新增系统管理员岗位

2026-04-27 16:25:39 +08:00
parent 5662c1fda9
commit 79812b2c77
63 changed files with 609 additions and 495 deletions
--- a/src/main/java/com/labelsys/backend/service/AnnotationResultService.java
+++ b/src/main/java/com/labelsys/backend/service/AnnotationResultService.java
@@ -1,6 +1,7 @@
 package com.labelsys.backend.service;

 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.labelsys.backend.common.ResultCode;
 import com.labelsys.backend.common.exception.BusinessException;
 import com.labelsys.backend.context.LoginUser;
@@ -13,44 +14,65 @@ import com.labelsys.backend.entity.SourceResource;
 import com.labelsys.backend.enums.RuntimeResultStatus;
 import com.labelsys.backend.mapper.AnnotationResultMapper;
 import com.labelsys.backend.mapper.SourceResourceMapper;
-import java.util.Comparator;
+import com.labelsys.backend.service.DataPermissionService;
 import java.util.List;
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.stereotype.Service;

+@Slf4j
@Service
@RequiredArgsConstructor
 public class AnnotationResultService {

    private final AnnotationResultMapper annotationResultMapper;
    private final SourceResourceMapper sourceResourceMapper;
+    private final DataPermissionService dataPermissionService;

    public PageResult<AnnotationResultResponse> pageResults(LoginUser currentUser, AnnotationResultPageQuery query) {
+        List<String> allowedRoles = dataPermissionService.getAllowedRoles(currentUser);
+        boolean shouldFilterByUserId = dataPermissionService.shouldFilterByUserId(currentUser);
+        
        LambdaQueryWrapper<AnnotationResult> wrapper = new LambdaQueryWrapper<AnnotationResult>()
            .eq(AnnotationResult::getCompanyId, currentUser.companyId())
            .eq(query.taskId() != null, AnnotationResult::getTaskId, query.taskId())
            .eq(query.resourceId() != null, AnnotationResult::getResourceId, query.resourceId())
-            .eq(query.requiresManualReview() != null, AnnotationResult::getRequiresManualReview, query.requiresManualReview())
-            .orderByDesc(AnnotationResult::getCreatedAt);
-        List<AnnotationResultResponse> records = annotationResultMapper.selectList(wrapper).stream()
+            .eq(query.requiresManualReview() != null, AnnotationResult::getRequiresManualReview, query.requiresManualReview());
+        
+        if (shouldFilterByUserId) {
+            wrapper.eq(AnnotationResult::getCreatorId, currentUser.userId());
+        } else if (!allowedRoles.isEmpty()) {
+            wrapper.in(AnnotationResult::getCreatorRole, allowedRoles);
+        }
+        
+        wrapper.orderByDesc(AnnotationResult::getCreatedAt);
+
+        Page<AnnotationResult> page = new Page<>(query.pageNo(), query.pageSize());
+        Page<AnnotationResult> resultPage = annotationResultMapper.selectPage(page, wrapper);
+
+        List<AnnotationResultResponse> records = resultPage.getRecords().stream()
            .map(this::toResponse)
            .filter(response -> query.runtimeStatus() == null || query.runtimeStatus().equals(response.runtimeStatus()))
-            .sorted(Comparator.comparing(AnnotationResultResponse::createdAt, Comparator.nullsLast(Comparator.naturalOrder())).reversed())
            .toList();
-        return paginate(records, query.pageNo(), query.pageSize());
+
+        return new PageResult<>(records, resultPage.getTotal(), (int) resultPage.getCurrent(), (int) resultPage.getSize());
    }

    public AnnotationResultResponse getResult(LoginUser currentUser, Long resultId) {
-        AnnotationResult result = annotationResultMapper.selectById(resultId);
-        if (result == null || !currentUser.companyId().equals(result.getCompanyId())) {
+        AnnotationResult result = annotationResultMapper.findActiveByIdAndCompanyId(resultId, currentUser.companyId());
+        if (result == null) {
+            log.warn("Result not found or cross-tenant access attempt: resultId={}, companyId={}, userId={}", 
+                resultId, currentUser.companyId(), currentUser.userId());
            throw new BusinessException(ResultCode.NOT_FOUND, "结果不存在");
        }
        return toResponse(result);
    }

