+		errors.Is(err, repository.ErrUserNotFound) || errors.Is(err, repository.ErrLastActiveAdmin)
+}
+
+func redirectUsers(c *gin.Context, message, errorMessage string) {
+	query := url.Values{}
+	if message != "" {
+		query.Set("msg", message)
+	}
+	if errorMessage != "" {
+		query.Set("error", errorMessage)
+	}
+	location := "/users"
+	if encoded := query.Encode(); encoded != "" {
+		location += "?" + encoded
+	}
+	c.Redirect(http.StatusSeeOther, location)
+}

admin/handler/web/web.go

@@ -83,6 +83,13 @@ func Register(r *gin.Engine, db *sql.DB, onlineThreshold time.Duration) {
 	// 5. 客户端列表
 	pages.GET("/clients", h.ClientList)
 	pages.POST("/clients/delete", h.ClientDelete)
+
+	// 6. 用户管理：先经过网页登录，再叠加管理员角色校验。
+	users := pages.Group("/users", AdminRequired())
+	users.GET("", h.UserList)
+	users.POST("/create", h.UserCreate)
+	users.POST("/status", h.UserSetStatus)
+	users.POST("/reset-password", h.UserResetPassword)
 }
 
 // page 组装每个页面都要的公共数据（导航高亮、标题、CSRF token）。

admin/model/model.go

@@ -78,6 +78,28 @@ type User struct {
 	UpdatedAt         string
 }
 
+// IsAdmin 供路由权限判断和模板决定是否显示用户管理入口。
+func (u *User) IsAdmin() bool { return u != nil && u.Role == RoleAdmin }
+
+// IsActive 供模板决定显示“启用”还是“禁用”操作。
+func (u User) IsActive() bool { return u.Status == UserActive }
+
+// RoleLabel 返回给操作员看的中文角色名。
+func (u User) RoleLabel() string {
+	if u.Role == RoleAdmin {
+		return "管理员"
+	}
+	return "采购员"
+}
+
+// StatusLabel 返回给操作员看的中文账号状态。
+func (u User) StatusLabel() string {
+	if u.Status == UserActive {
+		return "启用"
+	}
+	return "禁用"
+}
+
 // WebSession 是服务端保存的网页登录状态。SessionHash 是浏览器随机 Token
 // 的 SHA-256，不是 Token 原文。
 type WebSession struct {

admin/repository/user.go

@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
+	"strings"
 
 	"cmautobuy/admin/model"
 )
@@ -14,6 +15,8 @@ var (
 	ErrUsersAlreadyExist = errors.New("管理员已经初始化")
 	ErrUserNotFound      = errors.New("用户不存在")
 	ErrSessionNotFound   = errors.New("网页登录会话不存在")
+	ErrUsernameExists    = errors.New("用户名已经存在")
+	ErrLastActiveAdmin   = errors.New("不能禁用最后一个有效管理员")
 )
 
