feat: 用户管理后端与日志库迁移

src/Infrastructure/TakeoutSaaS.Infrastructure/App/Extensions/AppServiceCollectionExtensions.cs

@@ -12,6 +12,7 @@ using TakeoutSaaS.Domain.Tenants.Services;
 using TakeoutSaaS.Infrastructure.App.Options;
 using TakeoutSaaS.Infrastructure.App.Persistence;
 using TakeoutSaaS.Infrastructure.Logs.Persistence;
+using TakeoutSaaS.Infrastructure.Logs.Repositories;
 using TakeoutSaaS.Infrastructure.App.Persistence.Repositories;
 using TakeoutSaaS.Infrastructure.App.Repositories;
 using TakeoutSaaS.Infrastructure.App.Services;
@@ -57,6 +58,7 @@ public static class AppServiceCollectionExtensions
         services.AddScoped<IQuotaPackageRepository, EfQuotaPackageRepository>();
         services.AddScoped<IStatisticsRepository, EfStatisticsRepository>();
         services.AddScoped<ISubscriptionRepository, EfSubscriptionRepository>();
+        services.AddScoped<IOperationLogRepository, EfOperationLogRepository>();
 
         // 1. 账单领域/导出服务
         services.AddScoped<IBillingDomainService, BillingDomainService>();

src/Infrastructure/TakeoutSaaS.Infrastructure/Identity/Persistence/EfIdentityUserRepository.cs

@@ -32,6 +32,90 @@ public sealed class EfIdentityUserRepository(IdentityDbContext dbContext) : IIde
         return dbContext.IdentityUsers.AnyAsync(x => x.Account == normalized, cancellationToken);
     }
 
+    /// <summary>
+    /// 判断账号是否存在（租户内，可排除指定用户）。
+    /// </summary>
+    /// <param name="tenantId">租户 ID。</param>
+    /// <param name="account">账号。</param>
+    /// <param name="excludeUserId">排除的用户 ID。</param>
+    /// <param name="cancellationToken">取消标记。</param>
+    /// <returns>存在返回 true。</returns>
+    public Task<bool> ExistsByAccountAsync(long tenantId, string account, long? excludeUserId = null, CancellationToken cancellationToken = default)
+    {
+        // 1. 标准化账号
+        var normalized = account.Trim();
+
+        // 2. 构建查询（包含已删除数据）
+        var query = dbContext.IdentityUsers
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .Where(x => x.TenantId == tenantId && x.Account == normalized);
+
+        if (excludeUserId.HasValue)
+        {
+            query = query.Where(x => x.Id != excludeUserId.Value);
+        }
+
+        // 3. 返回是否存在
+        return query.AnyAsync(cancellationToken);
+    }
+
+    /// <summary>
+    /// 判断手机号是否存在（租户内，可排除指定用户）。
+    /// </summary>
+    /// <param name="tenantId">租户 ID。</param>
+    /// <param name="phone">手机号。</param>
+    /// <param name="excludeUserId">排除的用户 ID。</param>
+    /// <param name="cancellationToken">取消标记。</param>
+    /// <returns>存在返回 true。</returns>
+    public Task<bool> ExistsByPhoneAsync(long tenantId, string phone, long? excludeUserId = null, CancellationToken cancellationToken = default)
+    {
+        // 1. 标准化手机号
+        var normalized = phone.Trim();
+
+        // 2. 构建查询（包含已删除数据）
+        var query = dbContext.IdentityUsers
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .Where(x => x.TenantId == tenantId && x.Phone == normalized);
+
+        if (excludeUserId.HasValue)
+        {
+            query = query.Where(x => x.Id != excludeUserId.Value);
+        }
+
+        // 3. 返回是否存在
+        return query.AnyAsync(cancellationToken);
+    }
+
+    /// <summary>
+    /// 判断邮箱是否存在（租户内，可排除指定用户）。
+    /// </summary>
+    /// <param name="tenantId">租户 ID。</param>
+    /// <param name="email">邮箱。</param>
+    /// <param name="excludeUserId">排除的用户 ID。</param>
+    /// <param name="cancellationToken">取消标记。</param>
+    /// <returns>存在返回 true。</returns>
+    public Task<bool> ExistsByEmailAsync(long tenantId, string email, long? excludeUserId = null, CancellationToken cancellationToken = default)
+    {
+        // 1. 标准化邮箱
+        var normalized = email.Trim();
+
+        // 2. 构建查询（包含已删除数据）
+        var query = dbContext.IdentityUsers
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .Where(x => x.TenantId == tenantId && x.Email == normalized);
+
+        if (excludeUserId.HasValue)
+        {
+            query = query.Where(x => x.Id != excludeUserId.Value);
+        }
+
+        // 3. 返回是否存在
+        return query.AnyAsync(cancellationToken);
+    }
+
     /// <summary>
     /// 根据 ID 获取后台用户。
     /// </summary>
@@ -41,6 +125,19 @@ public sealed class EfIdentityUserRepository(IdentityDbContext dbContext) : IIde
     public Task<IdentityUser?> FindByIdAsync(long userId, CancellationToken cancellationToken = default)
         => dbContext.IdentityUsers.AsNoTracking().FirstOrDefaultAsync(x => x.Id == userId, cancellationToken);
 
+    /// <summary>
+    /// 根据 ID 获取后台用户（忽略租户过滤器，仅用于只读查询）。
+    /// </summary>
+    /// <param name="userId">用户 ID。</param>
+    /// <param name="cancellationToken">取消标记。</param>
+    /// <returns>后台用户或 null。</returns>
+    public Task<IdentityUser?> FindByIdIgnoringTenantAsync(long userId, CancellationToken cancellationToken = default)
+        => dbContext.IdentityUsers
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .Where(x => x.DeletedAt == null)
+            .FirstOrDefaultAsync(x => x.Id == userId, cancellationToken);
+
     /// <summary>
     /// 根据 ID 获取后台用户（用于更新，返回可跟踪实体）。
     /// </summary>
@@ -63,6 +160,31 @@ public sealed class EfIdentityUserRepository(IdentityDbContext dbContext) : IIde
             .Where(x => x.DeletedAt == null)
             .FirstOrDefaultAsync(x => x.Id == userId, cancellationToken);
 