    public AnnotationResultCompareResponse compareResult(LoginUser currentUser, Long resultId) {
-        AnnotationResult result = annotationResultMapper.selectById(resultId);
-        if (result == null || !currentUser.companyId().equals(result.getCompanyId())) {
+        AnnotationResult result = annotationResultMapper.findActiveByIdAndCompanyId(resultId, currentUser.companyId());
+        if (result == null) {
+            log.warn("Result not found or cross-tenant access attempt: resultId={}, companyId={}, userId={}", 
+                resultId, currentUser.companyId(), currentUser.userId());
            throw new BusinessException(ResultCode.NOT_FOUND, "结果不存在");
        }
        SourceResource resource = sourceResourceMapper.selectById(result.getResourceId());
@@ -88,12 +110,4 @@ public class AnnotationResultService {
        }
        return RuntimeResultStatus.AUTO_ARCHIVE_PENDING.name();
    }
-
-    private <T> PageResult<T> paginate(List<T> records, Integer pageNo, Integer pageSize) {
-        int actualPageNo = pageNo == null || pageNo < 1 ? 1 : pageNo;
-        int actualPageSize = pageSize == null || pageSize < 1 ? 10 : pageSize;
-        int fromIndex = Math.min((actualPageNo - 1) * actualPageSize, records.size());
-        int toIndex = Math.min(fromIndex + actualPageSize, records.size());
-        return new PageResult<>(records.subList(fromIndex, toIndex), (long) records.size(), actualPageNo, actualPageSize);
-    }
-}
+}
--- a/src/main/java/com/labelsys/backend/service/AnnotationTaskService.java
+++ b/src/main/java/com/labelsys/backend/service/AnnotationTaskService.java
@@ -1,6 +1,17 @@
 package com.labelsys.backend.service;

+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.util.StringUtils;
+
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.labelsys.backend.common.ResultCode;
 import com.labelsys.backend.common.exception.BusinessException;
 import com.labelsys.backend.context.LoginUser;
@@ -20,16 +31,9 @@ import com.labelsys.backend.mapper.AnnotationTaskMapper;
 import com.labelsys.backend.mapper.AnnotationTaskResourceMapper;
 import com.labelsys.backend.mapper.SourceResourceMapper;
 import com.labelsys.backend.util.IdGenerator;
-import java.util.ArrayList;
-import java.util.Comparator;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Set;
+
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.stereotype.Service;
-import org.springframework.transaction.annotation.Transactional;
-import org.springframework.util.StringUtils;