 // CountUsers 返回所有用户数量，disabled 也算。即使所有账号被禁用，
@@ -148,3 +151,131 @@ func DeleteExpiredSessions(q Execer, nowISO string) error {
 	}
 	return nil
 }
+
+// ListUsers 按用户名搜索并分页。列表和 COUNT 共用同一段筛选，避免页码漂移。
+func ListUsers(q Execer, keyword string, status model.UserStatus, limit, offset int) ([]model.User, int, error) {
+	pattern := "%" + escapeLike(keyword) + "%"
+	where := `WHERE username LIKE ? ESCAPE '\'`
+	args := []any{pattern}
+	if status == model.UserActive || status == model.UserDisabled {
+		where += ` AND status = ?`
+		args = append(args, status)
+	}
+	var total int
+	if err := q.QueryRow(`SELECT COUNT(*) FROM users `+where, args...).Scan(&total); err != nil {
+		return nil, 0, fmt.Errorf("统计 Admin 用户失败: %w", err)
+	}
+	listArgs := append(append([]any{}, args...), limit, offset)
+	rows, err := q.Query(`
+		SELECT user_id, username, role, status, last_login_at,
+		       password_changed_at, created_at, updated_at
+		  FROM users `+where+`
+		 ORDER BY created_at DESC, username ASC
+		 LIMIT ? OFFSET ?`, listArgs...)
+	if err != nil {
+		return nil, 0, fmt.Errorf("查询 Admin 用户列表失败: %w", err)
+	}
+	defer rows.Close()
+
+	users := make([]model.User, 0)
+	for rows.Next() {
+		var user model.User
+		var lastLogin sql.NullString
+		if err := rows.Scan(&user.UserID, &user.Username, &user.Role, &user.Status,
+			&lastLogin, &user.PasswordChangedAt, &user.CreatedAt, &user.UpdatedAt); err != nil {
+			return nil, 0, fmt.Errorf("读取 Admin 用户列表失败: %w", err)
+		}
+		user.LastLoginAt = lastLogin.String
+		users = append(users, user)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, 0, fmt.Errorf("遍历 Admin 用户列表失败: %w", err)
+	}
+	return users, total, nil
+}
+
+// CreateUser 创建一个已经完成密码哈希的账号。用户名由数据库 NOCASE 唯一约束
+// 做最终并发保护。
+func CreateUser(q Execer, user model.User) error {
+	_, err := q.Exec(`
+		INSERT INTO users
+		    (user_id, username, password_hash, role, status, last_login_at,
+		     password_changed_at, created_at, updated_at)
+		VALUES (?, ?, ?, ?, ?, NULL, ?, ?, ?)`,
+		user.UserID, user.Username, user.PasswordHash, user.Role, user.Status,
+		user.PasswordChangedAt, user.CreatedAt, user.UpdatedAt)
+	if err != nil {
+		if strings.Contains(err.Error(), "UNIQUE constraint failed: users.username") {
+			return ErrUsernameExists
+		}
+		return fmt.Errorf("创建 Admin 用户失败: %w", err)
+	}
+	return nil
+}
+
+// SetUserStatusAndRevokeSessions 在同一写事务里修改状态并撤销全部 Session。
+// 禁用管理员前会在事务内保护最后一个有效管理员。
+func SetUserStatusAndRevokeSessions(db *sql.DB, userID string, status model.UserStatus, updatedAt string) error {
+	tx, err := db.Begin()
+	if err != nil {
+		return fmt.Errorf("开始修改用户状态事务失败: %w", err)
+	}
+	defer tx.Rollback()
+
+	var role model.UserRole
+	var current model.UserStatus
+	if err := tx.QueryRow(`SELECT role, status FROM users WHERE user_id = ?`, userID).Scan(&role, &current); errors.Is(err, sql.ErrNoRows) {
+		return ErrUserNotFound
+	} else if err != nil {
+		return fmt.Errorf("读取待修改用户失败: %w", err)
+	}
+	if status == model.UserDisabled && current == model.UserActive && role == model.RoleAdmin {
+		var activeAdmins int
+		if err := tx.QueryRow(`SELECT COUNT(*) FROM users WHERE role = 'admin' AND status = 'active'`).Scan(&activeAdmins); err != nil {
+			return fmt.Errorf("统计有效管理员失败: %w", err)
+		}
+		if activeAdmins <= 1 {
+			return ErrLastActiveAdmin
+		}
+	}
+	if _, err := tx.Exec(`UPDATE users SET status = ?, updated_at = ? WHERE user_id = ?`, status, updatedAt, userID); err != nil {
+		return fmt.Errorf("修改用户状态失败: %w", err)
+	}
+	if _, err := tx.Exec(`DELETE FROM web_sessions WHERE user_id = ?`, userID); err != nil {
+		return fmt.Errorf("撤销用户 Session 失败: %w", err)
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("提交用户状态事务失败: %w", err)
+	}
+	return nil
+}
+
+// ResetUserPasswordAndRevokeSessions 原子更新密码哈希并撤销该用户所有 Session。
+func ResetUserPasswordAndRevokeSessions(db *sql.DB, userID, passwordHash, updatedAt string) error {
+	tx, err := db.Begin()
+	if err != nil {
+		return fmt.Errorf("开始重置密码事务失败: %w", err)
+	}
+	defer tx.Rollback()
+	result, err := tx.Exec(`
+		UPDATE users
+		   SET password_hash = ?, password_changed_at = ?, updated_at = ?
+		 WHERE user_id = ?`, passwordHash, updatedAt, updatedAt, userID)
+	if err != nil {
+		return fmt.Errorf("重置用户密码失败: %w", err)
+	}
+	affected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("确认重置密码结果失败: %w", err)
+	}
+	if affected == 0 {
+		return ErrUserNotFound
+	}
+	if _, err := tx.Exec(`DELETE FROM web_sessions WHERE user_id = ?`, userID); err != nil {
+		return fmt.Errorf("撤销用户 Session 失败: %w", err)
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("提交重置密码事务失败: %w", err)
+	}
+	return nil
+}

admin/service/auth.go

@@ -32,6 +32,20 @@ var (
 	dummyPasswordHash, _ = bcrypt.GenerateFromPassword([]byte("not-a-real-password"), bcrypt.DefaultCost)
 )
 
