用户管理与数据操作

server/api/admin/users/[id]/status.post.ts

@@ -0,0 +1,32 @@
+import { requireAdminAuth } from '../../../../utils/access'
+import { createApiError } from '../../../../utils/api-error'
+import { logActivity } from '../../../../utils/activity-log'
+import { findUserById, setUserDisabled } from '../../../../utils/db'
+
+export default defineEventHandler(async (event) => {
+  await requireAdminAuth(event)
+
+  const id = Number(getRouterParam(event, 'id'))
+  const target = Number.isInteger(id) ? findUserById(id) : null
+  if (!target) {
+    createApiError(event, 'INVALID_REQUEST', '用户不存在', 404)
+  }
+  if (target.role === 'admin') {
+    createApiError(event, 'FORBIDDEN', '不允许禁用管理员账号', 403)
+  }
+
+  const body = await readBody<{ disabled?: unknown }>(event).catch(() => null)
+  if (typeof body?.disabled !== 'boolean') {
+    createApiError(event, 'INVALID_REQUEST', '无效的账号状态', 400)
+  }
+
+  setUserDisabled(target.id, body.disabled)
+  logActivity(event, {
+    action: 'settings',
+    key: `users/${target.id}/status`,
+    originalName: target.username,
+    source: 'admin'
+  })
+
+  return { success: true, disabled: body.disabled }
+})

server/api/auth/login.post.ts

@@ -57,6 +57,11 @@ export default defineEventHandler(async (event) => {
 
   const user = findUserByUsername(username)
 
+  if (user?.disabled_at) {
+    logWarn('login failed: user disabled', { ip, username })
+    createApiError(event, 'FORBIDDEN', '该账号已被禁用', 403)
+  }
+
   // 管理员已清除密码：下次登录时直接进入设置新密码流程
   if (user && isPasswordResetRequired(user.id)) {
     return { success: false, requiresPasswordReset: true, username: user.username }