feat(admin): 优化用户权限分级·统一头像·数据分析面板修复

- fix(DataAnalysisPanel): 活跃用户卡片固定 400px + overflow-y 独立滚动容器，底部渐变遮罩提示滚动；列表项 tooltip 增加 max-height 与 overflow 截断；新增圆形头像显示与 @error 回退首字母
- feat(admin): 新增 getUserAvatarUrl 统一头像策略链（OAuth identity→Gravatar→DiceBear 7.x initials），stats/realtime、active-users、users/index 三处接口返回 avatarUrl
- fix(admin): 建立 SUPER_ADMIN(100)>ADMIN(80)>USER(10) 分级常量与 canChangeRoleOf/canResetPasswordFor 等谓词；reset-password、[id].put、index.post 全面应用级别守卫；前端 UserManager 按钮按权限禁用、availableRoles 按操作者级别过滤 SUPER_ADMIN/ADMIN 等高角色

server/api/admin/stats/active-users.get.ts

@@ -1,10 +1,10 @@
 import { createError, defineEventHandler, getQuery } from 'h3'
 import { db } from '~/drizzle/db'
-import { songs, users, votes } from '~/drizzle/schema'
+import { songs, users, votes, userIdentities } from '~/drizzle/schema'
 import { CacheService } from '../../../services/cacheService'
+import { getUserAvatarUrl } from '../../../utils/user-avatar'
 
 export default defineEventHandler(async (event) => {
-  // 检查认证和权限
   const user = event.context.user
   if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
     throw createError({
@@ -18,7 +18,6 @@ export default defineEventHandler(async (event) => {
   const limit = parseInt(query.limit as string) || 20
 
   try {
-    // 尝试从缓存获取数据
     const cacheService = CacheService.getInstance()
     const cachedStats = await cacheService.getActiveUsersStats(semester, limit)
     if (cachedStats) {
@@ -26,18 +25,24 @@ export default defineEventHandler(async (event) => {
       return cachedStats
     }
 
-    // 构建查询条件 - 如果没有指定学期或学期为'all'，查询所有用户
     let songWhere = {}
     if (semester && semester !== 'all') {
       songWhere = { semester: semester }
     }
 
-    // 获取活跃用户数据 - 有投稿歌曲的用户
     const allUsers = await db.select().from(users)
     const allSongs = await db.select().from(songs)
     const allVotes = await db.select().from(votes)
+    const allIdentities = await db.select().from(userIdentities)
+
+    const identitiesMap = new Map<number, typeof allIdentities>()
+    allIdentities.forEach((identity) => {
+      if (!identitiesMap.has(identity.userId)) {
+        identitiesMap.set(identity.userId, [])
+      }
+      identitiesMap.get(identity.userId)!.push(identity)
+    })
 
-    // 过滤有投稿歌曲的用户
     const activeUsers = allUsers
       .filter((user) => {
         const userSongs = allSongs.filter((song) => {
@@ -65,44 +70,48 @@ export default defineEventHandler(async (event) => {
         }
       })
 
-    // 如果没有活跃用户，返回空数组
     if (activeUsers.length === 0) {
       const emptyResult = []
-      // 缓存空结果
       await cacheService.setActiveUsersStats(semester, limit, emptyResult)
       console.log('[Cache] 活跃用户统计数据已缓存（空结果）')
       return emptyResult
     }
 
-    // 计算每个用户的活跃度数据
     const userStats = activeUsers.map((user) => {
       const contributions = user.songs.length
       const likes = user.songs.reduce((total, song) => total + song.votes.length, 0)
-
-      // 活跃度计算：投稿数 * 2 + 点赞数 * 0.5
       const activityScore = Math.round(contributions * 2 + likes * 0.5)
+      const userIdentitiesData = identitiesMap.get(user.id) || []
+      const avatarUrl = getUserAvatarUrl(
+        {
+          id: user.id,
+          name: user.name,
+          username: user.username,
+          email: user.email,
+          avatarProvider: user.avatarProvider,
+          avatarProviderUserId: user.avatarProviderUserId
+        },
+        userIdentitiesData
+      )
 
-      const userStat = {
+      return {
         id: user.id,
-        name: user.name || user.username, // 优先显示真实姓名，如果没有则显示登录名
+        name: user.name || user.username,
         contributions,
         likes,
-        activityScore
+        activityScore,
+        avatarUrl
       }
-
-      return userStat
     })
 
-    // 按活跃度分数降序排列并限制数量
     const sortedUsers = userStats.sort((a, b) => b.activityScore - a.activityScore).slice(0, limit)
 