+type validationError struct{ message string }
+
+func (e *validationError) Error() string { return e.message }
+
+// IsValidationError 让 Handler 区分可直接展示的表单错误和不可泄露的内部错误。
+func IsValidationError(err error) bool {
+	var target *validationError
+	return errors.As(err, &target)
+}
+
+func invalidInput(message string, args ...any) error {
+	return &validationError{message: fmt.Sprintf(message, args...)}
+}
+
 // HasUsers 判断首次初始化入口是否已经永久关闭。
 func HasUsers(db *sql.DB) (bool, error) {
 	count, err := repository.CountUsers(db)
@@ -41,27 +55,12 @@ func HasUsers(db *sql.DB) (bool, error) {
 // SetupInitialAdmin 校验表单、哈希密码并在事务中创建首位管理员。
 func SetupInitialAdmin(db *sql.DB, username, password, confirmation string, now time.Time) error {
 	username = strings.TrimSpace(username)
-	if username == "" {
+	if err := validateUsername(username); err != nil {
-		return fmt.Errorf("用户名不能为空")
+		return err
 	}
-	if len([]rune(username)) > maxUsernameLen {
+	hash, err := hashConfirmedPassword(password, confirmation)
-		return fmt.Errorf("用户名不能超过 %d 个字符", maxUsernameLen)
-	}
-	if len([]rune(password)) < minimumPasswordLen {
-		return fmt.Errorf("密码至少需要 %d 个字符", minimumPasswordLen)
-	}
-	// bcrypt 最多接受 72 字节。中文等字符可能占多个字节，因此不能只靠
-	// HTML 的 maxlength；服务端需要在哈希前给出可理解的校验错误。
-	if len([]byte(password)) > 72 {
-		return fmt.Errorf("密码不能超过 72 个字节")
-	}
-	if password != confirmation {
-		return fmt.Errorf("两次输入的密码不一致")
-	}
-
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
 	if err != nil {
-		return fmt.Errorf("生成密码哈希失败: %w", err)
+		return err
 	}
 	userID, err := randomID("USR-", 16)
 	if err != nil {
@@ -75,6 +74,35 @@ func SetupInitialAdmin(db *sql.DB, username, password, confirmation string, now
 	})
 }
 
+func validateUsername(username string) error {
+	if username == "" {
+		return invalidInput("用户名不能为空")
+	}
+	if len([]rune(username)) > maxUsernameLen {
+		return invalidInput("用户名不能超过 %d 个字符", maxUsernameLen)
+	}
+	return nil
+}
+
+func hashConfirmedPassword(password, confirmation string) ([]byte, error) {
+	if len([]rune(password)) < minimumPasswordLen {
+		return nil, invalidInput("密码至少需要 %d 个字符", minimumPasswordLen)
+	}
+	// bcrypt 最多接受 72 字节。中文等字符可能占多个字节，因此不能只靠
+	// HTML 的 maxlength；服务端需要在哈希前给出可理解的校验错误。
+	if len([]byte(password)) > 72 {
+		return nil, invalidInput("密码不能超过 72 个字节")
+	}
+	if password != confirmation {
+		return nil, invalidInput("两次输入的密码不一致")
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return nil, fmt.Errorf("生成密码哈希失败: %w", err)
+	}
+	return hash, nil
+}
+
 // Login 校验统一凭据并创建一个固定 12 小时有效的 Session。
 // 返回的 token 原文只交给 Cookie，数据库仅保存 SHA-256。
 func Login(db *sql.DB, username, password string, now time.Time) (token string, user *model.User, expiresAt time.Time, err error) {

admin/service/user.go

@@ -0,0 +1,112 @@
+// Admin 用户管理业务：列表、新增采购员、启停和重置密码。
+package service
+
+import (
+	"database/sql"
+	"errors"
+	"strings"
+	"time"
+
+	"cmautobuy/admin/model"
+	"cmautobuy/admin/repository"
+)
+
+var ErrAdminRequired = errors.New("只有管理员可以管理用户")
+
+// UserListResult 是用户管理页的分页结果。
+type UserListResult struct {
+	Rows       []model.User
+	Keyword    string
+	Status     model.UserStatus
+	Page       int
+	Total      int
+	TotalPages int
+}
+
+// ListUsers 搜索并分页。用户页沿用全站统一的每页 20 条规则。
+func ListUsers(db *sql.DB, actor *model.User, keyword string, status model.UserStatus, requestedPage int) (*UserListResult, error) {
+	if actor == nil || !actor.IsAdmin() {
+		return nil, ErrAdminRequired
+	}
+	keyword = strings.TrimSpace(keyword)
+	if status != model.UserActive && status != model.UserDisabled {
+		status = ""
+	}
+	page := requestedPage
+	if page < 1 {
+		page = 1
+	}
+	rows, total, err := repository.ListUsers(db, keyword, status, PageSize, (page-1)*PageSize)
+	if err != nil {
+		return nil, err
+	}
+	totalPages := TotalPages(total)
+	clampedPage := ClampPage(page, totalPages)
+	if clampedPage != page {
+		page = clampedPage
+		rows, _, err = repository.ListUsers(db, keyword, status, PageSize, (page-1)*PageSize)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return &UserListResult{
+		Rows: rows, Keyword: keyword, Status: status,
+		Page: page, Total: total, TotalPages: totalPages,
+	}, nil
+}
+
+// CreatePurchaser 创建固定 purchaser 角色的账号，不提供第二管理员入口。
+func CreatePurchaser(db *sql.DB, actor *model.User, username, password, confirmation string, now time.Time) error {
+	if actor == nil || !actor.IsAdmin() {
+		return ErrAdminRequired
+	}
+	username = strings.TrimSpace(username)
+	if err := validateUsername(username); err != nil {
+		return err
+	}
+	hash, err := hashConfirmedPassword(password, confirmation)
+	if err != nil {
+		return err
+	}
+	userID, err := randomID("USR-", 16)
+	if err != nil {
+		return err
+	}
+	at := now.UTC().Format(model.TimeLayout)
+	return repository.CreateUser(db, model.User{
+		UserID: userID, Username: username, PasswordHash: string(hash),
+		Role: model.RolePurchaser, Status: model.UserActive,
+		PasswordChangedAt: at, CreatedAt: at, UpdatedAt: at,
+	})
+}
+
+// ChangeUserStatus 启用或禁用账号。数据库事务负责最后管理员保护和 Session 撤销。
+func ChangeUserStatus(db *sql.DB, actor *model.User, userID string, status model.UserStatus, now time.Time) error {
+	if actor == nil || !actor.IsAdmin() {
+		return ErrAdminRequired
+	}
+	if status != model.UserActive && status != model.UserDisabled {
+		return invalidInput("账号状态无效")
+	}
+	if strings.TrimSpace(userID) == "" {
+		return invalidInput("用户编号不能为空")
+	}
+	return repository.SetUserStatusAndRevokeSessions(
+		db, userID, status, now.UTC().Format(model.TimeLayout))
+}
+
+// ResetUserPassword 更新密码哈希，并在同一事务中撤销目标用户全部 Session。
+func ResetUserPassword(db *sql.DB, actor *model.User, userID, password, confirmation string, now time.Time) error {
+	if actor == nil || !actor.IsAdmin() {
+		return ErrAdminRequired
+	}
+	if strings.TrimSpace(userID) == "" {
+		return invalidInput("用户编号不能为空")
+	}
+	hash, err := hashConfirmedPassword(password, confirmation)
+	if err != nil {
+		return err
+	}
+	return repository.ResetUserPasswordAndRevokeSessions(
+		db, userID, string(hash), now.UTC().Format(model.TimeLayout))
+}

