账户设置
@@ -311,6 +311,28 @@ Router.register('/settings', async () => {
API.toast(enabled ? '水印已启用' : '水印已关闭');
}
});
+
+ // 删除用户
+ document.querySelectorAll('button[data-delete-user]')?.forEach(btn => {
+ btn.addEventListener('click', async () => {
+ const username = btn.getAttribute('data-delete-user');
+ if (!confirm(`确定要删除用户 "${username}" 吗？此操作不可恢复。`)) {
+ return;
+ }
+
+ btn.disabled = true;
+ try {
+ await API.deleteUser(username);
+ API.toast('用户已删除');
+ // 刷新页面以更新用户列表
+ setTimeout(() => Router.navigate('/settings'), 1000);
+ } catch(e) {
+ API.toast('删除失败');
+ } finally {
+ btn.disabled = false;
+ }
+ });
+ });
document.querySelectorAll('button[data-clear]')?.forEach(btn => {
btn.addEventListener('click', async () => {
const mod = btn.getAttribute('data-clear');
diff --git a/server/app.py b/server/app.py
index bf2e468..7f050ab 100644
--- a/server/app.py
+++ b/server/app.py
@@ -1541,6 +1541,53 @@ def add_user():
return jsonify({'error': f'创建用户失败：{str(e)}'}), 500
+@app.post('/api/admin/delete-user')
+@require_login
+@require_any_role('superadmin')
+def delete_user():
+ """删除用户"""
+ data = request.get_json() or {}
+ username = (data.get('username') or '').strip()
+
+ if not username:
+ return jsonify({'error': '用户名不能为空'}), 400
+
+ # 获取当前登录用户
+ current_user = session.get('user')
+ if current_user and current_user.get('username') == username:
+ return jsonify({'error': '不能删除当前登录的用户'}), 400
+
+ conn = get_db()
+ c = conn.cursor()
+
+ # 检查用户是否存在
+ c.execute('SELECT id, role FROM users WHERE username=?', (username,))
+ user = c.fetchone()
+ if not user:
+ conn.close()
+ return jsonify({'error': '用户不存在'}), 404
+
+ # 检查是否是最后一个超级管理员
+ if user['role'] == 'superadmin':
+ c.execute('SELECT COUNT(*) as cnt FROM users WHERE role=?', ('superadmin',))
+ count = c.fetchone()['cnt']
+ if count <= 1:
+ conn.close()
+ return jsonify({'error': '不能删除最后一个超级管理员'}), 400
+
+ # 删除用户
+ try:
+ c.execute('DELETE FROM users WHERE username=?', (username,))
+ conn.commit()
+ conn.close()
+
+ log('delete_user', f'username={username}')
+ return jsonify({'ok': True, 'message': f'用户 {username} 已删除'})
+ except Exception as e:
+ conn.close()
+ return jsonify({'error': f'删除用户失败：{str(e)}'}), 500
+
+
@app.post('/api/admin/clear')
@require_login
@require_any_role('superadmin')