提交管理员操作一切

Modules/Store.Users.Contracts/Dtos/UserManagementRequests.cs

@@ -10,7 +10,7 @@ public class UserEditRequest
     public string? Notes { get; set; }
     public string? CardId { get; set; }
     public byte? GroupId { get; set; }
-    /// <summary>仅管理员可设置；子账号不能成为管理员。</summary>
+    /// <summary>仅管理员可设置；普通账号不能通过资料修改提升管理员级别。</summary>
     public short? SaLevel { get; set; }
     public string? Authority { get; set; }
     public string? ForbiddenPage { get; set; }
@@ -31,17 +31,26 @@ public sealed class UserUpdateRequest : UserEditRequest
 /// <summary>创建主账号或当前主账号的直属子账号。</summary>
 public sealed class UserCreateRequest : UserEditRequest
 {
+    /// <summary>创建子账号时的父账号；管理员可指定任意主账号，普通主账号只能指定自己。</summary>
+    public string? ParentUserName { get; set; }
     [Required(ErrorMessage = "用户名不能为空")] public string UserName { get; set; } = "";
     [Required(ErrorMessage = "密码不能为空")] public string Password { get; set; } = "";
 }
 
-/// <summary>修改本人密码，必须校验旧密码。</summary>
+/// <summary>本人改密需原密码；管理员及主账号可为管理范围内的其他账户重置密码。</summary>
 public sealed class ChangePasswordRequest
 {
-    [Required(ErrorMessage = "原密码不能为空")] public string OldPassword { get; set; } = "";
+    public string? UserName { get; set; }
+    public string? OldPassword { get; set; }
     [Required(ErrorMessage = "新密码不能为空")] public string NewPassword { get; set; } = "";
 }
 
+/// <summary>本人修改密码时验证原密码非空。</summary>
+public sealed class UserPasswordProofRequest
+{
+    [Required(ErrorMessage = "原密码不能为空")] public string OldPassword { get; set; } = "";
+}
+
 /// <summary>分页参数；页码、分页大小和过滤值由服务检查。</summary>
 public class UserSearchRequest
 {
@@ -49,6 +58,8 @@ public class UserSearchRequest
     public int PageSize { get; set; } = 50;
     public string? Keyword { get; set; }
     public byte? GroupId { get; set; }
+    /// <summary>查询子账号时可按父账号筛选；管理员可指定任意账号，普通主账号只能指定自己。</summary>
+    public string? ParentUserName { get; set; }
 }
 
 public sealed record UserPage<T>(long Total, IReadOnlyList<T> Items);

Modules/Store.Users.Contracts/Dtos/UserTopUpRequests.cs

@@ -4,6 +4,8 @@ namespace Store.Users.Contracts.Dtos;
 /// <summary>用户提交的充值备注。</summary>
 public sealed class UserTopUpMessageRequest
 {
+    /// <summary>目标账户；省略时为本人，指定时检查管理权限。</summary>
+    public string? UserName { get; set; }
     [Required(ErrorMessage = "充值备注不能为空")] public string Message { get; set; } = "";
 }
 

Modules/Store.Users/Commands/ShopRenewCommand.cs

@@ -18,7 +18,7 @@ namespace Store.Users.Commands;
 [MediatRBehavior(typeof(TransactionBehavior<,>))]
 [MediatRBehavior(typeof(AccountConsumptionBehavior<,>))]
 [MediatRBehavior(typeof(ShopOwnershipBehavior<,>))]
-public sealed record ShopRenewCommand(string UserName, string ShopId, int RenewDuration, string? Remark = null)
+public sealed record ShopRenewCommand(string UserName, string ShopId, int RenewDuration, string? Remark = null, string? OperatorName = null)
     : IRequest<ShopRenewResponse>, IValidatableRequest, IAccountConsumptionRequest, IShopOwnershipRequest
 {
     // 由消费管道建立，仅在当前事务执行期间有效。
@@ -29,6 +29,7 @@ public sealed record ShopRenewCommand(string UserName, string ShopId, int RenewD
     {
         RequestValidator.Validate(new UserNameRequest { UserName = UserName?.Trim()! });
         UserInputChecks.Length(UserName.Trim(), 20, "用户名");
+        UserInputChecks.Length(OperatorName, 20, "操作者");
         var request = new ShopRenewRequest { ShopId = ShopId, RenewDuration = RenewDuration, Remark = Remark };
         RequestValidator.Validate(request);
         UserInputChecks.Renew(request);
@@ -58,6 +59,12 @@ internal sealed class ShopRenewCommandHandler(UnitOfWorkExecutionContext executi
             ?? throw new InvalidOperationException("续费命令必须通过账户消费管道执行");
         var orm = executionContext.Orm;
         var user = context.User;
+        // 代操作权限在事务中再次确认，审计流水记录实际操作者而非被操作账户。
+        var operatorName = request.OperatorName ?? userName;
+        var actor = await orm.Select<UserEntity>().Where(u => u.UserName == operatorName).FirstAsync(cancellationToken)
+            ?? throw new AppException("操作者账户不存在");
+        if (!UserAccessPolicy.CanManage(actor, user) && actor.Id != user.Id)
+            throw new AppException("无权为该账户续费", 403);
         var shop = ((IShopOwnershipRequest)request).OwnedShop
             ?? throw new InvalidOperationException("续费命令必须通过商铺归属管道执行");
         decimal pointsPerMonth = context.Quote.UnitPrice;
@@ -87,8 +94,8 @@ internal sealed class ShopRenewCommandHandler(UnitOfWorkExecutionContext executi
             var record = new UserPointsRecordEntity
             {
                 OptionType = "续费",
-                OperatorType = "用户",
-                OperatorName = userName,
+                OperatorType = UserAccessPolicy.IsAdmin(actor) ? "管理员" : "用户",
+                OperatorName = actor.UserName,
                 UserName = userName,
                 UserNick = user.NickName,
                 DeltaPoints = pointsPerMonth,