@Slf4j
@Service
@@ -136,20 +140,35 @@ public class AnnotationTaskService {
    }

    public PageResult<AnnotationTaskResponse> pageTasks(LoginUser currentUser, AnnotationTaskPageQuery query) {
+        List<String> allowedRoles = dataPermissionService.getAllowedRoles(currentUser);
+        boolean shouldFilterByUserId = dataPermissionService.shouldFilterByUserId(currentUser);
+        
        LambdaQueryWrapper<AnnotationTask> wrapper = new LambdaQueryWrapper<AnnotationTask>()
            .eq(AnnotationTask::getCompanyId, currentUser.companyId())
            .eq(StringUtils.hasText(query.taskType()), AnnotationTask::getTaskType, query.taskType())
            .eq(StringUtils.hasText(query.taskStatus()), AnnotationTask::getTaskStatus, query.taskStatus())
            .eq(query.isDeleted() != null, AnnotationTask::getIsDeleted, query.isDeleted())
-            .like(StringUtils.hasText(query.keyword()), AnnotationTask::getTaskName, query.keyword())
-            .orderByDesc(AnnotationTask::getCreatedAt);
-        List<AnnotationTaskResponse> records = annotationTaskMapper.selectList(wrapper).stream()
-            .filter(task -> dataPermissionService.canAccessCreator(currentUser, task.getCreatorId(), task.getCreatorRole()))
-            .filter(task -> query.resourceId() == null || annotationTaskResourceMapper.listResourceIdsByTaskId(task.getId()).contains(query.resourceId()))
-            .sorted(Comparator.comparing(AnnotationTask::getCreatedAt, Comparator.nullsLast(Comparator.naturalOrder())).reversed())
-            .map(task -> buildTaskResponse(task, normalizeIds(annotationTaskResourceMapper.listResourceIdsByTaskId(task.getId()))))
+            .like(StringUtils.hasText(query.keyword()), AnnotationTask::getTaskName, query.keyword());
+        
+        if (shouldFilterByUserId) {
+            wrapper.eq(AnnotationTask::getCreatorId, currentUser.userId());
+        } else if (!allowedRoles.isEmpty()) {
+            wrapper.in(AnnotationTask::getCreatorRole, allowedRoles);
+        }
+        
+        wrapper.orderByDesc(AnnotationTask::getCreatedAt);
+
+        Page<AnnotationTask> page = new Page<>(query.pageNo(), query.pageSize());
+        Page<AnnotationTask> resultPage = annotationTaskMapper.selectPage(page, wrapper);
+
+        List<AnnotationTaskResponse> records = resultPage.getRecords().stream()
+            .filter(task -> query.resourceId() == null || 
+                annotationTaskResourceMapper.listResourceIdsByTaskId(task.getId()).contains(query.resourceId()))
+            .map(task -> buildTaskResponse(task, 
+                normalizeIds(annotationTaskResourceMapper.listResourceIdsByTaskId(task.getId()))))
            .toList();
-        return paginate(records, query.pageNo(), query.pageSize());
+
+        return new PageResult<>(records, resultPage.getTotal(), (int) resultPage.getCurrent(), (int) resultPage.getSize());
    }

    @Transactional
@@ -273,12 +292,4 @@ public class AnnotationTaskService {
        }
        return "****" + secret.substring(secret.length() - 4);
    }
-
-    private <T> PageResult<T> paginate(List<T> records, Integer pageNo, Integer pageSize) {
-        int actualPageNo = pageNo == null || pageNo < 1 ? 1 : pageNo;
-        int actualPageSize = pageSize == null || pageSize < 1 ? 10 : pageSize;
-        int fromIndex = Math.min((actualPageNo - 1) * actualPageSize, records.size());
-        int toIndex = Math.min(fromIndex + actualPageSize, records.size());
-        return new PageResult<>(records.subList(fromIndex, toIndex), (long) records.size(), actualPageNo, actualPageSize);
-    }
 }
--- a/src/main/java/com/labelsys/backend/service/CompanyService.java
+++ b/src/main/java/com/labelsys/backend/service/CompanyService.java
@@ -47,8 +47,8 @@ public class CompanyService {
    }

    private void assertPlatformAdmin(LoginUser currentUser) {
-        if (!currentUser.isPlatformAdmin()) {
-            throw new ForbiddenException("仅平台管理员可操作");
+        if (!currentUser.isSuperAdmin()) {
+            throw new ForbiddenException("仅系统管理员可操作");
        }
    }
 }
--- a/src/main/java/com/labelsys/backend/service/SourceResourceService.java
+++ b/src/main/java/com/labelsys/backend/service/SourceResourceService.java
@@ -1,8 +1,18 @@
 package com.labelsys.backend.service;

+import java.io.IOException;
+import java.util.List;
+
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.util.StringUtils;
+import org.springframework.web.multipart.MultipartFile;
+
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.labelsys.backend.common.ResultCode;
 import com.labelsys.backend.common.exception.BusinessException;
+import com.labelsys.backend.config.ObjectStorageProperties;
 import com.labelsys.backend.context.LoginUser;
 import com.labelsys.backend.dto.common.PageResult;
 import com.labelsys.backend.dto.request.SourceResourcePageQuery;
@@ -18,15 +28,9 @@ import com.labelsys.backend.mapper.SourceResourceMapper;
 import com.labelsys.backend.mapper.SysUserMapper;
 import com.labelsys.backend.util.IdGenerator;
 import com.labelsys.backend.util.ObjectStoragePathBuilder;
-import java.io.IOException;
-import java.util.Comparator;
-import java.util.List;
+
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.stereotype.Service;
-import org.springframework.transaction.annotation.Transactional;
-import org.springframework.util.StringUtils;
-import org.springframework.web.multipart.MultipartFile;

