优化平台端租户端

backend/src/api/menu.js

@@ -1,10 +1,12 @@
 import request from "@/utils/request";
 
 // 获取所有菜单
-export function getAllMenus() {
+// params.cid=2 时仅返回租户端（backend）菜单，用于角色权限编辑
+export function getAllMenus(params = {}) {
   return request({
     url: `/backend/allmenu`,
     method: "get",
+    params,
   });
 }
 

backend/src/api/platformRole.js

@@ -0,0 +1,39 @@
+import request from '@/utils/request'
+
+// 平台端角色管理（yz_system_admin_role，可同时管理平台角色 cid=1 与租户角色 cid=2）
+export function getAllPlatformRoles() {
+  return request({
+    url: '/platform/allRoles',
+    method: 'get'
+  })
+}
+
+export function getPlatformRoleById(id) {
+  return request({
+    url: `/platform/roles/${id}`,
+    method: 'get'
+  })
+}
+
+export function createPlatformRole(data) {
+  return request({
+    url: '/platform/roles',
+    method: 'post',
+    data
+  })
+}
+
+export function updatePlatformRole(id, data) {
+  return request({
+    url: `/platform/roles/${id}`,
+    method: 'put',
+    data
+  })
+}
+
+export function deletePlatformRole(id) {
+  return request({
+    url: `/platform/roles/${id}`,
+    method: 'delete'
+  })
+}

backend/src/api/tenantUser.js

@@ -0,0 +1,40 @@
+import request from '@/utils/request'
+
+// 平台端租户用户（yz_system_tenant_user）相关接口
+export function getTenantUserList(params) {
+  return request({
+    url: '/platform/tenantUser/list',
+    method: 'get',
+    params,
+  })
+}
+
+export function getTenantUsersByTid(tid) {
+  return request({
+    url: `/platform/getTenantUsers/${tid}`,
+    method: 'get',
+  })
+}
+
+export function createTenantUser(data) {
+  return request({
+    url: '/platform/tenantUser/create',
+    method: 'post',
+    data,
+  })
+}
+
+export function editTenantUser(id, data) {
+  return request({
+    url: `/platform/tenantUser/edit/${id}`,
+    method: 'post',
+    data,
+  })
+}
+
+export function deleteTenantUser(id) {
+  return request({
+    url: `/platform/tenantUser/delete/${id}`,
+    method: 'delete',
+  })
+}

backend/src/views/basicSettings/roles/components/detail.vue

@@ -12,6 +12,11 @@
           {{ roleDetail.status === 1 ? "启用" : "禁用" }}
         </el-tag>
       </el-descriptions-item>
+      <el-descriptions-item label="分类">
+        <el-tag :type="roleDetail.cid === 1 ? 'warning' : 'primary'" size="small">
+          {{ roleDetail.cid === 1 ? "平台角色" : "租户角色" }}
+        </el-tag>
+      </el-descriptions-item>
       <el-descriptions-item label="权限列表">
         <div v-if="menuNames.length > 0" style="max-height: 300px; overflow-y: auto;">
           <el-tag
@@ -44,7 +49,7 @@
 <script setup lang="ts">
 import { ref, watch, computed } from "vue";
 import { ElMessage } from "element-plus";
-import { getRoleById } from "@/api/role";
+import { getPlatformRoleById } from "@/api/platformRole";
 import { getAllMenus } from "@/api/menu";
 
 interface Props {
@@ -67,11 +72,11 @@ const allMenus = ref<any[]>([]);
 // 监听 modelValue
 watch(
   () => props.modelValue,
-  (val) => {
+  async (val) => {
     visible.value = val;
     if (val && props.roleId) {
-      loadRoleDetail();
+      await loadRoleDetail();
-      loadMenus();
+      await loadMenus(roleDetail.value.cid);
     }
   }
 );
@@ -127,7 +132,7 @@ const loadRoleDetail = async () => {
 
   loading.value = true;
   try {
-    const res = await getRoleById(props.roleId);
+    const res = await getPlatformRoleById(props.roleId);
     if (res.code === 200) {
       roleDetail.value = res.data || {};
     } else {
@@ -141,10 +146,12 @@ const loadRoleDetail = async () => {
   }
 };
 
-// 加载菜单树
+// 加载菜单树：租户角色(cid=2)只展示租户端菜单；平台角色展示全部权限
-const loadMenus = async () => {
+const loadMenus = async (cid?: number) => {
   try {
-    const res = await getAllMenus();
+    const isTenant = cid === undefined || cid === 2;
+    const params = isTenant ? { cid: 2 } : {};
+    const res = await getAllMenus(params);
     if (res.code === 200) {
       allMenus.value = res.data || [];
     }

backend/src/views/basicSettings/roles/components/edit.vue

@@ -12,6 +12,14 @@
         </el-radio-group>
       </el-form-item>
 
+      <el-form-item label="分类" prop="cid">
+        <el-radio-group v-model="form.cid" @change="onCidChange">
+          <el-radio :label="2">租户角色</el-radio>
+          <el-radio :label="1">平台角色</el-radio>
+        </el-radio-group>
+        <div class="form-tip">租户角色仅显示租户端菜单；平台角色显示全部权限</div>
+      </el-form-item>
+
       <el-form-item label="权限设置" prop="rights">
         <div style="margin-bottom: 10px;">
           <el-button size="small" @click="toggleSelectAll">
@@ -38,7 +46,7 @@
 <script setup lang="ts">
 import { ref, watch, nextTick } from "vue";
 import { ElMessage } from "element-plus";
-import { createRole, updateRole } from "@/api/role";
+import { createPlatformRole, updatePlatformRole } from "@/api/platformRole";
 import { getAllMenus } from "@/api/menu";
 
 interface Props {
@@ -66,6 +74,7 @@ const isExpandAll = ref(false);
 const form = ref({
   name: "",
   status: 1,
+  cid: 2,
   rights: [] as number[],
 });
 
@@ -140,9 +149,11 @@ const toggleSelectAll = () => {
 // --- 数据加载与监听 ---
 
 // 加载菜单树数据
+// 租户角色(cid=2)只展示租户端菜单；平台角色(cid=1)展示全部权限
 const loadMenus = async () => {
   try {
-    const res = await getAllMenus();
+    const params = form.value.cid === 2 ? { cid: 2 } : {};
+    const res = await getAllMenus(params);
     if (res.code === 200) {
       menuTree.value = res.data || [];
     }
@@ -152,6 +163,18 @@ const loadMenus = async () => {
   }
 };
 
