From d09d12828ddf22c01dc1be89c60dcdf63ff5f7f9 Mon Sep 17 00:00:00 2001
From: HenryDu8133 <813367384@qq.com>
Date: Sat, 12 Sep 2026 08:36:45 +0800
Subject: [PATCH] =?UTF-8?q?feat(admin):=20=E4=BC=98=E5=8C=96=E7=94=A8?=
 =?UTF-8?q?=E6=88=B7=E6=9D=83=E9=99=90=E5=88=86=E7=BA=A7=C2=B7=E7=BB=9F?=
 =?UTF-8?q?=E4=B8=80=E5=A4=B4=E5=83=8F=C2=B7=E6=95=B0=E6=8D=AE=E5=88=86?=
 =?UTF-8?q?=E6=9E=90=E9=9D=A2=E6=9D=BF=E4=BF=AE=E5=A4=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- fix(DataAnalysisPanel): 活跃用户卡片固定 400px + overflow-y 独立滚动容器，底部渐变遮罩提示滚动；列表项 tooltip 增加 max-height 与 overflow 截断；新增圆形头像显示与 @error 回退首字母
- feat(admin): 新增 getUserAvatarUrl 统一头像策略链（OAuth identity→Gravatar→DiceBear 7.x initials），stats/realtime、active-users、users/index 三处接口返回 avatarUrl
- fix(admin): 建立 SUPER_ADMIN(100)>ADMIN(80)>USER(10) 分级常量与 canChangeRoleOf/canResetPasswordFor 等谓词；reset-password、[id].put、index.post 全面应用级别守卫；前端 UserManager 按钮按权限禁用、availableRoles 按操作者级别过滤 SUPER_ADMIN/ADMIN 等高角色
---
 app/components/Admin/DataAnalysisPanel.vue    | 125 ++++++++------
 app/components/Admin/UserManager.vue          | 133 +++++++++++++--
 server/api/admin/stats/active-users.get.ts    |  47 ++---
 server/api/admin/stats/realtime.get.ts        | 160 +++++++++++++-----
 server/api/admin/users/[id].put.ts            |  48 +++---
 .../admin/users/[id]/reset-password.post.ts   |  62 ++++++-
 server/api/admin/users/index.get.ts           |  40 +++--
 server/api/admin/users/index.post.ts          |  31 ++--
 server/utils/permissions.js                   | 109 +++++++++++-
 server/utils/user-avatar.ts                   |  77 +++++++++
 10 files changed, 633 insertions(+), 199 deletions(-)

diff --git a/app/components/Admin/DataAnalysisPanel.vue b/app/components/Admin/DataAnalysisPanel.vue
index d4d91c8..0fa7fb6 100644
--- a/app/components/Admin/DataAnalysisPanel.vue
+++ b/app/components/Admin/DataAnalysisPanel.vue
@@ -395,43 +395,53 @@
           </div>
           <div
             v-else-if="activeUsers.length > 0"
-            class="flex-1 space-y-3 overflow-y-auto custom-scrollbar pr-2"
+            class="relative max-h-[400px] overflow-hidden"
           >
-            <div
-              v-for="(user, i) in activeUsers.slice(0, 5)"
-              :key="i"
-              class="relative p-5 bg-zinc-950/30 border border-zinc-800/50 rounded-3xl overflow-hidden group"
-            >
-              <div class="flex items-center gap-4 relative z-10">
-                <div
-                  class="w-12 h-12 rounded-2xl bg-zinc-800 flex items-center justify-center font-black text-zinc-500 group-hover:text-zinc-200 transition-colors"
-                >
-                  {{ user.name.charAt(0) }}
-                </div>
-                <div class="flex-1">
-                  <h4 class="text-sm font-bold text-zinc-100">{{ user.name }}</h4>
-                  <p class="text-xs text-zinc-600 font-medium mt-1">
-                    {{ user.contributions }}首投稿 · {{ user.likes }}次点赞
-                  </p>
-                </div>
-                <div class="text-right">
-                  <span
-                    class="text-xl font-black text-zinc-300 group-hover:text-purple-400 transition-colors"
-                    >{{ user.activityScore }}</span
-                  >
-                  <p class="text-[10px] font-black text-zinc-700 uppercase tracking-widest">
-                    活跃度
-                  </p>
-                </div>
-              </div>
-              <!-- 进度条指示器 -->
+            <div class="space-y-3 overflow-y-auto custom-scrollbar pr-2 max-h-[400px] pb-6">
               <div
-                class="absolute bottom-0 left-0 h-1 bg-purple-500/20 group-hover:bg-purple-500/40 transition-all"
-                :style="{
-                  width: `${(user.activityScore / Math.max(...activeUsers.map((u) => u.activityScore), 1)) * 100}%`
-                }"
-              />
+                v-for="(user, i) in activeUsers.slice(0, 5)"
+                :key="i"
+                class="relative p-5 bg-zinc-950/30 border border-zinc-800/50 rounded-3xl overflow-hidden group"
+              >
+                <div class="flex items-center gap-4 relative z-10">
+                  <img
+                    v-if="user.avatarUrl && !failedAvatars[user.id]"
+                    :src="user.avatarUrl"
+                    :alt="user.name"
+                    class="w-12 h-12 rounded-2xl object-cover border border-zinc-700/50 shrink-0"
+                    @error="handleAvatarError($event, user)"
+                  >
+                  <div
+                    v-else
+                    class="w-12 h-12 rounded-2xl bg-zinc-800 flex items-center justify-center font-black text-zinc-500 group-hover:text-zinc-200 transition-colors shrink-0"
+                  >
+                    {{ user.name.charAt(0) }}
+                  </div>
+                  <div class="flex-1 min-w-0">
+                    <h4 class="text-sm font-bold text-zinc-100 truncate">{{ user.name }}</h4>
+                    <p class="text-xs text-zinc-600 font-medium mt-1 truncate">
+                      {{ user.contributions }}首投稿 · {{ user.likes }}次点赞
+                    </p>
+                  </div>
+                  <div class="text-right shrink-0">
+                    <span
+                      class="text-xl font-black text-zinc-300 group-hover:text-purple-400 transition-colors"
+                      >{{ user.activityScore }}</span
+                    >
+                    <p class="text-[10px] font-black text-zinc-700 uppercase tracking-widest">
+                      活跃度
+                    </p>
+                  </div>
+                </div>
+                <div
+                  class="absolute bottom-0 left-0 h-1 bg-purple-500/20 group-hover:bg-purple-500/40 transition-all"
+                  :style="{
+                    width: `${(user.activityScore / Math.max(...activeUsers.map((u) => u.activityScore), 1)) * 100}%`
+                  }"
+                />
+              </div>
             </div>
+            <div class="absolute bottom-0 left-0 right-0 h-16 pointer-events-none bg-gradient-to-t from-zinc-900/90 via-zinc-900/40 to-transparent rounded-b-[2rem]" />
           </div>
           <div v-else class="flex-1 flex flex-col items-center justify-center text-zinc-700">
             <Users :size="32" class="opacity-20 mb-2" />
@@ -537,14 +547,14 @@
         @mouseleave="handleTooltipMouseLeave"
       >
         <div
-          class="bg-zinc-900 border border-zinc-800 rounded-3xl shadow-2xl overflow-hidden min-w-[320px] backdrop-blur-xl bg-opacity-90 animate-in fade-in zoom-in duration-200"
+          class="bg-zinc-900 border border-zinc-800 rounded-3xl shadow-2xl overflow-hidden min-w-[320px] max-w-[380px] backdrop-blur-xl bg-opacity-90 animate-in fade-in zoom-in duration-200"
         >
           <div
-            class="p-6 border-b border-zinc-800/50 bg-gradient-to-br from-blue-500/10 to-transparent"
+            class="p-6 border-b border-zinc-800/50 bg-gradient-to-br from-blue-500/10 to-transparent max-h-[500px] overflow-y-auto custom-scrollbar"
           >
             <div class="flex items-center justify-between mb-4">
-              <h4 class="text-sm font-black text-white uppercase tracking-widest">活跃用户详情</h4>
-              <div class="flex items-center gap-2 px-2 py-1 bg-blue-500/20 rounded-full">
+              <h4 class="text-sm font-black text-white uppercase tracking-widest truncate max-h-[20px] overflow-hidden">活跃用户详情</h4>
+              <div class="flex items-center gap-2 px-2 py-1 bg-blue-500/20 rounded-full shrink-0">
                 <div class="w-1.5 h-1.5 bg-blue-500 rounded-full animate-pulse" />
                 <span class="text-[10px] font-black text-blue-400"
                   >{{ realtimeStats.activeUsers }} 在线</span
@@ -554,44 +564,52 @@
 
