From b7e617cd0dfae748b9620a0fac51cc327510b40d Mon Sep 17 00:00:00 2001
From: selfrelease <freedak.ipad@gmail.com>
Date: Wed, 29 Jul 2026 12:01:14 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BC=81=E4=B8=9A=E7=99=BB=E5=BD=95?=
 =?UTF-8?q?=E6=8B=92=E7=BB=9D=20SUPER=5FADMIN=20+=20authMiddleware=20?=
 =?UTF-8?q?=E6=A0=A1=E9=AA=8C=20orgId=20=E9=9D=9E=E7=A9=BA=EF=BC=8C?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20500=20=E9=94=99=E8=AF=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/src/middleware/auth.ts       | 4 ++++
 backend/src/services/auth.service.ts | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/backend/src/middleware/auth.ts b/backend/src/middleware/auth.ts
index 2f7d62b..f5caa32 100644
--- a/backend/src/middleware/auth.ts
+++ b/backend/src/middleware/auth.ts
@@ -17,6 +17,10 @@ export function authMiddleware(req: AuthRequest, res: Response, next: NextFuncti
     return res.status(401).json({ success: false, error: { code: 'TOKEN_INVALID', message: '令牌无效或已过期' } })
   }
   req.user = payload
+  // 非 SUPER_ADMIN 用户必须有 orgId，否则企业端 API 会因 orgId=null 报错
+  if (payload.role !== 'SUPER_ADMIN' && !payload.orgId) {
+    return res.status(403).json({ success: false, error: { code: 'NO_ORG', message: '该账号未绑定企业' } })
+  }
   next()
 }
 
diff --git a/backend/src/services/auth.service.ts b/backend/src/services/auth.service.ts
index 7f9503f..378b363 100644
--- a/backend/src/services/auth.service.ts
+++ b/backend/src/services/auth.service.ts
@@ -94,6 +94,10 @@ export async function login(phone: string, password: string) {
     throw { code: 'ACCOUNT_DISABLED', message: '该账号已被禁用，请联系管理员' }
   }
 
+  if (user.role === 'SUPER_ADMIN') {
+    throw { code: 'FORBIDDEN', message: '平台管理员请使用平台管理入口登录' }
+  }
+
   await prisma.user.update({
     where: { id: user.id },
     data: { lastLoginAt: new Date() },