feat(admin): 优化用户权限分级·统一头像·数据分析面板修复

- fix(DataAnalysisPanel): 活跃用户卡片固定 400px + overflow-y 独立滚动容器，底部渐变遮罩提示滚动；列表项 tooltip 增加 max-height 与 overflow 截断；新增圆形头像显示与 @error 回退首字母
- feat(admin): 新增 getUserAvatarUrl 统一头像策略链（OAuth identity→Gravatar→DiceBear 7.x initials），stats/realtime、active-users、users/index 三处接口返回 avatarUrl
- fix(admin): 建立 SUPER_ADMIN(100)>ADMIN(80)>USER(10) 分级常量与 canChangeRoleOf/canResetPasswordFor 等谓词；reset-password、[id].put、index.post 全面应用级别守卫；前端 UserManager 按钮按权限禁用、availableRoles 按操作者级别过滤 SUPER_ADMIN/ADMIN 等高角色

server/api/admin/stats/realtime.get.ts

@@ -1,12 +1,24 @@
 import { createError, defineEventHandler } from 'h3'
 import { db } from '~/drizzle/db'
 import { CacheService } from '../../../services/cacheService'
-import { songs, users, votes } from '~/drizzle/schema'
-import { count, eq, gte } from 'drizzle-orm'
+import { songs, users, votes, userIdentities } from '~/drizzle/schema'
+import { count, eq, gte, inArray } from 'drizzle-orm'
 import { getBeijingHour, getBeijingStartOfDay } from '~/utils/timeUtils'
+import { getUserAvatarUrl } from '../../../utils/user-avatar'
+
+function formatRelativeTime(date: Date | null | undefined): string {
+  if (!date) return '未知'
+  const now = new Date()
+  const diff = now.getTime() - new Date(date).getTime()
+  const minutes = Math.floor(diff / 60000)
+  if (minutes < 1) return '刚刚'
+  if (minutes < 60) return `${minutes}分钟前`
+  const hours = Math.floor(minutes / 60)
+  if (hours < 24) return `${hours}小时前`
+  return `${Math.floor(hours / 24)}天前`
+}
 
 export default defineEventHandler(async (event) => {
-  // 检查认证和权限
   const user = event.context.user
   if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
     throw createError({
@@ -16,97 +28,172 @@ export default defineEventHandler(async (event) => {
   }
 
   try {
-    // 尝试从缓存获取数据
     const cacheService = CacheService.getInstance()
     const cachedStats = await cacheService.getRealtimeStats()
     if (cachedStats) {
       console.log('[Cache] 实时统计数据缓存命中')
       return cachedStats
     }
-    // 获取当前时间相关的日期
     const now = new Date()
-    const today = getBeijingStartOfDay() // 使用北京时间的一天开始
+    const today = getBeijingStartOfDay()
     const oneHourAgo = new Date(now.getTime() - 60 * 60 * 1000)
     const oneDayAgo = new Date(now.getTime() - 24 * 60 * 60 * 1000)
 
-    // 并行获取实时统计数据
     const [activeUsersData, todayRequests, popularGenres, peakHours] = await Promise.all([
-      // 活跃用户数和用户列表 (最近1小时点歌、登录或点赞的用户)
       (async () => {
         try {
-          // 获取最近1小时内点歌的用户
           const recentSongUsers = await db
             .select({
               requesterId: songs.requesterId,
               requesterName: users.name,
               requesterUsername: users.username,
-              requesterId2: users.id
+              requesterId2: users.id,
+              requesterLastActive: songs.createdAt,
+              requesterAvatarProvider: users.avatarProvider,
+              requesterAvatarProviderUserId: users.avatarProviderUserId,
+              requesterEmail: users.email
             })
             .from(songs)
             .innerJoin(users, eq(songs.requesterId, users.id))
             .where(gte(songs.createdAt, oneHourAgo))
-            .groupBy(songs.requesterId, users.id, users.name, users.username)
+            .groupBy(songs.requesterId, users.id, users.name, users.username, users.lastLogin, users.avatarProvider, users.avatarProviderUserId, users.email, songs.createdAt)
 
-          // 获取最近1小时内登录的用户
           const recentLoginUsers = await db
             .select({
               id: users.id,
               username: users.username,
-              name: users.name
+              name: users.name,
+              lastLogin: users.lastLogin,
+              avatarProvider: users.avatarProvider,
+              avatarProviderUserId: users.avatarProviderUserId,
+              email: users.email
             })
             .from(users)
             .where(gte(users.lastLogin, oneHourAgo))
 
-          // 获取最近1小时内点赞过歌曲的用户
           const recentVoteUsers = await db
             .select({
               userId: votes.userId,
               userName: users.name,
               userUsername: users.username,
-              userId2: users.id
+              userId2: users.id,
+              voteCreatedAt: votes.createdAt,
+              userAvatarProvider: users.avatarProvider,
+              userAvatarProviderUserId: users.avatarProviderUserId,
+              userEmail: users.email
             })
             .from(votes)
             .innerJoin(users, eq(votes.userId, users.id))
             .where(gte(votes.createdAt, oneHourAgo))
-            .groupBy(votes.userId, users.id, users.name, users.username)
+            .groupBy(votes.userId, users.id, users.name, users.username, users.avatarProvider, users.avatarProviderUserId, users.email, votes.createdAt)
 
-          // 合并并去重用户列表
-          const userMap = new Map()
+          const userMap = new Map<number, any>()
 
