feat: 网关管理模块 + RBAC权限认证 + 组织架构 + 审计日志

- 网关管理：GatewayEntity/Service/Controller CRUD + 测试连接；设备 GatewayId 外键关联
- JWT 认证：登录签发 Token（权限编码写入 Claims）、RequirePermission 权限过滤器、CurrentUser 上下文
- RBAC：用户/角色/权限实体与 CRUD，预定义 4 角色 + 6 权限种子（admin/admin123）
- 组织架构：sys_org 固定层级树（公司/实验室/部门/班组白夜班），层级校验，用户挂 OrgId/岗位/技能标签
- 数据权限：角色 DataScope（全部/本组织及下级），用户列表按组织子树过滤
- 防锁死保护：禁止删/禁自己，保证至少一名活跃管理员，角色摘除 user:manage 前校验
- 审计日志：AuditRecorder 接入设备增删改/指令下发/登录登出/组织变更，AuditController 查询
- 设备指令下发按网关表取连接参数；设备列表支持 gatewayId/productId 筛选

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

IOT_API/Controllers/Config/GatewayController.cs

@@ -1,14 +1,95 @@
 using Microsoft.AspNetCore.Mvc;
+using Model;
+using Model.Dto.Config;
+using Service.Interface.Config;
+using SqlSugar;
+using WebAPI.Filters;
 
-namespace WebAPI.Controllers
+namespace WebAPI.Controllers.Config
 {
     /// <summary>
     /// 网关管理
     /// </summary>
     [ApiController]
     [Route("api/config/gateway")]
+    [RequirePermission("device:view")]
     public class GatewayController : ControllerBase
     {
-        // TODO: 实现 网关管理 相关接口
+        private readonly IGatewayService _gatewayService;
+
+        public GatewayController(IGatewayService gatewayService)
+        {
+            _gatewayService = gatewayService;
+        }
+
+        /// <summary>
+        /// 网关列表（分页）
+        /// </summary>
+        [HttpGet("list")]
+        public async Task<Result<List<GatewayDto>>> GetList([FromQuery] int pageIndex = 1, [FromQuery] int pageSize = 10,
+            [FromQuery] string? keyword = null, [FromQuery] int? protocolType = null)
+        {
+            var total = new RefAsync<int>();
+            var result = await _gatewayService.GetPagedAsync(pageIndex, pageSize, total, keyword, protocolType);
+            Response.Headers["X-Total-Count"] = total.Value.ToString();
+            return result;
+        }
+
+        /// <summary>
+        /// 网关详情
+        /// </summary>
+        [HttpGet("{id}")]
+        public async Task<Result<GatewayDto>> GetById(long id)
+        {
+            return await _gatewayService.GetByIdAsync(id);
+        }
+
+        /// <summary>
+        /// 新增网关（需 device:edit 权限）
+        /// </summary>
+        [HttpPost]
+        [RequirePermission("device:edit")]
+        public async Task<Result<GatewayDto>> Add([FromBody] GatewayDto dto)
+        {
+            return await _gatewayService.AddAsync(dto);
+        }
+
+        /// <summary>
+        /// 修改网关（需 device:edit 权限）
+        /// </summary>
+        [HttpPut]
+        [RequirePermission("device:edit")]
+        public async Task<Result<GatewayDto>> Update([FromBody] GatewayDto dto)
+        {
+            return await _gatewayService.UpdateAsync(dto);
+        }
+
+        /// <summary>
+        /// 删除网关（软删除，设备 GatewayId 置 0；需 device:edit 权限）
+        /// </summary>
+        [HttpDelete("{id}")]
+        [RequirePermission("device:edit")]
+        public async Task<Result> Delete(long id)
+        {
+            return await _gatewayService.DeleteAsync(id);
+        }
+
+        /// <summary>
+        /// 测试网关连接（TCP/串口尝试连接，更新在线状态）
+        /// </summary>
+        [HttpPost("{id}/test-connection")]
+        public async Task<Result<GatewayTestResultDto>> TestConnection(long id)
+        {
+            return await _gatewayService.TestConnectionAsync(id);
+        }
+
+        /// <summary>
+        /// 网关下拉选项（设备表单用）
+        /// </summary>
+        [HttpGet("options")]
+        public async Task<Result<List<GatewayOptionDto>>> GetOptions()
+        {
+            return await _gatewayService.GetOptionsAsync();
+        }
     }
 }

IOT_API/Controllers/Config/IotDeviceController.cs

@@ -4,6 +4,7 @@ using Model.Dto.Config;
 using Service.Interface.Config;
 using SqlSugar;
 using System.Threading.Tasks;
+using WebAPI.Filters;
 
 namespace WebAPI.Controllers
 {
@@ -12,6 +13,7 @@ namespace WebAPI.Controllers
     /// </summary>
     [ApiController]
     [Route("api/config/device")]
+    [RequirePermission("device:view")]
     public class IotDeviceController : ControllerBase
     {
         private readonly IDeviceService _deviceService;
@@ -30,11 +32,12 @@ namespace WebAPI.Controllers
         /// <param name="pageSize">每页数量（默认10）</param>
         /// <param name="keyword">关键字（模糊匹配设备编号/名称/类型）</param>
         /// <param name="productId">所属产品Id（0 表示不过滤）</param>
+        /// <param name="gatewayId">所属网关Id（0 表示不过滤）</param>
         [HttpGet("list")]
-        public async Task<IActionResult> GetList(int pageIndex = 1, int pageSize = 10, string? keyword = null, long productId = 0)
+        public async Task<IActionResult> GetList(int pageIndex = 1, int pageSize = 10, string? keyword = null, long productId = 0, long gatewayId = 0)
         {
             RefAsync<int> total = 0;
-            var result = await _deviceService.GetPagedAsync(pageIndex, pageSize, total, keyword, productId > 0 ? productId : null);
+            var result = await _deviceService.GetPagedAsync(pageIndex, pageSize, total, keyword, productId > 0 ? productId : null, gatewayId > 0 ? gatewayId : null);
             Response.Headers["X-Total-Count"] = total.Value.ToString();
             return result.IsSuccess
                 ? Ok(Result<List<IotDeviceDto>>.Success(result.Data))
@@ -52,28 +55,31 @@ namespace WebAPI.Controllers
         }
 
         /// <summary>
-        /// 新增设备
+        /// 新增设备（需 device:edit 权限）
         /// </summary>
         [HttpPost]
+        [RequirePermission("device:edit")]
         public async Task<IActionResult> Add([FromBody] IotDeviceDto dto)
         {
             return Ok(await _deviceService.AddAsync(dto));
         }
 
         /// <summary>
-        /// 修改设备
+        /// 修改设备（需 device:edit 权限）
         /// </summary>
         [HttpPut]
+        [RequirePermission("device:edit")]
         public async Task<IActionResult> Update([FromBody] IotDeviceDto dto)
         {
             return Ok(await _deviceService.UpdateAsync(dto));
         }
 
         /// <summary>
-        /// 删除设备（软删除）
+        /// 删除设备（软删除；需 device:edit 权限）
         /// </summary>
         /// <param name="id">设备主键 Id</param>
         [HttpDelete("{id}")]
+        [RequirePermission("device:edit")]
         public async Task<IActionResult> Delete(long id)
         {
             return Ok(await _deviceService.DeleteAsync(id));
@@ -97,11 +103,12 @@ namespace WebAPI.Controllers
         }
 