+// 切换分类时重新加载菜单树并回显已选权限
+const onCidChange = async () => {
+  if (!visible.value) return;
+  await loadMenus();
+  nextTick(() => {
+    if (treeRef.value) {
+      treeRef.value.setCheckedKeys(form.value.rights);
+      updateSelectStatus();
+    }
+  });
+};
+
 // 解析权限数据
 const parseRights = (rights: any): number[] => {
   if (!rights) return [];
@@ -182,6 +205,7 @@ watch(
         form.value = {
           name: props.role.name,
           status: props.role.status,
+          cid: props.role.cid === 1 ? 1 : 2,
           rights: parseRights(props.role.rights),
         };
         // 设置树的回显
@@ -210,6 +234,7 @@ const resetForm = () => {
   form.value = {
     name: "",
     status: 1,
+    cid: 2,
     rights: [],
   };
   if (formRef.value) formRef.value.clearValidate();
@@ -233,6 +258,7 @@ const handleSubmit = async () => {
     const submitData: any = {
       name: form.value.name,
       status: form.value.status,
+      cid: form.value.cid,
       rights: checkedKeys,
     };
 
@@ -245,9 +271,9 @@ const handleSubmit = async () => {
 
     let res;
     if (isEdit.value && props.role) {
-      res = await updateRole(props.role.id, submitData);
+      res = await updatePlatformRole(props.role.id, submitData);
     } else {
-      res = await createRole(submitData);
+      res = await createPlatformRole(submitData);
     }
 
     if (res.code === 200) {
@@ -271,4 +297,11 @@ const handleSubmit = async () => {
 :deep(.el-tree) {
   background-color: var(--el-bg-color);
 }
+
+.form-tip {
+  margin-top: 6px;
+  font-size: 12px;
+  color: var(--el-text-color-secondary);
+  line-height: 1.4;
+}
 </style>

backend/src/views/basicSettings/roles/index.vue

@@ -15,6 +15,15 @@
     </div>
     <el-divider></el-divider>
 
+    <!-- 分类筛选 -->
+    <div class="filter-bar">
+      <el-radio-group v-model="typeFilter">
+        <el-radio-button :value="'all'">全部</el-radio-button>
+        <el-radio-button :value="1">平台角色</el-radio-button>
+        <el-radio-button :value="2">租户角色</el-radio-button>
+      </el-radio-group>
+    </div>
+
     <!-- 错误状态 -->
     <div v-if="error" class="error-state">
       <el-alert title="加载失败" :message="error" type="error" show-icon />
@@ -23,14 +32,20 @@
 
     <!-- 角色列表 -->
     <div v-else>
-      <el-table :data="roles" stripe style="width: 100%" v-loading="loading">
+      <el-table :data="displayRoles" stripe style="width: 100%" v-loading="loading">
-        <el-table-column prop="id" label="ID" width="80" align="center" />
         <el-table-column
           prop="name"
           label="角色名称"
           min-width="150"
           align="center"
         />
+        <el-table-column prop="cid" label="类型" width="120" align="center">
+          <template #default="{ row }">
+            <el-tag :type="row.cid === 1 ? 'warning' : 'primary'" size="small">
+              {{ row.cid === 1 ? "平台角色" : "租户角色" }}
+            </el-tag>
+          </template>
+        </el-table-column>
         <el-table-column prop="status" label="状态" width="100" align="center">
           <template #default="{ row }">
             <el-tag :type="row.status === 1 ? 'success' : 'info'" size="small">
@@ -38,12 +53,12 @@
             </el-tag>
           </template>
         </el-table-column>
-        <el-table-column
+        <el-table-column label="权限" min-width="150" align="center">
-          prop="rights"
+          <template #default="{ row }">
-          label="权限"
+            <el-tag v-if="!row.rights" type="success" size="small">全权限</el-tag>
-          min-width="150"
+            <el-tag v-else type="info" size="small">自定义权限</el-tag>
-          align="center"
+          </template>
-        />
+        </el-table-column>
         <el-table-column label="操作" width="220" fixed="right" align="center">
           <template #default="{ row }">
             <el-button
@@ -96,10 +111,13 @@
 </template>
 
 <script setup lang="ts">
-import { ref, onMounted } from "vue";
+import { ref, computed, onMounted } from "vue";
 import { ElMessage, ElMessageBox } from "element-plus";
 import { Plus, View, Edit, Delete, Refresh } from "@element-plus/icons-vue";
-import { getAllRoles, getRoleById, deleteRole } from "@/api/role";
+import {
+  getAllPlatformRoles,
+  deletePlatformRole,
+} from "@/api/platformRole";
 import RoleEditDialog from "./components/edit.vue";
 import RoleDetailDialog from "./components/detail.vue";
 import { useAuthStore } from "@/stores/auth";
@@ -110,6 +128,11 @@ const authStore = useAuthStore();
 const roles = ref<any[]>([]);
 const loading = ref(false);
 const error = ref("");
+const typeFilter = ref<string | number>("all");
+const displayRoles = computed(() => {
+  if (typeFilter.value === "all") return roles.value;
+  return roles.value.filter((r) => Number(r.cid) === Number(typeFilter.value));
+});
 
 const editDialogVisible = ref(false);
 const detailDialogVisible = ref(false);
@@ -131,7 +154,7 @@ const fetchRoles = async () => {
   loading.value = true;
   error.value = "";
   try {
-    const res = await getAllRoles();
+    const res = await getAllPlatformRoles();
     if (res.code === 200) {
       roles.value = res.data || [];
       // console.log('角色列表:', roles.value);
@@ -184,7 +207,7 @@ async function handleDelete(row: any) {
 
     loading.value = true;
     try {
-      const res = await deleteRole(row.id);
+      const res = await deletePlatformRole(row.id);
       if (res.code === 200) {
         ElMessage.success("删除成功");
         fetchRoles();

backend/src/views/basicSettings/tenants/components/TenantUsersTab.vue

@@ -35,11 +35,17 @@
           </el-tag>
         </template>
       </el-table-column>
-      <el-table-column label="操作" width="140" align="center" fixed="right">
+      <el-table-column label="操作" width="260" align="center" fixed="right">
         <template #default="{ row }">
-          <el-button text type="primary" @click="openPasswordDialog(row)">
+          <el-button text type="primary" @click="openPasswordDialog(row)">修改密码</el-button>
-            修改密码
+          <el-button
+            text
+            :type="Number(row.status) === 1 ? 'warning' : 'success'"
+            @click="handleToggleStatus(row)"
+          >
+            {{ Number(row.status) === 1 ? "禁用" : "启用" }}
           </el-button>
+          <el-button text type="danger" @click="handleDelete(row)">删除</el-button>
         </template>
       </el-table-column>
     </el-table>
@@ -65,9 +71,13 @@
 