Modules/Store.Users/Controllers/UserController.cs

@@ -1,6 +1,7 @@
 using MAX.Framework.Security;
 using MediatR;
 using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Store.Users.Commands;
 using Store.Users.Contracts.Dtos;
@@ -20,55 +21,67 @@ namespace Store.Users.Controllers;
 public class UserController(UserManagementService users, UserFundsService funds, IMediator mediator, ICurrentUser currentUser) : ControllerBase
 {
     /// <summary>获取本人或授权范围内的用户信息，响应不包含密码。</summary>
+    [EndpointSummary("获取用户信息")]
     public Task<UserInfo> GetUser(string? userName, CancellationToken cancellationToken)
     {
         return users.GetUser(userName, cancellationToken);
     }
 
-    /// <summary>管理员分页查询所有用户。</summary>
+    /// <summary>管理员查询全部用户；普通主账号仅查询本人及直属子账号。</summary>
+    [EndpointSummary("分页查询所有用户")]
     public Task<UserPage<UserInfo>> GetAllUser(UserSearchRequest request, CancellationToken cancellationToken)
     {
         return users.Search(request, false, cancellationToken);
     }
 
-    /// <summary>分页查询当前主账号的直属子账号。</summary>
+    /// <summary>管理员可查询所有账号的子账号，普通主账号只能查询自己的直属子账号。</summary>
+    /// <param name="request">管理员可通过 ParentUserName 筛选指定父账号；普通主账号仅可指定自己。</param>
+    /// <param name="cancellationToken">请求取消标记。</param>
+    [EndpointSummary("分页查询子账号")]
+    [EndpointDescription("管理员不传 ParentUserName 时查询全部子账号，传入时按指定父账号筛选；普通主账号只能查询自己的子账号。")]
     public Task<UserPage<UserInfo>> GetSubUser(UserSearchRequest request, CancellationToken cancellationToken)
     {
         return users.Search(request, true, cancellationToken);
     }
 
     /// <summary>管理员创建主账号。</summary>
+    [EndpointSummary("创建主账号")]
     public Task<UserInfo> AddUser(UserCreateRequest request, CancellationToken cancellationToken)
     {
         return users.Create(request, false, cancellationToken);
     }
 
-    /// <summary>主账号创建直属子账号。</summary>
+    /// <summary>管理员可为指定主账号创建子账号，普通主账号仅可为自己创建子账号。</summary>
+    [EndpointSummary("创建直属子账号")]
     public Task<UserInfo> AddSubUser(UserCreateRequest request, CancellationToken cancellationToken)
     {
         return users.Create(request, true, cancellationToken);
     }
 
-    /// <summary>管理员修改账户资料，用户名不可变更。</summary>
+    /// <summary>管理员修改任意账户；普通主账号仅修改本人及直属子账号，用户名不可变更。</summary>
+    [EndpointSummary("修改用户资料")]
     public Task<UserInfo> UpdateUser(UserUpdateRequest request, CancellationToken cancellationToken)
     {
         return users.Update(request.Id, request, false, cancellationToken);
     }
 
-    /// <summary>主账号修改直属子账号资料。</summary>
+    /// <summary>管理员修改任意子账号，普通主账号仅修改直属子账号。</summary>
+    [EndpointSummary("修改直属子账号资料")]
     public Task<UserInfo> UpdateSubUser(UserUpdateRequest request, CancellationToken cancellationToken)
     {
         return users.Update(request.Id, request, true, cancellationToken);
     }
 
