修复(权限管理)：统一 PM 系统导航与权限校验

backend/tests/test_user_login_sessions.py

@@ -4,6 +4,7 @@ import uuid
 import pytest
 
 from app.core.config import settings
+from app.crud import user as user_crud
 from app.models.user import User, UserStatus
 from app.models.user_login_session import UserLoginSession
 from app.services.user_login_sessions import get_login_summaries, session_id_from_payload
@@ -59,3 +60,44 @@ async def test_login_summary_marks_recent_unended_sessions_online(db_session, mo
     assert summaries[user.id].status == "ONLINE"
     assert summaries[user.id].active_session_count == 1
     assert summaries[user.id].client_type == "desktop"
+
+
+@pytest.mark.asyncio
+async def test_user_list_filters_online_and_offline_accounts(db_session, monkeypatch):
+    now = datetime.now(timezone.utc)
+    monkeypatch.setattr(settings, "USER_SESSION_ONLINE_SECONDS", 300)
+    online_user = User(
+        id=uuid.uuid4(),
+        email="online-filter@example.com",
+        password_hash="hash",
+        full_name="Online Filter",
+        clinical_department="IT",
+        status=UserStatus.ACTIVE,
+    )
+    offline_user = User(
+        id=uuid.uuid4(),
+        email="offline-filter@example.com",
+        password_hash="hash",
+        full_name="Offline Filter",
+        clinical_department="IT",
+        status=UserStatus.ACTIVE,
+    )
+    db_session.add_all([online_user, offline_user])
+    db_session.add(
+        UserLoginSession(
+            id=uuid.uuid4(),
+            user_id=online_user.id,
+            client_type="web",
+            login_at=now - timedelta(minutes=1),
+            last_seen_at=now - timedelta(seconds=10),
+        )
+    )
+    await db_session.commit()
+
+    online = await user_crud.list_users(db_session, login_status="ONLINE")
+    offline = await user_crud.list_users(db_session, login_status="OFFLINE")
+
+    assert online_user.id in {user.id for user in online}
+    assert offline_user.id not in {user.id for user in online}
+    assert offline_user.id in {user.id for user in offline}
+    assert await user_crud.count_users(db_session, login_status="ONLINE") == len(online)