 <script setup lang="ts">
 import { ref, reactive, watch } from "vue";
-import { ElMessage } from "element-plus";
+import { ElMessage, ElMessageBox } from "element-plus";
 import { Plus } from "@element-plus/icons-vue";
-import { getAllUsers, changePassword } from "@/api/user";
+import {
+  getTenantUserList,
+  editTenantUser,
+  deleteTenantUser,
+} from "@/api/tenantUser";
 import AddUser from "./adduser.vue";
 
 const props = defineProps<{
@@ -119,7 +129,7 @@ const refreshTenantUsers = async () => {
   if (id == null) return;
   usersLoading.value = true;
   try {
-    const usersRes = await getAllUsers(buildTenantUserQuery(id));
+    const usersRes = await getTenantUserList(buildTenantUserQuery(id));
     if (usersRes?.code === 200) {
       tenantUsers.value = usersRes?.data?.list || usersRes?.data || [];
     } else {
@@ -135,7 +145,7 @@ const refreshTenantUsers = async () => {
 const loadUsersForTid = async (tid: number) => {
   usersLoading.value = true;
   try {
-    const usersRes = await getAllUsers({ tid });
+    const usersRes = await getTenantUserList({ tid });
     if (usersRes?.code === 200) {
       tenantUsers.value = usersRes?.data?.list || usersRes?.data || [];
     } else {
@@ -194,7 +204,9 @@ const submitPassword = async () => {
 
   passwordSubmitting.value = true;
   try {
-    const res = await changePassword(currentTenantUserId.value, { newPassword: passwordForm.password });
+    const res = await editTenantUser(currentTenantUserId.value, {
+      password: passwordForm.password,
+    });
     if (res.code === 200) {
       ElMessage.success("密码修改成功");
       passwordDialogVisible.value = false;
@@ -206,6 +218,52 @@ const submitPassword = async () => {
   }
 };
 
+const handleToggleStatus = async (row: any) => {
+  const next = Number(row.status) === 1 ? 0 : 1;
+  const actionText = next === 0 ? "禁用" : "启用";
+  const name = row.name || row.account || `ID ${row.id}`;
+  try {
+    await ElMessageBox.confirm(`确定要${actionText}用户「${name}」吗？`, "提示", {
+      type: "warning",
+    });
+  } catch {
+    return;
+  }
+  try {
+    const res = await editTenantUser(row.id, { status: next });
+    if (res.code === 200) {
+      ElMessage.success(`${actionText}成功`);
+      refreshTenantUsers();
+    } else {
+      ElMessage.error(res.msg || `${actionText}失败`);
+    }
+  } catch (e: any) {
+    ElMessage.error(e?.message || `${actionText}失败`);
+  }
+};
+
+const handleDelete = async (row: any) => {
+  const name = row.name || row.account || `ID ${row.id}`;
+  try {
+    await ElMessageBox.confirm(`确定要删除用户「${name}」吗？删除后不可恢复。`, "警告", {
+      type: "warning",
+    });
+  } catch {
+    return;
+  }
+  try {
+    const res = await deleteTenantUser(row.id);
+    if (res.code === 200) {
+      ElMessage.success("删除成功");
+      refreshTenantUsers();
+    } else {
+      ElMessage.error(res.msg || "删除失败");
+    }
+  } catch (e: any) {
+    ElMessage.error(e?.message || "删除失败");
+  }
+};
+
 defineExpose({
   refreshTenantUsers,
 });

backend/src/views/basicSettings/tenants/components/adduser.vue

@@ -43,7 +43,7 @@
  */
 import { ref, reactive } from 'vue';
 import { ElMessage } from 'element-plus';
-import { addUser } from '@/api/user';
+import { createTenantUser } from '@/api/tenantUser';
 
 const emit = defineEmits(['success']);
 const visible = ref(false);
@@ -123,7 +123,7 @@ const submitForm = async () => {
         };
         // 提交时不需要把确认密码发给后端
         delete (submitData as any).password2;
-        const res = await addUser(submitData);
+        const res = await createTenantUser(submitData);
         if (res.code === 200) {
             ElMessage.success('添加成功');
             visible.value = false;

backend/src/views/basicSettings/users/components/userEdit.vue

@@ -70,6 +70,23 @@
           <el-option label="禁用" :value="0" />
         </el-select>
       </el-form-item>
+
+      <!-- 角色（关联 yz_system_admin_role, cid=2） -->
+      <el-form-item label="角色">
+        <el-select
+          v-model="form.group_id"
+          placeholder="请选择角色（未分配则拥有全部功能权限）"
+          clearable
+          style="width: 100%"
+        >
+          <el-option
+            v-for="role in roles"
+            :key="role.id"
+            :label="role.name"
+            :value="role.id"
+          />
+        </el-select>
+      </el-form-item>
     </el-form>
 
     <!-- 对话框脚部 -->
@@ -84,6 +101,7 @@
 import { ref, computed, watch } from "vue";
 import { ElMessage } from "element-plus";
 import { addUser, editUser, getUserInfo } from "@/api/user";
+import { getAllRoles } from "@/api/role";
 
 const props = defineProps({
   modelValue: {
@@ -117,8 +135,26 @@ const form = ref<any>({
   confirmPassword: "",
   email: "",
   status: 1,
+  group_id: undefined,
 });
 