admin/service/user_test.go

@@ -0,0 +1,147 @@
+package service
+
+import (
+	"database/sql"
+	"errors"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/bcrypt"
+
+	"cmautobuy/admin/model"
+	"cmautobuy/admin/repository"
+)
+
+func TestCreatePurchaser_固定角色且用户名不区分大小写唯一(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	admin := prepareAdminUser(t, db, now)
+	if err := CreatePurchaser(db, admin, "buyer", "buyer-password", "buyer-password", now); err != nil {
+		t.Fatalf("创建采购员失败: %v", err)
+	}
+	buyer, err := repository.FindUserByUsername(db, "BUYER")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if buyer.Role != model.RolePurchaser || buyer.Status != model.UserActive {
+		t.Fatalf("新账号角色或状态错误: %+v", buyer)
+	}
+	if buyer.PasswordHash == "buyer-password" ||
+		bcrypt.CompareHashAndPassword([]byte(buyer.PasswordHash), []byte("buyer-password")) != nil {
+		t.Fatal("采购员密码必须保存为可验证的 bcrypt 哈希")
+	}
+	if err := CreatePurchaser(db, admin, "BUYER", "other-password", "other-password", now); !errors.Is(err, repository.ErrUsernameExists) {
+		t.Fatalf("大小写不同的重复用户名应被拒绝，实际 %v", err)
+	}
+}
+
+func TestChangeUserStatus_禁用撤销全部Session且启用后可重新登录(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	admin := prepareAdminUser(t, db, now)
+	if err := CreatePurchaser(db, admin, "buyer", "buyer-password", "buyer-password", now); err != nil {
+		t.Fatal(err)
+	}
+	buyer, _ := repository.FindUserByUsername(db, "buyer")
+	token, _, _, err := Login(db, "buyer", "buyer-password", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := ChangeUserStatus(db, admin, buyer.UserID, model.UserDisabled, now.Add(time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Authenticate(db, token, now.Add(2*time.Minute)); !errors.Is(err, ErrUnauthenticated) {
+		t.Fatalf("禁用后旧 Session 应失效，实际 %v", err)
+	}
+	if _, _, _, err := Login(db, "buyer", "buyer-password", now.Add(2*time.Minute)); !errors.Is(err, ErrInvalidCredentials) {
+		t.Fatalf("禁用账号不应登录，实际 %v", err)
+	}
+	if err := ChangeUserStatus(db, admin, buyer.UserID, model.UserActive, now.Add(3*time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, _, err := Login(db, "buyer", "buyer-password", now.Add(4*time.Minute)); err != nil {
+		t.Fatalf("重新启用后应可登录: %v", err)
+	}
+}
+
+func TestResetUserPassword_原子撤销Session并更换凭据(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	admin := prepareAdminUser(t, db, now)
+	if err := CreatePurchaser(db, admin, "buyer", "old-password", "old-password", now); err != nil {
+		t.Fatal(err)
+	}
+	buyer, _ := repository.FindUserByUsername(db, "buyer")
+	token, _, _, _ := Login(db, "buyer", "old-password", now)
+	if err := ResetUserPassword(db, admin, buyer.UserID, "new-password", "new-password", now.Add(time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Authenticate(db, token, now.Add(2*time.Minute)); !errors.Is(err, ErrUnauthenticated) {
+		t.Fatalf("重置密码后旧 Session 应失效，实际 %v", err)
+	}
+	if _, _, _, err := Login(db, "buyer", "old-password", now.Add(2*time.Minute)); !errors.Is(err, ErrInvalidCredentials) {
+		t.Fatalf("旧密码应失效，实际 %v", err)
+	}
+	if _, _, _, err := Login(db, "buyer", "new-password", now.Add(2*time.Minute)); err != nil {