+    /// <summary>
+    /// 根据 ID 获取后台用户（用于更新，包含已删除数据）。
+    /// </summary>
+    /// <param name="tenantId">租户 ID。</param>
+    /// <param name="userId">用户 ID。</param>
+    /// <param name="ignoreTenantFilter">是否忽略租户过滤。</param>
+    /// <param name="cancellationToken">取消标记。</param>
+    /// <returns>后台用户或 null。</returns>
+    public Task<IdentityUser?> GetForUpdateIncludingDeletedAsync(
+        long tenantId,
+        long userId,
+        bool ignoreTenantFilter = false,
+        CancellationToken cancellationToken = default)
+    {
+        // 1. 构建查询（包含已删除数据）
+        var query = dbContext.IdentityUsers.IgnoreQueryFilters();
+        if (!ignoreTenantFilter)
+        {
+            query = query.Where(x => x.TenantId == tenantId);
+        }
+
+        // 2. 返回实体
+        return query.FirstOrDefaultAsync(x => x.Id == userId, cancellationToken);
+    }
+
     /// <summary>
     /// 按租户与关键字搜索后台用户（只读）。
     /// </summary>
@@ -88,6 +210,144 @@ public sealed class EfIdentityUserRepository(IdentityDbContext dbContext) : IIde
         return await query.ToListAsync(cancellationToken);
     }
 
+    /// <summary>
+    /// 分页查询后台用户列表。
+    /// </summary>
+    /// <param name="filter">查询过滤条件。</param>
+    /// <param name="ignoreTenantFilter">是否忽略租户过滤器。</param>
+    /// <param name="cancellationToken">取消标记。</param>
+    /// <returns>分页结果。</returns>
+    public async Task<(IReadOnlyList<IdentityUser> Items, int Total)> SearchPagedAsync(
+        IdentityUserSearchFilter filter,
+        bool ignoreTenantFilter = false,
+        CancellationToken cancellationToken = default)
+    {
+        // 1. 构建基础查询
+        var query = dbContext.IdentityUsers.AsNoTracking();
+        if (ignoreTenantFilter || filter.IncludeDeleted)
+        {
+            query = query.IgnoreQueryFilters();
+        }
+
+        // 2. 租户过滤
+        if (!ignoreTenantFilter)
+        {
+            if (filter.TenantId.HasValue && filter.TenantId.Value != 0)
+            {
+                query = query.Where(x => x.TenantId == filter.TenantId.Value);
+            }
+        }
+        else if (filter.TenantId.HasValue && filter.TenantId.Value != 0)
+        {
+            query = query.Where(x => x.TenantId == filter.TenantId.Value);
+        }
+
+        if (!filter.IncludeDeleted)
+        {
+            query = query.Where(x => x.DeletedAt == null);
+        }
+
+        // 3. 关键字筛选
+        if (!string.IsNullOrWhiteSpace(filter.Keyword))
+        {
+            var normalized = filter.Keyword.Trim();
+            var likeValue = $"%{normalized}%";
+            query = query.Where(x =>
+                EF.Functions.ILike(x.Account, likeValue)
+                || EF.Functions.ILike(x.DisplayName, likeValue)
+                || (x.Phone != null && EF.Functions.ILike(x.Phone, likeValue))
+                || (x.Email != null && EF.Functions.ILike(x.Email, likeValue)));
+        }
+
+        // 4. 状态过滤
+        if (filter.Status.HasValue)
+        {
+            query = query.Where(x => x.Status == filter.Status.Value);
+        }
+
+        // 5. 角色过滤
+        if (filter.RoleId.HasValue)
+        {
+            var roleId = filter.RoleId.Value;
+            var userRoles = dbContext.UserRoles.AsNoTracking();
+            if (ignoreTenantFilter || filter.IncludeDeleted)
+            {
+                userRoles = userRoles.IgnoreQueryFilters();
+            }
+
+            if (!ignoreTenantFilter)
+            {
+                if (filter.TenantId.HasValue && filter.TenantId.Value != 0)
+                {
+                    userRoles = userRoles.Where(x => x.TenantId == filter.TenantId.Value);
+                }
+            }
+            else if (filter.TenantId.HasValue && filter.TenantId.Value != 0)
+            {
+                userRoles = userRoles.Where(x => x.TenantId == filter.TenantId.Value);
+            }
+
+            if (!filter.IncludeDeleted)
+            {
+                userRoles = userRoles.Where(x => x.DeletedAt == null);
+            }
+
+            query = query.Where(user => userRoles.Any(role => role.UserId == user.Id && role.RoleId == roleId));
+        }
+
+        // 6. 时间范围过滤
+        if (filter.CreatedAtFrom.HasValue)
+        {
+            query = query.Where(x => x.CreatedAt >= filter.CreatedAtFrom.Value);
+        }
+
+        if (filter.CreatedAtTo.HasValue)
+        {
+            query = query.Where(x => x.CreatedAt <= filter.CreatedAtTo.Value);
+        }
+
+        if (filter.LastLoginFrom.HasValue)
+        {
+            query = query.Where(x => x.LastLoginAt >= filter.LastLoginFrom.Value);
+        }
+
+        if (filter.LastLoginTo.HasValue)
+        {
+            query = query.Where(x => x.LastLoginAt <= filter.LastLoginTo.Value);
+        }
+
+        // 7. 排序
+        var sorted = filter.SortBy?.ToLowerInvariant() switch
+        {
+            "account" => filter.SortDescending
+                ? query.OrderByDescending(x => x.Account)
+                : query.OrderBy(x => x.Account),
+            "displayname" => filter.SortDescending
+                ? query.OrderByDescending(x => x.DisplayName)
+                : query.OrderBy(x => x.DisplayName),
+            "status" => filter.SortDescending
+                ? query.OrderByDescending(x => x.Status)
+                : query.OrderBy(x => x.Status),
+            "lastloginat" => filter.SortDescending
+                ? query.OrderByDescending(x => x.LastLoginAt)
+                : query.OrderBy(x => x.LastLoginAt),
+            _ => filter.SortDescending
+                ? query.OrderByDescending(x => x.CreatedAt)
+                : query.OrderBy(x => x.CreatedAt)
+        };
+
+        // 8. 分页
+        var page = filter.Page <= 0 ? 1 : filter.Page;
+        var pageSize = filter.PageSize <= 0 ? 20 : filter.PageSize;
+        var total = await sorted.CountAsync(cancellationToken);
+        var items = await sorted
+            .Skip((page - 1) * pageSize)
+            .Take(pageSize)
+            .ToListAsync(cancellationToken);
+
+        return (items, total);
+    }
+
     /// <summary>
     /// 根据 ID 集合批量获取后台用户（只读）。
     /// </summary>
@@ -101,6 +361,50 @@ public sealed class EfIdentityUserRepository(IdentityDbContext dbContext) : IIde
             .ToListAsync(cancellationToken)
             .ContinueWith(t => (IReadOnlyList<IdentityUser>)t.Result, cancellationToken);
 