             <div
               v-if="realtimeStats.activeUsersList && realtimeStats.activeUsersList.length > 0"
-              class="space-y-4"
+              class="space-y-3 max-h-[350px] overflow-y-auto custom-scrollbar pr-1"
             >
               <div
                 v-for="user in realtimeStats.activeUsersList.slice(0, 5)"
                 :key="user.id"
                 class="flex items-center gap-3 p-3 bg-zinc-950/50 border border-zinc-800/50 rounded-2xl group hover:border-blue-500/30 transition-all"
               >
+                <img
+                  v-if="user.avatarUrl && !failedAvatars[user.id]"
+                  :src="user.avatarUrl"
+                  :alt="user.name"
+                  class="w-10 h-10 rounded-xl object-cover border border-zinc-700/50 shrink-0"
+                  @error="handleAvatarError($event, user)"
+                >
                 <div
-                  class="w-10 h-10 rounded-xl bg-zinc-800 flex items-center justify-center font-black text-zinc-500 group-hover:text-blue-400 transition-colors"
+                  v-else
+                  class="w-10 h-10 rounded-xl bg-zinc-800 flex items-center justify-center font-black text-zinc-500 group-hover:text-blue-400 transition-colors shrink-0"
                 >
                   {{ user.name.charAt(0) }}
                 </div>
                 <div class="flex-1 min-w-0">
-                  <div class="text-xs font-bold text-zinc-200 truncate">{{ user.name }}</div>
-                  <div class="text-[10px] text-zinc-500 font-medium truncate">
+                  <div class="text-xs font-bold text-zinc-200 truncate max-h-[16px] overflow-hidden">{{ user.name }}</div>
+                  <div class="text-[10px] text-zinc-500 font-medium truncate max-h-[14px] overflow-hidden">
                     @{{ user.username }}
                   </div>
                 </div>
-                <div class="text-[10px] font-black text-zinc-600 bg-zinc-900 px-2 py-1 rounded-lg">
+                <div class="text-[10px] font-black text-zinc-600 bg-zinc-900 px-2 py-1 rounded-lg shrink-0">
                   {{ user.lastActive }}
                 </div>
               </div>
               <div v-if="realtimeStats.activeUsersList.length > 5" class="text-center py-2">
-                <span class="text-[10px] font-black text-zinc-600 uppercase tracking-widest"
+                <span class="text-[10px] font-black text-zinc-600 uppercase tracking-widest max-h-[14px] overflow-hidden block"
                   >及其他 {{ realtimeStats.activeUsersList.length - 5 }} 位用户</span
                 >
               </div>
             </div>
             <div v-else class="py-10 flex flex-col items-center justify-center text-zinc-600">
               <Users :size="32" class="opacity-20 mb-3" />
-              <p class="text-xs font-black uppercase tracking-widest">暂无在线用户</p>
+              <p class="text-xs font-black uppercase tracking-widest truncate max-h-[16px] overflow-hidden">暂无在线用户</p>
             </div>
           </div>
           <div class="px-6 py-4 bg-zinc-950/50 flex items-center justify-between">
-            <span class="text-[10px] font-black text-zinc-600 uppercase tracking-widest"
+            <span class="text-[10px] font-black text-zinc-600 uppercase tracking-widest truncate max-h-[14px] overflow-hidden"
               >实时数据同步中</span
             >
-            <Activity :size="12" class="text-blue-500 animate-pulse" />
+            <Activity :size="12" class="text-blue-500 animate-pulse shrink-0" />
           </div>
         </div>
       </div>
@@ -600,7 +618,7 @@
 </template>
 
 <script setup>
-import { onMounted, ref, computed } from 'vue'
+import { onMounted, ref, computed, reactive } from 'vue'
 import {
   TrendingUp,
   Users,
@@ -727,6 +745,17 @@ const tooltip = ref({
   }
 })
 
+// 头像加载失败状态管理
+const failedAvatars = reactive({})
+const handleAvatarError = (event, user) => {
+  if (user && user.id) {
+    failedAvatars[user.id] = true
+  }
+  if (event && event.target) {
+    event.target.style.display = 'none'
+  }
+}
+
 // 鼠标进入事件处理
 const handleMouseEnter = (event) => {
   const rect = event.target.getBoundingClientRect()
diff --git a/app/components/Admin/UserManager.vue b/app/components/Admin/UserManager.vue
index 7252dc2..7af836d 100644
--- a/app/components/Admin/UserManager.vue
+++ b/app/components/Admin/UserManager.vue
@@ -221,9 +221,9 @@
                     class="flex items-center justify-end gap-1.5 opacity-0 group-hover:opacity-100 transition-all action-buttons"
                   >
                     <button
-                      :disabled="isSelf(user)"
+                      :disabled="isSelf(user) || !canManageTargetUser(user)"
                       class="p-2 bg-zinc-950 border border-zinc-800 rounded-xl text-zinc-500 hover:text-blue-400 transition-colors disabled:opacity-20 disabled:cursor-not-allowed action-btn"
-                      title="编辑用户"
+                      :title="!canManageTargetUser(user) ? '权限不足：无法编辑该用户' : '编辑用户'"
                       @click="editUser(user)"
                     >
                       <Edit2 :size="13" />
@@ -236,17 +236,17 @@
                       <Music :size="13" />
                     </button>
                     <button
-                      :disabled="isSelf(user)"
+                      :disabled="isSelf(user) || !canResetPasswordFor(user)"
                       class="p-2 bg-zinc-950 border border-zinc-800 rounded-xl text-zinc-500 hover:text-amber-400 transition-colors disabled:opacity-20 disabled:cursor-not-allowed action-btn"
-                      title="重置密码"
+                      :title="!canResetPasswordFor(user) ? '权限不足：无法重置该用户的密码' : '重置密码'"
                       @click="resetPassword(user)"
                     >
                       <Lock :size="13" />
                     </button>
                     <button
-                      :disabled="isSelf(user)"
+                      :disabled="isSelf(user) || !canManageTargetUser(user)"
                       class="p-2 bg-zinc-950 border border-zinc-800 rounded-xl text-zinc-500 hover:text-red-400 transition-colors disabled:opacity-20 disabled:cursor-not-allowed action-btn"
-                      title="删除用户"
+                      :title="!canManageTargetUser(user) ? '权限不足：无法删除该用户' : '删除用户'"
                       @click="confirmDeleteUser(user)"
                     >
                       <Trash2 :size="13" />
@@ -363,8 +363,9 @@
 