         /// <summary>
-        /// 按物模型可写点向设备下发指令
+        /// 按物模型可写点向设备下发指令（需 device:control 权限）
         /// </summary>
         /// <param name="id">设备主键 Id</param>
         /// <param name="dto">指令请求（PointId 点Id + Value 工程值 + IsSimulated 是否模拟）</param>
         [HttpPost("{id}/command")]
+        [RequirePermission("device:control")]
         public async Task<IActionResult> SendCommand(long id, [FromBody] DeviceCommandDto dto)
         {
             if (dto == null)

IOT_API/Controllers/System/AuditController.cs

@@ -1,14 +1,43 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Model;
+using Model.Dto.System;
+using Service.Interface;
+using SqlSugar;
+using WebAPI.Filters;
 
 namespace WebAPI.Controllers
 {
     /// <summary>
-    /// 操作审计日志
+    /// 操作审计日志（满足实验室审计要求；需 user:manage 权限）
     /// </summary>
     [ApiController]
     [Route("api/system/audit")]
+    [RequirePermission("user:manage")]
     public class AuditController : ControllerBase
     {
-        // TODO: 实现 操作审计日志 相关接口
+        private readonly IAuditLogService _auditLogService;
+
+        public AuditController(IAuditLogService auditLogService)
+        {
+            _auditLogService = auditLogService;
+        }
+
+        /// <summary>
+        /// 审计日志列表（分页；筛选：操作人/描述关键字、操作类型、操作对象、时间段）
+        /// </summary>
+        [HttpGet("list")]
+        public async Task<IActionResult> GetList(int pageIndex = 1, int pageSize = 20,
+            string? keyword = null, string? operationType = null, string? operationTarget = null,
+            DateTime? startTime = null, DateTime? endTime = null)
+        {
+            RefAsync<int> total = 0;
+            var result = await _auditLogService.GetPagedAsync(pageIndex, pageSize, total,
+                keyword, operationType, operationTarget, startTime, endTime);
+            Response.Headers["X-Total-Count"] = total.Value.ToString();
+            return result.IsSuccess
+                ? Ok(Result<List<AuditLogDto>>.Success(result.Data))
+                : Ok(Result<List<AuditLogDto>>.Error(result.Msg));
+        }
     }
 }

IOT_API/Controllers/System/AuthController.cs

@@ -0,0 +1,65 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Model;
+using Model.Dto.System;
+using Service.Interface;
+using WebAPI.Filters;
+
+namespace WebAPI.Controllers
+{
+    /// <summary>
+    /// 认证授权（登录/登出/当前用户/改密）
+    /// </summary>
+    [ApiController]
+    [Route("api/system/auth")]
+    public class AuthController : ControllerBase
+    {
+        private readonly IAuthService _authService;
+
+        public AuthController(IAuthService authService)
+        {
+            _authService = authService;
+        }
+
+        /// <summary>
+        /// 登录（用户名+密码，成功返回 Token 与权限列表）
+        /// </summary>
+        [HttpPost("login")]
+        [AllowAnonymous]
+        public async Task<IActionResult> Login([FromBody] LoginDto dto)
+        {
+            var ip = HttpContext.Connection.RemoteIpAddress?.ToString();
+            return Ok(await _authService.LoginAsync(dto, ip));
+        }
+
+        /// <summary>
+        /// 退出登录（记录审计日志）
+        /// </summary>
+        [HttpPost("logout")]
+        [Authorize]
+        public async Task<IActionResult> Logout()
+        {
+            return Ok(await _authService.LogoutAsync());
+        }
+
+        /// <summary>
+        /// 当前登录用户信息 + 权限列表
+        /// </summary>
+        [HttpGet("me")]
+        [Authorize]
+        public async Task<IActionResult> Me()
+        {
+            return Ok(await _authService.GetMeAsync());
+        }
+
+        /// <summary>
+        /// 修改自己的密码
+        /// </summary>
+        [HttpPost("change-password")]
+        [Authorize]
+        public async Task<IActionResult> ChangePassword([FromBody] ChangePasswordDto dto)
+        {
+            return Ok(await _authService.ChangePasswordAsync(dto));
+        }
+    }
+}

IOT_API/Controllers/System/OrganizationController.cs

@@ -1,14 +1,69 @@
 using Microsoft.AspNetCore.Mvc;
+using Model;
+using Model.Dto.System;
+using Service.Interface;
+using WebAPI.Filters;
 
 namespace WebAPI.Controllers
 {
     /// <summary>
-    /// 组织架构管理
+    /// 组织架构管理（公司/实验室/部门/班组树；需 user:manage 权限）
     /// </summary>
     [ApiController]
     [Route("api/system/organization")]
+    [RequirePermission("user:manage")]
     public class OrganizationController : ControllerBase
     {
-        // TODO: 实现 组织架构管理 相关接口
+        private readonly IOrgService _orgService;
+
+        public OrganizationController(IOrgService orgService)
+        {
+            _orgService = orgService;
+        }
+
+        /// <summary>
+        /// 完整组织树（嵌套子级，含班组白/夜班）
+        /// </summary>
+        [HttpGet("tree")]
+        public async Task<IActionResult> GetTree()
+        {
+            return Ok(await _orgService.GetTreeAsync());
+        }
+
+        /// <summary>
+        /// 组织下拉选项（平铺）
+        /// </summary>
+        [HttpGet("options")]
+        public async Task<IActionResult> GetOptions()
+        {
+            return Ok(await _orgService.GetOptionsAsync());
+        }
+
+        /// <summary>
+        /// 新增组织节点（ParentId 传父级Id，根节点传 "0"）
+        /// </summary>
+        [HttpPost]
+        public async Task<IActionResult> Add([FromBody] OrgDto dto)
+        {
+            return Ok(await _orgService.AddAsync(dto));
+        }
+
+        /// <summary>
+        /// 修改组织节点
+        /// </summary>
+        [HttpPut]
+        public async Task<IActionResult> Update([FromBody] OrgDto dto)
+        {
+            return Ok(await _orgService.UpdateAsync(dto));
+        }
+
+        /// <summary>
+        /// 删除组织节点（有子级或挂靠用户时不可删）
+        /// </summary>
+        [HttpDelete("{id}")]
+        public async Task<IActionResult> Delete(long id)
+        {
+            return Ok(await _orgService.DeleteAsync(id));
+        }
     }
 }