-    // 缓存结果
     await cacheService.setActiveUsersStats(semester, limit, sortedUsers)
     console.log('[Cache] 活跃用户统计数据已缓存')
 
     return sortedUsers
   } catch (error) {
-    // 返回空数组而不是抛出错误，避免前端显示错误
+    console.error('[Stats] 获取活跃用户失败:', error)
     return []
   }
 })

server/api/admin/stats/realtime.get.ts

@@ -1,12 +1,24 @@
 import { createError, defineEventHandler } from 'h3'
 import { db } from '~/drizzle/db'
 import { CacheService } from '../../../services/cacheService'
-import { songs, users, votes } from '~/drizzle/schema'
-import { count, eq, gte } from 'drizzle-orm'
+import { songs, users, votes, userIdentities } from '~/drizzle/schema'
+import { count, eq, gte, inArray } from 'drizzle-orm'
 import { getBeijingHour, getBeijingStartOfDay } from '~/utils/timeUtils'
+import { getUserAvatarUrl } from '../../../utils/user-avatar'
+
+function formatRelativeTime(date: Date | null | undefined): string {
+  if (!date) return '未知'
+  const now = new Date()
+  const diff = now.getTime() - new Date(date).getTime()
+  const minutes = Math.floor(diff / 60000)
+  if (minutes < 1) return '刚刚'
+  if (minutes < 60) return `${minutes}分钟前`
+  const hours = Math.floor(minutes / 60)
+  if (hours < 24) return `${hours}小时前`
+  return `${Math.floor(hours / 24)}天前`
+}
 
 export default defineEventHandler(async (event) => {
-  // 检查认证和权限
   const user = event.context.user
   if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
     throw createError({
@@ -16,97 +28,172 @@ export default defineEventHandler(async (event) => {
   }
 
   try {
-    // 尝试从缓存获取数据
     const cacheService = CacheService.getInstance()
     const cachedStats = await cacheService.getRealtimeStats()
     if (cachedStats) {
       console.log('[Cache] 实时统计数据缓存命中')
       return cachedStats
     }
-    // 获取当前时间相关的日期
     const now = new Date()
-    const today = getBeijingStartOfDay() // 使用北京时间的一天开始
+    const today = getBeijingStartOfDay()
     const oneHourAgo = new Date(now.getTime() - 60 * 60 * 1000)
     const oneDayAgo = new Date(now.getTime() - 24 * 60 * 60 * 1000)
 
-    // 并行获取实时统计数据
     const [activeUsersData, todayRequests, popularGenres, peakHours] = await Promise.all([
-      // 活跃用户数和用户列表 (最近1小时点歌、登录或点赞的用户)
       (async () => {
         try {
-          // 获取最近1小时内点歌的用户
           const recentSongUsers = await db
             .select({
               requesterId: songs.requesterId,
               requesterName: users.name,
               requesterUsername: users.username,
-              requesterId2: users.id
+              requesterId2: users.id,
+              requesterLastActive: songs.createdAt,
+              requesterAvatarProvider: users.avatarProvider,
+              requesterAvatarProviderUserId: users.avatarProviderUserId,
+              requesterEmail: users.email
             })
             .from(songs)
             .innerJoin(users, eq(songs.requesterId, users.id))
             .where(gte(songs.createdAt, oneHourAgo))
-            .groupBy(songs.requesterId, users.id, users.name, users.username)
+            .groupBy(songs.requesterId, users.id, users.name, users.username, users.lastLogin, users.avatarProvider, users.avatarProviderUserId, users.email, songs.createdAt)
 
-          // 获取最近1小时内登录的用户
           const recentLoginUsers = await db
             .select({
               id: users.id,
               username: users.username,
-              name: users.name
+              name: users.name,
+              lastLogin: users.lastLogin,
+              avatarProvider: users.avatarProvider,
+              avatarProviderUserId: users.avatarProviderUserId,
+              email: users.email
             })
             .from(users)
             .where(gte(users.lastLogin, oneHourAgo))
 
-          // 获取最近1小时内点赞过歌曲的用户
           const recentVoteUsers = await db
             .select({
               userId: votes.userId,
               userName: users.name,
               userUsername: users.username,
-              userId2: users.id
+              userId2: users.id,
+              voteCreatedAt: votes.createdAt,
+              userAvatarProvider: users.avatarProvider,
+              userAvatarProviderUserId: users.avatarProviderUserId,
+              userEmail: users.email
             })
             .from(votes)
             .innerJoin(users, eq(votes.userId, users.id))
             .where(gte(votes.createdAt, oneHourAgo))
-            .groupBy(votes.userId, users.id, users.name, users.username)
+            .groupBy(votes.userId, users.id, users.name, users.username, users.avatarProvider, users.avatarProviderUserId, users.email, votes.createdAt)
 
-          // 合并并去重用户列表
-          const userMap = new Map()
+          const userMap = new Map<number, any>()
 
-          // 添加点歌用户
           recentSongUsers.forEach((song) => {
-            userMap.set(song.requesterId2, {
-              id: song.requesterId2,
+            const id = song.requesterId2
+            const existing = userMap.get(id)
+            const lastActive = existing?.lastActive
+              ? new Date(existing.lastActive) > new Date(song.requesterLastActive)
+                ? existing.lastActive
+                : song.requesterLastActive
+              : song.requesterLastActive
+            userMap.set(id, {
+              id,
               username: song.requesterUsername,
-              name: song.requesterName
+              name: song.requesterName,
+              email: song.requesterEmail,
+              avatarProvider: song.requesterAvatarProvider,
+              avatarProviderUserId: song.requesterAvatarProviderUserId,
+              lastActive
             })
           })
 