             <div class="flex gap-2 action-buttons">
               <button
-                :disabled="isSelf(user)"
+                :disabled="isSelf(user) || !canManageTargetUser(user)"
                 class="flex-1 py-2.5 bg-zinc-950 border border-zinc-800 rounded-lg text-zinc-400 flex items-center justify-center gap-2 text-[10px] font-black uppercase tracking-widest active:bg-blue-600 active:text-white transition-colors disabled:opacity-20 action-btn"
+                :title="!canManageTargetUser(user) ? '权限不足：无法编辑该用户' : '编辑用户'"
                 @click="editUser(user)"
               >
                 <Edit2 :size="12" /> 编辑
@@ -376,15 +377,17 @@
                 <Music :size="12" /> 记录
               </button>
               <button
-                :disabled="isSelf(user)"
+                :disabled="isSelf(user) || !canResetPasswordFor(user)"
                 class="flex-1 py-2.5 bg-zinc-950 border border-zinc-800 rounded-lg text-zinc-400 flex items-center justify-center gap-2 text-[10px] font-black uppercase tracking-widest active:bg-amber-600 active:text-white transition-colors disabled:opacity-20 action-btn"
+                :title="!canResetPasswordFor(user) ? '权限不足：无法重置该用户的密码' : '重置密码'"
                 @click="resetPassword(user)"
               >
                 <Lock :size="12" /> 重置
               </button>
               <button
-                :disabled="isSelf(user)"
+                :disabled="isSelf(user) || !canManageTargetUser(user)"
                 class="px-3 py-2.5 bg-zinc-950 border border-zinc-800 rounded-lg text-zinc-400 active:bg-red-600 active:text-white transition-colors disabled:opacity-20 action-btn"
+                :title="!canManageTargetUser(user) ? '权限不足：无法删除该用户' : '删除用户'"
                 @click="confirmDeleteUser(user)"
               >
                 <Trash2 :size="14" />
@@ -1493,6 +1496,25 @@ const passwordForm = ref({
 const auth = useAuth()
 const permissions = usePermissions()
 
+// 前端侧角色级别映射（与 server/utils/permissions.js 的 ROLE_LEVELS 保持一致）
+const ROLE_LEVELS = {
+  SUPER_ADMIN: 100,
+  ADMIN: 80,
+  MINISTER: 80,
+  VICE_MINISTER: 70,
+  SONG_ADMIN: 60,
+  STAFF: 60,
+  RESIDENT: 50,
+  TEACHER: 40,
+  USER: 10
+}
+
+const getRoleLevel = (roleName) => {
+  if (!roleName) return 0
+  const name = String(roleName).toUpperCase()
+  return ROLE_LEVELS[name] ?? 0
+}
+
 // 判断是否为当前登录用户
 const isSelf = (user) => {
   return auth.user.value?.id === user?.id
@@ -1503,14 +1525,53 @@ const isSuperAdmin = computed(() => {
   return auth.user.value?.role === 'SUPER_ADMIN'
 })
 
+const currentUserRoleLevel = computed(() => getRoleLevel(auth.user.value?.role))
+
+// 是否为普通管理员（ADMIN/MINISTER 级别，非 SUPER）
+const isAdminOnly = computed(() => {
+  return !isSuperAdmin.value && currentUserRoleLevel.value >= 80
+})
+
+// 操作者能否对目标用户执行管理操作（目标级别必须严格低于操作者，且目标不是 ID=1）
+const canManageTargetUser = (targetUser) => {
+  if (!targetUser) return false
+  if (isSelf(targetUser)) return false
+  if (String(targetUser.id) === '1') return false
+  if (isSuperAdmin.value) return true
+  const targetLevel = getRoleLevel(targetUser.role)
+  return currentUserRoleLevel.value > targetLevel
+}
+
+// 操作者能否重置目标用户的密码（ADMIN 仅可重置 USER 及以下）
+const canResetPasswordFor = (targetUser) => {
+  if (!canManageTargetUser(targetUser)) return false
+  if (isSuperAdmin.value) return true
+  // 普通 ADMIN 只能重置级别 <= USER(10) 的用户
+  const targetLevel = getRoleLevel(targetUser.role)
+  return targetLevel <= ROLE_LEVELS.USER
+}
+
+// 操作者能否将角色改为指定 newRole
+const canAssignRole = (newRole) => {
+  if (!newRole) return false
+  if (isSuperAdmin.value) {
+    return String(newRole).toUpperCase() !== 'SUPER_ADMIN'
+  }
+  const targetLevel = getRoleLevel(newRole)
+  return currentUserRoleLevel.value > targetLevel
+}
+
 const availableRoles = computed(() => {
   if (isSuperAdmin.value) {
     // 超级管理员可以分配除自己以外的所有角色
     return allRoles.value.filter((role) => role.name !== 'SUPER_ADMIN')
-  } else {
-    // 其他角色不能分配角色，返回空数组
-    return []
   }
+  // 普通 ADMIN/MINISTER 等只能分配级别严格低于自己的角色（SUPER_ADMIN 已在上层排除）
+  return allRoles.value.filter(
+    (role) =>
+      role.name !== 'SUPER_ADMIN' &&
+      getRoleLevel(role.name) < currentUserRoleLevel.value
+  )
 })
 