IOT_API/Controllers/System/RoleController.cs

@@ -1,14 +1,103 @@
 using Microsoft.AspNetCore.Mvc;
+using Model;
+using Model.Dto.System;
+using Service.Interface;
+using SqlSugar;
+using WebAPI.Filters;
 
 namespace WebAPI.Controllers
 {
     /// <summary>
-    /// 角色权限管理
+    /// 角色权限管理（需 user:manage 权限）
     /// </summary>
     [ApiController]
     [Route("api/system/role")]
+    [RequirePermission("user:manage")]
     public class RoleController : ControllerBase
     {
-        // TODO: 实现 角色权限管理 相关接口
+        private readonly IRoleService _roleService;
+
+        public RoleController(IRoleService roleService)
+        {
+            _roleService = roleService;
+        }
+
+        /// <summary>
+        /// 角色列表（分页）
+        /// </summary>
+        [HttpGet("list")]
+        public async Task<IActionResult> GetList(int pageIndex = 1, int pageSize = 10, string? keyword = null)
+        {
+            RefAsync<int> total = 0;
+            var result = await _roleService.GetPagedAsync(pageIndex, pageSize, total, keyword);
+            Response.Headers["X-Total-Count"] = total.Value.ToString();
+            return result.IsSuccess
+                ? Ok(Result<List<RoleDto>>.Success(result.Data))
+                : Ok(Result<List<RoleDto>>.Error(result.Msg));
+        }
+
+        /// <summary>
+        /// 角色下拉选项
+        /// </summary>
+        [HttpGet("options")]
+        public async Task<IActionResult> GetOptions()
+        {
+            return Ok(await _roleService.GetOptionsAsync());
+        }
+
+        /// <summary>
+        /// 全部权限列表（分配权限用）
+        /// </summary>
+        [HttpGet("permissions")]
+        public async Task<IActionResult> GetPermissions()
+        {
+            return Ok(await _roleService.GetPermissionsAsync());
+        }
+
+        /// <summary>
+        /// 角色详情（含权限Id列表）
+        /// </summary>
+        [HttpGet("{id}")]
+        public async Task<IActionResult> GetById(long id)
+        {
+            return Ok(await _roleService.GetByIdAsync(id));
+        }
+
+        /// <summary>
+        /// 新增角色（PermissionIds 传权限）
+        /// </summary>
+        [HttpPost]
+        public async Task<IActionResult> Add([FromBody] RoleDto dto)
+        {
+            return Ok(await _roleService.AddAsync(dto));
+        }
+
+        /// <summary>
+        /// 修改角色（PermissionIds 传 null 不改权限）
+        /// </summary>
+        [HttpPut]
+        public async Task<IActionResult> Update([FromBody] RoleDto dto)
+        {
+            return Ok(await _roleService.UpdateAsync(dto));
+        }
+
+        /// <summary>
+        /// 删除角色（系统内置角色不可删）
+        /// </summary>
+        [HttpDelete("{id}")]
+        public async Task<IActionResult> Delete(long id)
+        {
+            return Ok(await _roleService.DeleteAsync(id));
+        }
+
+        /// <summary>
+        /// 分配权限（全量覆盖）
+        /// </summary>
+        [HttpPost("{id}/permissions")]
+        public async Task<IActionResult> AssignPermissions(long id, [FromBody] List<string> permissionIds)
+        {
+            var ids = permissionIds?.Select(long.Parse).Where(p => p > 0).ToList() ?? new List<long>();
+            return Ok(await _roleService.AssignPermissionsAsync(id, ids));
+        }
     }
 }

IOT_API/Controllers/System/UserController.cs

@@ -1,14 +1,124 @@
 using Microsoft.AspNetCore.Mvc;
+using Model;
+using Model.Dto.System;
+using Service.Interface;
+using SqlSugar;
+using WebAPI.Filters;
 
 namespace WebAPI.Controllers
 {
     /// <summary>
-    /// 用户管理
+    /// 用户管理（需 user:manage 权限）
     /// </summary>
     [ApiController]
     [Route("api/system/user")]
+    [RequirePermission("user:manage")]
     public class UserController : ControllerBase
     {
-        // TODO: 实现 用户管理 相关接口
+        private readonly IUserService _userService;
+
+        public UserController(IUserService userService)
+        {
+            _userService = userService;
+        }
+
+        /// <summary>
+        /// 用户列表（分页，关键字匹配用户名/姓名，可按角色、组织节点筛选；受数据范围约束）
+        /// </summary>
+        [HttpGet("list")]
+        public async Task<IActionResult> GetList(int pageIndex = 1, int pageSize = 10, string? keyword = null, long roleId = 0, long orgId = 0)
+        {
+            RefAsync<int> total = 0;
+            var result = await _userService.GetPagedAsync(pageIndex, pageSize, total, keyword, roleId > 0 ? roleId : null, orgId > 0 ? orgId : null);
+            Response.Headers["X-Total-Count"] = total.Value.ToString();
+            return result.IsSuccess
+                ? Ok(Result<List<UserDto>>.Success(result.Data))
+                : Ok(Result<List<UserDto>>.Error(result.Msg));
+        }
+
+        /// <summary>
+        /// 用户下拉选项（启用中的用户）
+        /// </summary>
+        [HttpGet("options")]
+        public async Task<IActionResult> GetOptions()
+        {
+            return Ok(await _userService.GetOptionsAsync());
+        }
+
+        /// <summary>
+        /// 用户详情
+        /// </summary>
+        [HttpGet("{id}")]
+        public async Task<IActionResult> GetById(long id)
+        {
+            return Ok(await _userService.GetByIdAsync(id));
+        }
+
+        /// <summary>
+        /// 新增用户（InitialPassword 传初始密码，RoleIds 传角色）
+        /// </summary>
+        [HttpPost]
+        public async Task<IActionResult> Add([FromBody] UserDto dto)
+        {
+            return Ok(await _userService.AddAsync(dto));
+        }
+
+        /// <summary>
+        /// 修改用户（RoleIds 传 null 不改角色；密码走重置接口）
+        /// </summary>
+        [HttpPut]
+        public async Task<IActionResult> Update([FromBody] UserDto dto)
+        {
+            return Ok(await _userService.UpdateAsync(dto));
+        }
+
+        /// <summary>
+        /// 删除用户（软删除）
+        /// </summary>
+        [HttpDelete("{id}")]
+        public async Task<IActionResult> Delete(long id)
+        {
+            return Ok(await _userService.DeleteAsync(id));
+        }
+
+        /// <summary>
+        /// 分配角色（全量覆盖）
+        /// </summary>
+        [HttpPost("{id}/roles")]
+        public async Task<IActionResult> AssignRoles(long id, [FromBody] List<string> roleIds)
+        {
+            var ids = roleIds?.Select(long.Parse).Where(r => r > 0).ToList() ?? new List<long>();
+            return Ok(await _userService.AssignRolesAsync(id, ids));
+        }
+
+        /// <summary>
+        /// 重置用户密码
+        /// </summary>
+        [HttpPost("{id}/reset-password")]
+        public async Task<IActionResult> ResetPassword(long id, [FromBody] ResetPasswordRequest request)
+        {
+            if (request == null || string.IsNullOrWhiteSpace(request.NewPassword))
+                return Ok(Result.Error("新密码不能为空"));
+            return Ok(await _userService.ResetPasswordAsync(id, request.NewPassword));
+        }
+
+        /// <summary>
+        /// 启用/禁用用户
+        /// </summary>
+        [HttpPost("{id}/enabled")]
+        public async Task<IActionResult> SetEnabled(long id, [FromBody] EnabledRequest request)
+        {
+            return Ok(await _userService.SetEnabledAsync(id, request?.Enabled ?? true));
+        }
+
+        public class ResetPasswordRequest
+        {
+            public string NewPassword { get; set; } = "";
+        }
+
+        public class EnabledRequest
+        {
+            public bool Enabled { get; set; } = true;
+        }
     }
 }