+    /// <summary>
+    /// 批量获取后台用户（可用于更新，支持包含已删除数据）。
+    /// </summary>
+    /// <param name="tenantId">租户 ID。</param>
+    /// <param name="userIds">用户 ID 集合。</param>
+    /// <param name="includeDeleted">是否包含已删除数据。</param>
+    /// <param name="ignoreTenantFilter">是否忽略租户过滤器。</param>
+    /// <param name="cancellationToken">取消标记。</param>
+    /// <returns>后台用户列表。</returns>
+    public Task<IReadOnlyList<IdentityUser>> GetForUpdateByIdsAsync(
+        long tenantId,
+        IEnumerable<long> userIds,
+        bool includeDeleted,
+        bool ignoreTenantFilter = false,
+        CancellationToken cancellationToken = default)
+    {
+        // 1. 构建基础查询
+        var ids = userIds.Distinct().ToArray();
+        if (ids.Length == 0)
+        {
+            return Task.FromResult<IReadOnlyList<IdentityUser>>(Array.Empty<IdentityUser>());
+        }
+
+        var query = dbContext.IdentityUsers.Where(x => ids.Contains(x.Id));
+        if (ignoreTenantFilter || includeDeleted)
+        {
+            query = query.IgnoreQueryFilters();
+        }
+
+        if (!ignoreTenantFilter)
+        {
+            query = query.Where(x => x.TenantId == tenantId);
+        }
+
+        if (!includeDeleted)
+        {
+            query = query.Where(x => x.DeletedAt == null);
+        }
+
+        // 2. 返回列表
+        return query.ToListAsync(cancellationToken)
+            .ContinueWith(t => (IReadOnlyList<IdentityUser>)t.Result, cancellationToken);
+    }
+
     /// <summary>
     /// 新增后台用户。
     /// </summary>
@@ -115,6 +419,20 @@ public sealed class EfIdentityUserRepository(IdentityDbContext dbContext) : IIde
         return Task.CompletedTask;
     }
 
+    /// <summary>
+    /// 删除后台用户（软删除）。
+    /// </summary>
+    /// <param name="user">后台用户实体。</param>
+    /// <param name="cancellationToken">取消标记。</param>
+    /// <returns>异步任务。</returns>
+    public Task RemoveAsync(IdentityUser user, CancellationToken cancellationToken = default)
+    {
+        // 1. 标记删除
+        dbContext.IdentityUsers.Remove(user);
+        // 2. 返回完成任务
+        return Task.CompletedTask;
+    }
+
     /// <summary>
     /// 持久化仓储变更。
     /// </summary>

src/Infrastructure/TakeoutSaaS.Infrastructure/Identity/Persistence/EfPermissionRepository.cs

@@ -17,7 +17,10 @@ public sealed class EfPermissionRepository(IdentityDbContext dbContext) : IPermi
     /// <param name="cancellationToken">取消标记。</param>
     /// <returns>权限实体或 null。</returns>
     public Task<Permission?> FindByIdAsync(long permissionId, long tenantId, CancellationToken cancellationToken = default)
-        => dbContext.Permissions.AsNoTracking().FirstOrDefaultAsync(x => x.Id == permissionId && x.TenantId == tenantId, cancellationToken);
+        => dbContext.Permissions
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .FirstOrDefaultAsync(x => x.Id == permissionId && x.TenantId == tenantId && x.DeletedAt == null, cancellationToken);
 
     /// <summary>
     /// 根据权限编码获取权限。
@@ -27,7 +30,10 @@ public sealed class EfPermissionRepository(IdentityDbContext dbContext) : IPermi
     /// <param name="cancellationToken">取消标记。</param>
     /// <returns>权限实体或 null。</returns>
     public Task<Permission?> FindByCodeAsync(string code, long tenantId, CancellationToken cancellationToken = default)
-        => dbContext.Permissions.AsNoTracking().FirstOrDefaultAsync(x => x.Code == code && x.TenantId == tenantId, cancellationToken);
+        => dbContext.Permissions
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .FirstOrDefaultAsync(x => x.Code == code && x.TenantId == tenantId && x.DeletedAt == null, cancellationToken);
 
     /// <summary>
     /// 根据权限编码集合批量获取权限。
@@ -46,8 +52,10 @@ public sealed class EfPermissionRepository(IdentityDbContext dbContext) : IPermi
             .ToArray();
 
         // 2. 按租户筛选权限
-        return dbContext.Permissions.AsNoTracking()
-            .Where(x => x.TenantId == tenantId && normalizedCodes.Contains(x.Code))
+        return dbContext.Permissions
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .Where(x => x.TenantId == tenantId && x.DeletedAt == null && normalizedCodes.Contains(x.Code))
             .ToListAsync(cancellationToken)
             .ContinueWith(t => (IReadOnlyList<Permission>)t.Result, cancellationToken);
     }
@@ -60,8 +68,10 @@ public sealed class EfPermissionRepository(IdentityDbContext dbContext) : IPermi
     /// <param name="cancellationToken">取消标记。</param>
     /// <returns>权限列表。</returns>
     public Task<IReadOnlyList<Permission>> GetByIdsAsync(long tenantId, IEnumerable<long> permissionIds, CancellationToken cancellationToken = default)
-        => dbContext.Permissions.AsNoTracking()
-            .Where(x => x.TenantId == tenantId && permissionIds.Contains(x.Id))
+        => dbContext.Permissions
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .Where(x => x.TenantId == tenantId && x.DeletedAt == null && permissionIds.Contains(x.Id))
             .ToListAsync(cancellationToken)
             .ContinueWith(t => (IReadOnlyList<Permission>)t.Result, cancellationToken);
 
@@ -75,7 +85,10 @@ public sealed class EfPermissionRepository(IdentityDbContext dbContext) : IPermi
     public Task<IReadOnlyList<Permission>> SearchAsync(long tenantId, string? keyword, CancellationToken cancellationToken = default)
     {
         // 1. 构建基础查询
-        var query = dbContext.Permissions.AsNoTracking().Where(x => x.TenantId == tenantId);
+        var query = dbContext.Permissions
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .Where(x => x.TenantId == tenantId && x.DeletedAt == null);
         if (!string.IsNullOrWhiteSpace(keyword))
         {
             // 2. 追加关键字过滤

src/Infrastructure/TakeoutSaaS.Infrastructure/Identity/Persistence/EfRolePermissionRepository.cs

@@ -17,8 +17,10 @@ public sealed class EfRolePermissionRepository(IdentityDbContext dbContext) : IR
     /// <param name="cancellationToken">取消标记。</param>
     /// <returns>角色权限映射列表。</returns>
     public Task<IReadOnlyList<RolePermission>> GetByRoleIdsAsync(long tenantId, IEnumerable<long> roleIds, CancellationToken cancellationToken = default)
-        => dbContext.RolePermissions.AsNoTracking()
-            .Where(x => x.TenantId == tenantId && roleIds.Contains(x.RoleId))
+        => dbContext.RolePermissions
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .Where(x => x.TenantId == tenantId && x.DeletedAt == null && roleIds.Contains(x.RoleId))
             .ToListAsync(cancellationToken)
             .ContinueWith(t => (IReadOnlyList<RolePermission>)t.Result, cancellationToken);
 

src/Infrastructure/TakeoutSaaS.Infrastructure/Identity/Persistence/EfRoleRepository.cs