     /// <summary>删除无资金和业务关联的账户。</summary>
+    [EndpointSummary("删除用户")]
     public async Task<ApiResult> DelUser(int id, CancellationToken cancellationToken)
     {
         await users.Delete(id, cancellationToken);
         return ApiResult.Ok();
     }
 
-    /// <summary>校验旧密码并修改本人密码，成功后需重新登录。</summary>
+    /// <summary>本人改密校验原密码；管理员或主账号可为管理范围内的其他账户重置密码。</summary>
+    [EndpointSummary("修改或重置用户密码")]
     public async Task<ApiResult> ChangePassword(ChangePasswordRequest request, CancellationToken cancellationToken)
     {
         await users.ChangePassword(request, cancellationToken);
@@ -76,49 +89,57 @@ public class UserController(UserManagementService users, UserFundsService funds,
     }
 
     /// <summary>查询授权账户的积分流水。</summary>
+    [EndpointSummary("查询用户积分流水")]
     public Task<UserPage<UserPointsRecordEntity>> GetUserPoints(UserRecordSearchRequest request, CancellationToken cancellationToken)
     {
         return users.Points(request.UserName, request, cancellationToken);
     }
 
     /// <summary>查询授权账户的余额流水。</summary>
+    [EndpointSummary("查询用户余额流水")]
     public Task<UserPage<UserPaymentRecordEntity>> GetUserBalance(UserRecordSearchRequest request, CancellationToken cancellationToken)
     {
         return users.Balance(request.UserName, request, cancellationToken);
     }
 
     /// <summary>管理员充值积分，或当前用户向其他账户转移自己的积分。</summary>
+    [EndpointSummary("充值或转移用户积分")]
     public Task<UserFundsResponse> UpdateUserPoints(UserFundsRequest request, CancellationToken cancellationToken)
     {
         return funds.Change(request, true, cancellationToken);
     }
 
     /// <summary>管理员充值或扣减余额，自动记录审计流水。</summary>
+    [EndpointSummary("充值或扣减用户余额")]
     public Task<UserFundsResponse> UpdateUserBalance(UserFundsRequest request, CancellationToken cancellationToken)
     {
         return funds.Change(request, false, cancellationToken);
     }
 
-    /// <summary>提交本人的充值备注。</summary>
+    /// <summary>提交本人或管理范围内账户的充值备注。</summary>
+    [EndpointSummary("提交充值备注")]
     public Task<long> AddUserTopUpMsg(UserTopUpMessageRequest request, CancellationToken cancellationToken)
     {
         return users.AddTopUpMessage(request, cancellationToken);
     }
 
-    /// <summary>管理员填写充值备注的处理结果。</summary>
+    /// <summary>管理员可处理所有充值备注，普通主账号仅处理本人及直属子账号备注，不自动充值。</summary>
+    [EndpointSummary("处理充值备注")]
     public async Task<ApiResult> UpdateUserTopUpMsg(UserTopUpResultRequest request, CancellationToken cancellationToken)
     {
         await users.UpdateTopUpMessage(request, cancellationToken);
         return ApiResult.Ok();
     }
 
-    /// <summary>分页查询充值备注。</summary>
+    /// <summary>按管理员、主账号或子账号的授权范围分页查询充值备注。</summary>
+    [EndpointSummary("分页查询充值备注")]
     public Task<UserPage<UserTopUpMessageEntity>> GetUserTopUpMsg(UserSearchRequest request, CancellationToken cancellationToken)
     {
         return users.TopUpMessages(request, cancellationToken);
     }
 
     /// <summary>管理员维护代理充值二维码。</summary>
+    [EndpointSummary("维护代理充值二维码")]
     public async Task<ApiResult> UpdateTopUpQrcode(UserTopUpQrcodeRequest request, CancellationToken cancellationToken)
     {
         await users.UpdateTopUpQrcode(request, cancellationToken);
@@ -126,18 +147,22 @@ public class UserController(UserManagementService users, UserFundsService funds,
     }
 
     /// <summary>获取代理充值二维码。</summary>
+    [EndpointSummary("获取代理充值二维码")]
     public Task<string?> GetTopUpQrcode(string agentCode, CancellationToken cancellationToken)
     {
         return users.GetTopUpQrcode(agentCode, cancellationToken);
     }
 
-    /// <summary>使用当前登录用户的积分为商铺续费。</summary>
-    public Task<ShopRenewResponse> ShopRenew(ShopRenewRequest request, CancellationToken cancellationToken)
+    /// <summary>管理员或主账号为授权账户的商铺续费，扣除店铺所属账户积分并记录实际操作者。</summary>
+    [EndpointSummary("使用积分为商铺续费")]
+    public async Task<ShopRenewResponse> ShopRenew(ShopRenewRequest request, CancellationToken cancellationToken)
     {
         if (!currentUser.IsAuthenticated || string.IsNullOrWhiteSpace(currentUser.UserName))
         {
             throw new UnauthorizedAccessException();
         }
-        return mediator.Send(new ShopRenewCommand(currentUser.UserName, request.ShopId, request.RenewDuration, request.Remark), cancellationToken);
+        var targetName = await users.GetManagedUserName(request.UserName, cancellationToken);
+        return await mediator.Send(new ShopRenewCommand(targetName, request.ShopId, request.RenewDuration, request.Remark,
+            currentUser.UserName), cancellationToken);
     }
 }