 // 由于使用服务器端分页，这些计算属性简化了
@@ -1594,13 +1655,18 @@ const getStatusDisplayName = (status) => {
 }
 
 const editUser = (user) => {
-  // 禁止编辑自身
   if (isSelf(user)) {
     if (window.$showNotification) {
       window.$showNotification('禁止在用户管理中修改自己的账户', 'warning')
     }
     return
   }
+  if (!canManageTargetUser(user)) {
+    if (window.$showNotification) {
+      window.$showNotification('权限不足：无法编辑该用户', 'warning')
+    }
+    return
+  }
   editingUser.value = user
   userForm.value = {
     name: user.name,
@@ -1614,13 +1680,18 @@ const editUser = (user) => {
 }
 
 const resetPassword = (user) => {
-  // 禁止重置自身密码
   if (isSelf(user)) {
     if (window.$showNotification) {
       window.$showNotification('禁止在用户管理中重置自己的密码', 'warning')
     }
     return
   }
+  if (!canResetPasswordFor(user)) {
+    if (window.$showNotification) {
+      window.$showNotification('权限不足：无法重置该用户的密码', 'warning')
+    }
+    return
+  }
   resetPasswordUser.value = user
   passwordForm.value = {
     password: '',
@@ -1629,13 +1700,18 @@ const resetPassword = (user) => {
 }
 
 const confirmDeleteUser = (user) => {
-  // 禁止删除自身
   if (isSelf(user)) {
     if (window.$showNotification) {
       window.$showNotification('不能删除自己的账户', 'warning')
     }
     return
   }
+  if (!canManageTargetUser(user)) {
+    if (window.$showNotification) {
+      window.$showNotification('权限不足：无法删除该用户', 'warning')
+    }
+    return
+  }
   deletingUser.value = user
   showDeleteModal.value = true
 }
@@ -1687,6 +1763,20 @@ const closeDeleteModal = () => {
 
 const confirmDelete = async () => {
   if (!deletingUser.value) return
+  if (isSelf(deletingUser.value)) {
+    if (window.$showNotification) {
+      window.$showNotification('不能删除自己的账户', 'warning')
+    }
+    closeDeleteModal()
+    return
+  }
+  if (!canManageTargetUser(deletingUser.value)) {
+    if (window.$showNotification) {
+      window.$showNotification('权限不足：无法删除该用户', 'warning')
+    }
+    closeDeleteModal()
+    return
+  }
 
   deleting.value = true
 
@@ -1737,11 +1827,22 @@ const closeResetPassword = () => {
 }
 
 const saveUser = async () => {
-  // 保护：禁止保存针对自身的更改
   if (editingUser.value && isSelf(editingUser.value)) {
     formError.value = '禁止在用户管理中修改自己的账户'
     return
   }
+  if (editingUser.value && !canManageTargetUser(editingUser.value)) {
+    formError.value = '权限不足：无法编辑该用户'
+    return
+  }
+  if (userForm.value.role && !canAssignRole(userForm.value.role)) {
+    formError.value = `权限不足：无法分配角色 ${userForm.value.role}`
+    return
+  }
+  if (userForm.value.password && editingUser.value && !canResetPasswordFor(editingUser.value)) {
+    formError.value = '权限不足：无法重置该用户的密码'
+    return
+  }
   if (!userForm.value.name || !userForm.value.username) {
     formError.value = '请填写必要信息'
     return
diff --git a/server/api/admin/stats/active-users.get.ts b/server/api/admin/stats/active-users.get.ts
index ac05201..34756ca 100644
--- a/server/api/admin/stats/active-users.get.ts
+++ b/server/api/admin/stats/active-users.get.ts
@@ -1,10 +1,10 @@
 import { createError, defineEventHandler, getQuery } from 'h3'
 import { db } from '~/drizzle/db'
-import { songs, users, votes } from '~/drizzle/schema'
+import { songs, users, votes, userIdentities } from '~/drizzle/schema'
 import { CacheService } from '../../../services/cacheService'
+import { getUserAvatarUrl } from '../../../utils/user-avatar'
 
 export default defineEventHandler(async (event) => {
-  // 检查认证和权限
   const user = event.context.user
   if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
     throw createError({
@@ -18,7 +18,6 @@ export default defineEventHandler(async (event) => {
   const limit = parseInt(query.limit as string) || 20
 
   try {
-    // 尝试从缓存获取数据
     const cacheService = CacheService.getInstance()
     const cachedStats = await cacheService.getActiveUsersStats(semester, limit)
     if (cachedStats) {
@@ -26,18 +25,24 @@ export default defineEventHandler(async (event) => {
       return cachedStats
     }
 
-    // 构建查询条件 - 如果没有指定学期或学期为'all'，查询所有用户
     let songWhere = {}
     if (semester && semester !== 'all') {
       songWhere = { semester: semester }
     }
 
-    // 获取活跃用户数据 - 有投稿歌曲的用户
     const allUsers = await db.select().from(users)
     const allSongs = await db.select().from(songs)
     const allVotes = await db.select().from(votes)
+    const allIdentities = await db.select().from(userIdentities)
+
+    const identitiesMap = new Map<number, typeof allIdentities>()
+    allIdentities.forEach((identity) => {
+      if (!identitiesMap.has(identity.userId)) {
+        identitiesMap.set(identity.userId, [])
+      }
+      identitiesMap.get(identity.userId)!.push(identity)
+    })
 
-    // 过滤有投稿歌曲的用户
     const activeUsers = allUsers
       .filter((user) => {
         const userSongs = allSongs.filter((song) => {
@@ -65,44 +70,48 @@ export default defineEventHandler(async (event) => {
         }
       })
 
-    // 如果没有活跃用户，返回空数组
     if (activeUsers.length === 0) {
       const emptyResult = []
-      // 缓存空结果
       await cacheService.setActiveUsersStats(semester, limit, emptyResult)
       console.log('[Cache] 活跃用户统计数据已缓存（空结果）')
       return emptyResult
     }
 
-    // 计算每个用户的活跃度数据
     const userStats = activeUsers.map((user) => {
       const contributions = user.songs.length
       const likes = user.songs.reduce((total, song) => total + song.votes.length, 0)
-
-      // 活跃度计算：投稿数 * 2 + 点赞数 * 0.5
       const activityScore = Math.round(contributions * 2 + likes * 0.5)
+      const userIdentitiesData = identitiesMap.get(user.id) || []
+      const avatarUrl = getUserAvatarUrl(
+        {
+          id: user.id,
+          name: user.name,
+          username: user.username,
+          email: user.email,
+          avatarProvider: user.avatarProvider,
+          avatarProviderUserId: user.avatarProviderUserId
+        },
+        userIdentitiesData
+      )
 
-      const userStat = {
+      return {
         id: user.id,
-        name: user.name || user.username, // 优先显示真实姓名，如果没有则显示登录名
+        name: user.name || user.username,
         contributions,
         likes,
-        activityScore
+        activityScore,
+        avatarUrl
       }
-
-      return userStat
     })
 
-    // 按活跃度分数降序排列并限制数量
     const sortedUsers = userStats.sort((a, b) => b.activityScore - a.activityScore).slice(0, limit)
 