@@ -17,7 +17,10 @@ public sealed class EfRoleRepository(IdentityDbContext dbContext) : IRoleReposit
     /// <param name="cancellationToken">取消标记。</param>
     /// <returns>角色实体或 null。</returns>
     public Task<Role?> FindByIdAsync(long roleId, long tenantId, CancellationToken cancellationToken = default)
-        => dbContext.Roles.AsNoTracking().FirstOrDefaultAsync(x => x.Id == roleId && x.TenantId == tenantId && x.DeletedAt == null, cancellationToken);
+        => dbContext.Roles
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .FirstOrDefaultAsync(x => x.Id == roleId && x.TenantId == tenantId && x.DeletedAt == null, cancellationToken);
 
     /// <summary>
     /// 根据角色编码获取角色。
@@ -27,7 +30,10 @@ public sealed class EfRoleRepository(IdentityDbContext dbContext) : IRoleReposit
     /// <param name="cancellationToken">取消标记。</param>
     /// <returns>角色实体或 null。</returns>
     public Task<Role?> FindByCodeAsync(string code, long tenantId, CancellationToken cancellationToken = default)
-        => dbContext.Roles.AsNoTracking().FirstOrDefaultAsync(x => x.Code == code && x.TenantId == tenantId && x.DeletedAt == null, cancellationToken);
+        => dbContext.Roles
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .FirstOrDefaultAsync(x => x.Code == code && x.TenantId == tenantId && x.DeletedAt == null, cancellationToken);
 
     /// <summary>
     /// 根据角色 ID 集合获取角色列表。
@@ -37,7 +43,9 @@ public sealed class EfRoleRepository(IdentityDbContext dbContext) : IRoleReposit
     /// <param name="cancellationToken">取消标记。</param>
     /// <returns>角色列表。</returns>
     public Task<IReadOnlyList<Role>> GetByIdsAsync(long tenantId, IEnumerable<long> roleIds, CancellationToken cancellationToken = default)
-        => dbContext.Roles.AsNoTracking()
+        => dbContext.Roles
+            .IgnoreQueryFilters()
+            .AsNoTracking()
             .Where(x => x.TenantId == tenantId && roleIds.Contains(x.Id) && x.DeletedAt == null)
             .ToListAsync(cancellationToken)
             .ContinueWith(t => (IReadOnlyList<Role>)t.Result, cancellationToken);
@@ -52,7 +60,10 @@ public sealed class EfRoleRepository(IdentityDbContext dbContext) : IRoleReposit
     public Task<IReadOnlyList<Role>> SearchAsync(long tenantId, string? keyword, CancellationToken cancellationToken = default)
     {
         // 1. 构建基础查询
-        var query = dbContext.Roles.AsNoTracking().Where(x => x.TenantId == tenantId && x.DeletedAt == null);
+        var query = dbContext.Roles
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .Where(x => x.TenantId == tenantId && x.DeletedAt == null);
         if (!string.IsNullOrWhiteSpace(keyword))
         {
             // 2. 追加关键字过滤

src/Infrastructure/TakeoutSaaS.Infrastructure/Identity/Persistence/EfUserRoleRepository.cs

@@ -17,8 +17,10 @@ public sealed class EfUserRoleRepository(IdentityDbContext dbContext) : IUserRol
     /// <param name="cancellationToken">取消标记。</param>
     /// <returns>用户角色映射列表。</returns>
     public Task<IReadOnlyList<UserRole>> GetByUserIdsAsync(long tenantId, IEnumerable<long> userIds, CancellationToken cancellationToken = default)
-        => dbContext.UserRoles.AsNoTracking()
-            .Where(x => x.TenantId == tenantId && userIds.Contains(x.UserId))
+        => dbContext.UserRoles
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .Where(x => x.TenantId == tenantId && x.DeletedAt == null && userIds.Contains(x.UserId))
             .ToListAsync(cancellationToken)
             .ContinueWith(t => (IReadOnlyList<UserRole>)t.Result, cancellationToken);
 
@@ -30,8 +32,10 @@ public sealed class EfUserRoleRepository(IdentityDbContext dbContext) : IUserRol
     /// <param name="cancellationToken">取消标记。</param>
     /// <returns>用户角色列表。</returns>
     public Task<IReadOnlyList<UserRole>> GetByUserIdAsync(long tenantId, long userId, CancellationToken cancellationToken = default)
-        => dbContext.UserRoles.AsNoTracking()
-            .Where(x => x.TenantId == tenantId && x.UserId == userId)
+        => dbContext.UserRoles
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .Where(x => x.TenantId == tenantId && x.DeletedAt == null && x.UserId == userId)
             .ToListAsync(cancellationToken)
             .ContinueWith(t => (IReadOnlyList<UserRole>)t.Result, cancellationToken);
 
@@ -53,6 +57,7 @@ public sealed class EfUserRoleRepository(IdentityDbContext dbContext) : IUserRol
 
             // 2. 读取当前角色映射
             var existing = await dbContext.UserRoles
+                .IgnoreQueryFilters()
                 .Where(x => x.TenantId == tenantId && x.UserId == userId)
                 .ToListAsync(cancellationToken);
 
@@ -76,6 +81,20 @@ public sealed class EfUserRoleRepository(IdentityDbContext dbContext) : IUserRol
         });
     }
 
+    /// <summary>
+    /// 统计指定角色下的用户数量。
+    /// </summary>
+    /// <param name="tenantId">租户 ID。</param>
+    /// <param name="roleId">角色 ID。</param>
+    /// <param name="cancellationToken">取消标记。</param>
+    /// <returns>用户数量。</returns>
+    public Task<int> CountUsersByRoleAsync(long tenantId, long roleId, CancellationToken cancellationToken = default)
+        => dbContext.UserRoles
+            .IgnoreQueryFilters()
+            .AsNoTracking()
+            .Where(x => x.TenantId == tenantId && x.DeletedAt == null && x.RoleId == roleId)
+            .CountAsync(cancellationToken);
+
     /// <summary>
     /// 保存仓储变更。
     /// </summary>

src/Infrastructure/TakeoutSaaS.Infrastructure/Identity/Persistence/IdentityDbContext.cs