+interface RoleOption {
+  id: number;
+  name: string;
+  status?: number;
+}
+
+const roles = ref<RoleOption[]>([]);
+
+const fetchRoles = async () => {
+  try {
+    const res = await getAllRoles();
+    roles.value = (res.data || []).filter((r: RoleOption) => r.status !== 0);
+  } catch (e) {
+    roles.value = [];
+  }
+};
+
 const dialogTitle = computed(() => {
   return isAdd.value ? "添加用户" : "编辑用户";
 });
@@ -189,6 +225,9 @@ watch(
   () => props.modelValue,
   (newVal) => {
     visible.value = newVal;
+    if (newVal) {
+      fetchRoles();
+    }
   }
 );
 
@@ -240,6 +279,7 @@ const loadUserData = async (user: any) => {
       confirmPassword: "",
       email: data.email,
       status: statusValue,
+      group_id: data.group_id ? Number(data.group_id) : undefined,
     };
   } catch (e: any) {
     console.error("Failed to load user data:", e);
@@ -299,6 +339,7 @@ const handleSubmit = async () => {
         email: form.value.email,
         status: form.value.status,
         password: form.value.password,
+        group_id: form.value.group_id,
       };
 
       await addUser(submitData);
@@ -319,6 +360,7 @@ const handleSubmit = async () => {
         sex: form.value.sex,
         email: form.value.email,
         status: form.value.status,
+        group_id: form.value.group_id,
       };
 
       // 只有在填写了密码时才添加到提交数据中
@@ -354,6 +396,7 @@ defineExpose({
       confirmPassword: "",
       email: "",
       status: 1,
+      group_id: undefined,
     };
     visible.value = true;
     // 清除表单验证

go/controllers/backend_admin_user.go

@@ -22,6 +22,7 @@ type backendUserInfoDTO struct {
 	ID         uint64  `json:"id"`
 	Tid        uint64  `json:"tid"`
 	Uid        uint64  `json:"uid"`
+	GroupID    uint64  `json:"group_id"`
 	Account    *string `json:"account"`
 	Name       *string `json:"name"`
 	Phone      *string `json:"phone"`
@@ -40,6 +41,7 @@ type backendUserInfoDTO struct {
 type backendTenantUserPayload struct {
 	Tid       uint64  `json:"tid"`
 	Uid       uint64  `json:"uid"`
+	GroupID   *uint64 `json:"group_id"`
 	Account   *string `json:"account"`
 	Name      *string `json:"name"`
 	Phone     *string `json:"phone"`
@@ -95,6 +97,7 @@ func toBackendUserInfoDTO(u models.SystemTenantUser) backendUserInfoDTO {
 		ID:         u.ID,
 		Tid:        u.Tid,
 		Uid:        u.Uid,
+		GroupID:    u.GroupID,
 		Account:    u.Account,
 		Name:       u.Name,
 		Phone:      u.Phone,
@@ -395,6 +398,23 @@ func (c *BackendAdminUserController) AddUser() {
 		_ = services.SetDefaultTenant(p.Uid, p.Tid)
 	}
 
+	// 关联角色（group_id）：0 表示未分配，前端展示为"未分配/全权限"
+	if p.GroupID != nil && *p.GroupID > 0 {
+		models.EnsureTenantUserGroupColumn()
+		_, _ = models.Orm.QueryTable(new(models.SystemTenantUser)).
+			Filter("id", id).
+			Update(map[string]interface{}{"group_id": *p.GroupID})
+	} else if isDefault == 1 {
+		// 租户第一个账号（普通租户）即租户管理员：自动绑定「租户管理员」角色，
+		// 使"普通租户"与"租户管理员"合二为一（均可登录 backend 并拥有全权限）。
+		if adminRoleID, err := models.GetTenantAdminRole(p.Tid); err == nil && adminRoleID > 0 {
+			models.EnsureTenantUserGroupColumn()
+			_, _ = models.Orm.QueryTable(new(models.SystemTenantUser)).
+				Filter("id", id).
+				Update(map[string]interface{}{"group_id": adminRoleID})
+		}
+	}
+
 	c.Data["json"] = map[string]interface{}{
 		"code": 200,
 		"msg":  "success",
@@ -493,6 +513,10 @@ func (c *BackendAdminUserController) EditUser() {
 		update["remark"] = *p.Remark
 	}
 
+	if p.GroupID != nil {
+		update["group_id"] = *p.GroupID
+	}
+
 	if len(update) == 0 {
 		c.Data["json"] = map[string]interface{}{"code": 400, "msg": "无更新字段"}
 		_ = c.ServeJSON()

go/controllers/backend_menu.go

@@ -77,6 +77,9 @@ func (c *BackendMenuController) GetMenu() {
 }
 
 func (c *BackendMenuController) GetBackendMenu() {
+	// 确保租户用户 group_id 列存在（老库兼容）
+	models.EnsureTenantUserGroupColumn()
+
 	var menus []models.SystemMenu
 	_, err := models.Orm.QueryTable(new(models.SystemMenu)).Filter("status", 1).All(&menus)
 	if err != nil {
@@ -84,10 +87,105 @@ func (c *BackendMenuController) GetBackendMenu() {
 		_ = c.ServeJSON()
 		return
 	}
-	c.Data["json"] = map[string]interface{}{"code": 200, "msg": "success", "data": buildMenuTree(filterMenusByView(menus, 2), 0)}
+	backendMenus := filterMenusByView(menus, 2)
+
+	// 按当前登录用户角色过滤可见功能菜单：
+	// 角色 rights 为空（或未分配角色）→ 全权限，返回全部后端菜单；
+	// 否则仅返回角色允许访问的菜单（含其祖先节点，保证树结构完整）。
+	idStr := c.Ctx.Input.Param(":id")
+	uid, _ := strconv.ParseUint(idStr, 10, 64)
+	if uid > 0 {
+		var tu models.SystemTenantUser
+		if e := models.Orm.QueryTable(new(models.SystemTenantUser)).
+			Filter("id", uid).
+			Filter("delete_time__isnull", true).
+			One(&tu); e == nil && tu.GroupID > 0 {
+			var role models.AdminRole
+			if re := models.Orm.QueryTable(new(models.AdminRole)).
+				Filter("id", tu.GroupID).
+				Filter("cid", 2).
+				One(&role); re == nil {
+				backendMenus = filterMenusByRights(backendMenus, role.Rights)
+			}
+		}
+	}
+
+	c.Data["json"] = map[string]interface{}{"code": 200, "msg": "success", "data": buildMenuTree(backendMenus, 0)}
 	_ = c.ServeJSON()
 }
 