Modules/Store.Users/Dtos/ShopRenewRequest.cs

@@ -4,6 +4,8 @@ namespace Store.Users.Dtos;
 /// <summary>续费请求；仅声明店铺ID非空，时长和长度由服务或命令处理。</summary>
 public class ShopRenewRequest
 {
+    /// <summary>续费账户；管理员可指定任意账户，普通主账号仅限本人及直属子账号。</summary>
+    public string? UserName { get; set; }
     [Required(ErrorMessage = "店铺ID不能为空")] public string ShopId { get; set; } = "";
     /// <summary>续费时长，单位月，合法范围1-120。</summary>
     public int RenewDuration { get; set; }

Modules/Store.Users/README.md

@@ -22,21 +22,21 @@ HTTP 方法约定：控制器通过 [DefaultHttpPost] 启用默认 POST。所有
 | 方法 | 路径 | 访问与行为 |
 | --- | --- | --- |
 | POST | /user/GetUser?userName=... | 本人、直属主账号或管理员；省略用户名读取本人 |
-| POST | /user/GetAllUser | 管理员分页查询，支持 Keyword、GroupId |
-| POST | /user/GetSubUser | 当前主账号直属子账号分页查询 |
+| POST | /user/GetAllUser | 管理员查询全部；普通主账号查询本人及直属子账号 |
+| POST | /user/GetSubUser | 管理员查询所有子账号，可用 ParentUserName 按父账号筛选；普通主账号仅能查询自己的子账号 |
 | POST | /user/AddUser | 管理员新增主账号 |
 | POST | /user/AddSubUser | 当前主账号新增直属子账号 |
-| POST | /user/UpdateUser | 管理员修改资料 |
-| POST | /user/UpdateSubUser | 主账号修改直属子账号 |
+| POST | /user/UpdateUser | 管理员修改任意账户；普通主账号修改本人及直属子账号 |
+| POST | /user/UpdateSubUser | 管理员修改任意子账号；普通主账号修改直属子账号 |
 | POST | /user/DelUser?id=... | 管理员或直属主账号删除空账户 |
-| POST | /user/ChangePassword | 本人校验旧密码后修改，会话立即失效 |
+| POST | /user/ChangePassword | 本人改密校验原密码；管理员/主账号可重置授权账户密码 |
 | POST | /user/GetUserPoints | 授权账户积分流水，支持起止时间、操作类型、店铺过滤 |
 | POST | /user/GetUserBalance | 授权账户余额流水，支持起止时间、支付类型、订单过滤 |
-| POST | /user/UpdateUserPoints | 管理员充值；本人向其他账户转移自己的积分 |
+| POST | /user/UpdateUserPoints | 管理员充值；本人向管理范围内账户转移自己的积分 |
 | POST | /user/UpdateUserBalance | 管理员充值或消费调整 |
-| POST | /user/AddUserTopUpMsg | 本人提交充值备注 |
-| POST | /user/UpdateUserTopUpMsg | 管理员填写处理结果，不自动充值 |
-| POST | /user/GetUserTopUpMsg | 本人备注或管理员查看全部 |
+| POST | /user/AddUserTopUpMsg | 本人或授权账户提交充值备注 |
+| POST | /user/UpdateUserTopUpMsg | 管理员或主账号处理授权账户的备注，不自动充值 |
+| POST | /user/GetUserTopUpMsg | 管理员查看全部；主账号查看本人及直属子账号备注 |
 | POST | /user/UpdateTopUpQrcode | 管理员维护代理二维码 |
 | POST | /user/GetTopUpQrcode?agentCode=... | 登录用户读取代理二维码 |
 | POST | /user/ShopRenew | 保留原有 MediatR 事务续费用例 |
@@ -85,3 +85,15 @@ RequestValidator.Validate(request);
 权限、账户归属、数据库记录是否存在、余额是否足够、重复请求等业务规则继续在服务或业务管道中判断。不合法的参数抛出 ValidationException，权限和业务错误沿用现有业务异常；现有过滤器将它们转换为 HTTP 200 和对应业务码。
 