IOT_API/Filters/RequirePermissionAttribute.cs

@@ -0,0 +1,52 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Model;
+
+namespace WebAPI.Filters
+{
+    /// <summary>
+    /// 权限校验过滤器：标注在 Controller 或 Action 上，执行前校验当前用户（JWT Claims）是否拥有指定权限
+    /// 用法：[RequirePermission("device:edit")]
+    /// 权限编码在登录时随 JWT 写入 Claims，此处只读 Claims，不查库
+    /// </summary>
+    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true)]
+    public class RequirePermissionAttribute : Attribute, IAsyncAuthorizationFilter
+    {
+        private readonly string _permissionCode;
+
+        public RequirePermissionAttribute(string permissionCode)
+        {
+            _permissionCode = permissionCode;
+        }
+
+        public Task OnAuthorizationAsync(AuthorizationFilterContext context)
+        {
+            // 已被 [AllowAnonymous] 标记的接口放行（如登录本身）
+            if (context.ActionDescriptor.EndpointMetadata.Any(m => m is IAllowAnonymous))
+                return Task.CompletedTask;
+
+            var user = context.HttpContext.User;
+            if (user?.Identity?.IsAuthenticated != true)
+            {
+                context.Result = new UnauthorizedObjectResult(Result.Error("未登录或 Token 已失效"));
+                return Task.CompletedTask;
+            }
+
+            var perms = user.FindFirst("permissions")?.Value;
+            var permList = string.IsNullOrWhiteSpace(perms)
+                ? new List<string>()
+                : perms.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries).ToList();
+
+            if (!permList.Contains(_permissionCode) && !permList.Contains("*"))
+            {
+                context.Result = new ObjectResult(Result.Error($"没有操作权限（需要权限：{_permissionCode}）"))
+                {
+                    StatusCode = StatusCodes.Status403Forbidden
+                };
+            }
+
+            return Task.CompletedTask;
+        }
+    }
+}

IOT_API/IOT_API.csproj

@@ -8,6 +8,7 @@
 
   <ItemGroup>
     <PackageReference Include="AutoMapper" Version="16.2.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.0" />
     <PackageReference Include="Swashbuckle.AspNetCore" Version="6.6.2" />
   </ItemGroup>
 

IOT_API/Program.cs

@@ -1,5 +1,10 @@
 using Common;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
 using ORM;
+using Service.Implement;
+using Service.Interface;
+using System.Text;
 using System.Text.Json;
 using WebAPI.Services;
 
@@ -32,6 +37,9 @@ namespace WebAPI
             DatabaseConfig.CreateDatabaseAndCheckConnection(createDatabase: true, checkConnection: true);
             SqlSugarContext.InitDatabase();
 
+            // RBAC 数据种子：预定义角色/权限/默认管理员（幂等）
+            DataSeeder.Seed();
+
             // 飞书自建应用凭证：用于告警 @ 时把接收人手机号转成 open_id（webhook 机器人自身无此能力）
             var feishu = builder.Configuration.GetSection("Feishu");
             Common.Notify.FeishuConfig.Init(feishu["AppId"] ?? "", feishu["AppSecret"] ?? "");
@@ -51,6 +59,28 @@ namespace WebAPI
             // 自动注册业务服务（Service.Interface -> Service.Implement）
             builder.Services.AddBusinessServices();
 
+            // 当前用户上下文（从 JWT Claims 解析，供业务服务取操作人/做权限判断）
+            builder.Services.AddHttpContextAccessor();
+            builder.Services.AddScoped<ICurrentUser, CurrentUser>();
+
+            // JWT 认证：登录后签发 Token，后续请求凭 Bearer Token 识别用户与角色
+            var jwt = builder.Configuration.GetSection("Jwt");
+            builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+                .AddJwtBearer(options =>
+                {
+                    options.TokenValidationParameters = new TokenValidationParameters
+                    {
+                        ValidateIssuer = true,
+                        ValidateAudience = true,
+                        ValidateLifetime = true,
+                        ValidateIssuerSigningKey = true,
+                        ValidIssuer = jwt["Issuer"],
+                        ValidAudience = jwt["Audience"],
+                        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwt["SecretKey"]!)),
+                        ClockSkew = TimeSpan.FromSeconds(30)
+                    };
+                });
+
             // 告警通知渠道（飞书/钉钉/企微 Notifier）+ 后台推送 Worker
             builder.Services.AddAlertNotification();
             builder.Services.AddHostedService<AlertNotifyWorker>();
@@ -74,6 +104,8 @@ namespace WebAPI
             // 导致前端 vite 代理被 CORS 拦截（Network Error）；上位机/现场部署通常也只用 http
             // app.UseHttpsRedirection();
 
+            app.UseAuthentication();
+
             app.UseAuthorization();
 
             // 静态文件：设备附件上传后通过 /uploads/... 访问（存储于 wwwroot）

IOT_API/Services/CurrentUser.cs

@@ -0,0 +1,62 @@
+using System.Security.Claims;
+using Service.Interface;
+
+namespace WebAPI.Services
+{
+    /// <summary>
+    /// 当前登录用户上下文实现：从 JWT Claims（HttpContext.User）解析
+    /// </summary>
+    public class CurrentUser : ICurrentUser
+    {
+        private readonly IHttpContextAccessor _accessor;
+
+        public CurrentUser(IHttpContextAccessor accessor)
+        {
+            _accessor = accessor;
+        }
+
+        private ClaimsPrincipal? Principal => _accessor?.HttpContext?.User;
+
+        public bool IsAuthenticated => Principal?.Identity?.IsAuthenticated ?? false;
+
+        public long UserId
+        {
+            get
+            {
+                var v = Principal?.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+                return long.TryParse(v, out var id) ? id : 0;
+            }
+        }
+
+        public string UserName => Principal?.FindFirst(ClaimTypes.Name)?.Value ?? "";
+
+        public List<long> RoleIds => ParseList("roleIds").Select(long.Parse).ToList();
+
+        public List<string> RoleNames => ParseList("roleNames");
+
+        public List<string> Permissions => ParseList("permissions");
+
+        public byte DataScope
+        {
+            get
+            {
+                var v = Principal?.FindFirst("dataScope")?.Value;
+                return byte.TryParse(v, out var b) ? b : (byte)2;
+            }
+        }
+
+        public bool HasPermission(string code)
+        {
+            if (!IsAuthenticated) return false;
+            var perms = Permissions;
+            return perms.Contains(code) || perms.Contains("*");
+        }
+
+        private List<string> ParseList(string claimType)
+        {
+            var raw = Principal?.FindFirst(claimType)?.Value;
+            if (string.IsNullOrWhiteSpace(raw)) return new List<string>();
+            return raw.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries).ToList();
+        }
+    }
+}

Model/Dto/Config/GatewayDto.cs

@@ -0,0 +1,56 @@
+namespace Model.Dto.Config
+{
+    /// <summary>
+    /// 网关 DTO
+    /// </summary>
+    public class GatewayDto
+    {
+        public string Id { get; set; }
+        public string Code { get; set; }
+        public string Name { get; set; }
+        public int ProtocolType { get; set; }
+
+        // TCP
+        public string? Host { get; set; }
+        public int? Port { get; set; }
+
+        // 串口
+        public string? ComPort { get; set; }
+        public int? BaudRate { get; set; }
+        public byte? DataBits { get; set; }
+        public byte? StopBits { get; set; }
+        public byte? Parity { get; set; }
+
+        // S7
+        public string? CpuType { get; set; }
+        public byte? Rack { get; set; }
+        public byte? Slot { get; set; }
+
+        // 状态
+        public bool IsEnabled { get; set; }
+        public byte OnlineStatus { get; set; }
+        public DateTime? LastConnectedTime { get; set; }
+        public string? LastError { get; set; }
+        public string? Remark { get; set; }
+        public DateTime? CreateTime { get; set; }
+    }
+
+    /// <summary>
+    /// 网关下拉选项 DTO（设备表单选用）
+    /// </summary>
+    public class GatewayOptionDto
+    {
+        public string Id { get; set; }
+        public string Code { get; set; }
+        public string Name { get; set; }
+    }
+
+    /// <summary>
+    /// 测试连接结果 DTO
+    /// </summary>
+    public class GatewayTestResultDto
+    {
+        public bool Success { get; set; }
+        public string Message { get; set; }
+    }
+}