@@ -93,13 +93,30 @@ public sealed class IdentityDbContext(
         builder.Property(x => x.Account).HasMaxLength(64).IsRequired();
         builder.Property(x => x.DisplayName).HasMaxLength(64).IsRequired();
         builder.Property(x => x.PasswordHash).HasMaxLength(256).IsRequired();
+        builder.Property(x => x.Phone).HasMaxLength(32);
+        builder.Property(x => x.Email).HasMaxLength(128);
+        builder.Property(x => x.Status).HasConversion<int>();
+        builder.Property(x => x.FailedLoginCount).IsRequired();
+        builder.Property(x => x.LockedUntil);
+        builder.Property(x => x.LastLoginAt);
+        builder.Property(x => x.MustChangePassword).IsRequired();
         builder.Property(x => x.Avatar).HasColumnType("text");
+        builder.Property(x => x.RowVersion)
+            .IsRowVersion()
+            .IsConcurrencyToken()
+            .HasColumnType("bytea");
         builder.Property(x => x.TenantId).IsRequired();
         ConfigureAuditableEntity(builder);
         ConfigureSoftDeleteEntity(builder);
 
         builder.HasIndex(x => x.TenantId);
         builder.HasIndex(x => new { x.TenantId, x.Account }).IsUnique();
+        builder.HasIndex(x => new { x.TenantId, x.Phone })
+            .IsUnique()
+            .HasFilter("\"Phone\" IS NOT NULL");
+        builder.HasIndex(x => new { x.TenantId, x.Email })
+            .IsUnique()
+            .HasFilter("\"Email\" IS NOT NULL");
     }
 
     /// <summary>

src/Infrastructure/TakeoutSaaS.Infrastructure/Logs/Repositories/EfOperationLogRepository.cs

@@ -0,0 +1,24 @@
+using TakeoutSaaS.Domain.Tenants.Entities;
+using TakeoutSaaS.Domain.Tenants.Repositories;
+using TakeoutSaaS.Infrastructure.Logs.Persistence;
+
+namespace TakeoutSaaS.Infrastructure.Logs.Repositories;
+
+/// <summary>
+/// 运营操作日志仓储实现。
+/// </summary>
+public sealed class EfOperationLogRepository(TakeoutLogsDbContext logsContext) : IOperationLogRepository
+{
+    /// <inheritdoc />
+    public Task AddAsync(OperationLog log, CancellationToken cancellationToken = default)
+    {
+        // 1. 添加日志实体
+        logsContext.OperationLogs.Add(log);
+        // 2. 返回完成任务
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc />
+    public Task SaveChangesAsync(CancellationToken cancellationToken = default)
+        => logsContext.SaveChangesAsync(cancellationToken);
+}

src/Infrastructure/TakeoutSaaS.Infrastructure/Migrations/IdentityDb/20251226174411_AddIdentityUserManagementFields.Designer.cs