 公共 RequestValidator 位于 `Core/MAX.Framework/Validation/RequestValidator.cs`。它仍支持标准 DataAnnotations 及 IValidatableObject，其他模块可以直接复用；User 模块“DTO 仅非空”的约定不改变公共校验器能力。该工具不递归验证嵌套对象。
+
+## 账户管理权限
+
+统一使用 Services/UserAccessPolicy：管理员可管理任意账户，普通主账号可管理本人及直属子账号；普通子账号保留本人查询和本人改密能力，不能管理其他账户。UpdateUser 支持此统一范围，UpdateSubUser 同时要求目标确实是子账号。管理员创建子账号时可传 ParentUserName 指定任意主账号；普通主账号只能指定自己。
+
+ChangePassword 可传 UserName 指定目标，省略表示本人。本人改密仍须正确 OldPassword；管理员或主账号重置管理范围内的其他账户时仅需 NewPassword。成功后注销目标账户的会话。
+
+已确认的财务权限保持：直接充值积分/余额、余额扣款、计费配置和公共代理二维码维护仅管理员可用；普通主账号不能提升管理员级别。积分转移仅从当前登录账户转出，普通主账号的转入目标限直属子账号。充值备注的提交/处理不代表资金到账。
+
+ShopRenew 可传 UserName 指定授权账户，以店铺所属账户积分扣款，流水记录实际 OperatorName。账户删除仍禁止删除当前登录账户，且要求无积分、无余额、无子账号和无店铺关联。
+
+管理员角色账户即使存在父账号关系，也不能由普通主账号修改或重置密码，避免通过子账号关系获得管理员身份。

Modules/Store.Users/Services/UserAccessPolicy.cs

@@ -0,0 +1,18 @@
+using Store.Users.Entities;
+
+namespace Store.Users.Services;
+
+/// <summary>统一账户管理范围：管理员管理全部，主账号管理本人及直属子账号。</summary>
+internal static class UserAccessPolicy
+{
+    public static bool IsAdmin(UserEntity actor) => actor.SaLevel == 1;
+
+    public static bool Owns(UserEntity actor, UserEntity target) => actor.IsMainUser
+        && string.Equals(target.ParentUserName, actor.UserName, StringComparison.OrdinalIgnoreCase);
+
+    public static bool CanRead(UserEntity actor, UserEntity target) =>
+        IsAdmin(actor) || actor.Id == target.Id || Owns(actor, target);
+
+    public static bool CanManage(UserEntity actor, UserEntity target) =>
+        IsAdmin(actor) || (!IsAdmin(target) && actor.IsMainUser && (actor.Id == target.Id || Owns(actor, target)));
+}

Modules/Store.Users/Services/UserFundsService.cs

@@ -37,6 +37,8 @@ public sealed class UserFundsService(IFreeSql orm, ICurrentUser currentUser) : I
         var target = await db.Select<UserEntity>().Where(u => u.UserName == name).FirstAsync(ct)
             ?? throw new AppException("目标账户不存在");
         if (transfer && actor.Id == target.Id) throw new AppException("不能向自己转移积分");
+        if (transfer && !UserAccessPolicy.CanManage(actor, target))
+            throw new AppException("只能向管理范围内的账户转移积分", 403);
         // 双账户转移按相同主键顺序加锁，避免双方同时转账时产生反向锁顺序。
         var ids = transfer ? new[] { actor.Id, target.Id }.Order().ToArray() : new[] { target.Id };
         foreach (var id in ids)

Modules/Store.Users/Services/UserInputChecks.cs

@@ -49,6 +49,7 @@ internal static class UserInputChecks
         if (request.Page is < 1 or > 1000000) throw new ValidationException("页码必须为1-1000000");
         if (request.PageSize is < 1 or > 200) throw new ValidationException("每页条数必须为1-200");
         Length(request.Keyword, 100, "查询关键字");
+        Length(request.ParentUserName, 20, "父账号");
         Group(request.GroupId);
     }
 

Modules/Store.Users/Services/UserManagementService.TopUp.cs

@@ -6,40 +6,57 @@ namespace Store.Users.Services;
 
 public sealed partial class UserManagementService
 {
-    /// <summary>以本人身份提交充值备注，不能伪造提交账户或昵称。</summary>
+    /// <summary>为本人或授权账户提交充值备注，昵称从目标账户读取。</summary>
     public async Task<long> AddTopUpMessage(UserTopUpMessageRequest request, CancellationToken ct)
     {
         RequestValidator.Validate(request);
         UserInputChecks.Length(request.Message, 1000, "充值备注");
+        UserInputChecks.Length(request.UserName, 20, "用户名");
         var actor = await Actor(orm, ct);
+        var name = string.IsNullOrWhiteSpace(request.UserName) ? actor.UserName : request.UserName.Trim();
+        var target = await orm.Select<UserEntity>().Where(u => u.UserName == name).FirstAsync(ct)
+            ?? throw new AppException("用户不存在");
+        if (!UserAccessPolicy.CanManage(actor, target) && actor.Id != target.Id)
+            throw new AppException("无权为该账户提交充值备注", 403);
         return await orm.Insert(new UserTopUpMessageEntity
         {
-            UserName = actor.UserName, NickName = actor.NickName, Message = request.Message.Trim()
+            UserName = target.UserName, NickName = target.NickName, Message = request.Message.Trim()
         }).ExecuteIdentityAsync(ct);
     }
 