Model/Dto/Config/IotDeviceDto.cs

@@ -25,8 +25,11 @@ namespace Model.Dto.Config
         /// <summary>所属产品型号/名称（只读展示）</summary>
         public string? ProductName { get; set; }
 
-        /// <summary>所属网关Code</summary>
-        public string GatewayCode { get; set; }
+        /// <summary>所属网关Id（string，0=未分配）</summary>
+        public string GatewayId { get; set; }
+
+        /// <summary>所属网关名称（只读展示）</summary>
+        public string? GatewayName { get; set; }
 
         /// <summary>从站地址</summary>
         public byte SlaveId { get; set; }

Model/Dto/System/OrgDto.cs

@@ -0,0 +1,56 @@
+namespace Model.Dto.System
+{
+    /// <summary>
+    /// 组织架构树节点 DTO（嵌套子级；含数据权限摘要）
+    /// </summary>
+    public class OrgTreeDto
+    {
+        public string Id { get; set; }
+        public string ParentId { get; set; }
+        public string Name { get; set; }
+        public string Code { get; set; }
+        public int OrgType { get; set; }
+        public int ShiftType { get; set; }
+        public string? Leader { get; set; }
+        public string? Phone { get; set; }
+        public int Sort { get; set; }
+        public string? Remark { get; set; }
+        public List<OrgTreeDto> Children { get; set; } = new();
+
+        /// <summary>直接挂靠用户数</summary>
+        public int UserCount { get; set; }
+
+        /// <summary>本组织及下级用户总数</summary>
+        public int TotalUserCount { get; set; }
+
+        /// <summary>数据权限摘要：本组织及下级用户的角色+数据范围（去重，如「实验室管理员·本组织及下级」）</summary>
+        public List<string> ScopeSummary { get; set; } = new();
+    }
+
+    /// <summary>
+    /// 组织架构编辑 DTO（新增/修改用）
+    /// </summary>
+    public class OrgDto
+    {
+        public string Id { get; set; }
+        public string ParentId { get; set; }
+        public string Name { get; set; }
+        public string Code { get; set; }
+        public int OrgType { get; set; }
+        public int ShiftType { get; set; }
+        public string? Leader { get; set; }
+        public string? Phone { get; set; }
+        public int Sort { get; set; }
+        public string? Remark { get; set; }
+    }
+
+    /// <summary>
+    /// 组织下拉选项 DTO（用户表单选组织用）
+    /// </summary>
+    public class OrgOptionDto
+    {
+        public string Id { get; set; }
+        public string Name { get; set; }
+        public int OrgType { get; set; }
+    }
+}

Model/Dto/System/PermissionDto.cs

@@ -0,0 +1,37 @@
+namespace Model.Dto.System
+{
+    /// <summary>
+    /// 权限 DTO
+    /// </summary>
+    public class PermissionDto
+    {
+        public string Id { get; set; }
+        public string Code { get; set; }
+        public string Name { get; set; }
+        public string? Group { get; set; }
+        public byte IsSystem { get; set; }
+        public int Sort { get; set; }
+    }
+
+    /// <summary>
+    /// 审计日志 DTO
+    /// </summary>
+    public class AuditLogDto
+    {
+        public string Id { get; set; }
+        public string UserId { get; set; }
+        public string? UserName { get; set; }
+        public string RoleId { get; set; }
+        public string? RoleName { get; set; }
+        public string OperationType { get; set; }
+        public string OperationTarget { get; set; }
+        public string TargetId { get; set; }
+        public string DeviceId { get; set; }
+        public string? OldValue { get; set; }
+        public string? NewValue { get; set; }
+        public string? Ip { get; set; }
+        public string? Description { get; set; }
+        public DateTime OperateTime { get; set; }
+        public DateTime? CreateTime { get; set; }
+    }
+}

Model/Dto/System/RoleDto.cs

@@ -0,0 +1,31 @@
+namespace Model.Dto.System
+{
+    /// <summary>
+    /// 角色 DTO
+    /// </summary>
+    public class RoleDto
+    {
+        public string Id { get; set; }
+        public string Code { get; set; }
+        public string Name { get; set; }
+        public byte DataScope { get; set; }
+        public byte IsSystem { get; set; }
+        public int Sort { get; set; }
+        public string? Remark { get; set; }
+        public DateTime? CreateTime { get; set; }
+        /// <summary>角色的权限Id列表（分配权限用）</summary>
+        public List<string>? PermissionIds { get; set; }
+        /// <summary>角色的权限编码列表（展示用）</summary>
+        public List<string>? PermissionCodes { get; set; }
+    }
+
+    /// <summary>
+    /// 角色下拉选项 DTO
+    /// </summary>
+    public class RoleOptionDto
+    {
+        public string Id { get; set; }
+        public string Code { get; set; }
+        public string Name { get; set; }
+    }
+}

Model/Dto/System/UserDto.cs

@@ -0,0 +1,68 @@
+namespace Model.Dto.System
+{
+    /// <summary>
+    /// 用户 DTO
+    /// </summary>
+    public class UserDto
+    {
+        public string Id { get; set; }
+        public string UserName { get; set; }
+        public string? RealName { get; set; }
+        public string? Email { get; set; }
+        public string? Phone { get; set; }
+        public string OrgId { get; set; }
+        public string? OrgName { get; set; }
+        public string? Position { get; set; }
+        public string? SkillTags { get; set; }
+        public byte IsEnabled { get; set; }
+        public DateTime? LastLoginTime { get; set; }
+        public string? Avatar { get; set; }
+        public string? Remark { get; set; }
+        public DateTime? CreateTime { get; set; }
+        /// <summary>用户的角色Id列表（分配角色用）</summary>
+        public List<string>? RoleIds { get; set; }
+        /// <summary>用户的角色名称（展示用，逗号分隔）</summary>
+        public string? RoleNames { get; set; }
+        /// <summary>初始密码（仅新增用户时传入，不回显）</summary>
+        public string? InitialPassword { get; set; }
+    }
+
+    /// <summary>
+    /// 登录请求 DTO
+    /// </summary>
+    public class LoginDto
+    {
+        public string UserName { get; set; }
+        public string Password { get; set; }
+    }
+
+    /// <summary>
+    /// 登录结果 DTO
+    /// </summary>
+    public class LoginResultDto
+    {
+        public string Token { get; set; }
+        public string RefreshToken { get; set; }
+        public UserDto User { get; set; }
+        public List<string> Permissions { get; set; } = new();
+    }
+
+    /// <summary>
+    /// 修改密码 DTO
+    /// </summary>
+    public class ChangePasswordDto
+    {
+        public string OldPassword { get; set; }
+        public string NewPassword { get; set; }
+    }
+
+    /// <summary>
+    /// 用户下拉选项 DTO
+    /// </summary>
+    public class UserOptionDto
+    {
+        public string Id { get; set; }
+        public string UserName { get; set; }
+        public string? RealName { get; set; }
+    }
+}