-    // 缓存结果
     await cacheService.setActiveUsersStats(semester, limit, sortedUsers)
     console.log('[Cache] 活跃用户统计数据已缓存')
 
     return sortedUsers
   } catch (error) {
-    // 返回空数组而不是抛出错误，避免前端显示错误
+    console.error('[Stats] 获取活跃用户失败:', error)
     return []
   }
 })
diff --git a/server/api/admin/stats/realtime.get.ts b/server/api/admin/stats/realtime.get.ts
index 030e2a8..86ed510 100644
--- a/server/api/admin/stats/realtime.get.ts
+++ b/server/api/admin/stats/realtime.get.ts
@@ -1,12 +1,24 @@
 import { createError, defineEventHandler } from 'h3'
 import { db } from '~/drizzle/db'
 import { CacheService } from '../../../services/cacheService'
-import { songs, users, votes } from '~/drizzle/schema'
-import { count, eq, gte } from 'drizzle-orm'
+import { songs, users, votes, userIdentities } from '~/drizzle/schema'
+import { count, eq, gte, inArray } from 'drizzle-orm'
 import { getBeijingHour, getBeijingStartOfDay } from '~/utils/timeUtils'
+import { getUserAvatarUrl } from '../../../utils/user-avatar'
+
+function formatRelativeTime(date: Date | null | undefined): string {
+  if (!date) return '未知'
+  const now = new Date()
+  const diff = now.getTime() - new Date(date).getTime()
+  const minutes = Math.floor(diff / 60000)
+  if (minutes < 1) return '刚刚'
+  if (minutes < 60) return `${minutes}分钟前`
+  const hours = Math.floor(minutes / 60)
+  if (hours < 24) return `${hours}小时前`
+  return `${Math.floor(hours / 24)}天前`
+}
 
 export default defineEventHandler(async (event) => {
-  // 检查认证和权限
   const user = event.context.user
   if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
     throw createError({
@@ -16,97 +28,172 @@ export default defineEventHandler(async (event) => {
   }
 
   try {
-    // 尝试从缓存获取数据
     const cacheService = CacheService.getInstance()
     const cachedStats = await cacheService.getRealtimeStats()
     if (cachedStats) {
       console.log('[Cache] 实时统计数据缓存命中')
       return cachedStats
     }
-    // 获取当前时间相关的日期
     const now = new Date()
-    const today = getBeijingStartOfDay() // 使用北京时间的一天开始
+    const today = getBeijingStartOfDay()
     const oneHourAgo = new Date(now.getTime() - 60 * 60 * 1000)
     const oneDayAgo = new Date(now.getTime() - 24 * 60 * 60 * 1000)
 
-    // 并行获取实时统计数据
     const [activeUsersData, todayRequests, popularGenres, peakHours] = await Promise.all([
-      // 活跃用户数和用户列表 (最近1小时点歌、登录或点赞的用户)
       (async () => {
         try {
-          // 获取最近1小时内点歌的用户
           const recentSongUsers = await db
             .select({
               requesterId: songs.requesterId,
               requesterName: users.name,
               requesterUsername: users.username,
-              requesterId2: users.id
+              requesterId2: users.id,
+              requesterLastActive: songs.createdAt,
+              requesterAvatarProvider: users.avatarProvider,
+              requesterAvatarProviderUserId: users.avatarProviderUserId,
+              requesterEmail: users.email
             })
             .from(songs)
             .innerJoin(users, eq(songs.requesterId, users.id))
             .where(gte(songs.createdAt, oneHourAgo))
-            .groupBy(songs.requesterId, users.id, users.name, users.username)
+            .groupBy(songs.requesterId, users.id, users.name, users.username, users.lastLogin, users.avatarProvider, users.avatarProviderUserId, users.email, songs.createdAt)
 
-          // 获取最近1小时内登录的用户
           const recentLoginUsers = await db
             .select({
               id: users.id,
               username: users.username,
-              name: users.name
+              name: users.name,
+              lastLogin: users.lastLogin,
+              avatarProvider: users.avatarProvider,
+              avatarProviderUserId: users.avatarProviderUserId,
+              email: users.email
             })
             .from(users)
             .where(gte(users.lastLogin, oneHourAgo))
 
-          // 获取最近1小时内点赞过歌曲的用户
           const recentVoteUsers = await db
             .select({
               userId: votes.userId,
               userName: users.name,
               userUsername: users.username,
-              userId2: users.id
+              userId2: users.id,
+              voteCreatedAt: votes.createdAt,
+              userAvatarProvider: users.avatarProvider,
+              userAvatarProviderUserId: users.avatarProviderUserId,
+              userEmail: users.email
             })
             .from(votes)
             .innerJoin(users, eq(votes.userId, users.id))
             .where(gte(votes.createdAt, oneHourAgo))
-            .groupBy(votes.userId, users.id, users.name, users.username)
+            .groupBy(votes.userId, users.id, users.name, users.username, users.avatarProvider, users.avatarProviderUserId, users.email, votes.createdAt)
 
-          // 合并并去重用户列表
-          const userMap = new Map()
+          const userMap = new Map<number, any>()
 
-          // 添加点歌用户
           recentSongUsers.forEach((song) => {
-            userMap.set(song.requesterId2, {
-              id: song.requesterId2,
+            const id = song.requesterId2
+            const existing = userMap.get(id)
+            const lastActive = existing?.lastActive
+              ? new Date(existing.lastActive) > new Date(song.requesterLastActive)
+                ? existing.lastActive
+                : song.requesterLastActive
+              : song.requesterLastActive
+            userMap.set(id, {
+              id,
               username: song.requesterUsername,
-              name: song.requesterName
+              name: song.requesterName,
+              email: song.requesterEmail,
+              avatarProvider: song.requesterAvatarProvider,
+              avatarProviderUserId: song.requesterAvatarProviderUserId,
+              lastActive
             })
           })
 
-          // 添加登录用户
-          recentLoginUsers.forEach((user) => {
-            userMap.set(user.id, {
-              id: user.id,
-              username: user.username,
-              name: user.name
+          recentLoginUsers.forEach((u) => {
+            const existing = userMap.get(u.id)
+            const lastActive = existing?.lastActive
+              ? new Date(existing.lastActive) > new Date(u.lastLogin)
+                ? existing.lastActive
+                : u.lastLogin
+              : u.lastLogin
+            userMap.set(u.id, {
+              id: u.id,
+              username: u.username,
+              name: u.name,
+              email: u.email,
+              avatarProvider: u.avatarProvider,
+              avatarProviderUserId: u.avatarProviderUserId,
+              lastActive
             })
           })
 
-          // 添加点赞用户
           recentVoteUsers.forEach((vote) => {
-            userMap.set(vote.userId2, {
-              id: vote.userId2,
+            const id = vote.userId2
+            const existing = userMap.get(id)
+            const lastActive = existing?.lastActive
+              ? new Date(existing.lastActive) > new Date(vote.voteCreatedAt)
+                ? existing.lastActive
+                : vote.voteCreatedAt
+              : vote.voteCreatedAt
+            userMap.set(id, {
+              id,
               username: vote.userUsername,
-              name: vote.userName
+              name: vote.userName,
+              email: vote.userEmail,
+              avatarProvider: vote.userAvatarProvider,
+              avatarProviderUserId: vote.userAvatarProviderUserId,
+              lastActive
             })
           })
 