-    /// <summary>管理员记录人工处理结果。备注处理与实际充值是不同用例。</summary>
+    /// <summary>管理范围内记录人工处理结果。备注处理不会自动增加积分或余额。</summary>
     public async Task UpdateTopUpMessage(UserTopUpResultRequest request, CancellationToken ct)
     {
         RequestValidator.Validate(request);
         UserInputChecks.PositiveId(request.Id);
         UserInputChecks.Length(request.Result, 1000, "处理结果");
         var actor = await Actor(orm, ct);
-        if (!IsAdmin(actor)) throw new AppException("仅管理员可以处理充值备注", 403);
-        if (!await orm.Select<UserTopUpMessageEntity>().Where(m => m.Id == request.Id).AnyAsync(ct))
-            throw new AppException("充值备注不存在");
+        var message = await orm.Select<UserTopUpMessageEntity>().Where(m => m.Id == request.Id).FirstAsync(ct)
+            ?? throw new AppException("充值备注不存在");
+        if (!IsAdmin(actor))
+        {
+            var target = await orm.Select<UserEntity>().Where(u => u.UserName == message.UserName).FirstAsync(ct);
+            if (target == null || !UserAccessPolicy.CanManage(actor, target))
+                throw new AppException("无权处理该账户的充值备注", 403);
+        }
         await orm.Update<UserTopUpMessageEntity>().Set(m => m.Result, request.Result.Trim())
             .Where(m => m.Id == request.Id).ExecuteAffrowsAsync(ct);
     }
 
-    /// <summary>普通用户仅查看自己提交的备注，管理员查看全部。</summary>
+    /// <summary>管理员查看全部，主账号查看本人和直属子账号，子账号仅查看本人备注。</summary>
     public async Task<UserPage<UserTopUpMessageEntity>> TopUpMessages(UserSearchRequest request, CancellationToken ct)
     {
         RequestValidator.Validate(request);
         UserInputChecks.Search(request);
         var actor = await Actor(orm, ct);
         var select = orm.Select<UserTopUpMessageEntity>();
-        if (!IsAdmin(actor)) select = select.Where(m => m.UserName == actor.UserName);
+        if (!IsAdmin(actor))
+        {
+            if (actor.IsMainUser)
+                select = select.Where(m => m.UserName == actor.UserName || orm.Select<UserEntity>()
+                    .Where(u => u.UserName == m.UserName && u.ParentUserName == actor.UserName).Any());
+            else select = select.Where(m => m.UserName == actor.UserName);
+        }
         var total = await select.CountAsync(ct);
         var rows = await select.OrderByDescending(m => m.Id).Page(request.Page, request.PageSize).ToListAsync(ct);
         return new(total, rows);

Modules/Store.Users/Services/UserManagementService.cs

@@ -23,10 +23,7 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
             ?? throw new UnauthorizedAccessException("登录账户不存在");
     }
 
-    private static bool IsAdmin(UserEntity actor) => actor.SaLevel == 1;
-    private static bool Owns(UserEntity actor, UserEntity target) =>
-        actor.IsMainUser && string.Equals(target.ParentUserName, actor.UserName, StringComparison.OrdinalIgnoreCase);
-
+    private static bool IsAdmin(UserEntity actor) => UserAccessPolicy.IsAdmin(actor);
     /// <summary>仅本人、直属主账号或超级管理员可以读取账户详情。</summary>
     public async Task<UserInfo> GetUser(string? userName, CancellationToken ct)
     {
@@ -36,21 +33,53 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
         UserInputChecks.Length(name, 20, "用户名");
         var target = await orm.Select<UserEntity>().Where(u => u.UserName == name).FirstAsync(ct)
             ?? throw new AppException("用户不存在");
-        if (!IsAdmin(actor) && actor.Id != target.Id && !Owns(actor, target))
+        if (!UserAccessPolicy.CanRead(actor, target))
             throw new AppException("无权访问该账户", 403);
         return await query.GetUser(target.UserName);
     }
 