+		t.Fatalf("新密码应可登录: %v", err)
+	}
+}
+
+func TestChangeUserStatus_最后管理员保护同时保留Session(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	admin := prepareAdminUser(t, db, now)
+	token, _, _, err := Login(db, "admin", "admin-password", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = ChangeUserStatus(db, admin, admin.UserID, model.UserDisabled, now.Add(time.Minute))
+	if !errors.Is(err, repository.ErrLastActiveAdmin) {
+		t.Fatalf("禁用最后管理员应拒绝，实际 %v", err)
+	}
+	if _, err := Authenticate(db, token, now.Add(2*time.Minute)); err != nil {
+		t.Fatalf("失败事务不能撤销管理员 Session: %v", err)
+	}
+}
+
+func TestUserManagement_采购员无权调用且搜索转义通配符(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	admin := prepareAdminUser(t, db, now)
+	if err := CreatePurchaser(db, admin, "buyer%", "buyer-password", "buyer-password", now); err != nil {
+		t.Fatal(err)
+	}
+	buyer, _ := repository.FindUserByUsername(db, "buyer%")
+	result, err := ListUsers(db, admin, "%", "", 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Total != 1 || len(result.Rows) != 1 || result.Rows[0].Username != "buyer%" {
+		t.Fatalf("搜索中的 %% 应按字面量处理: %+v", result)
+	}
+	if err := ChangeUserStatus(db, admin, buyer.UserID, model.UserDisabled, now); err != nil {
+		t.Fatal(err)
+	}
+	disabled, err := ListUsers(db, admin, "", model.UserDisabled, 1)
+	if err != nil || disabled.Total != 1 || disabled.Rows[0].Username != "buyer%" {
+		t.Fatalf("禁用状态筛选错误: result=%+v err=%v", disabled, err)
+	}
+	if _, err := ListUsers(db, buyer, "", "", 1); !errors.Is(err, ErrAdminRequired) {
+		t.Fatalf("采购员不应列出用户，实际 %v", err)
+	}
+	if err := CreatePurchaser(db, buyer, "other", "other-password", "other-password", now); !errors.Is(err, ErrAdminRequired) {
+		t.Fatalf("采购员不应创建用户，实际 %v", err)
+	}
+}
+
+func prepareAdminUser(t *testing.T, db *sql.DB, now time.Time) *model.User {
+	t.Helper()
+	if err := SetupInitialAdmin(db, "admin", "admin-password", "admin-password", now); err != nil {
+		t.Fatalf("准备管理员失败: %v", err)
+	}
+	admin, err := repository.FindUserByUsername(db, "admin")
+	if err != nil {
+		t.Fatalf("读取管理员失败: %v", err)
+	}
+	return admin
+}

admin/static/css/app.css

@@ -247,6 +247,7 @@ tr.empty small { color: #aaa; }
 }
 .modal-body { padding: 16px; }
 .modal-body h3 { font-size: 14px; margin: 20px 0 8px; }
+.form-stack { display: grid; gap: 16px; }
 .modal-foot {
   display: flex;
   align-items: center;
@@ -307,6 +308,22 @@ input[type="date"] {
 }
 input.wide { width: 100%; }
 
+.row-actions {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  white-space: nowrap;
+}
+.row-actions form { margin: 0; }
+.status-pill {
+  display: inline-block;
+  padding: 2px 8px;
+  border-radius: 999px;
+  border: 1px solid currentColor;
+}
+.status-active { color: #1a7f37; background: #f0fff4; }
+.status-disabled { color: #777; background: #f3f4f6; }
+
 select {
   padding: 5px 8px;
   border: 1px solid #ccd1d6;

admin/static/js/app.js

@@ -1,7 +1,7 @@
 /* Admin 的全部 JavaScript。
  *
  * 原生 JS，没有框架、没有构建步骤——见 admin/AGENTS.md 前端约束。
- * 只做三件纯前端的事：全选、删除前二次确认、按钮禁用。
+ * 只做轻量界面交互：全选、操作前确认、按钮禁用和弹窗。
  * 搜索、删除、导入本身都是普通表单 POST，服务端渲染，不需要 JS。
  *
  * 不要往这里加业务逻辑。业务逻辑在服务端。
@@ -83,6 +83,34 @@
     });
   }
 