@Slf4j
@Service
@@ -51,69 +55,64 @@ public class SourceResourceService {
        }
        long resourceId = IdGenerator.nextId();
        String extension = resolveExtension(file.getOriginalFilename(), request.getResourceType());
-        String objectKey = ObjectStoragePathBuilder.sourceObjectKey(
-            currentUser.companyId(), request.getResourceType(), resourceId, extension);
+        String objectKey = ObjectStoragePathBuilder.sourceObjectKey(currentUser.companyId(), request.getResourceType(),
+            resourceId, extension);
        try {
-            objectStorageService.upload(
-                objectStorageProperties.getSourceBucket(),
-                objectKey,
-                file.getBytes(),
+            objectStorageService.upload(objectStorageProperties.getSourceBucket(), objectKey, file.getBytes(),
                file.getContentType());
        } catch (IOException ex) {
            throw new BusinessException(ResultCode.BAD_REQUEST, "读取上传文件失败");
        }

-        SourceResource resource = SourceResource.builder()
-            .id(resourceId)
-            .companyId(currentUser.companyId())
-            .creatorId(currentUser.userId())
-            .creatorRole(currentUser.role())
-            .resourceName(StringUtils.hasText(request.getResourceName()) ? request.getResourceName() : file.getOriginalFilename())
-            .resourceType(request.getResourceType())
-            .bucketName(objectStorageProperties.getSourceBucket())
-            .filePath(objectKey)
-            .fileSize(file.getSize())
-            .sourceStatus(SourceStatus.READY.name())
-            .storageProvider("rustfs")
-            .remark(request.getRemark())
-            .build();
+        SourceResource resource = SourceResource.builder().id(resourceId).companyId(currentUser.companyId())
+            .creatorId(currentUser.userId()).creatorRole(currentUser.role())
+            .resourceName(
+                StringUtils.hasText(request.getResourceName()) ? request.getResourceName() : file.getOriginalFilename())
+            .resourceType(request.getResourceType()).bucketName(objectStorageProperties.getSourceBucket())
+            .filePath(objectKey).fileSize(file.getSize()).sourceStatus(SourceStatus.READY.name())
+            .storageProvider("rustfs").remark(request.getRemark()).build();
        sourceResourceMapper.insert(resource);
-        log.info("uploaded source resource, companyId={}, userId={}, resourceId={}",
-            currentUser.companyId(), currentUser.userId(), resourceId);
-        return new SourceUploadResponse(
-            resource.getId(),
-            resource.getResourceName(),
-            resource.getResourceType(),
-            resource.getBucketName(),
-            resource.getFilePath(),
-            resource.getFileSize(),
-            resource.getSourceStatus(),
+        log.info("uploaded source resource, companyId={}, userId={}, resourceId={}", currentUser.companyId(),
+            currentUser.userId(), resourceId);
+        return new SourceUploadResponse(resource.getId(), resource.getResourceName(), resource.getResourceType(),
+            resource.getBucketName(), resource.getFilePath(), resource.getFileSize(), resource.getSourceStatus(),
            resource.getCreatedAt());
    }