-    /// <summary>管理员查询全部账户；普通主账号只能查询自己的直属子账号。</summary>
+    /// <summary>解析代操作目标，服务端校验管理员或主子账号归属，省略用户名时操作本人。</summary>
+    public async Task<string> GetManagedUserName(string? userName, CancellationToken ct)
+    {
+        var actor = await Actor(orm, ct);
+        var name = string.IsNullOrWhiteSpace(userName) ? actor.UserName : userName.Trim();
+        UserInputChecks.Length(name, 20, "用户名");
+        var target = await orm.Select<UserEntity>().Where(u => u.UserName == name).FirstAsync(ct)
+            ?? throw new AppException("用户不存在");
+        if (!UserAccessPolicy.CanManage(actor, target) && actor.Id != target.Id)
+            throw new AppException("无权操作该账户", 403);
+        return target.UserName;
+    }
+
+    /// <summary>管理员查询全部账户；普通主账号的列表范围为本人和直属子账号。</summary>
     public async Task<UserPage<UserInfo>> Search(UserSearchRequest request, bool subUsersOnly, CancellationToken ct)
     {
         RequestValidator.Validate(request);
         UserInputChecks.Search(request);
         var actor = await Actor(orm, ct);
-        if (!subUsersOnly && !IsAdmin(actor)) throw new AppException("仅管理员可以查询全部账户", 403);
-        if (subUsersOnly && !actor.IsMainUser) throw new AppException("子账号不能管理其他账户", 403);
+        if (!subUsersOnly && !IsAdmin(actor) && !actor.IsMainUser) throw new AppException("无权查询账户列表", 403);
+        if (subUsersOnly && !IsAdmin(actor) && !actor.IsMainUser) throw new AppException("子账号不能管理其他账户", 403);
         var select = orm.Select<UserEntity>();
-        if (subUsersOnly) select = select.Where(u => u.ParentUserName == actor.UserName);
+        if (subUsersOnly)
+        {
+            var parentUserName = request.ParentUserName?.Trim();
+            if (IsAdmin(actor))
+            {
+                // 管理员省略父账号时查询所有子账号，但不混入主账号。
+                select = select.Where(u => u.ParentUserName != null && u.ParentUserName.Trim() != "");
+                if (!string.IsNullOrWhiteSpace(parentUserName))
+                    select = select.Where(u => u.ParentUserName == parentUserName);
+            }
+            else
+            {
+                if (!string.IsNullOrWhiteSpace(parentUserName)
+                    && !string.Equals(parentUserName, actor.UserName, StringComparison.OrdinalIgnoreCase))
+                    throw new AppException("只能查询自己的子账号", 403);
+                select = select.Where(u => u.ParentUserName == actor.UserName);
+            }
+        }
+        else if (!IsAdmin(actor))
+            select = select.Where(u => u.Id == actor.Id || u.ParentUserName == actor.UserName);
         if (request.GroupId.HasValue) select = select.Where(u => u.GroupId == request.GroupId.Value);
         if (!string.IsNullOrWhiteSpace(request.Keyword))
         {
@@ -70,6 +99,7 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
         UserInputChecks.Length(request.UserName, 20, "用户名");
         UserInputChecks.Length(request.Password, 128, "密码", 6);
         UserInputChecks.Edit(request);
+        UserInputChecks.Length(request.ParentUserName, 20, "父账号");
 