+  /* ── 普通敏感操作的二次确认 ───────────────
+     账号启停和密码重置不是删除，但同样会撤销登录。服务端仍负责权限和事务，
+     这里仅降低误操作概率。 */
+  function setupConfirmSubmit() {
+    document.querySelectorAll("form[data-confirm-submit]").forEach(function (form) {
+      form.addEventListener("submit", function (e) {
+        if (!window.confirm(form.getAttribute("data-confirm-submit"))) {
+          e.preventDefault();
+        }
+      });
+    });
+  }
+
+  /* 用户列表共用一个重置密码弹窗。按钮只把用户编号和显示名放进表单，
+     不在前端处理权限、密码或 Session。 */
+  function setupUserResetModal() {
+    var modal = document.getElementById("reset-password-modal");
+    if (!modal) return;
+    var idInput = modal.querySelector("[data-reset-user-id-input]");
+    var nameLabel = modal.querySelector("[data-reset-username-label]");
+    document.querySelectorAll("[data-reset-user-id]").forEach(function (button) {
+      button.addEventListener("click", function () {
+        idInput.value = button.getAttribute("data-reset-user-id") || "";
+        nameLabel.textContent = button.getAttribute("data-reset-username") || "";
+      });
+    });
+  }
+
   /* ── 弹窗 ──────────────────────────────────
      弹窗**内容由服务端渲染**，这里只负责显示、隐藏和把内容取回来。
      不要在这里拼业务数据——价格格式、规格顺序都是业务规则，
@@ -190,6 +218,8 @@
   document.addEventListener("DOMContentLoaded", function () {
     document.querySelectorAll("table").forEach(setupCheckAll);
     setupConfirmDelete();
+    setupConfirmSubmit();
+    setupUserResetModal();
     setupModals();
     setupRowDetail();
     setupCaptchaRefresh();

admin/templates/partials/header.html

@@ -15,6 +15,9 @@
   <a href="/syb"     class="{{if eq .Active "syb"}}active{{end}}">顺运宝数据</a>
   <a href="/tasks"   class="{{if eq .Active "tasks"}}active{{end}}">采集采购</a>
   <a href="/clients" class="{{if eq .Active "clients"}}active{{end}}">客户端列表</a>
+  {{if and .CurrentUser .CurrentUser.IsAdmin}}
+  <a href="/users" class="{{if eq .Active "users"}}active{{end}}">用户管理</a>
+  {{end}}
   {{if .CurrentUser}}
   <span class="nav-user">{{.CurrentUser.Username}}</span>
   <form class="nav-logout" method="post" action="/logout">