+// parseRightsToSet 将角色 rights 解析为菜单 ID 集合（兼容 JSON 数组 / 逗号分隔）
+func parseRightsToSet(raw string) map[uint64]bool {
+	set := map[uint64]bool{}
+	var arr []string
+	if err := json.Unmarshal([]byte(raw), &arr); err == nil {
+		for _, s := range arr {
+			s = strings.TrimSpace(s)
+			if s == "" {
+				continue
+			}
+			if n, e := strconv.ParseUint(s, 10, 64); e == nil {
+				set[n] = true
+			}
+		}
+		return set
+	}
+	for _, s := range strings.Split(raw, ",") {
+		s = strings.TrimSpace(s)
+		if s == "" {
+			continue
+		}
+		if n, e := strconv.ParseUint(s, 10, 64); e == nil {
+			set[n] = true
+		}
+	}
+	return set
+}
+
+// filterMenusByRights 按角色 rights（菜单 ID 集合）过滤菜单，并补全祖先节点，保证树结构完整。
+// rights 为空（nil / 空串）→ 原样返回（全权限）。
+func filterMenusByRights(menus []models.SystemMenu, rights *string) []models.SystemMenu {
+	if rights == nil || strings.TrimSpace(*rights) == "" {
+		return menus
+	}
+	allowed := parseRightsToSet(*rights)
+	if len(allowed) == 0 {
+		return menus
+	}
+
+	pidOf := make(map[uint64]int64, len(menus))
+	byID := make(map[uint64]models.SystemMenu, len(menus))
+	for _, m := range menus {
+		pidOf[m.ID] = m.Pid
+		byID[m.ID] = m
+	}
+
+	final := make(map[uint64]bool, len(allowed))
+	for id := range allowed {
+		cur := id
+		for {
+			if _, ok := byID[cur]; !ok {
+				break
+			}
+			if final[cur] {
+				break
+			}
+			final[cur] = true
+			p := pidOf[cur]
+			if p == 0 {
+				break
+			}
+			cur = uint64(p)
+		}
+	}
+
+	out := make([]models.SystemMenu, 0, len(final))
+	for id := range final {
+		out = append(out, byID[id])
+	}
+	return out
+}
+
 func (c *BackendMenuController) GetTenantList() {
 	var tid uint64
 	if jwtTid := c.Ctx.Input.GetData("tid"); jwtTid != nil {