    public PageResult<SourceResourceResponse> pageResources(LoginUser currentUser, SourceResourcePageQuery query) {
-        LambdaQueryWrapper<SourceResource> wrapper = new LambdaQueryWrapper<SourceResource>()
-            .eq(SourceResource::getCompanyId, currentUser.companyId())
-            .eq(StringUtils.hasText(query.resourceType()), SourceResource::getResourceType, query.resourceType())
-            .eq(StringUtils.hasText(query.sourceStatus()), SourceResource::getSourceStatus, query.sourceStatus())
-            .like(StringUtils.hasText(query.keyword()), SourceResource::getResourceName, query.keyword())
-            .orderByDesc(SourceResource::getCreatedAt);
-        List<SourceResourceResponse> records = sourceResourceMapper.selectList(wrapper).stream()
-            .filter(resource -> dataPermissionService.canAccessCreator(currentUser, resource.getCreatorId(), resource.getCreatorRole()))
-            .sorted(Comparator.comparing(SourceResource::getCreatedAt, Comparator.nullsLast(Comparator.naturalOrder())).reversed())
-            .map(this::toResponse)
-            .toList();
-        return paginate(records, query.pageNo(), query.pageSize());
+        List<String> allowedRoles = dataPermissionService.getAllowedRoles(currentUser);
+        boolean shouldFilterByUserId = dataPermissionService.shouldFilterByUserId(currentUser);
+
+        LambdaQueryWrapper<SourceResource> wrapper =
+            new LambdaQueryWrapper<SourceResource>().eq(SourceResource::getCompanyId, currentUser.companyId())
+                .eq(StringUtils.hasText(query.resourceType()), SourceResource::getResourceType, query.resourceType())
+                .eq(StringUtils.hasText(query.sourceStatus()), SourceResource::getSourceStatus, query.sourceStatus())
+                .like(StringUtils.hasText(query.keyword()), SourceResource::getResourceName, query.keyword());
+
+        if (shouldFilterByUserId) {
+            wrapper.eq(SourceResource::getCreatorId, currentUser.userId());
+        } else if (!allowedRoles.isEmpty()) {
+            wrapper.in(SourceResource::getCreatorRole, allowedRoles);
+        }
+
+        wrapper.orderByDesc(SourceResource::getCreatedAt);
+
+        Page<SourceResource> page = new Page<>(query.pageNo(), query.pageSize());
+        Page<SourceResource> resultPage = sourceResourceMapper.selectPage(page, wrapper);
+
+        List<SourceResourceResponse> records = resultPage.getRecords().stream().map(this::toResponse).toList();
+
+        return new PageResult<>(records, resultPage.getTotal(), (int)resultPage.getCurrent(),
+            (int)resultPage.getSize());
    }

    public SourceResourceResponse getResource(LoginUser currentUser, Long resourceId) {
        SourceResource resource = sourceResourceMapper.selectById(resourceId);
        if (resource == null || !currentUser.companyId().equals(resource.getCompanyId())) {
+            log.warn("Resource not found or cross-tenant access attempt: resourceId={}, companyId={}, userId={}",
+                resourceId, currentUser.companyId(), currentUser.userId());
            throw new BusinessException(ResultCode.NOT_FOUND, "资源不存在");
        }
-        if (!dataPermissionService.canAccessCreator(currentUser, resource.getCreatorId(), resource.getCreatorRole())) {
-            throw new BusinessException(ResultCode.FORBIDDEN, "无权访问资源");
-        }
        return toResponse(resource);
    }

@@ -136,25 +135,16 @@ public class SourceResourceService {
        }
        objectStorageService.delete(resource.getBucketName(), resource.getFilePath());
        sourceResourceMapper.deleteById(resourceId);
-        log.info("deleted source resource, companyId={}, userId={}, resourceId={}",
-            currentUser.companyId(), currentUser.userId(), resourceId);
+        log.info("deleted source resource, companyId={}, userId={}, resourceId={}", currentUser.companyId(),
+            currentUser.userId(), resourceId);
    }