-          // 添加登录用户
-          recentLoginUsers.forEach((user) => {
-            userMap.set(user.id, {
-              id: user.id,
-              username: user.username,
-              name: user.name
+          recentLoginUsers.forEach((u) => {
+            const existing = userMap.get(u.id)
+            const lastActive = existing?.lastActive
+              ? new Date(existing.lastActive) > new Date(u.lastLogin)
+                ? existing.lastActive
+                : u.lastLogin
+              : u.lastLogin
+            userMap.set(u.id, {
+              id: u.id,
+              username: u.username,
+              name: u.name,
+              email: u.email,
+              avatarProvider: u.avatarProvider,
+              avatarProviderUserId: u.avatarProviderUserId,
+              lastActive
             })
           })
 
-          // 添加点赞用户
           recentVoteUsers.forEach((vote) => {
-            userMap.set(vote.userId2, {
-              id: vote.userId2,
+            const id = vote.userId2
+            const existing = userMap.get(id)
+            const lastActive = existing?.lastActive
+              ? new Date(existing.lastActive) > new Date(vote.voteCreatedAt)
+                ? existing.lastActive
+                : vote.voteCreatedAt
+              : vote.voteCreatedAt
+            userMap.set(id, {
+              id,
               username: vote.userUsername,
-              name: vote.userName
+              name: vote.userName,
+              email: vote.userEmail,
+              avatarProvider: vote.userAvatarProvider,
+              avatarProviderUserId: vote.userAvatarProviderUserId,
+              lastActive
             })
           })
 
-          const activeUsersList = Array.from(userMap.values())
+          const userIds = Array.from(userMap.keys())
+          let identitiesData: any[] = []
+          if (userIds.length > 0) {
+            try {
+              identitiesData = await db
+                .select()
+                .from(userIdentities)
+                .where(inArray(userIdentities.userId, userIds))
+            } catch (e) {
+              identitiesData = []
+            }
+          }
+
+          const identitiesMap = new Map<number, any[]>()
+          identitiesData.forEach((identity) => {
+            if (!identitiesMap.has(identity.userId)) {
+              identitiesMap.set(identity.userId, [])
+            }
+            identitiesMap.get(identity.userId)!.push(identity)
+          })
+
+          const activeUsersList = Array.from(userMap.values()).map((u) => {
+            const userIdentitiesData = identitiesMap.get(u.id) || []
+            const avatarUrl = getUserAvatarUrl(
+              {
+                id: u.id,
+                name: u.name,
+                username: u.username,
+                email: u.email,
+                avatarProvider: u.avatarProvider,
+                avatarProviderUserId: u.avatarProviderUserId
+              },
+              userIdentitiesData
+            )
+            return {
+              id: u.id,
+              username: u.username,
+              name: u.name,
+              avatarUrl,
+              lastActive: formatRelativeTime(u.lastActive)
+            }
+          })
 
           return {
             count: activeUsersList.length,
             users: activeUsersList
           }
         } catch (error) {
+          console.error('[Realtime] 获取活跃用户失败:', error)
           return {
             count: 0,
             users: []
@@ -114,7 +201,6 @@ export default defineEventHandler(async (event) => {
         }
       })(),
 
-      // 今日点歌数
       (async () => {
         try {
           const todayCountResult = await db
@@ -127,12 +213,10 @@ export default defineEventHandler(async (event) => {
         }
       })(),
 
-      // 热门流派 (Song模型中没有genre字段，返回空数组)
       (async () => {
         return []
       })(),
 
-      // 高峰时段 (最近7天的小时统计)
       (async () => {
         try {
           const sevenDaysAgo = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000)
@@ -143,7 +227,6 @@ export default defineEventHandler(async (event) => {
             .from(songs)
             .where(gte(songs.createdAt, sevenDaysAgo))
 
-          // 按小时统计
           const hourCount = songsData.reduce(
             (acc, song) => {
               const hour = getBeijingHour(song.createdAt)
@@ -153,7 +236,6 @@ export default defineEventHandler(async (event) => {
             {} as Record<number, number>
           )
 
-          // 返回前3个高峰时段
           return Object.entries(hourCount)
             .sort(([, a], [, b]) => b - a)
             .slice(0, 3)
@@ -177,12 +259,12 @@ export default defineEventHandler(async (event) => {
       timestamp: now.toISOString()
     }
 
-    // 缓存结果
     await cacheService.setRealtimeStats(result)
     console.log('[Cache] 实时统计数据已缓存')
 
     return result
   } catch (error) {
+    console.error('[Realtime] 获取失败:', error)
     throw createError({
       statusCode: 500,
       message: '获取实时统计数据失败'