go/controllers/backend_role.go

@@ -0,0 +1,249 @@
+package controllers
+
+import (
+	"encoding/json"
+	"io"
+	"strconv"
+	"strings"
+
+	"server/models"
+	"server/pkg/jwtutil"
+
+	beego "github.com/beego/beego/v2/server/web"
+)
+
+// BackendRoleController 租户端（backend）角色管理（yz_system_admin_role, cid=2）
+// 角色按租户隔离：所有读写均以当前登录租户（JWT 中的 tenant_id）为边界，
+// 租户仅能查看/管理自己名下的角色，无法越权访问其他租户数据。
+type BackendRoleController struct {
+	beego.Controller
+}
+
+type backendRolePayload struct {
+	Name   string      `json:"name"`
+	Status *uint8      `json:"status"`
+	Rights interface{} `json:"rights"`
+}
+
+// currentTenantID 从 Bearer Token 解析当前登录租户 ID。
+// 返回 (tid, true) 表示成功；失败时已写入 401/403 响应并返回 (0, false)。
+func (c *BackendRoleController) currentTenantID() (uint64, bool) {
+	authHeader := c.Ctx.Request.Header.Get("Authorization")
+	if authHeader == "" {
+		c.Data["json"] = map[string]interface{}{"code": 401, "msg": "未登录"}
+		_ = c.ServeJSON()
+		return 0, false
+	}
+	authParts := strings.SplitN(authHeader, " ", 2)
+	if len(authParts) != 2 || authParts[0] != "Bearer" {
+		c.Data["json"] = map[string]interface{}{"code": 401, "msg": "认证信息格式错误"}
+		_ = c.ServeJSON()
+		return 0, false
+	}
+	claims, err := jwtutil.ParseToken(authParts[1])
+	if err != nil {
+		c.Data["json"] = map[string]interface{}{"code": 401, "msg": "无效的token"}
+		_ = c.ServeJSON()
+		return 0, false
+	}
+	if claims.UserType != "backend" && claims.UserType != "app" {
+		c.Data["json"] = map[string]interface{}{"code": 403, "msg": "无权访问"}
+		_ = c.ServeJSON()
+		return 0, false
+	}
+	if claims.TenantId <= 0 {
+		c.Data["json"] = map[string]interface{}{"code": 401, "msg": "租户信息缺失"}
+		_ = c.ServeJSON()
+		return 0, false
+	}
+	return uint64(claims.TenantId), true
+}
+
+// GetAllRoles 获取当前租户的角色列表
+// GET /backend/allRoles
+func (c *BackendRoleController) GetAllRoles() {
+	tid, ok := c.currentTenantID()
+	if !ok {
+		return
+	}
+	// 懒加载补齐当前租户的默认角色（租户管理员/部门负责人/员工）
+	models.EnsureDefaultTenantRoles(tid)
+
+	var rows []models.AdminRole
+	_, err := models.Orm.QueryTable(new(models.AdminRole)).
+		Filter("cid", 2).
+		Filter("tenant_id", tid).
+		OrderBy("-id").
+		All(&rows)
+	if err != nil {
+		c.Data["json"] = map[string]interface{}{"code": 500, "msg": "查询失败"}
+		_ = c.ServeJSON()
+		return
+	}
+	c.Data["json"] = map[string]interface{}{"code": 200, "msg": "success", "data": rows}
+	_ = c.ServeJSON()
+}
+
+// GetRoleByID 获取当前租户的角色详情
+// GET /backend/roles/:id
+func (c *BackendRoleController) GetRoleByID() {
+	tid, ok := c.currentTenantID()
+	if !ok {
+		return
+	}
+	idStr := c.Ctx.Input.Param(":id")
+	id, _ := strconv.ParseUint(idStr, 10, 64)
+	if id == 0 {
+		c.Data["json"] = map[string]interface{}{"code": 400, "msg": "id 不能为空"}
+		_ = c.ServeJSON()
+		return
+	}
+	var role models.AdminRole
+	if err := models.Orm.QueryTable(new(models.AdminRole)).
+		Filter("id", id).
+		Filter("cid", 2).
+		Filter("tenant_id", tid).
+		One(&role); err != nil {
+		c.Data["json"] = map[string]interface{}{"code": 404, "msg": "角色不存在"}
+		_ = c.ServeJSON()
+		return
+	}
+	c.Data["json"] = map[string]interface{}{"code": 200, "msg": "success", "data": role}
+	_ = c.ServeJSON()
+}
+
+// CreateRole 创建当前租户的角色
+// POST /backend/roles
+func (c *BackendRoleController) CreateRole() {
+	tid, ok := c.currentTenantID()
+	if !ok {
+		return
+	}
+	var p backendRolePayload
+	raw, _ := io.ReadAll(c.Ctx.Request.Body)
+	if err := json.Unmarshal(raw, &p); err != nil {
+		c.Data["json"] = map[string]interface{}{"code": 400, "msg": "参数错误"}
+		_ = c.ServeJSON()
+		return
+	}
+	p.Name = strings.TrimSpace(p.Name)
+	if p.Name == "" {
+		c.Data["json"] = map[string]interface{}{"code": 400, "msg": "name 不能为空"}
+		_ = c.ServeJSON()
+		return
+	}
+
+	status := uint8(1)
+	if p.Status != nil {
+		status = *p.Status
+	}
+	rights := normalizeRights(p.Rights)
+	role := &models.AdminRole{
+		TenantID: tid,
+		Cid:      2,
+		Name:     p.Name,
+		Status:   status,
+		Rights:   rights,
+	}
+	id, err := models.Orm.Insert(role)
+	if err != nil {
+		c.Data["json"] = map[string]interface{}{"code": 500, "msg": "创建失败"}
+		_ = c.ServeJSON()
+		return
+	}
+	c.Data["json"] = map[string]interface{}{"code": 200, "msg": "success", "data": map[string]interface{}{"id": id}}
+	_ = c.ServeJSON()
+}
+
+// UpdateRole 更新当前租户的角色
+// PUT /backend/roles/:id
+func (c *BackendRoleController) UpdateRole() {
+	tid, ok := c.currentTenantID()
+	if !ok {
+		return
+	}
+	idStr := c.Ctx.Input.Param(":id")
+	id, _ := strconv.ParseUint(idStr, 10, 64)
+	if id == 0 {
+		c.Data["json"] = map[string]interface{}{"code": 400, "msg": "id 不能为空"}
+		_ = c.ServeJSON()
+		return
+	}
+
+	var p backendRolePayload
+	raw, _ := io.ReadAll(c.Ctx.Request.Body)
+	if err := json.Unmarshal(raw, &p); err != nil {
+		c.Data["json"] = map[string]interface{}{"code": 400, "msg": "参数错误"}
+		_ = c.ServeJSON()
+		return
+	}
+
+	update := map[string]interface{}{}
+	if strings.TrimSpace(p.Name) != "" {
+		update["name"] = strings.TrimSpace(p.Name)
+	}
+	if p.Status != nil {
+		update["status"] = *p.Status
+	}
+	if p.Rights != nil {
+		update["rights"] = normalizeRights(p.Rights)
+	}
+	if len(update) == 0 {
+		c.Data["json"] = map[string]interface{}{"code": 400, "msg": "无更新字段"}
+		_ = c.ServeJSON()
+		return
+	}
+
+	// 仅允许更新本租户名下的角色，防止越权改到其他租户
+	cnt, err := models.Orm.QueryTable(new(models.AdminRole)).
+		Filter("id", id).
+		Filter("cid", 2).
+		Filter("tenant_id", tid).
+		Update(update)
+	if err != nil {
+		c.Data["json"] = map[string]interface{}{"code": 500, "msg": "更新失败"}
+		_ = c.ServeJSON()
+		return
+	}
+	if cnt == 0 {
+		c.Data["json"] = map[string]interface{}{"code": 404, "msg": "角色不存在"}
+		_ = c.ServeJSON()
+		return
+	}
+	c.Data["json"] = map[string]interface{}{"code": 200, "msg": "success"}
+	_ = c.ServeJSON()
+}
+
+// DeleteRole 删除当前租户的角色
+// DELETE /backend/roles/:id
+func (c *BackendRoleController) DeleteRole() {
+	tid, ok := c.currentTenantID()
+	if !ok {
+		return
+	}
+	idStr := c.Ctx.Input.Param(":id")
+	id, _ := strconv.ParseUint(idStr, 10, 64)
+	if id == 0 {
+		c.Data["json"] = map[string]interface{}{"code": 400, "msg": "id 不能为空"}
+		_ = c.ServeJSON()
+		return
+	}
+	// 仅允许删除本租户名下的角色
+	cnt, err := models.Orm.QueryTable(new(models.AdminRole)).
+		Filter("id", id).
+		Filter("cid", 2).
+		Filter("tenant_id", tid).
+		Delete()
+	if err != nil {
+		c.Data["json"] = map[string]interface{}{"code": 500, "msg": "删除失败"}
+		_ = c.ServeJSON()
+		return
+	}
+	if cnt == 0 {
+		c.Data["json"] = map[string]interface{}{"code": 404, "msg": "角色不存在"}
+		_ = c.ServeJSON()
+		return
+	}
+	c.Data["json"] = map[string]interface{}{"code": 200, "msg": "success"}
+	_ = c.ServeJSON()
+}

