From 6df4d7a49eba5ae91e5059d4210690c0cfb15cac Mon Sep 17 00:00:00 2001
From: smail <likb_blue@163.com>
Date: Fri, 2 Oct 2026 03:51:11 +0800
Subject: [PATCH] =?UTF-8?q?=E8=A1=A5=E5=85=85=E5=88=86=E7=BB=84=E7=AE=A1?=
 =?UTF-8?q?=E7=90=86=E5=85=A5=E5=8F=A3=E5=92=8C=E5=88=9B=E5=BB=BA=E6=9D=83?=
 =?UTF-8?q?=E9=99=90=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

允许管理员通过成员管理能力打开分组操作，并限制创建账号时的分组范围。
---
 backend/controllers/user.go                                | 4 ++++
 .../src/views/components/UserManagement/UserManagement.vue | 7 ++++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/backend/controllers/user.go b/backend/controllers/user.go
index 9166c5e..9f37bd9 100644
--- a/backend/controllers/user.go
+++ b/backend/controllers/user.go
@@ -132,6 +132,10 @@ func CreateUser(ctx *context.Context, w http.ResponseWriter, req *http.Request)
 		writeAccountGroupError(w, err)
 		return
 	}
+	if err := accountgroup.CheckWrite(tx, accountgroup.MembershipScopeGuard(ctx.UserID, ctx.EffectiveRole(), groupIDs)); err != nil {
+		writeAccountGroupError(w, err)
+		return
+	}
 	groupIDs, err = accountgroup.ValidateMembership(tx, user.EffectiveRole(), groupIDs)
 	if err != nil {
 		writeAccountGroupError(w, err)
diff --git a/frontend/src/views/components/UserManagement/UserManagement.vue b/frontend/src/views/components/UserManagement/UserManagement.vue
index 12b470e..c4fbfeb 100644
--- a/frontend/src/views/components/UserManagement/UserManagement.vue
+++ b/frontend/src/views/components/UserManagement/UserManagement.vue
@@ -84,7 +84,7 @@
             </el-tag>
           </template>
         </el-table-column>
-        <el-table-column label="操作" align="right" :width="canManageGroups ? 126 : 68">
+        <el-table-column label="操作" align="right" :width="canManageMembership ? 126 : 68">
           <template #default="scope">
             <el-button
               size="small"
@@ -97,7 +97,7 @@
             >
               编辑
             </el-button>
-            <el-button v-if="canManageGroups" size="small" text :disabled="groupSaving" @click="editMembership(scope.row)">分组</el-button>
+            <el-button v-if="canManageMembership" size="small" text :disabled="groupSaving" @click="editMembership(scope.row)">分组</el-button>
           </template>
         </el-table-column>
       </el-table>
@@ -238,7 +238,7 @@
                 </el-tag>
               </div>
               <el-button
-                v-if="canManageGroups"
+                v-if="canManageMembership"
                 class="membership-manage-button"
                 type="primary"
                 plain
@@ -368,6 +368,7 @@ const {
   groupsLoading,
   groupsError,
   canManageGroups,
+  canManageMembership,
   groupSaving,
   membershipVisible,
   membershipUser,