feat: 😀禁止越权增加超管、系统管理账户

Admin.NET/Admin.NET.Core/Enum/ErrorCodeEnum.cs

@@ -235,6 +235,12 @@ public enum ErrorCodeEnum
     [ErrorCodeItemMetadata("禁止注册超级管理员和系统管理员")]
     D1037,
 
+    /// <summary>
+    /// 禁止越权操作系统账户
+    /// </summary>
+    [ErrorCodeItemMetadata("禁止越权操作系统账户")]
+    D1038,
+
     /// <summary>
     /// 父机构不存在
     /// </summary>

Admin.NET/Admin.NET.Core/Service/User/SysUserService.cs

@@ -107,6 +107,9 @@ public class SysUserService : IDynamicApiController, ITransient
         if (await query.AnyAsync(u => u.Account == input.Account)) throw Oops.Oh(ErrorCodeEnum.D1003);
         if (!string.IsNullOrWhiteSpace(input.Phone) && await query.AnyAsync(u => u.Phone == input.Phone)) throw Oops.Oh(ErrorCodeEnum.D1032);
 
+        // 禁止越权新增超级管理员和系统管理员
+        if (_userManager.AccountType != AccountTypeEnum.SuperAdmin && input.AccountType is AccountTypeEnum.SuperAdmin or AccountTypeEnum.SysAdmin) throw Oops.Oh(ErrorCodeEnum.D1038);
+
         var password = await _sysConfigService.GetConfigValue<string>(ConfigConst.SysPassword);
 
         var user = input.Adapt<SysUser>();
@@ -143,6 +146,9 @@ public class SysUserService : IDynamicApiController, ITransient
         if (await query.AnyAsync(u => u.Account == input.Account)) throw Oops.Oh(ErrorCodeEnum.D1003);
         if (!string.IsNullOrWhiteSpace(input.Phone) && await query.AnyAsync(u => u.Phone == input.Phone)) throw Oops.Oh(ErrorCodeEnum.D1032);
 
+        // 禁止越权注册
+        if (input.AccountType is AccountTypeEnum.SuperAdmin or AccountTypeEnum.SysAdmin) throw Oops.Oh(ErrorCodeEnum.D1038);
+
         if (string.IsNullOrWhiteSpace(input.Password))
         {
             var password = await _sysConfigService.GetConfigValue<string>(ConfigConst.SysPassword);
@@ -186,6 +192,9 @@ public class SysUserService : IDynamicApiController, ITransient
         if (await query.AnyAsync(u => u.Account == input.Account)) throw Oops.Oh(ErrorCodeEnum.D1003);
         if (!string.IsNullOrWhiteSpace(input.Phone) && await query.AnyAsync(u => u.Phone == input.Phone)) throw Oops.Oh(ErrorCodeEnum.D1032);
 
+        // 禁止越权更新超级管理员或系统管理员信息
+        if (_userManager.AccountType != AccountTypeEnum.SuperAdmin && input.AccountType is AccountTypeEnum.SuperAdmin or AccountTypeEnum.SysAdmin) throw Oops.Oh(ErrorCodeEnum.D1038);
+
         await _sysUserRep.AsUpdateable(input.Adapt<SysUser>()).IgnoreColumns(true)
             .IgnoreColumns(u => new { u.Password, u.Status, u.TenantId }).ExecuteCommandAsync();
 

Web/src/views/system/user/component/editUser.vue

@@ -35,7 +35,7 @@
 								<el-form-item label="账号类型" prop="accountType" :rules="[{ required: true, message: '账号类型不能为空', trigger: 'blur' }]">
 									<g-sys-dict
 										v-model="state.ruleForm.accountType"
-										:on-item-filter="(data: any) => data.name != 'SuperAdmin' && (data.name == 'SysAdmin' ? [888, 999].includes(userInfos.accountType) : true)"
+										:on-item-filter="(data: any) => data.name != 'SuperAdmin' && (data.name == 'SysAdmin' ? AccountTypeEnum.NUMBER_999 == userInfos.accountType : true)"
 										code="AccountTypeEnum"
 										render-as="select"
 									/>
@@ -225,7 +225,7 @@ import { storeToRefs } from 'pinia';
 import { useUserInfo } from '/@/stores/userInfo';
 import { getAPI } from '/@/utils/axios-utils';
 import { SysPosApi, SysRoleApi, SysUserApi } from '/@/api-services/api';
-import { RoleOutput, SysOrg, SysPos, UpdateUserInput } from '/@/api-services/models';
+import {AccountTypeEnum, RoleOutput, SysOrg, SysPos, UpdateUserInput} from '/@/api-services/models';
 
 const props = defineProps({
 	title: String,