go/controllers/platform_tenant_user.go

@@ -202,6 +202,14 @@ func (c *PlatformTenantUserController) CreateTenantUser() {
 	}
 	if isDefault == 1 {
 		_ = services.SetDefaultTenant(p.Uid, p.Tid)
+		// 租户第一个账号（普通租户）即租户管理员：自动绑定「租户管理员」角色，
+		// 使"普通租户"与"租户管理员"合二为一（均可登录 backend 并拥有全权限）。
+		if adminRoleID, err := models.GetTenantAdminRole(p.Tid); err == nil && adminRoleID > 0 {
+			models.EnsureTenantUserGroupColumn()
+			_, _ = models.Orm.QueryTable(new(models.SystemTenantUser)).
+				Filter("id", id).
+				Update(map[string]interface{}{"group_id": adminRoleID})
+		}
 	}
 
 	c.Data["json"] = map[string]interface{}{"code": 200, "msg": "success", "data": map[string]interface{}{"id": id}}

go/models/admin_role.go

@@ -5,7 +5,8 @@ import "time"
 // AdminRole 平台角色表 yz_system_admin_role
 type AdminRole struct {
 	ID         uint64     `orm:"column(id);pk;auto" json:"id"`
-	Cid        uint8      `orm:"column(cid);default(1)" json:"cid"` // 1平台角色 2租户角色
+	TenantID   uint64     `orm:"column(tenant_id);default(0)" json:"tenant_id"` // 租户ID：0=平台/全局，>0=具体租户（仅 cid=2 租户角色使用）
+	Cid        uint8      `orm:"column(cid);default(1)" json:"cid"`            // 1平台角色 2租户角色
 	Name       string     `orm:"column(name);size(32)" json:"name"`
 	Status     uint8      `orm:"column(status);default(1)" json:"status"`
 	Rights     *string    `orm:"column(rights);type(text);null" json:"rights"`

go/models/admin_role_default.go

@@ -0,0 +1,80 @@
+package models
+
+import (
+	"sync"
+
+	"github.com/beego/beego/v2/client/orm"
+)
+
+var adminRoleTenantColOnce sync.Once
+
+// EnsureAdminRoleTenantColumn 为角色表补齐 tenant_id 列（历史库可能早于租户隔离特性建表）。
+// 字段已存在时 MySQL 报 duplicate column，统一忽略，不阻断主流程。
+func EnsureAdminRoleTenantColumn() {
+	if Orm == nil {
+		return
+	}
+	adminRoleTenantColOnce.Do(func() {
+		_, _ = Orm.Raw(`
+			ALTER TABLE yz_system_admin_role
+			ADD COLUMN tenant_id bigint unsigned NOT NULL DEFAULT 0 COMMENT '租户ID 0-平台/全局 >0-具体租户'
+		`).Exec()
+	})
+}
+
+// EnsureDefaultTenantRoles 保证指定租户（cid=2）的默认角色齐全：
+//   - 租户管理员：全权限（rights 为空，见 permission.go 空权限即放行）
+//   - 部门负责人
+//   - 员工
+//
+// 默认角色按租户隔离：每个租户首次访问角色列表时补建自己的一套，互不影响。
+// 缺失的自动插入；已存在（同名同 cid 同租户）的不动。任何失败均静默忽略不阻断主流程。
+func EnsureDefaultTenantRoles(tid uint64) {
+	if Orm == nil || tid == 0 {
+		return
+	}
+	// 确保 tenant_id 列存在（兼容老表）
+	EnsureAdminRoleTenantColumn()
+
+	defaults := []string{"租户管理员", "部门负责人", "员工"}
+	for _, name := range defaults {
+		cnt, err := Orm.QueryTable(new(AdminRole)).
+			Filter("cid", 2).
+			Filter("tenant_id", tid).
+			Filter("name", name).
+			Count()
+		if err != nil {
+			continue
+		}
+		if cnt > 0 {
+			continue
+		}
+		role := &AdminRole{
+			TenantID: tid,
+			Cid:      2,
+			Name:     name,
+			Status:   1,
+			Rights:   nil, // 空权限 = 全权限（permission.go）
+		}
+		_, _ = Orm.Insert(role)
+	}
+}
+
+// GetTenantAdminRole 返回指定租户（cid=2）的「租户管理员」角色 ID。
+// 角色不存在时先调用 EnsureDefaultTenantRoles 补建再查；任何失败返回 (0, err)。
+// 普通租户（租户第一个账号）与租户管理员实为同一概念，均绑定此角色以获得 backend 全权限。
+func GetTenantAdminRole(tid uint64) (uint64, error) {
+	if Orm == nil || tid == 0 {
+		return 0, orm.ErrNoRows
+	}
+	EnsureDefaultTenantRoles(tid)
+	var role AdminRole
+	if err := Orm.QueryTable(new(AdminRole)).
+		Filter("cid", 2).
+		Filter("tenant_id", tid).
+		Filter("name", "租户管理员").
+		One(&role); err != nil {
+		return 0, err
+	}
+	return role.ID, nil
+}

go/models/system_tenant_user.go

@@ -1,11 +1,15 @@
 package models
 
-import "time"
+import (
+	"sync"
+	"time"
+)
 
 type SystemTenantUser struct {
 	ID         uint64     `orm:"column(id);pk;auto" json:"id"`
 	Tid        uint64     `orm:"column(tid)" json:"tid"`
 	Uid        uint64     `orm:"column(uid)" json:"uid"`
+	GroupID    uint64     `orm:"column(group_id);default(0)" json:"group_id"` // 角色ID：关联 yz_system_admin_role(id, cid=2)；0=未分配（视为全权限）
 	Account    *string    `orm:"column(account);size(64);null" json:"account"`
 	Name       *string    `orm:"column(name);size(64);null" json:"name"`
 	Phone      *string    `orm:"column(phone);size(20);null" json:"phone"`
@@ -24,3 +28,19 @@ type SystemTenantUser struct {
 func (m *SystemTenantUser) TableName() string {
 	return "yz_system_tenant_user"
 }
+
+var tenantUserGroupColOnce sync.Once
+
+// EnsureTenantUserGroupColumn 为租户用户表补齐 group_id（角色）列。
+// 历史库可能早于"用户-角色"特性建表，字段已存在时 MySQL 报 duplicate column，统一忽略。
+func EnsureTenantUserGroupColumn() {
+	if Orm == nil {
+		return
+	}
+	tenantUserGroupColOnce.Do(func() {
+		_, _ = Orm.Raw(`
+			ALTER TABLE yz_system_tenant_user
+			ADD COLUMN group_id bigint unsigned NOT NULL DEFAULT 0 COMMENT '角色ID 关联 yz_system_admin_role(cid=2)'
+		`).Exec()
+	})
+}