-          const activeUsersList = Array.from(userMap.values())
+          const userIds = Array.from(userMap.keys())
+          let identitiesData: any[] = []
+          if (userIds.length > 0) {
+            try {
+              identitiesData = await db
+                .select()
+                .from(userIdentities)
+                .where(inArray(userIdentities.userId, userIds))
+            } catch (e) {
+              identitiesData = []
+            }
+          }
+
+          const identitiesMap = new Map<number, any[]>()
+          identitiesData.forEach((identity) => {
+            if (!identitiesMap.has(identity.userId)) {
+              identitiesMap.set(identity.userId, [])
+            }
+            identitiesMap.get(identity.userId)!.push(identity)
+          })
+
+          const activeUsersList = Array.from(userMap.values()).map((u) => {
+            const userIdentitiesData = identitiesMap.get(u.id) || []
+            const avatarUrl = getUserAvatarUrl(
+              {
+                id: u.id,
+                name: u.name,
+                username: u.username,
+                email: u.email,
+                avatarProvider: u.avatarProvider,
+                avatarProviderUserId: u.avatarProviderUserId
+              },
+              userIdentitiesData
+            )
+            return {
+              id: u.id,
+              username: u.username,
+              name: u.name,
+              avatarUrl,
+              lastActive: formatRelativeTime(u.lastActive)
+            }
+          })
 
           return {
             count: activeUsersList.length,
             users: activeUsersList
           }
         } catch (error) {
+          console.error('[Realtime] 获取活跃用户失败:', error)
           return {
             count: 0,
             users: []
@@ -114,7 +201,6 @@ export default defineEventHandler(async (event) => {
         }
       })(),
 
-      // 今日点歌数
       (async () => {
         try {
           const todayCountResult = await db
@@ -127,12 +213,10 @@ export default defineEventHandler(async (event) => {
         }
       })(),
 
-      // 热门流派 (Song模型中没有genre字段，返回空数组)
       (async () => {
         return []
       })(),
 
-      // 高峰时段 (最近7天的小时统计)
       (async () => {
         try {
           const sevenDaysAgo = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000)
@@ -143,7 +227,6 @@ export default defineEventHandler(async (event) => {
             .from(songs)
             .where(gte(songs.createdAt, sevenDaysAgo))
 
-          // 按小时统计
           const hourCount = songsData.reduce(
             (acc, song) => {
               const hour = getBeijingHour(song.createdAt)
@@ -153,7 +236,6 @@ export default defineEventHandler(async (event) => {
             {} as Record<number, number>
           )
 
-          // 返回前3个高峰时段
           return Object.entries(hourCount)
             .sort(([, a], [, b]) => b - a)
             .slice(0, 3)
@@ -177,12 +259,12 @@ export default defineEventHandler(async (event) => {
       timestamp: now.toISOString()
     }
 
-    // 缓存结果
     await cacheService.setRealtimeStats(result)
     console.log('[Cache] 实时统计数据已缓存')
 
     return result
   } catch (error) {
+    console.error('[Realtime] 获取失败:', error)
     throw createError({
       statusCode: 500,
       message: '获取实时统计数据失败'
diff --git a/server/api/admin/users/[id].put.ts b/server/api/admin/users/[id].put.ts
index a9cc874..eeb5ff3 100644
--- a/server/api/admin/users/[id].put.ts
+++ b/server/api/admin/users/[id].put.ts
@@ -3,6 +3,7 @@ import { db } from '~/drizzle/db'
 import { users, userStatusLogs } from '~/drizzle/schema'
 import { eq } from 'drizzle-orm'
 import { updateUserPassword } from '~~/server/services/userService'
+import { getRoleLevel, canChangeRoleOf, canResetPasswordFor } from '~~/server/utils/permissions.js'
 
 export default defineEventHandler(async (event) => {
   try {
@@ -51,6 +52,8 @@ export default defineEventHandler(async (event) => {
     }
 
     const targetUser = existingUser[0]
+    const currentLevel = getRoleLevel(user.role)
+    const targetLevel = getRoleLevel(targetUser.role)
 
     // 1. 禁止修改系统初始超级管理员 (ID: 1)
     if (targetUser.id === 1) {
@@ -61,7 +64,6 @@ export default defineEventHandler(async (event) => {
     }
 
     // 2. 禁止对自身进行任何用户管理操作（包括角色、资料、状态、密码等）
-    // 使用 String 转换确保 ID 比较的准确性
     if (String(userId) === String(user.id)) {
       throw createError({
         statusCode: 400,
@@ -69,12 +71,11 @@ export default defineEventHandler(async (event) => {
       })
     }
 
-    // 3. 越级修改保护
-    // 如果目标用户是 SUPER_ADMIN，操作者必须是 SUPER_ADMIN
-    if (targetUser.role === 'SUPER_ADMIN' && user.role !== 'SUPER_ADMIN') {
+    // 3. 非超级管理员必须严格高于目标角色级别
+    if (user.role !== 'SUPER_ADMIN' && currentLevel <= targetLevel) {
       throw createError({
         statusCode: 403,
-        statusMessage: '权限不足：普通管理员无法修改超级管理员信息'
+        statusMessage: `权限不足：${user.role} 无法操作同级或更高角色的用户`
       })
     }
 
@@ -94,31 +95,26 @@ export default defineEventHandler(async (event) => {
       }
     }
 
-    // 角色权限控制
-    let validRole = 'USER'
-    if (role && ['USER', 'TEACHER', 'ADMIN', 'SONG_ADMIN', 'SUPER_ADMIN'].includes(role)) {
-      // 超级管理员可以设置任何角色
-      if (user.role === 'SUPER_ADMIN') {
-        validRole = role
-      }
-      // 管理员只能设置管理员以下的角色（USER, SONG_ADMIN）
-      else if (user.role === 'ADMIN') {
-        if (['USER', 'TEACHER', 'SONG_ADMIN'].includes(role)) {
-          validRole = role
-        } else {
-          throw createError({
-            statusCode: 403,
-            statusMessage: '管理员只能设置用户、教师和歌曲管理员角色'
-          })
-        }
-      }
-      // 其他角色不能设置角色
-      else {
+    // 角色权限控制（统一使用 canChangeRoleOf 语义化检查）
+    let validRole = targetUser.role
+    if (role && role !== targetUser.role) {
+      if (!canChangeRoleOf(user, targetUser, role)) {
         throw createError({
           statusCode: 403,
-          statusMessage: '没有权限设置用户角色'
+          statusMessage: user.role === 'SUPER_ADMIN'
+            ? '超级管理员不能将目标用户提升为 SUPER_ADMIN'
+            : `权限不足：${user.role} 无法将用户角色更改为 ${role}`
         })
       }
+      validRole = role
+    }
+
+    // 如果请求中包含密码更新，校验密码重置权限
+    if (password && !canResetPasswordFor(user, targetUser)) {
+      throw createError({
+        statusCode: 403,
+        statusMessage: `权限不足：${user.role} 无法重置目标用户的密码`
+      })
     }
 
     // 验证status字段的有效性
diff --git a/server/api/admin/users/[id]/reset-password.post.ts b/server/api/admin/users/[id]/reset-password.post.ts
index 18e9cc7..968655f 100644
--- a/server/api/admin/users/[id]/reset-password.post.ts
+++ b/server/api/admin/users/[id]/reset-password.post.ts
@@ -1,16 +1,18 @@
 import { updateUserPassword } from '~~/server/services/userService'
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { eq } from 'drizzle-orm'
+import { canResetPasswordFor, getRoleLevel } from '../../../utils/permissions.js'
 
 export default defineEventHandler(async (event) => {
-  // 检查认证和权限
-  const user = event.context.user
-  if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
+  const currentUser = event.context.user
+  if (!currentUser || !['ADMIN', 'SUPER_ADMIN'].includes(currentUser.role)) {
     throw createError({
       statusCode: 403,
       message: '没有权限访问'
     })
   }
 