@@ -0,0 +1,726 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using TakeoutSaaS.Infrastructure.Identity.Persistence;
+
+#nullable disable
+
+namespace TakeoutSaaS.Infrastructure.Migrations.IdentityDb
+{
+    [DbContext(typeof(IdentityDbContext))]
+    [Migration("20251226174411_AddIdentityUserManagementFields")]
+    partial class AddIdentityUserManagementFields
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.0")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("TakeoutSaaS.Domain.Identity.Entities.IdentityUser", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasComment("实体唯一标识。");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<string>("Account")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)")
+                        .HasComment("登录账号。");
+
+                    b.Property<string>("Avatar")
+                        .HasColumnType("text")
+                        .HasComment("头像地址。");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("创建时间（UTC）。");
+
+                    b.Property<long?>("CreatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("创建人用户标识，匿名或系统操作时为 null。");
+
+                    b.Property<DateTime?>("DeletedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("软删除时间（UTC），未删除时为 null。");
+
+                    b.Property<long?>("DeletedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("删除人用户标识（软删除），未删除时为 null。");
+
+                    b.Property<string>("DisplayName")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)")
+                        .HasComment("展示名称。");
+
+                    b.Property<string>("Email")
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)")
+                        .HasComment("邮箱（租户内唯一）。");
+
+                    b.Property<int>("FailedLoginCount")
+                        .HasColumnType("integer")
+                        .HasComment("登录失败次数。");
+
+                    b.Property<DateTime?>("LastLoginAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("最近登录时间（UTC）。");
+
+                    b.Property<DateTime?>("LockedUntil")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("锁定截止时间（UTC）。");
+
+                    b.Property<long?>("MerchantId")
+                        .HasColumnType("bigint")
+                        .HasComment("所属商户（平台管理员为空）。");
+
+                    b.Property<bool>("MustChangePassword")
+                        .HasColumnType("boolean")
+                        .HasComment("是否强制修改密码。");
+
+                    b.Property<string>("PasswordHash")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)")
+                        .HasComment("密码哈希。");
+
+                    b.Property<string>("Phone")
+                        .HasMaxLength(32)
+                        .HasColumnType("character varying(32)")
+                        .HasComment("手机号（租户内唯一）。");
+
+                    b.Property<byte[]>("RowVersion")
+                        .IsConcurrencyToken()
+                        .IsRequired()
+                        .ValueGeneratedOnAddOrUpdate()
+                        .HasColumnType("bytea")
+                        .HasComment("并发控制字段。");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasComment("账号状态。");
+
+                    b.Property<long>("TenantId")
+                        .HasColumnType("bigint")
+                        .HasComment("所属租户 ID。");
+
+                    b.Property<DateTime?>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("最近一次更新时间（UTC），从未更新时为 null。");
+
+                    b.Property<long?>("UpdatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("最后更新人用户标识，匿名或系统操作时为 null。");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TenantId");
+
+                    b.HasIndex("TenantId", "Account")
+                        .IsUnique();
+
+                    b.HasIndex("TenantId", "Email")
+                        .IsUnique()
+                        .HasFilter("\"Email\" IS NOT NULL");
+
+                    b.HasIndex("TenantId", "Phone")
+                        .IsUnique()
+                        .HasFilter("\"Phone\" IS NOT NULL");
+
+                    b.ToTable("identity_users", null, t =>
+                        {
+                            t.HasComment("管理后台账户实体（平台管理员、租户管理员或商户员工）。");
+                        });
+                });
+
+            modelBuilder.Entity("TakeoutSaaS.Domain.Identity.Entities.MenuDefinition", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasComment("实体唯一标识。");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<string>("AuthListJson")
+                        .HasColumnType("text")
+                        .HasComment("按钮权限列表 JSON（存储 MenuAuthItemDto 数组）。");
+
+                    b.Property<string>("Component")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)")
+                        .HasComment("组件路径（不含 .vue）。");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("创建时间（UTC）。");
+
+                    b.Property<long?>("CreatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("创建人用户标识，匿名或系统操作时为 null。");
+
+                    b.Property<DateTime?>("DeletedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("软删除时间（UTC），未删除时为 null。");
+
+                    b.Property<long?>("DeletedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("删除人用户标识（软删除），未删除时为 null。");
+
+                    b.Property<string>("Icon")
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)")
+                        .HasComment("图标标识。");
+
+                    b.Property<bool>("IsIframe")
+                        .HasColumnType("boolean")
+                        .HasComment("是否 iframe。");
+
+                    b.Property<bool>("KeepAlive")
+                        .HasColumnType("boolean")
+                        .HasComment("是否缓存。");
+
+                    b.Property<string>("Link")
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)")
+                        .HasComment("外链或 iframe 地址。");
+
+                    b.Property<string>("MetaPermissions")
+                        .IsRequired()
+                        .HasMaxLength(1024)
+                        .HasColumnType("character varying(1024)")
+                        .HasComment("Meta.permissions（逗号分隔）。");
+
+                    b.Property<string>("MetaRoles")
+                        .IsRequired()
+                        .HasMaxLength(1024)
+                        .HasColumnType("character varying(1024)")
+                        .HasComment("Meta.roles（逗号分隔）。");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)")
+                        .HasComment("菜单名称（前端路由 name）。");
+
+                    b.Property<long>("ParentId")
+                        .HasColumnType("bigint")
+                        .HasComment("父级菜单 ID，根节点为 0。");
+
+                    b.Property<string>("Path")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)")
+                        .HasComment("路由路径。");
+
+                    b.Property<string>("RequiredPermissions")
+                        .IsRequired()
+                        .HasMaxLength(1024)
+                        .HasColumnType("character varying(1024)")
+                        .HasComment("访问该菜单所需的权限集合（逗号分隔）。");
+
+                    b.Property<int>("SortOrder")
+                        .HasColumnType("integer")
+                        .HasComment("排序。");
+
+                    b.Property<long>("TenantId")
+                        .HasColumnType("bigint")
+                        .HasComment("所属租户 ID。");
+
+                    b.Property<string>("Title")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)")
+                        .HasComment("标题。");
+
+                    b.Property<DateTime?>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("最近一次更新时间（UTC），从未更新时为 null。");
+
+                    b.Property<long?>("UpdatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("最后更新人用户标识，匿名或系统操作时为 null。");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TenantId", "ParentId", "SortOrder");
+
+                    b.ToTable("menu_definitions", null, t =>
+                        {
+                            t.HasComment("管理端菜单定义。");
+                        });
+                });
+
+            modelBuilder.Entity("TakeoutSaaS.Domain.Identity.Entities.MiniUser", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasComment("实体唯一标识。");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<string>("Avatar")
+                        .HasColumnType("text")
+                        .HasComment("头像地址。");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("创建时间（UTC）。");
+
+                    b.Property<long?>("CreatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("创建人用户标识，匿名或系统操作时为 null。");
+
+                    b.Property<DateTime?>("DeletedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("软删除时间（UTC），未删除时为 null。");
+
+                    b.Property<long?>("DeletedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("删除人用户标识（软删除），未删除时为 null。");
+
+                    b.Property<string>("Nickname")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)")
+                        .HasComment("昵称。");
+
+                    b.Property<string>("OpenId")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)")
+                        .HasComment("微信 OpenId。");
+
+                    b.Property<long>("TenantId")
+                        .HasColumnType("bigint")
+                        .HasComment("所属租户 ID。");
+
+                    b.Property<string>("UnionId")
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)")
+                        .HasComment("微信 UnionId，可能为空。");
+
+                    b.Property<DateTime?>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("最近一次更新时间（UTC），从未更新时为 null。");
+
+                    b.Property<long?>("UpdatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("最后更新人用户标识，匿名或系统操作时为 null。");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TenantId");
+
+                    b.HasIndex("TenantId", "OpenId")
+                        .IsUnique();
+
+                    b.ToTable("mini_users", null, t =>
+                        {
+                            t.HasComment("小程序用户实体。");
+                        });
+                });
+
+            modelBuilder.Entity("TakeoutSaaS.Domain.Identity.Entities.Permission", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasComment("实体唯一标识。");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<string>("Code")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)")
+                        .HasComment("权限编码（租户内唯一）。");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("创建时间（UTC）。");