go/routers/backend/backend.go

@@ -10,6 +10,17 @@ import (
 // 该端不包含平台菜单配置接口。
 func Register() {
 	RegisterAuthRoutes()
+	RegisterRoleRoutes()
+}
+
+// RegisterRoleRoutes 注册 backend 租户角色管理路由。
+func RegisterRoleRoutes() {
+	// 租户角色管理（yz_system_admin_role, cid=2）
+	beego.Router("/backend/allRoles", &controllers.BackendRoleController{}, "get:GetAllRoles")
+	beego.Router("/backend/roles/:id", &controllers.BackendRoleController{}, "get:GetRoleByID")
+	beego.Router("/backend/roles", &controllers.BackendRoleController{}, "post:CreateRole")
+	beego.Router("/backend/roles/:id", &controllers.BackendRoleController{}, "put:UpdateRole")
+	beego.Router("/backend/roles/:id", &controllers.BackendRoleController{}, "delete:DeleteRole")
 }
 
 // RegisterAuthRoutes 注册 backend 认证相关路由。
@@ -33,6 +44,7 @@ func RegisterAuthRoutes() {
 	beego.Router("/backend/getCurrentUser", &controllers.BackendAuthController{}, "get:GetCurrentUser")
 
 	// 菜单接口
+	beego.Router("/backend/allmenu", &controllers.BackendMenuController{}, "get:GetAllMenus")
 	beego.Router("/backend/menu/:id", &controllers.BackendMenuController{}, "get:GetBackendMenu")
 	// 前端菜单接口
 	beego.Router("/backend/frontmenus", &controllers.BackendMenuFrontController{}, "get:List;post:Create")

go/services/tenant_user.go

@@ -8,6 +8,10 @@ import (
 
 // BindTenantUser 绑定用户到租户（若已存在则更新状态/默认值）
 func BindTenantUser(tid, uid uint64, account, name, phone, email *string, sex *uint8, birth *string, password *string, isDefault, status int8, remark *string) (uint64, error) {
+	// 确保 group_id（角色）列存在，避免老表插入时报 Unknown column。
+	// INSERT 会带上该列，列不存在会直接失败，故必须在写入前补齐。
+	models.EnsureTenantUserGroupColumn()
+
 	var existed models.SystemTenantUser
 	err := models.Orm.QueryTable(new(models.SystemTenantUser)).
 		Filter("tid", tid).

platform/src/api/tenantUser.js

@@ -18,7 +18,7 @@ export function createTenantUser(data) {
   });
 }
 
-// 修改租户用户绑定信息（用于修改密码等）
+// 修改租户用户绑定信息（用于修改密码、启用/禁用等）
 export function editTenantUser(id, data) {
   return request({
     url: `/platform/tenantUser/edit/${id}`,
@@ -27,3 +27,11 @@ export function editTenantUser(id, data) {
   });
 }
 
+// 删除租户用户绑定
+export function deleteTenantUser(id) {
+  return request({
+    url: `/platform/tenantUser/delete/${id}`,
+    method: "delete",
+  });
+}
+

platform/src/views/basicSettings/tenants/components/TenantUsersTab.vue

@@ -35,11 +35,19 @@
           </el-tag>
         </template>
       </el-table-column>
-      <el-table-column label="操作" width="140" align="center" fixed="right">
+      <el-table-column label="操作" width="260" align="center" fixed="right">
         <template #default="{ row }">
           <el-button text type="primary" @click="openPasswordDialog(row)">
             修改密码
           </el-button>
+          <el-button
+            text
+            :type="Number(row.status) === 1 ? 'warning' : 'success'"
+            @click="handleToggleStatus(row)"
+          >
+            {{ Number(row.status) === 1 ? "禁用" : "启用" }}
+          </el-button>
+          <el-button text type="danger" @click="handleDelete(row)">删除</el-button>
         </template>
       </el-table-column>
     </el-table>
@@ -65,9 +73,9 @@
 
 <script setup lang="ts">
 import { ref, reactive, watch } from "vue";
-import { ElMessage } from "element-plus";
+import { ElMessage, ElMessageBox } from "element-plus";
 import { Plus } from "@element-plus/icons-vue";
-import { getTenantUserList, editTenantUser } from "@/api/tenantUser";
+import { getTenantUserList, editTenantUser, deleteTenantUser } from "@/api/tenantUser";
 import AddUser from "./adduser.vue";
 
 const props = defineProps<{
@@ -206,6 +214,54 @@ const submitPassword = async () => {
   }
 };
 
+const handleToggleStatus = async (row: any) => {
+  const next = Number(row.status) === 1 ? 0 : 1;
+  const actionText = next === 0 ? "禁用" : "启用";
+  const name = row.name || row.account || `ID ${row.id}`;
+  try {
+    await ElMessageBox.confirm(`确定要${actionText}用户「${name}」吗？`, "提示", {
+      type: "warning",
+    });
+  } catch {
+    return;
+  }
+  try {
+    const res = await editTenantUser(row.id, { status: next });
+    if (res.code === 200) {
+      ElMessage.success(`${actionText}成功`);
+      refreshTenantUsers();
+    } else {
+      ElMessage.error(res.msg || `${actionText}失败`);
+    }
+  } catch (e: any) {
+    ElMessage.error(e?.message || `${actionText}失败`);
+  }
+};
+
+const handleDelete = async (row: any) => {
+  const name = row.name || row.account || `ID ${row.id}`;
+  try {
+    await ElMessageBox.confirm(
+      `确定要删除用户「${name}」吗？删除后不可恢复。`,
+      "警告",
+      { type: "warning" }
+    );
+  } catch {
+    return;
+  }
+  try {
+    const res = await deleteTenantUser(row.id);
+    if (res.code === 200) {
+      ElMessage.success("删除成功");
+      refreshTenantUsers();
+    } else {
+      ElMessage.error(res.msg || "删除失败");
+    }
+  } catch (e: any) {
+    ElMessage.error(e?.message || "删除失败");
+  }
+};
+
 defineExpose({
   refreshTenantUsers,
 });