feat: 统一生产初始化流程并保护系统管理员

backend/app/api/v1/users.py

@@ -51,6 +51,16 @@ async def update_user(
     db_user = await user_crud.get_by_id(db, user_id)
     if not db_user:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")
+    if user_crud.is_protected_admin_user(db_user):
+        if user_in.email is not None and user_in.email != db_user.email:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="系统管理员邮箱不允许修改")
+        if user_in.role is not None and user_in.role != "ADMIN":
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="系统管理员角色不允许修改")
+        requested_status = user_in.status
+        if user_in.is_active is not None:
+            requested_status = "ACTIVE" if user_in.is_active else "DISABLED"
+        if requested_status is not None and requested_status != "ACTIVE":
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="系统管理员不允许停用")
     if db_user.role.value == "ADMIN":
         requested_role = user_in.role
         requested_status = user_in.status
@@ -75,6 +85,8 @@ async def delete_user(
     db_user = await user_crud.get_by_id(db, user_id)
     if not db_user:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")
+    if user_crud.is_protected_admin_user(db_user):
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="系统管理员账号不允许删除")
     if db_user.id == current_user.id:
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="不允许删除自己")
     if db_user.role.value == "ADMIN" and db_user.status.value == "ACTIVE":