admin/templates/user/list.html

@@ -0,0 +1,140 @@
+{{define "user/list"}}
+{{template "header" .}}
+
+<div class="toolbar">
+  <form class="inline grow" method="get" action="/users">
+    <label for="user-q">用户名</label>
+    <input id="user-q" class="search-narrow" type="text" name="q"
+           value="{{.Keyword}}" placeholder="搜索用户名">
+    <label for="user-status">状态</label>
+    <select id="user-status" name="status">
+      <option value="">全部</option>
+      <option value="active" {{if eq .StatusFilter "active"}}selected{{end}}>启用</option>
+      <option value="disabled" {{if eq .StatusFilter "disabled"}}selected{{end}}>禁用</option>
+    </select>
+    <button type="submit">搜索</button>
+  </form>
+  <button type="button" class="primary" data-modal-open="create-user-modal">新增采购员</button>
+</div>
+
+{{if .Message}}<p class="notice" role="status">{{.Message}}</p>{{end}}
+{{if .Error}}<p class="missing" role="alert">{{.Error}}</p>{{end}}
+
+<div class="table-wrap">
+<table>
+  <thead>
+    <tr>
+      <th>用户名</th>
+      <th>角色</th>
+      <th>状态</th>
+      <th>最后登录</th>
+      <th>创建时间</th>
+      <th>操作</th>
+    </tr>
+  </thead>
+  <tbody>
+    {{range .Rows}}
+    <tr>
+      <td>{{.Username}}</td>
+      <td>{{.RoleLabel}}</td>
+      <td><span class="status-pill {{if .IsActive}}status-active{{else}}status-disabled{{end}}">{{.StatusLabel}}</span></td>
+      <td>{{if .LastLoginAt}}{{.LastLoginAt}}{{else}}从未登录{{end}}</td>
+      <td>{{.CreatedAt}}</td>
+      <td>
+        <div class="row-actions">
+          {{if .IsAdmin}}
+          <button type="button" disabled title="不能禁用最后一个有效管理员">唯一管理员</button>
+          {{else}}
+          <form method="post" action="/users/status"
+                data-confirm-submit="确定{{if .IsActive}}禁用{{else}}启用{{end}}采购员“{{.Username}}”吗？{{if .IsActive}}该账号的现有登录会立即失效。{{end}}">
+            <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
+            <input type="hidden" name="user_id" value="{{.UserID}}">
+            <input type="hidden" name="status" value="{{if .IsActive}}disabled{{else}}active{{end}}">
+            <button type="submit" {{if .IsActive}}class="danger"{{end}}>{{if .IsActive}}禁用{{else}}启用{{end}}</button>
+          </form>
+          <button type="button" data-modal-open="reset-password-modal"
+                  data-reset-user-id="{{.UserID}}" data-reset-username="{{.Username}}">重置密码</button>
+          {{end}}
+        </div>
+      </td>
+    </tr>
+    {{else}}
+    <tr class="empty">
+      <td colspan="6">
+        {{if .Keyword}}没有匹配的用户。<a href="/users">清除搜索条件</a>
+        {{else}}还没有用户。{{end}}
+      </td>
+    </tr>
+    {{end}}
+  </tbody>
+</table>
+</div>
+
+<div class="modal-backdrop" id="create-user-modal" {{if not .NeedCreate}}hidden{{end}}>
+  <div class="modal modal-narrow" role="dialog" aria-modal="true" aria-labelledby="create-user-title">
+    <div class="modal-head">
+      <h2 id="create-user-title">新增采购员</h2>
+      <button type="button" class="modal-x" data-modal-close aria-label="关闭">×</button>
+    </div>
+    <form method="post" action="/users/create">
+      <div class="modal-body form-stack">
+        <p class="hint">新账号固定为采购员，可使用业务页面，但不能进入用户管理。</p>
+        <div class="field">
+          <label for="new-username">用户名</label>
+          <input id="new-username" type="text" name="username" value="{{.CreateUsername}}" maxlength="64"
+                 required autocomplete="off" autofocus>
+        </div>
+        <div class="field">
+          <label for="new-password">初始密码</label>
+          <input id="new-password" type="password" name="password" minlength="8"
+                 maxlength="72" required autocomplete="new-password">
+          <small>至少 8 个字符。密码不会显示在列表或日志中。</small>
+        </div>
+        <div class="field">
+          <label for="new-password-confirm">确认密码</label>
+          <input id="new-password-confirm" type="password" name="password_confirm"
+                 minlength="8" maxlength="72" required autocomplete="new-password">
+        </div>
+        <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
+      </div>
+      <div class="modal-foot">
+        <button type="button" data-modal-close>取消</button>
+        <button type="submit" class="primary">创建采购员</button>
+      </div>
+    </form>
+  </div>
+</div>
+
+<div class="modal-backdrop" id="reset-password-modal" hidden>
+  <div class="modal modal-narrow" role="dialog" aria-modal="true" aria-labelledby="reset-password-title">
+    <div class="modal-head">
+      <h2 id="reset-password-title">重置采购员密码</h2>
+      <button type="button" class="modal-x" data-modal-close aria-label="关闭">×</button>
+    </div>
+    <form method="post" action="/users/reset-password"
+          data-confirm-submit="确定重置这个采购员的密码吗？现有登录会立即失效。">
+      <div class="modal-body form-stack">
+        <p>账号：<strong data-reset-username-label></strong></p>
+        <div class="field">
+          <label for="reset-password">新密码</label>
+          <input id="reset-password" type="password" name="password" minlength="8"
+                 maxlength="72" required autocomplete="new-password" autofocus>
+        </div>
+        <div class="field">
+          <label for="reset-password-confirm">确认新密码</label>
+          <input id="reset-password-confirm" type="password" name="password_confirm"
+                 minlength="8" maxlength="72" required autocomplete="new-password">
+        </div>
+        <input type="hidden" name="user_id" data-reset-user-id-input>
+        <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
+      </div>
+      <div class="modal-foot">
+        <button type="button" data-modal-close>取消</button>
+        <button type="submit" class="danger">重置密码</button>
+      </div>
+    </form>
+  </div>
+</div>
+
+{{template "footer" .}}
+{{end}}