    private SourceResourceResponse toResponse(SourceResource resource) {
        SysUser creator = sysUserMapper.selectById(resource.getCreatorId());
-        return new SourceResourceResponse(
-            resource.getId(),
-            resource.getResourceName(),
-            resource.getResourceType(),
-            resource.getBucketName(),
-            resource.getFilePath(),
-            resource.getFileSize(),
-            resource.getSourceStatus(),
-            resource.getStorageProvider(),
-            resource.getRemark(),
-            creator == null ? null : creator.getRealName(),
-            resource.getCreatedAt(),
-            resource.getUpdatedAt());
+        return new SourceResourceResponse(resource.getId(), resource.getResourceName(), resource.getResourceType(),
+            resource.getBucketName(), resource.getFilePath(), resource.getFileSize(), resource.getSourceStatus(),
+            resource.getStorageProvider(), resource.getRemark(), creator == null ? null : creator.getRealName(),
+            resource.getCreatedAt(), resource.getUpdatedAt());
    }

    private String resolveExtension(String originalFilename, String resourceType) {
@@ -168,12 +158,4 @@ public class SourceResourceService {
            default -> "bin";
        };
    }
-
-    private <T> PageResult<T> paginate(List<T> records, Integer pageNo, Integer pageSize) {
-        int actualPageNo = pageNo == null || pageNo < 1 ? 1 : pageNo;
-        int actualPageSize = pageSize == null || pageSize < 1 ? 10 : pageSize;
-        int fromIndex = Math.min((actualPageNo - 1) * actualPageSize, records.size());
-        int toIndex = Math.min(fromIndex + actualPageSize, records.size());
-        return new PageResult<>(records.subList(fromIndex, toIndex), (long) records.size(), actualPageNo, actualPageSize);
-    }
 }
--- a/src/main/java/com/labelsys/backend/service/UserService.java
+++ b/src/main/java/com/labelsys/backend/service/UserService.java
@@ -12,6 +12,7 @@ import com.labelsys.backend.common.exception.BusinessException;
 import com.labelsys.backend.common.exception.ForbiddenException;
 import com.labelsys.backend.context.LoginUser;
 import com.labelsys.backend.dto.request.CreateCompanyAdminRequest;
+import com.labelsys.backend.dto.request.CreateSystemEngineerAdminRequest;
 import com.labelsys.backend.dto.request.CreateUserRequest;
 import com.labelsys.backend.dto.request.UpdateUserAssignmentRequest;
 import com.labelsys.backend.dto.request.UpdateUserStatusRequest;
@@ -39,6 +40,12 @@ public class UserService {
    private final PasswordEncoder passwordEncoder;
    private final TokenSessionRepository tokenSessionRepository;

+    public List<SysUser> listAllUsers(LoginUser currentUser) {
+        assertSystemAdmin(currentUser);
+        LambdaQueryWrapper wrapper = new LambdaQueryWrapper<SysUser>().orderByAsc(SysUser::getId);
+        return sysUserMapper.selectList(wrapper);
+    }
+
    public List<SysUser> listCompanyUsers(LoginUser currentUser) {
        assertCompanyAdmin(currentUser);
        LambdaQueryWrapper wrapper = new LambdaQueryWrapper<SysUser>()
@@ -47,17 +54,32 @@ public class UserService {
    }

    public List<SysUser> listCompanyAdmins(LoginUser currentUser, Long companyId) {
-        assertPlatformAdmin(currentUser);
+        assertSystemAdmin(currentUser);
        return sysUserMapper.listCompanyAdmins(companyId);
    }

    public SysUser createCompanyAdmin(LoginUser currentUser, CreateCompanyAdminRequest request) {
-        assertPlatformAdmin(currentUser);
+        assertSystemAdmin(currentUser);
        ensureEnabledCompany(request.companyId());
-        return createUser(
-            request.companyId(),
-            new CreateUserRequest(request.phone(), request.username(), request.realName(), UserRole.EMPLOYEE, UserPosition.ADMIN)
-        );
+        return createUser(request.companyId(), new CreateUserRequest(request.phone(), request.username(),
+            request.realName(), UserRole.EMPLOYEE, UserPosition.ADMIN));
+    }
+
+    public SysUser createSystemEngineerAdmin(LoginUser currentUser, CreateSystemEngineerAdminRequest request) {
+        assertSystemAdmin(currentUser);
+        Long systemCompanyId = 1L;
+        ensureEnabledCompany(systemCompanyId);
+
+        if (sysUserMapper.findByCompanyIdAndPhone(systemCompanyId, request.phone()) != null) {
+            throw new BusinessException(ResultCode.CONFLICT, "同一公司内手机号已存在");
+        }
+
+        SysUser user = SysUser.builder().id(IdGenerator.nextId()).companyId(systemCompanyId).phone(request.phone())
+            .username(request.username()).realName(request.realName()).role(UserRole.ENGINEER)
+            .position(UserPosition.SUPER_ADMIN).passwordHash(passwordEncoder.encode(DEFAULT_PASSWORD))
+            .mustChangePassword(true).status(UserStatus.ENABLED).sessionVersion(1).build();
+        sysUserMapper.insert(user);
+        return user;
    }