-  // 安全获取ID参数
   const params = event.context.params || {}
   const id = parseInt(params.id || '')
 
@@ -31,15 +33,54 @@ export default defineEventHandler(async (event) => {
   }
 
   try {
-    // 禁止对自身进行密码重置（通过用户管理界面）
-    if (id === user.id) {
+    if (id === currentUser.id) {
       throw createError({
         statusCode: 400,
         message: '禁止在用户管理中重置自己的密码'
       })
     }
-    
-    // 使用统一服务重置密码 (forceReset = true)
+
+    const targetUserResult = await db
+      .select({ id: users.id, role: users.role, username: users.username })
+      .from(users)
+      .where(eq(users.id, id))
+      .limit(1)
+
+    if (targetUserResult.length === 0) {
+      throw createError({
+        statusCode: 404,
+        message: '用户不存在'
+      })
+    }
+
+    const targetUser = targetUserResult[0]
+
+    if (targetUser.id === 1) {
+      throw createError({
+        statusCode: 403,
+        message: '无法重置系统初始超级管理员的密码'
+      })
+    }
+
+    const currentLevel = getRoleLevel(currentUser.role)
+    const targetLevel = getRoleLevel(targetUser.role)
+
+    if (currentUser.role !== 'SUPER_ADMIN') {
+      if (currentLevel <= targetLevel) {
+        throw createError({
+          statusCode: 403,
+          message: '权限不足：不能重置角色级别大于等于自己的用户密码'
+        })
+      }
+    }
+
+    if (!canResetPasswordFor(currentUser, targetUser)) {
+      throw createError({
+        statusCode: 403,
+        message: '权限不足：当前角色无法重置该用户的密码'
+      })
+    }
+
     await updateUserPassword(id, body.newPassword, true)
 
     return {
@@ -47,7 +88,10 @@ export default defineEventHandler(async (event) => {
       message: '密码重置成功'
     }
   } catch (error) {
-    console.error('重置密码失败:', error)
+    console.error('[ResetPassword] 失败:', error)
+    if (error.statusCode) {
+      throw error
+    }
     throw createError({
       statusCode: 500,
       message: '重置密码失败'
diff --git a/server/api/admin/users/index.get.ts b/server/api/admin/users/index.get.ts
index 950aa84..437b652 100644
--- a/server/api/admin/users/index.get.ts
+++ b/server/api/admin/users/index.get.ts
@@ -96,26 +96,36 @@ export default defineEventHandler(async (event) => {
         meowNickname: true,
         meowBoundAt: true,
         createdAt: true,
-        updatedAt: true
+        updatedAt: true,
+        avatarProvider: true,
+        avatarProviderUserId: true,
+        email: true
       },
       with: {
-        identities: {
-          columns: {
-            provider: true,
-            providerUsername: true
-          },
-          where: (identities, { eq }) => eq(identities.provider, 'github')
-        }
+        identities: true
       }
     })
 
-    // 处理用户列表，添加头像字段
-    const formattedUsers = usersList.map((user) => ({
-      ...user,
-      avatar: user.identities?.[0]?.providerUsername
-        ? `https://github.com/${user.identities[0].providerUsername}.png`
-        : null
-    }))
+    const { getUserAvatarUrl } = await import('../../../utils/user-avatar')
+
+    const formattedUsers = usersList.map((user) => {
+      const avatarUrl = getUserAvatarUrl(
+        {
+          id: user.id,
+          name: user.name,
+          username: user.username,
+          email: user.email,
+          avatarProvider: user.avatarProvider,
+          avatarProviderUserId: user.avatarProviderUserId
+        },
+        user.identities || []
+      )
+      return {
+        ...user,
+        avatar: avatarUrl,
+        avatarUrl
+      }
+    })
 
     // 计算分页信息
     const totalPages = Math.ceil(total / limitNum)
diff --git a/server/api/admin/users/index.post.ts b/server/api/admin/users/index.post.ts
index dd11826..de23c11 100644
--- a/server/api/admin/users/index.post.ts
+++ b/server/api/admin/users/index.post.ts
@@ -2,6 +2,7 @@ import bcrypt from 'bcryptjs'
 import { db } from '~/drizzle/db'
 import { users } from '~/drizzle/schema'
 import { eq } from 'drizzle-orm'
+import { getRoleLevel, isRoleHigher, canManageUserRole } from '~~/server/utils/permissions.js'
 
 export default defineEventHandler(async (event) => {
   // 检查认证和权限
@@ -51,31 +52,21 @@ export default defineEventHandler(async (event) => {
     // 加密密码
     const hashedPassword = await bcrypt.hash(body.password, 10)
 
-    // 角色权限控制
+    // 角色权限控制（统一使用 canManageUserRole 数值化级别检查）
     let validRole = 'USER'
-    if (body.role && ['USER', 'TEACHER', 'ADMIN', 'SONG_ADMIN', 'SUPER_ADMIN'].includes(body.role)) {
-      // 超级管理员可以创建任何角色的用户
-      if (user.role === 'SUPER_ADMIN') {
-        validRole = body.role
-      }
-      // 管理员只能创建管理员以下的角色（USER, SONG_ADMIN）
-      else if (user.role === 'ADMIN') {
-        if (['USER', 'TEACHER', 'SONG_ADMIN'].includes(body.role)) {
-          validRole = body.role
-        } else {
-          throw createError({
-            statusCode: 403,
-            message: '管理员只能创建用户、教师和歌曲管理员角色'
-          })
-        }
-      }
-      // 其他角色不能创建用户
-      else {
+    const requestedRole = body.role
+    if (requestedRole) {
+      if (!canManageUserRole(user, requestedRole)) {
+        const currentLevel = getRoleLevel(user.role)
+        const targetLevel = getRoleLevel(requestedRole)
         throw createError({
           statusCode: 403,
-          message: '没有权限创建用户'
+          message: isRoleHigher(requestedRole, user.role) || currentLevel <= targetLevel
+            ? `权限不足：${user.role} 无法创建级别高于或等于自身的角色（${requestedRole}）`
+            : `没有权限创建 ${requestedRole} 角色的用户`
         })
       }
+      validRole = requestedRole
     }
 
     // 状态验证
diff --git a/server/utils/permissions.js b/server/utils/permissions.js
index a7830fd..2a3ac1e 100644
--- a/server/utils/permissions.js
+++ b/server/utils/permissions.js
@@ -85,18 +85,113 @@ function getRoleInfo(roleName) {
   return ROLES[roleName] || null
 }
 