admin/user_integration_test.go

@@ -0,0 +1,124 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"cmautobuy/admin/repository"
+	"cmautobuy/admin/service"
+)
+
+func Test用户管理管理员与采购员权限边界(t *testing.T) {
+	db, err := repository.Open(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	if err := repository.Migrate(db); err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now()
+	if err := service.SetupInitialAdmin(db, "admin", "admin-password", "admin-password", now); err != nil {
+		t.Fatal(err)
+	}
+	admin, _ := repository.FindUserByUsername(db, "admin")
+	if err := service.CreatePurchaser(db, admin, "buyer", "buyer-password", "buyer-password", now); err != nil {
+		t.Fatal(err)
+	}
+	router, err := newRouter(db)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	adminToken, _, _, err := service.Login(db, "admin", "admin-password", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	adminPageRequest := httptest.NewRequest(http.MethodGet, "/users", nil)
+	adminPageRequest.AddCookie(&http.Cookie{Name: "cmautobuy_session", Value: adminToken})
+	adminPage := httptest.NewRecorder()
+	router.ServeHTTP(adminPage, adminPageRequest)
+	if adminPage.Code != http.StatusOK {
+		t.Fatalf("管理员 GET /users = %d，响应：%s", adminPage.Code, adminPage.Body.String())
+	}
+	for _, want := range []string{"用户管理", "新增采购员", "buyer", "重置密码", "data-confirm-submit"} {
+		if !strings.Contains(adminPage.Body.String(), want) {
+			t.Errorf("用户管理页缺少 %q", want)
+		}
+	}
+	for _, secret := range []string{"admin-password", "buyer-password"} {
+		if strings.Contains(adminPage.Body.String(), secret) {
+			t.Fatalf("用户管理页泄露密码 %q", secret)
+		}
+	}
+	csrfCookie := findResponseCookie(t, adminPage, "cmautobuy_csrf")
+
+	duplicate := postFormRequest("/users/create", url.Values{
+		"csrf_token": {csrfCookie.Value}, "username": {"BUYER"},
+		"password": {"another-password"}, "password_confirm": {"another-password"},
+	}, csrfCookie)
+	duplicate.AddCookie(&http.Cookie{Name: "cmautobuy_session", Value: adminToken})
+	duplicateResponse := httptest.NewRecorder()
+	router.ServeHTTP(duplicateResponse, duplicate)
+	if duplicateResponse.Code != http.StatusBadRequest ||
+		!strings.Contains(duplicateResponse.Body.String(), "用户名已经存在") ||
+		!strings.Contains(duplicateResponse.Body.String(), `value="BUYER"`) {
+		t.Fatalf("重复用户名应保留用户名并重开表单: %d %s", duplicateResponse.Code, duplicateResponse.Body.String())
+	}
+	if strings.Contains(duplicateResponse.Body.String(), "another-password") {
+		t.Fatal("校验失败页面不能回显密码")
+	}
+
+	// 即使已登录管理员，没有 CSRF 也不能创建账号。
+	noCSRF := postFormRequest("/users/create", url.Values{
+		"username": {"staff"}, "password": {"staff-password"},
+		"password_confirm": {"staff-password"},
+	})
+	noCSRF.AddCookie(&http.Cookie{Name: "cmautobuy_session", Value: adminToken})
+	noCSRFResponse := httptest.NewRecorder()
+	router.ServeHTTP(noCSRFResponse, noCSRF)
+	if noCSRFResponse.Code != http.StatusForbidden {
+		t.Fatalf("无 CSRF 创建采购员 = %d，期望 403", noCSRFResponse.Code)
+	}
+
+	create := postFormRequest("/users/create", url.Values{
+		"csrf_token": {csrfCookie.Value}, "username": {"staff"},
+		"password": {"staff-password"}, "password_confirm": {"staff-password"},
+	}, csrfCookie)
+	create.AddCookie(&http.Cookie{Name: "cmautobuy_session", Value: adminToken})
+	createResponse := httptest.NewRecorder()
+	router.ServeHTTP(createResponse, create)
+	if createResponse.Code != http.StatusSeeOther || !strings.HasPrefix(createResponse.Header().Get("Location"), "/users?") {
+		t.Fatalf("创建采购员 = %d %s", createResponse.Code, createResponse.Header().Get("Location"))
+	}
+	if _, err := repository.FindUserByUsername(db, "STAFF"); err != nil {
+		t.Fatalf("HTTP 创建的采购员不存在: %v", err)
+	}
+
+	buyerToken, _, _, err := service.Login(db, "buyer", "buyer-password", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	buyerBusiness := httptest.NewRequest(http.MethodGet, "/shopee", nil)
+	buyerBusiness.AddCookie(&http.Cookie{Name: "cmautobuy_session", Value: buyerToken})
+	buyerBusinessResponse := httptest.NewRecorder()
+	router.ServeHTTP(buyerBusinessResponse, buyerBusiness)
+	if buyerBusinessResponse.Code != http.StatusOK {
+		t.Fatalf("采购员应可访问业务页，实际 %d", buyerBusinessResponse.Code)
+	}
+	if strings.Contains(buyerBusinessResponse.Body.String(), `href="/users"`) {
+		t.Fatal("采购员导航不应显示用户管理入口")
+	}
+
+	buyerUsers := httptest.NewRequest(http.MethodGet, "/users", nil)
+	buyerUsers.AddCookie(&http.Cookie{Name: "cmautobuy_session", Value: buyerToken})
+	buyerUsersResponse := httptest.NewRecorder()
+	router.ServeHTTP(buyerUsersResponse, buyerUsers)
+	if buyerUsersResponse.Code != http.StatusForbidden || !strings.Contains(buyerUsersResponse.Body.String(), "只有管理员") {
+		t.Fatalf("采购员访问 /users = %d，响应：%s", buyerUsersResponse.Code, buyerUsersResponse.Body.String())
+	}
+}