From a2a7e0125c2238928532037b76982e18988838c8 Mon Sep 17 00:00:00 2001
From: yueli <yueli@example.com>
Date: Wed, 15 Jul 2026 09:22:58 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20SUPERVISOR=E4=B8=8D=E8=83=BD=E4=BF=AE?=
 =?UTF-8?q?=E6=94=B9/=E5=88=A0=E9=99=A4SUPER=5FADMIN=E8=B4=A6=E5=8F=B7,=20?=
 =?UTF-8?q?=E4=B8=8D=E8=83=BD=E5=88=A0=E8=87=AA=E5=B7=B1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 inventory-backend/app/services/auth_service.py | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/inventory-backend/app/services/auth_service.py b/inventory-backend/app/services/auth_service.py
index d06bac0..d6b9f3e 100644
--- a/inventory-backend/app/services/auth_service.py
+++ b/inventory-backend/app/services/auth_service.py
@@ -308,6 +308,10 @@ class AuthService:
         if not user:
             raise Exception("用户不存在")
 
+        # 主管不能修改超级管理员
+        if operator_role_upper == UserRole.SUPERVISOR and (user.role or '').upper() == UserRole.SUPER_ADMIN:
+            raise Exception("权限不足：主管无法修改超级管理员账号")
+
         # 1. 更新基本信息
         if 'role' in data:
             valid_roles = [
@@ -378,6 +382,17 @@ class AuthService:
         if not user:
             raise Exception("用户不存在")
 
+        # 任何人都不能删除自己
+        from flask_jwt_extended import get_jwt
+        claims = get_jwt()
+        current_user_id = claims.get('sub')
+        if str(current_user_id) == str(user_id):
+            raise Exception("不能删除自己的账号")
+
+        # 主管不能删除超级管理员
+        if operator_role_upper == UserRole.SUPERVISOR and (user.role or '').upper() == UserRole.SUPER_ADMIN:
+            raise Exception("权限不足：主管无法删除超级管理员账号")
+
         # 权限校验
         if operator_role_upper == UserRole.SUPER_ADMIN:
             pass  # 超管可删除任何人