Model/Entity/Config/GatewayEntity.cs

@@ -0,0 +1,127 @@
+using SqlSugar;
+
+namespace Model.Entity.Config
+{
+    /// <summary>
+    /// 网关（通讯通道）：TCP 类存 IP+端口，串口类存 COM+波特率，S7 类额外存 CPU/Rack/Slot。
+    /// 同一网关下多设备用从站号（SlaveId）区分。
+    /// </summary>
+    public class GatewayEntity : BaseEntity
+    {
+        /// <summary>
+        /// 网关编码（唯一，如 GW-ENV-01）
+        /// </summary>
+        [SugarColumn(ColumnDescription = "网关编码", Length = 64)]
+        public string Code { get; set; }
+
+        /// <summary>
+        /// 网关名称
+        /// </summary>
+        [SugarColumn(ColumnDescription = "网关名称", Length = 100)]
+        public string Name { get; set; }
+
+        /// <summary>
+        /// 通讯协议类型（决定连接参数组：TCP/Serial/S7）
+        /// </summary>
+        [SugarColumn(ColumnDescription = "通讯协议类型")]
+        public IotDeviceProtocolEnum ProtocolType { get; set; } = IotDeviceProtocolEnum.ModbusTcp;
+
+        #region TCP 参数（ModbusTcp / Tcp / S7 协议使用）
+        /// <summary>
+        /// IP 地址
+        /// </summary>
+        [SugarColumn(ColumnDescription = "IP地址", Length = 50, IsNullable = true)]
+        public string? Host { get; set; }
+
+        /// <summary>
+        /// 端口号（ModbusTcp 默认 502，S7 默认 102）
+        /// </summary>
+        [SugarColumn(ColumnDescription = "端口号", IsNullable = true)]
+        public int? Port { get; set; }
+        #endregion
+
+        #region 串口参数（ModbusRtu / Serial 协议使用）
+        /// <summary>
+        /// 串口号（如 COM3）
+        /// </summary>
+        [SugarColumn(ColumnDescription = "串口号", Length = 20, IsNullable = true)]
+        public string? ComPort { get; set; }
+
+        /// <summary>
+        /// 波特率（默认 9600）
+        /// </summary>
+        [SugarColumn(ColumnDescription = "波特率", IsNullable = true)]
+        public int? BaudRate { get; set; }
+
+        /// <summary>
+        /// 数据位（默认 8）
+        /// </summary>
+        [SugarColumn(ColumnDescription = "数据位", IsNullable = true)]
+        public byte? DataBits { get; set; }
+
+        /// <summary>
+        /// 停止位（1/2，默认 1）
+        /// </summary>
+        [SugarColumn(ColumnDescription = "停止位", IsNullable = true)]
+        public byte? StopBits { get; set; }
+
+        /// <summary>
+        /// 校验位（0=None 1=Odd 2=Even，默认 0）
+        /// </summary>
+        [SugarColumn(ColumnDescription = "校验位", IsNullable = true)]
+        public byte? Parity { get; set; }
+        #endregion
+
+        #region S7 参数（S7 协议专用）
+        /// <summary>
+        /// S7 CPU 型号（如 S71200、S71500）
+        /// </summary>
+        [SugarColumn(ColumnDescription = "S7 CPU型号", Length = 20, IsNullable = true)]
+        public string? CpuType { get; set; }
+
+        /// <summary>
+        /// S7 Rack（默认 0）
+        /// </summary>
+        [SugarColumn(ColumnDescription = "S7 Rack", IsNullable = true)]
+        public byte? Rack { get; set; }
+
+        /// <summary>
+        /// S7 Slot（默认 1）
+        /// </summary>
+        [SugarColumn(ColumnDescription = "S7 Slot", IsNullable = true)]
+        public byte? Slot { get; set; }
+        #endregion
+
+        #region 状态
+        /// <summary>
+        /// 是否启用
+        /// </summary>
+        [SugarColumn(ColumnDescription = "是否启用")]
+        public bool IsEnabled { get; set; } = true;
+
+        /// <summary>
+        /// 在线状态（0=离线 1=在线 3=异常，由测试连接更新）
+        /// </summary>
+        [SugarColumn(ColumnDescription = "在线状态")]
+        public byte OnlineStatus { get; set; }
+
+        /// <summary>
+        /// 最后连接成功时间
+        /// </summary>
+        [SugarColumn(ColumnDescription = "最后连接时间", IsNullable = true)]
+        public DateTime? LastConnectedTime { get; set; }
+
+        /// <summary>
+        /// 最近错误
+        /// </summary>
+        [SugarColumn(ColumnDescription = "最近错误", Length = 500, IsNullable = true)]
+        public string? LastError { get; set; }
+        #endregion
+
+        /// <summary>
+        /// 备注
+        /// </summary>
+        [SugarColumn(ColumnDescription = "备注", Length = 500, IsNullable = true)]
+        public string? Remark { get; set; }
+    }
+}

Model/Entity/Config/IotDeviceEntity.cs

@@ -34,10 +34,10 @@ namespace Model.Entity.Config
         public long ProductId { get; set; }
 
         /// <summary>
-        /// 所属网关Code（对应网关实体/通道的标识，连接时据此刻查找 IP/端口/串口）
+        /// 所属网关Id（关联 GatewayEntity.Id，0=未分配）
         /// </summary>
-        [SugarColumn(ColumnDescription = "所属网关Code", Length = 64)]
-        public string GatewayCode { get; set; }
+        [SugarColumn(ColumnDescription = "所属网关Id", DefaultValue = "0")]
+        public long GatewayId { get; set; }
 
         /// <summary>
         /// 从站地址（协议从站号，网关下区分设备）

Model/Entity/System/AuditLogEntity.cs

@@ -0,0 +1,50 @@
+using SqlSugar;
+
+namespace Model.Entity.System
+{
+    /// <summary>
+    /// 审计日志表（记录所有关键操作）
+    /// </summary>
+    [SugarTable("sys_audit_log")]
+    public class AuditLogEntity : BaseEntity
+    {
+        [SugarColumn(ColumnName = "UserId", ColumnDescription = "操作人用户Id")]
+        public long UserId { get; set; }
+
+        [SugarColumn(ColumnName = "UserName", ColumnDescription = "操作人用户名", Length = 64, IsNullable = true)]
+        public string? UserName { get; set; }
+
+        [SugarColumn(ColumnName = "RoleId", ColumnDescription = "操作人角色Id（0=无/多角色）", DefaultValue = "0")]
+        public long RoleId { get; set; }
+
+        [SugarColumn(ColumnName = "RoleName", ColumnDescription = "操作人角色名称", Length = 100, IsNullable = true)]
+        public string? RoleName { get; set; }
+
+        [SugarColumn(ColumnName = "OperationType", ColumnDescription = "操作类型（Create/Update/Delete/Login/Command等）", Length = 32, IsNullable = false)]
+        public string OperationType { get; set; }
+
+        [SugarColumn(ColumnName = "OperationTarget", ColumnDescription = "操作对象（如 IotDevice/Gateway/User/Role）", Length = 64, IsNullable = false)]
+        public string OperationTarget { get; set; }
+
+        [SugarColumn(ColumnName = "TargetId", ColumnDescription = "操作对象Id（0=无具体Id）", DefaultValue = "0")]
+        public long TargetId { get; set; }
+
+        [SugarColumn(ColumnName = "DeviceId", ColumnDescription = "关联设备Id（0=无关设备）", DefaultValue = "0")]
+        public long DeviceId { get; set; }
+
+        [SugarColumn(ColumnName = "OldValue", ColumnDescription = "操作前值（JSON）", ColumnDataType = "text", IsNullable = true)]
+        public string? OldValue { get; set; }
+
+        [SugarColumn(ColumnName = "NewValue", ColumnDescription = "操作后值（JSON）", ColumnDataType = "text", IsNullable = true)]
+        public string? NewValue { get; set; }
+
+        [SugarColumn(ColumnName = "Ip", ColumnDescription = "操作IP", Length = 45, IsNullable = true)]
+        public string? Ip { get; set; }
+
+        [SugarColumn(ColumnName = "Description", ColumnDescription = "操作描述", Length = 500, IsNullable = true)]
+        public string? Description { get; set; }
+
+        [SugarColumn(ColumnName = "OperateTime", ColumnDescription = "操作时间", IsNullable = false)]
+        public DateTime OperateTime { get; set; }
+    }
+}