-// 检查用户是否可以管理其他用户角色
-function canManageUserRole(currentUser, targetRole) {
-  if (!currentUser || !currentUser.role) return false
+const ROLE_LEVELS = {
+  SUPER_ADMIN: 100,
+  ADMIN: 80,
+  MINISTER: 80,
+  VICE_MINISTER: 70,
+  SONG_ADMIN: 60,
+  STAFF: 60,
+  RESIDENT: 50,
+  TEACHER: 40,
+  USER: 10
+}
+
+export function getRoleLevel(roleName) {
+  if (!roleName) return 0
+  const upperRole = String(roleName).toUpperCase()
+  return ROLE_LEVELS[upperRole] ?? 0
+}
+
+export function isRoleHigherOrEqual(currentRole, targetRole) {
+  return getRoleLevel(currentRole) >= getRoleLevel(targetRole)
+}
+
+export function isRoleHigher(currentRole, targetRole) {
+  return getRoleLevel(currentRole) > getRoleLevel(targetRole)
+}
+
+function canResetPasswordFor(currentUser, targetUser) {
+  if (!currentUser || !currentUser.role || !targetUser) return false
+
+  const currentLevel = getRoleLevel(currentUser.role)
+  const targetLevel = getRoleLevel(targetUser.role)
 
-  // 只有超级管理员可以分配角色
   if (currentUser.role === 'SUPER_ADMIN') {
-    // 超级管理员可以分配除自己以外的所有角色
-    return Object.keys(ROLES).includes(targetRole) && targetRole !== 'SUPER_ADMIN'
+    return true
+  }
+
+  if (currentUser.role === 'ADMIN' || currentUser.role === 'MINISTER') {
+    return targetLevel <= getRoleLevel('USER')
   }
 
   return false
 }
 
+function canChangeRoleOf(currentUser, targetUser, newRole) {
+  if (!currentUser || !currentUser.role || !targetUser) return false
+
+  const currentLevel = getRoleLevel(currentUser.role)
+  const targetLevel = getRoleLevel(targetUser.role)
+  const newRoleLevel = getRoleLevel(newRole)
+
+  if (String(currentUser.id) === String(targetUser.id)) {
+    return false
+  }
+
+  if (currentUser.role === 'SUPER_ADMIN') {
+    if (targetUser.id === 1) return false
+    return newRoleLevel <= currentLevel
+  }
+
+  if (currentLevel < targetLevel) {
+    return false
+  }
+
+  if (newRoleLevel >= currentLevel) {
+    return false
+  }
+
+  return true
+}
+
+function canDeleteUser(currentUser, targetUser) {
+  if (!currentUser || !currentUser.role || !targetUser) return false
+
+  if (String(currentUser.id) === String(targetUser.id)) {
+    return false
+  }
+
+  if (targetUser.id === 1) {
+    return false
+  }
+
+  const currentLevel = getRoleLevel(currentUser.role)
+  const targetLevel = getRoleLevel(targetUser.role)
+
+  return currentLevel > targetLevel
+}
+
+function canManageUserRole(currentUser, targetRole) {
+  if (!currentUser || !currentUser.role) return false
+
+  if (currentUser.role === 'SUPER_ADMIN') {
+    return Object.keys(ROLES).includes(targetRole) && targetRole !== 'SUPER_ADMIN'
+  }
+
+  const currentLevel = getRoleLevel(currentUser.role)
+  const targetLevel = getRoleLevel(targetRole)
+  return targetLevel < currentLevel
+}
+
 // 导出所有函数和常量
-export { canAccessAdmin, canAccessPage, getUserPages, getRoleInfo, canManageUserRole }
+export {
+  canAccessAdmin,
+  canAccessPage,
+  getUserPages,
+  getRoleInfo,
+  canManageUserRole,
+  canResetPasswordFor,
+  canChangeRoleOf,
+  canDeleteUser
+}
diff --git a/server/utils/user-avatar.ts b/server/utils/user-avatar.ts
index de76771..9cf6fc3 100644
--- a/server/utils/user-avatar.ts
+++ b/server/utils/user-avatar.ts
@@ -1,6 +1,10 @@
 interface AvatarUserState {
   avatarProvider?: string | null
   avatarProviderUserId?: string | null
+  email?: string | null
+  username?: string | null
+  name?: string | null
+  id?: string | number | null
 }
 
 interface IdentityRow {
@@ -8,6 +12,7 @@ interface IdentityRow {
   providerUserId: string
   avatar?: string | null
   createdAt: Date | string
+  providerUsername?: string | null
 }
 
 export interface AvatarSource {
@@ -43,3 +48,75 @@ export function resolveAvatarSource(
 
   return null
 }
+
+function md5Hash(str: string): string {
+  let hash = 0
+  for (let i = 0; i < str.length; i++) {
+    const char = str.charCodeAt(i)
+    hash = ((hash << 5) - hash) + char
+    hash = hash & hash
+  }
+  return Math.abs(hash).toString(16).padStart(8, '0') + Math.abs(hash * 7).toString(16).padStart(8, '0') +
+         Math.abs(hash * 13).toString(16).padStart(8, '0') + Math.abs(hash * 17).toString(16).padStart(8, '0')
+}
+
+export function generateGravatarUrl(email?: string | null): string | null {
+  if (!email) return null
+  const normalizedEmail = email.trim().toLowerCase()
+  const hash = md5Hash(normalizedEmail)
+  return `https://www.gravatar.com/avatar/${hash}?d=404&s=128`
+}
+
+export function generateDiceBearUrl(seed: string): string {
+  const encodedSeed = encodeURIComponent(seed || 'user')
+  return `https://api.dicebear.com/7.x/initials/svg?seed=${encodedSeed}&backgroundType=gradientLinear&fontSize=40&fontWeight=700`
+}
+
+export function buildAvatarFromSource(source: AvatarSource | null, identities: IdentityRow[] = []): string | null {
+  if (!source || !source.provider) return null
+
+  const identity = identities.find(
+    (id) => id.provider === source.provider && id.providerUserId === source.providerUserId
+  )
+
+  if (identity?.avatar) {
+    return identity.avatar
+  }
+
+  switch (source.provider.toLowerCase()) {
+    case 'github':
+      if (identity?.providerUsername) {
+        return `https://github.com/${identity.providerUsername}.png?size=128`
+      }
+      if (source.providerUserId) {
+        return `https://avatars.githubusercontent.com/u/${source.providerUserId}?size=128`
+      }
+      return null
+    case 'google':
+      return null
+    case 'casdoor':
+      return null
+    default:
+      return null
+  }
+}
+
+export function getUserAvatarUrl(
+  user: AvatarUserState,
+  identities: IdentityRow[] = []
+): string {
+  try {
+    const source = resolveAvatarSource(user, identities)
+    const sourceAvatar = source ? buildAvatarFromSource(source, identities) : null
+    if (sourceAvatar) return sourceAvatar
+
+    const gravatar = generateGravatarUrl(user.email)
+    if (gravatar) return gravatar
+
+    const seed = (user.name || user.username || user.id?.toString() || 'User')
+    return generateDiceBearUrl(seed)
+  } catch {
+    const seed = (user?.name || user?.username || user?.id?.toString() || 'User')
+    return generateDiceBearUrl(seed)
+  }
+}