+
+                    b.Property<long?>("CreatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("创建人用户标识，匿名或系统操作时为 null。");
+
+                    b.Property<DateTime?>("DeletedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("软删除时间（UTC），未删除时为 null。");
+
+                    b.Property<long?>("DeletedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("删除人用户标识（软删除），未删除时为 null。");
+
+                    b.Property<string>("Description")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)")
+                        .HasComment("描述。");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)")
+                        .HasComment("权限名称。");
+
+                    b.Property<long>("ParentId")
+                        .HasColumnType("bigint")
+                        .HasComment("父级权限 ID，根节点为 0。");
+
+                    b.Property<int>("SortOrder")
+                        .HasColumnType("integer")
+                        .HasComment("排序值，值越小越靠前。");
+
+                    b.Property<long>("TenantId")
+                        .HasColumnType("bigint")
+                        .HasComment("所属租户 ID。");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(16)
+                        .HasColumnType("character varying(16)")
+                        .HasComment("权限类型（group/leaf）。");
+
+                    b.Property<DateTime?>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("最近一次更新时间（UTC），从未更新时为 null。");
+
+                    b.Property<long?>("UpdatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("最后更新人用户标识，匿名或系统操作时为 null。");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TenantId");
+
+                    b.HasIndex("TenantId", "Code")
+                        .IsUnique();
+
+                    b.HasIndex("TenantId", "ParentId", "SortOrder");
+
+                    b.ToTable("permissions", null, t =>
+                        {
+                            t.HasComment("权限定义。");
+                        });
+                });
+
+            modelBuilder.Entity("TakeoutSaaS.Domain.Identity.Entities.Role", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasComment("实体唯一标识。");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<string>("Code")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)")
+                        .HasComment("角色编码（租户内唯一）。");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("创建时间（UTC）。");
+
+                    b.Property<long?>("CreatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("创建人用户标识，匿名或系统操作时为 null。");
+
+                    b.Property<DateTime?>("DeletedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("软删除时间（UTC），未删除时为 null。");
+
+                    b.Property<long?>("DeletedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("删除人用户标识（软删除），未删除时为 null。");
+
+                    b.Property<string>("Description")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)")
+                        .HasComment("描述。");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)")
+                        .HasComment("角色名称。");
+
+                    b.Property<long>("TenantId")
+                        .HasColumnType("bigint")
+                        .HasComment("所属租户 ID。");
+
+                    b.Property<DateTime?>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("最近一次更新时间（UTC），从未更新时为 null。");
+
+                    b.Property<long?>("UpdatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("最后更新人用户标识，匿名或系统操作时为 null。");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TenantId");
+
+                    b.HasIndex("TenantId", "Code")
+                        .IsUnique();
+
+                    b.ToTable("roles", null, t =>
+                        {
+                            t.HasComment("角色定义。");
+                        });
+                });
+
+            modelBuilder.Entity("TakeoutSaaS.Domain.Identity.Entities.RolePermission", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasComment("实体唯一标识。");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("创建时间（UTC）。");
+
+                    b.Property<long?>("CreatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("创建人用户标识，匿名或系统操作时为 null。");
+
+                    b.Property<DateTime?>("DeletedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("软删除时间（UTC），未删除时为 null。");
+
+                    b.Property<long?>("DeletedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("删除人用户标识（软删除），未删除时为 null。");
+
+                    b.Property<long>("PermissionId")
+                        .HasColumnType("bigint")
+                        .HasComment("权限 ID。");
+
+                    b.Property<long>("RoleId")
+                        .HasColumnType("bigint")
+                        .HasComment("角色 ID。");
+
+                    b.Property<long>("TenantId")
+                        .HasColumnType("bigint")
+                        .HasComment("所属租户 ID。");
+
+                    b.Property<DateTime?>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("最近一次更新时间（UTC），从未更新时为 null。");
+
+                    b.Property<long?>("UpdatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("最后更新人用户标识，匿名或系统操作时为 null。");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TenantId");
+
+                    b.HasIndex("TenantId", "RoleId", "PermissionId")
+                        .IsUnique();
+
+                    b.ToTable("role_permissions", null, t =>
+                        {
+                            t.HasComment("角色-权限关系。");
+                        });
+                });
+
+            modelBuilder.Entity("TakeoutSaaS.Domain.Identity.Entities.RoleTemplate", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasComment("实体唯一标识。");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("创建时间（UTC）。");
+
+                    b.Property<long?>("CreatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("创建人用户标识，匿名或系统操作时为 null。");
+
+                    b.Property<DateTime?>("DeletedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("软删除时间（UTC），未删除时为 null。");
+
+                    b.Property<long?>("DeletedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("删除人用户标识（软删除），未删除时为 null。");
+
+                    b.Property<string>("Description")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)")
+                        .HasComment("模板描述。");
+
+                    b.Property<bool>("IsActive")
+                        .HasColumnType("boolean")
+                        .HasComment("是否启用。");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)")
+                        .HasComment("模板名称。");
+
+                    b.Property<string>("TemplateCode")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)")
+                        .HasComment("模板编码（唯一）。");
+
+                    b.Property<DateTime?>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("最近一次更新时间（UTC），从未更新时为 null。");
+
+                    b.Property<long?>("UpdatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("最后更新人用户标识，匿名或系统操作时为 null。");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TemplateCode")
+                        .IsUnique();
+
+                    b.ToTable("role_templates", null, t =>
+                        {
+                            t.HasComment("角色模板定义（平台级）。");
+                        });
+                });
+
+            modelBuilder.Entity("TakeoutSaaS.Domain.Identity.Entities.RoleTemplatePermission", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasComment("实体唯一标识。");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("创建时间（UTC）。");
+
+                    b.Property<long?>("CreatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("创建人用户标识，匿名或系统操作时为 null。");
+
+                    b.Property<DateTime?>("DeletedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("软删除时间（UTC），未删除时为 null。");
+
+                    b.Property<long?>("DeletedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("删除人用户标识（软删除），未删除时为 null。");
+
+                    b.Property<string>("PermissionCode")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)")
+                        .HasComment("权限编码。");
+
+                    b.Property<long>("RoleTemplateId")
+                        .HasColumnType("bigint")
+                        .HasComment("模板 ID。");
+
+                    b.Property<DateTime?>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("最近一次更新时间（UTC），从未更新时为 null。");
+
+                    b.Property<long?>("UpdatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("最后更新人用户标识，匿名或系统操作时为 null。");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("RoleTemplateId", "PermissionCode")
+                        .IsUnique();
+
+                    b.ToTable("role_template_permissions", null, t =>
+                        {
+                            t.HasComment("角色模板-权限关系（平台级）。");
+                        });
+                });
+
+            modelBuilder.Entity("TakeoutSaaS.Domain.Identity.Entities.UserRole", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasComment("实体唯一标识。");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("创建时间（UTC）。");
+
+                    b.Property<long?>("CreatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("创建人用户标识，匿名或系统操作时为 null。");
+
+                    b.Property<DateTime?>("DeletedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("软删除时间（UTC），未删除时为 null。");
+
+                    b.Property<long?>("DeletedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("删除人用户标识（软删除），未删除时为 null。");
+
+                    b.Property<long>("RoleId")
+                        .HasColumnType("bigint")
+                        .HasComment("角色 ID。");
+
+                    b.Property<long>("TenantId")
+                        .HasColumnType("bigint")
+                        .HasComment("所属租户 ID。");
+
+                    b.Property<DateTime?>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("最近一次更新时间（UTC），从未更新时为 null。");
+
+                    b.Property<long?>("UpdatedBy")
+                        .HasColumnType("bigint")
+                        .HasComment("最后更新人用户标识，匿名或系统操作时为 null。");
+
+                    b.Property<long>("UserId")
+                        .HasColumnType("bigint")
+                        .HasComment("用户 ID。");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TenantId");
+
+                    b.HasIndex("TenantId", "UserId", "RoleId")
+                        .IsUnique();
+
+                    b.ToTable("user_roles", null, t =>
+                        {
+                            t.HasComment("用户-角色关系。");
+                        });
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