Model/Entity/System/OrgEntity.cs

@@ -0,0 +1,40 @@
+using SqlSugar;
+
+namespace Model.Entity.System
+{
+    /// <summary>
+    /// 组织架构表（树形：公司/实验室/部门/班组，ParentId 自关联；班组带白/夜班）
+    /// </summary>
+    [SugarTable("sys_org")]
+    public class OrgEntity : BaseEntity
+    {
+        [SugarColumn(ColumnName = "ParentId", ColumnDescription = "父级组织Id（0=根节点）", DefaultValue = "0")]
+        public long ParentId { get; set; }
+
+        [SugarColumn(ColumnName = "Name", ColumnDescription = "组织名称", Length = 100, IsNullable = false)]
+        public string Name { get; set; }
+
+        [SugarColumn(ColumnName = "Code", ColumnDescription = "组织编码（唯一）", Length = 64, IsNullable = false)]
+        public string Code { get; set; }
+
+        /// <summary>组织类型：1=公司, 2=实验室, 3=部门, 4=班组</summary>
+        [SugarColumn(ColumnName = "OrgType", ColumnDescription = "组织类型（1公司/2实验室/3部门/4班组）", ColumnDataType = "smallint", DefaultValue = "3")]
+        public byte OrgType { get; set; }
+
+        /// <summary>班组班次：0=非班组, 1=白班, 2=夜班</summary>
+        [SugarColumn(ColumnName = "ShiftType", ColumnDescription = "班次（0非班组/1白班/2夜班）", ColumnDataType = "smallint", DefaultValue = "0")]
+        public byte ShiftType { get; set; }
+
+        [SugarColumn(ColumnName = "Leader", ColumnDescription = "负责人", Length = 50, IsNullable = true)]
+        public string? Leader { get; set; }
+
+        [SugarColumn(ColumnName = "Phone", ColumnDescription = "联系电话", Length = 20, IsNullable = true)]
+        public string? Phone { get; set; }
+
+        [SugarColumn(ColumnName = "Sort", ColumnDescription = "排序号", DefaultValue = "0")]
+        public int Sort { get; set; }
+
+        [SugarColumn(ColumnName = "Remark", ColumnDescription = "备注", Length = 500, IsNullable = true)]
+        public string? Remark { get; set; }
+    }
+}

Model/Entity/System/PermissionEntity.cs

@@ -0,0 +1,26 @@
+using SqlSugar;
+
+namespace Model.Entity.System
+{
+    /// <summary>
+    /// 权限表（功能权限码，如 device:view / device:edit / alert:confirm）
+    /// </summary>
+    [SugarTable("sys_permission")]
+    public class PermissionEntity : BaseEntity
+    {
+        [SugarColumn(ColumnName = "Code", ColumnDescription = "权限编码（唯一，如 device:view）", Length = 64, IsNullable = false)]
+        public string Code { get; set; }
+
+        [SugarColumn(ColumnName = "Name", ColumnDescription = "权限名称", Length = 100, IsNullable = false)]
+        public string Name { get; set; }
+
+        [SugarColumn(ColumnName = "Group", ColumnDescription = "权限分组（如 device/alert/inspection/user）", Length = 64, IsNullable = true)]
+        public string? Group { get; set; }
+
+        [SugarColumn(ColumnName = "IsSystem", ColumnDescription = "是否系统内置（不可删除）", ColumnDataType = "smallint", DefaultValue = "0")]
+        public byte IsSystem { get; set; }
+
+        [SugarColumn(ColumnName = "Sort", ColumnDescription = "排序号", DefaultValue = "0")]
+        public int Sort { get; set; }
+    }
+}

Model/Entity/System/RoleEntity.cs

@@ -0,0 +1,29 @@
+using SqlSugar;
+
+namespace Model.Entity.System
+{
+    /// <summary>
+    /// 角色表
+    /// </summary>
+    [SugarTable("sys_role")]
+    public class RoleEntity : BaseEntity
+    {
+        [SugarColumn(ColumnName = "Code", ColumnDescription = "角色编码（唯一）", Length = 64, IsNullable = false)]
+        public string Code { get; set; }
+
+        [SugarColumn(ColumnName = "Name", ColumnDescription = "角色名称", Length = 100, IsNullable = false)]
+        public string Name { get; set; }
+
+        [SugarColumn(ColumnName = "DataScope", ColumnDescription = "数据范围（1=全部,2=本实验室）", ColumnDataType = "smallint", DefaultValue = "2")]
+        public byte DataScope { get; set; }
+
+        [SugarColumn(ColumnName = "IsSystem", ColumnDescription = "是否系统内置角色（不可删除）", ColumnDataType = "smallint", DefaultValue = "0")]
+        public byte IsSystem { get; set; }
+
+        [SugarColumn(ColumnName = "Sort", ColumnDescription = "排序号", DefaultValue = "0")]
+        public int Sort { get; set; }
+
+        [SugarColumn(ColumnName = "Remark", ColumnDescription = "备注", Length = 500, IsNullable = true)]
+        public string? Remark { get; set; }
+    }
+}

Model/Entity/System/RolePermissionEntity.cs

@@ -0,0 +1,17 @@
+using SqlSugar;
+
+namespace Model.Entity.System
+{
+    /// <summary>
+    /// 角色-权限关联表（多对多）
+    /// </summary>
+    [SugarTable("sys_role_permission")]
+    public class RolePermissionEntity : BaseEntity
+    {
+        [SugarColumn(ColumnName = "RoleId", ColumnDescription = "角色Id")]
+        public long RoleId { get; set; }
+
+        [SugarColumn(ColumnName = "PermissionId", ColumnDescription = "权限Id")]
+        public long PermissionId { get; set; }
+    }
+}