         using var work = orm.CreateUnitOfWork();
         work.GetOrBeginTransaction();
@@ -78,12 +108,23 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
         // 锁住主账号，使其创建子账号和删除操作串行化。
         actor = await db.Select<UserEntity>().Where(u => u.Id == actor.Id).ForUpdate().FirstAsync(ct)
             ?? throw new AppException("操作者账户不存在");
-        if (subUser ? !actor.IsMainUser : !IsAdmin(actor)) throw new AppException("无权创建该账户", 403);
+        if (subUser ? !IsAdmin(actor) && !actor.IsMainUser : !IsAdmin(actor)) throw new AppException("无权创建该账户", 403);
+        var parentName = "";
+        if (subUser)
+        {
+            parentName = string.IsNullOrWhiteSpace(request.ParentUserName) ? actor.UserName : request.ParentUserName.Trim();
+            if (!IsAdmin(actor) && !string.Equals(parentName, actor.UserName, StringComparison.OrdinalIgnoreCase))
+                throw new AppException("只能在自己的账户下创建子账号", 403);
+            var parent = await db.Select<UserEntity>().Where(u => u.UserName == parentName).ForUpdate().FirstAsync(ct)
+                ?? throw new AppException("父账号不存在");
+            if (!parent.IsMainUser) throw new AppException("父账号必须是主账号");
+            parentName = parent.UserName;
+        }
         var name = request.UserName.Trim();
         if (await db.Select<UserEntity>().Where(u => u.UserName == name).AnyAsync(ct)) throw new AppException("用户名已存在");
         var user = new UserEntity
         {
-            UserName = name, ParentUserName = subUser ? actor.UserName : "", GroupId = subUser ? (byte)4 : (byte)3,
+            UserName = name, ParentUserName = parentName, GroupId = subUser ? (byte)4 : (byte)3,
             NickName = name, Mobile = "", CompanyName = "", Notes = "", CardId = "", Authority = "",
             ForbiddenPage = "", OemId = "", SaLevel = 0, ShopPointsPerMonth = 30,
             PostagePerOrder = 2.2m, RefundPostagePerOrder = 2.5m, GiftOemAmountPerOrder = 0,
@@ -111,7 +152,8 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
         var actor = await Actor(db, ct);
         var target = await db.Select<UserEntity>().Where(u => u.Id == id).ForUpdate().FirstAsync(ct)
             ?? throw new AppException("用户不存在");
-        if (subUser ? !Owns(actor, target) : !IsAdmin(actor)) throw new AppException("无权修改该账户", 403);
+        if (!UserAccessPolicy.CanManage(actor, target)) throw new AppException("无权修改该账户", 403);
+        if (subUser && target.IsMainUser) throw new AppException("目标账户不是子账号");
         Apply(target, request, actor, !target.IsMainUser);
         await CheckOem(db, target, ct);
         target.MdyTime = DateTime.Now;
@@ -139,7 +181,7 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
         var target = await db.Select<UserEntity>().Where(u => u.Id == id).ForUpdate().FirstAsync(ct)
             ?? throw new AppException("用户不存在");
         if (actor.Id == target.Id) throw new AppException("不能删除当前登录账户");
-        if (!IsAdmin(actor) && !Owns(actor, target)) throw new AppException("无权删除该账户", 403);
+        if (!UserAccessPolicy.CanManage(actor, target)) throw new AppException("无权删除该账户", 403);
         if ((target.Balance ?? 0) != 0 || target.Points != 0) throw new AppException("账户仍有余额或积分，不能删除");
         if (await db.Select<UserEntity>().Where(u => u.ParentUserName == target.UserName).AnyAsync(ct))
             throw new AppException("请先处理该账户的子账号");
@@ -152,19 +194,29 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
         onlineUsers.SignOut(target.UserName);
     }
 
-    /// <summary>比较并更新密码，防止并发密码变更丢失；成功后立即失效已有登录会话。</summary>
+    /// <summary>本人改密校验原密码，管理者可重置授权账户密码；比较并更新后失效目标账户会话。</summary>
     public async Task ChangePassword(ChangePasswordRequest request, CancellationToken ct)
     {
         RequestValidator.Validate(request);
         UserInputChecks.Length(request.OldPassword, 128, "原密码");
         UserInputChecks.Length(request.NewPassword, 128, "新密码", 6);
         var actor = await Actor(orm, ct);
-        if (!UserPassword.Verify(actor, request.OldPassword)) throw new AppException("原密码错误");
-        var hash = UserPassword.Hash(actor, request.NewPassword);
+        var name = string.IsNullOrWhiteSpace(request.UserName) ? actor.UserName : request.UserName.Trim();
+        UserInputChecks.Length(name, 20, "用户名");
+        var target = await orm.Select<UserEntity>().Where(u => u.UserName == name).FirstAsync(ct)
+            ?? throw new AppException("用户不存在");
+        if (target.Id == actor.Id)
+        {
+            RequestValidator.Validate(new UserPasswordProofRequest { OldPassword = request.OldPassword! });
+            if (!UserPassword.Verify(target, request.OldPassword!)) throw new AppException("原密码错误");
+        }
+        else if (!UserAccessPolicy.CanManage(actor, target))
+            throw new AppException("无权修改该账户密码", 403);
+        var hash = UserPassword.Hash(target, request.NewPassword);
         if (await orm.Update<UserEntity>().Set(u => u.Password, hash).Set(u => u.MdyTime, DateTime.Now)
-            .Where(u => u.Id == actor.Id && u.Password == actor.Password).ExecuteAffrowsAsync(ct) != 1)
+            .Where(u => u.Id == target.Id && u.Password == target.Password).ExecuteAffrowsAsync(ct) != 1)
             throw new AppException("密码已发生变化，请重新登录");
-        onlineUsers.SignOut(actor.UserName);
+        onlineUsers.SignOut(target.UserName);
     }
 
     /// <summary>按账户归属查询积分流水；分页与账户详情使用相同的访问范围。</summary>
@@ -222,7 +274,7 @@ public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser cur
             throw new AppException("仅管理员可以修改计费配置", 403);
         if (request.SaLevel.HasValue)
         {
-            if (!IsAdmin(actor) || (subUser && request.SaLevel != 0)) throw new AppException("无权设置管理员级别", 403);
+            if (!IsAdmin(actor)) throw new AppException("无权设置管理员级别", 403);
             user.SaLevel = request.SaLevel;
         }
         user.NickName = request.NickName?.Trim() ?? user.NickName;