src/Infrastructure/TakeoutSaaS.Infrastructure/Migrations/IdentityDb/20251226174411_AddIdentityUserManagementFields.cs

@@ -0,0 +1,178 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace TakeoutSaaS.Infrastructure.Migrations.IdentityDb
+{
+    /// <inheritdoc />
+    public partial class AddIdentityUserManagementFields : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "Email",
+                table: "identity_users",
+                type: "character varying(128)",
+                maxLength: 128,
+                nullable: true,
+                comment: "邮箱（租户内唯一）。");
+
+            migrationBuilder.AddColumn<int>(
+                name: "FailedLoginCount",
+                table: "identity_users",
+                type: "integer",
+                nullable: false,
+                defaultValue: 0,
+                comment: "登录失败次数。");
+
+            migrationBuilder.AddColumn<DateTime>(
+                name: "LastLoginAt",
+                table: "identity_users",
+                type: "timestamp with time zone",
+                nullable: true,
+                comment: "最近登录时间（UTC）。");
+
+            migrationBuilder.AddColumn<DateTime>(
+                name: "LockedUntil",
+                table: "identity_users",
+                type: "timestamp with time zone",
+                nullable: true,
+                comment: "锁定截止时间（UTC）。");
+
+            migrationBuilder.AddColumn<bool>(
+                name: "MustChangePassword",
+                table: "identity_users",
+                type: "boolean",
+                nullable: false,
+                defaultValue: false,
+                comment: "是否强制修改密码。");
+
+            migrationBuilder.AddColumn<string>(
+                name: "Phone",
+                table: "identity_users",
+                type: "character varying(32)",
+                maxLength: 32,
+                nullable: true,
+                comment: "手机号（租户内唯一）。");
+
+            migrationBuilder.AddColumn<byte[]>(
+                name: "RowVersion",
+                table: "identity_users",
+                type: "bytea",
+                rowVersion: true,
+                nullable: false,
+                defaultValue: new byte[0],
+                comment: "并发控制字段。");
+
+            migrationBuilder.AddColumn<int>(
+                name: "Status",
+                table: "identity_users",
+                type: "integer",
+                nullable: false,
+                defaultValue: 1,
+                comment: "账号状态。");
+
+            // 1. 修复历史用户默认状态为启用
+            migrationBuilder.Sql(
+                """
+                UPDATE identity_users
+                SET "Status" = 1
+                WHERE "Status" = 0;
+                """);
+
+            // 2. 创建 RowVersion 触发器，确保并发字段自动更新
+            migrationBuilder.Sql(
+                """
+                CREATE OR REPLACE FUNCTION public.set_identity_user_row_version()
+                RETURNS trigger AS $$
+                BEGIN
+                    NEW."RowVersion" = decode(md5(random()::text || clock_timestamp()::text), 'hex');
+                    RETURN NEW;
+                END;
+                $$ LANGUAGE plpgsql;
+                """);
+
+            migrationBuilder.Sql(
+                """
+                DROP TRIGGER IF EXISTS trg_identity_users_row_version ON identity_users;
+                CREATE TRIGGER trg_identity_users_row_version
+                BEFORE INSERT OR UPDATE ON identity_users
+                FOR EACH ROW EXECUTE FUNCTION public.set_identity_user_row_version();
+                """);
+
+            // 3. 回填已有数据的 RowVersion
+            migrationBuilder.Sql(
+                """
+                UPDATE identity_users
+                SET "RowVersion" = decode(md5(random()::text || clock_timestamp()::text), 'hex')
+                WHERE "RowVersion" IS NULL OR octet_length("RowVersion") = 0;
+                """);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_identity_users_TenantId_Email",
+                table: "identity_users",
+                columns: new[] { "TenantId", "Email" },
+                unique: true,
+                filter: "\"Email\" IS NOT NULL");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_identity_users_TenantId_Phone",
+                table: "identity_users",
+                columns: new[] { "TenantId", "Phone" },
+                unique: true,
+                filter: "\"Phone\" IS NOT NULL");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.Sql(
+                """
+                DROP TRIGGER IF EXISTS trg_identity_users_row_version ON identity_users;
+                DROP FUNCTION IF EXISTS public.set_identity_user_row_version();
+                """);
+
+            migrationBuilder.DropIndex(
+                name: "IX_identity_users_TenantId_Email",
+                table: "identity_users");
+
+            migrationBuilder.DropIndex(
+                name: "IX_identity_users_TenantId_Phone",
+                table: "identity_users");
+
+            migrationBuilder.DropColumn(
+                name: "Email",
+                table: "identity_users");
+
+            migrationBuilder.DropColumn(
+                name: "FailedLoginCount",
+                table: "identity_users");
+
+            migrationBuilder.DropColumn(
+                name: "LastLoginAt",
+                table: "identity_users");
+
+            migrationBuilder.DropColumn(
+                name: "LockedUntil",
+                table: "identity_users");
+
+            migrationBuilder.DropColumn(
+                name: "MustChangePassword",
+                table: "identity_users");
+
+            migrationBuilder.DropColumn(
+                name: "Phone",
+                table: "identity_users");
+
+            migrationBuilder.DropColumn(
+                name: "RowVersion",
+                table: "identity_users");
+
+            migrationBuilder.DropColumn(
+                name: "Status",
+                table: "identity_users");
+        }
+    }
+}

src/Infrastructure/TakeoutSaaS.Infrastructure/Migrations/IdentityDb/IdentityDbContextModelSnapshot.cs

@@ -63,16 +63,53 @@ namespace TakeoutSaaS.Infrastructure.Migrations.IdentityDb
                         .HasColumnType("character varying(64)")
                         .HasComment("展示名称。");
 
+                    b.Property<string>("Email")
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)")
+                        .HasComment("邮箱（租户内唯一）。");
+
+                    b.Property<int>("FailedLoginCount")
+                        .HasColumnType("integer")
+                        .HasComment("登录失败次数。");
+
+                    b.Property<DateTime?>("LastLoginAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("最近登录时间（UTC）。");
+
+                    b.Property<DateTime?>("LockedUntil")
+                        .HasColumnType("timestamp with time zone")
+                        .HasComment("锁定截止时间（UTC）。");
+
                     b.Property<long?>("MerchantId")
                         .HasColumnType("bigint")
                         .HasComment("所属商户（平台管理员为空）。");
 
+                    b.Property<bool>("MustChangePassword")
+                        .HasColumnType("boolean")
+                        .HasComment("是否强制修改密码。");
+
                     b.Property<string>("PasswordHash")
                         .IsRequired()
                         .HasMaxLength(256)
                         .HasColumnType("character varying(256)")
                         .HasComment("密码哈希。");
 
+                    b.Property<string>("Phone")
+                        .HasMaxLength(32)
+                        .HasColumnType("character varying(32)")
+                        .HasComment("手机号（租户内唯一）。");
+
+                    b.Property<byte[]>("RowVersion")
+                        .IsConcurrencyToken()
+                        .IsRequired()
+                        .ValueGeneratedOnAddOrUpdate()
+                        .HasColumnType("bytea")
+                        .HasComment("并发控制字段。");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer")
+                        .HasComment("账号状态。");
+
                     b.Property<long>("TenantId")
                         .HasColumnType("bigint")
                         .HasComment("所属租户 ID。");
@@ -92,6 +129,14 @@ namespace TakeoutSaaS.Infrastructure.Migrations.IdentityDb
                     b.HasIndex("TenantId", "Account")
                         .IsUnique();
 
+                    b.HasIndex("TenantId", "Email")
+                        .IsUnique()
+                        .HasFilter("\"Email\" IS NOT NULL");
+
+                    b.HasIndex("TenantId", "Phone")
+                        .IsUnique()
+                        .HasFilter("\"Phone\" IS NOT NULL");
+
                     b.ToTable("identity_users", null, t =>
                         {
                             t.HasComment("管理后台账户实体（平台管理员、租户管理员或商户员工）。");