    public SysUser createCompanyUser(LoginUser currentUser, CreateUserRequest request) {
@@ -66,7 +88,7 @@ public class UserService {
    }

    public SysUser createCompanyUser(LoginUser currentUser, Long companyId, CreateUserRequest request) {
-        assertPlatformAdmin(currentUser);
+        assertSystemAdmin(currentUser);
        ensureEnabledCompany(companyId);
        return createUser(companyId, request);
    }
@@ -90,8 +112,9 @@ public class UserService {
    }

    @Transactional
-    public void updateCompanyAdminStatus(LoginUser currentUser, Long companyId, Long userId, UpdateUserStatusRequest request) {
-        assertPlatformAdmin(currentUser);
+    public void updateCompanyAdminStatus(LoginUser currentUser, Long companyId, Long userId,
+        UpdateUserStatusRequest request) {
+        assertSystemAdmin(currentUser);
        if (sysUserMapper.updateStatus(userId, companyId, request.status()) == 0) {
            throw new BusinessException(ResultCode.NOT_FOUND, "用户不存在");
        }
@@ -102,19 +125,10 @@ public class UserService {
        if (sysUserMapper.findByCompanyIdAndPhone(companyId, request.phone()) != null) {
            throw new BusinessException(ResultCode.CONFLICT, "同一公司内手机号已存在");
        }
-        SysUser user = SysUser.builder()
-            .id(IdGenerator.nextId())
-            .companyId(companyId)
-            .phone(request.phone())
-            .username(request.username())
-            .realName(request.realName())
-            .role(request.role())
-            .position(request.position())
-            .passwordHash(passwordEncoder.encode(DEFAULT_PASSWORD))
-            .mustChangePassword(true)
-            .status(UserStatus.ENABLED)
-            .sessionVersion(1)
-            .build();
+        SysUser user = SysUser.builder().id(IdGenerator.nextId()).companyId(companyId).phone(request.phone())
+            .username(request.username()).realName(request.realName()).role(request.role()).position(request.position())
+            .passwordHash(passwordEncoder.encode(DEFAULT_PASSWORD)).mustChangePassword(true).status(UserStatus.ENABLED)
+            .sessionVersion(1).build();
        sysUserMapper.insert(user);
        return user;
    }
@@ -126,14 +140,20 @@ public class UserService {
        }
    }

-    private void assertPlatformAdmin(LoginUser currentUser) {
-        if (!currentUser.isPlatformAdmin()) {
-            throw new ForbiddenException("仅平台管理员可操作");
+    // private void assertPlatformAdmin(LoginUser currentUser) {
+    //     if (!currentUser.isPlatformAdmin()) {
+    //         throw new ForbiddenException("仅平台管理员可操作");
+    //     }
+    // }
+
+    private void assertSystemAdmin(LoginUser currentUser) {
+        if (!currentUser.isSuperAdmin()) {
+            throw new ForbiddenException("仅超级管理员可操作");
        }
    }

    private void assertCompanyAdmin(LoginUser currentUser) {
-        if (currentUser.isPlatformAdmin() || currentUser.position() != UserPosition.ADMIN) {
+        if (currentUser.isSuperAdmin() || currentUser.position() != UserPosition.ADMIN) {
            throw new ForbiddenException("仅公司管理员可操作");
        }
    }