-          // 添加点歌用户
           recentSongUsers.forEach((song) => {
-            userMap.set(song.requesterId2, {
-              id: song.requesterId2,
+            const id = song.requesterId2
+            const existing = userMap.get(id)
+            const lastActive = existing?.lastActive
+              ? new Date(existing.lastActive) > new Date(song.requesterLastActive)
+                ? existing.lastActive
+                : song.requesterLastActive
+              : song.requesterLastActive
+            userMap.set(id, {
+              id,
               username: song.requesterUsername,
-              name: song.requesterName
+              name: song.requesterName,
+              email: song.requesterEmail,
+              avatarProvider: song.requesterAvatarProvider,
+              avatarProviderUserId: song.requesterAvatarProviderUserId,
+              lastActive
             })
           })
 
-          // 添加登录用户
-          recentLoginUsers.forEach((user) => {
-            userMap.set(user.id, {
-              id: user.id,
-              username: user.username,
-              name: user.name
+          recentLoginUsers.forEach((u) => {
+            const existing = userMap.get(u.id)
+            const lastActive = existing?.lastActive
+              ? new Date(existing.lastActive) > new Date(u.lastLogin)
+                ? existing.lastActive
+                : u.lastLogin
+              : u.lastLogin
+            userMap.set(u.id, {
+              id: u.id,
+              username: u.username,
+              name: u.name,
+              email: u.email,
+              avatarProvider: u.avatarProvider,
+              avatarProviderUserId: u.avatarProviderUserId,
+              lastActive
             })
           })
 
-          // 添加点赞用户
           recentVoteUsers.forEach((vote) => {
-            userMap.set(vote.userId2, {
-              id: vote.userId2,
+            const id = vote.userId2
+            const existing = userMap.get(id)
+            const lastActive = existing?.lastActive
+              ? new Date(existing.lastActive) > new Date(vote.voteCreatedAt)
+                ? existing.lastActive
+                : vote.voteCreatedAt
+              : vote.voteCreatedAt
+            userMap.set(id, {
+              id,
               username: vote.userUsername,
-              name: vote.userName
+              name: vote.userName,
+              email: vote.userEmail,
+              avatarProvider: vote.userAvatarProvider,
+              avatarProviderUserId: vote.userAvatarProviderUserId,
+              lastActive
             })
           })
 
-          const activeUsersList = Array.from(userMap.values())
+          const userIds = Array.from(userMap.keys())
+          let identitiesData: any[] = []
+          if (userIds.length > 0) {
+            try {
+              identitiesData = await db
+                .select()
+                .from(userIdentities)
+                .where(inArray(userIdentities.userId, userIds))
+            } catch (e) {
+              identitiesData = []
+            }
+          }
+
+          const identitiesMap = new Map<number, any[]>()
+          identitiesData.forEach((identity) => {
+            if (!identitiesMap.has(identity.userId)) {
+              identitiesMap.set(identity.userId, [])
+            }
+            identitiesMap.get(identity.userId)!.push(identity)
+          })
+
+          const activeUsersList = Array.from(userMap.values()).map((u) => {
+            const userIdentitiesData = identitiesMap.get(u.id) || []
+            const avatarUrl = getUserAvatarUrl(
+              {
+                id: u.id,
+                name: u.name,
+                username: u.username,
+                email: u.email,
+                avatarProvider: u.avatarProvider,
+                avatarProviderUserId: u.avatarProviderUserId
+              },
+              userIdentitiesData
+            )
+            return {
+              id: u.id,
+              username: u.username,
+              name: u.name,
+              avatarUrl,
+              lastActive: formatRelativeTime(u.lastActive)
+            }
+          })
 
           return {
             count: activeUsersList.length,
             users: activeUsersList
           }
         } catch (error) {
+          console.error('[Realtime] 获取活跃用户失败:', error)
           return {
             count: 0,
             users: []
@@ -114,7 +201,6 @@ export default defineEventHandler(async (event) => {
         }
       })(),
 
-      // 今日点歌数
       (async () => {
         try {
           const todayCountResult = await db
@@ -127,12 +213,10 @@ export default defineEventHandler(async (event) => {
         }
       })(),
 
-      // 热门流派 (Song模型中没有genre字段，返回空数组)
       (async () => {
         return []
       })(),
 
-      // 高峰时段 (最近7天的小时统计)
       (async () => {
         try {
           const sevenDaysAgo = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000)
@@ -143,7 +227,6 @@ export default defineEventHandler(async (event) => {
             .from(songs)
             .where(gte(songs.createdAt, sevenDaysAgo))
 
-          // 按小时统计
           const hourCount = songsData.reduce(
             (acc, song) => {
               const hour = getBeijingHour(song.createdAt)
@@ -153,7 +236,6 @@ export default defineEventHandler(async (event) => {
             {} as Record<number, number>
           )
 
-          // 返回前3个高峰时段
           return Object.entries(hourCount)
             .sort(([, a], [, b]) => b - a)
             .slice(0, 3)
@@ -177,12 +259,12 @@ export default defineEventHandler(async (event) => {
       timestamp: now.toISOString()
     }
 
-    // 缓存结果
     await cacheService.setRealtimeStats(result)
     console.log('[Cache] 实时统计数据已缓存')
 
     return result
   } catch (error) {
+    console.error('[Realtime] 获取失败:', error)
     throw createError({
       statusCode: 500,
       message: '获取实时统计数据失败'