Model/Entity/System/UserEntity.cs

@@ -0,0 +1,47 @@
+using SqlSugar;
+
+namespace Model.Entity.System
+{
+    /// <summary>
+    /// 用户表
+    /// </summary>
+    [SugarTable("sys_user")]
+    public class UserEntity : BaseEntity
+    {
+        [SugarColumn(ColumnName = "UserName", ColumnDescription = "用户名（登录账号）", Length = 64, IsNullable = false)]
+        public string UserName { get; set; }
+
+        [SugarColumn(ColumnName = "PasswordHash", ColumnDescription = "密码哈希", Length = 256, IsNullable = false)]
+        public string PasswordHash { get; set; }
+
+        [SugarColumn(ColumnName = "RealName", ColumnDescription = "真实姓名", Length = 100, IsNullable = true)]
+        public string? RealName { get; set; }
+
+        [SugarColumn(ColumnName = "Email", ColumnDescription = "邮箱", Length = 128, IsNullable = true)]
+        public string? Email { get; set; }
+
+        [SugarColumn(ColumnName = "Phone", ColumnDescription = "手机号", Length = 20, IsNullable = true)]
+        public string? Phone { get; set; }
+
+        [SugarColumn(ColumnName = "OrgId", ColumnDescription = "所属组织Id（公司/实验室/部门/班组任一节点，0=未分配）", DefaultValue = "0")]
+        public long OrgId { get; set; }
+
+        [SugarColumn(ColumnName = "Position", ColumnDescription = "岗位", Length = 64, IsNullable = true)]
+        public string? Position { get; set; }
+
+        [SugarColumn(ColumnName = "SkillTags", ColumnDescription = "技能标签（逗号分隔，如 Modbus,PLC,温度箱）", Length = 500, IsNullable = true)]
+        public string? SkillTags { get; set; }
+
+        [SugarColumn(ColumnName = "IsEnabled", ColumnDescription = "是否启用", ColumnDataType = "smallint", DefaultValue = "1")]
+        public byte IsEnabled { get; set; }
+
+        [SugarColumn(ColumnName = "LastLoginTime", ColumnDescription = "最后登录时间", IsNullable = true)]
+        public DateTime? LastLoginTime { get; set; }
+
+        [SugarColumn(ColumnName = "Avatar", ColumnDescription = "头像URL", Length = 256, IsNullable = true)]
+        public string? Avatar { get; set; }
+
+        [SugarColumn(ColumnName = "Remark", ColumnDescription = "备注", Length = 500, IsNullable = true)]
+        public string? Remark { get; set; }
+    }
+}

Model/Entity/System/UserRoleEntity.cs

@@ -0,0 +1,17 @@
+using SqlSugar;
+
+namespace Model.Entity.System
+{
+    /// <summary>
+    /// 用户-角色关联表（多对多）
+    /// </summary>
+    [SugarTable("sys_user_role")]
+    public class UserRoleEntity : BaseEntity
+    {
+        [SugarColumn(ColumnName = "UserId", ColumnDescription = "用户Id")]
+        public long UserId { get; set; }
+
+        [SugarColumn(ColumnName = "RoleId", ColumnDescription = "角色Id")]
+        public long RoleId { get; set; }
+    }
+}

Model/Mapper/EntityMapper.cs

@@ -1,9 +1,11 @@
 using Model.Dto.Asset;
 using Model.Dto.Config;
 using Model.Dto.Inspection;
+using Model.Dto.System;
 using Model.Entity.Asset;
 using Model.Entity.Config;
 using Model.Entity.Inspection;
+using Model.Entity.System;
 
 namespace Model.Mapper
 {
@@ -410,7 +412,7 @@ namespace Model.Mapper
                 Name = entity.Name,
                 DeviceType = entity.DeviceType,
                 ProductId = entity.ProductId.ToString(),
-                GatewayCode = entity.GatewayCode,
+                GatewayId = entity.GatewayId.ToString(),
                 SlaveId = entity.SlaveId,
                 Manufacturer = entity.Manufacturer,
                 Description = entity.Description,
@@ -445,7 +447,7 @@ namespace Model.Mapper
                 Name = dto.Name,
                 DeviceType = dto.DeviceType,
                 ProductId = ParseId(dto.ProductId),
-                GatewayCode = dto.GatewayCode,
+                GatewayId = ParseId(dto.GatewayId),
                 SlaveId = dto.SlaveId,
                 Manufacturer = dto.Manufacturer,
                 Description = dto.Description,
@@ -485,6 +487,99 @@ namespace Model.Mapper
         }
         #endregion
 
+        #region 网关
+        /// <summary>
+        /// GatewayEntity → GatewayDto
+        /// </summary>
+        public static GatewayDto ToDto(this GatewayEntity entity)
+        {
+            if (entity == null) return null;
+            return new GatewayDto
+            {
+                Id = entity.Id.ToString(),
+                Code = entity.Code,
+                Name = entity.Name,
+                ProtocolType = (int)entity.ProtocolType,
+                Host = entity.Host,
+                Port = entity.Port,
+                ComPort = entity.ComPort,
+                BaudRate = entity.BaudRate,
+                DataBits = entity.DataBits,
+                StopBits = entity.StopBits,
+                Parity = entity.Parity,
+                CpuType = entity.CpuType,
+                Rack = entity.Rack,
+                Slot = entity.Slot,
+                IsEnabled = entity.IsEnabled,
+                OnlineStatus = entity.OnlineStatus,
+                LastConnectedTime = entity.LastConnectedTime,
+                LastError = entity.LastError,
+                Remark = entity.Remark,
+                CreateTime = entity.CreateTime
+            };
+        }
+
+        /// <summary>
+        /// List&lt;GatewayEntity&gt; → List&lt;GatewayDto&gt;
+        /// </summary>
+        public static List<GatewayDto> ToDtoList(this List<GatewayEntity> entities)
+        {
+            return entities?.Select(e => e.ToDto()).ToList() ?? new List<GatewayDto>();
+        }
+
+        /// <summary>
+        /// GatewayDto → GatewayEntity（入参映射）
+        /// </summary>
+        public static GatewayEntity ToEntity(this GatewayDto dto)
+        {
+            if (dto == null) return null;
+            return new GatewayEntity
+            {
+                Id = ParseId(dto.Id),
+                Code = dto.Code,
+                Name = dto.Name,
+                ProtocolType = (IotDeviceProtocolEnum)dto.ProtocolType,
+                Host = dto.Host,
+                Port = dto.Port,
+                ComPort = dto.ComPort,
+                BaudRate = dto.BaudRate,
+                DataBits = dto.DataBits,
+                StopBits = dto.StopBits,
+                Parity = dto.Parity,
+                CpuType = dto.CpuType,
+                Rack = dto.Rack,
+                Slot = dto.Slot,
+                IsEnabled = dto.IsEnabled,
+                OnlineStatus = dto.OnlineStatus,
+                LastConnectedTime = dto.LastConnectedTime,
+                LastError = dto.LastError,
+                Remark = dto.Remark
+            };
+        }
+
+        /// <summary>
+        /// GatewayEntity → GatewayOptionDto（下拉选项）
+        /// </summary>
+        public static GatewayOptionDto ToOptionDto(this GatewayEntity entity)
+        {
+            if (entity == null) return null;
+            return new GatewayOptionDto
+            {
+                Id = entity.Id.ToString(),
+                Code = entity.Code,
+                Name = entity.Name
+            };
+        }
+
+        /// <summary>
+        /// List&lt;GatewayEntity&gt; → List&lt;GatewayOptionDto&gt;
+        /// </summary>
+        public static List<GatewayOptionDto> ToOptionDtoList(this List<GatewayEntity> entities)
+        {
+            return entities?.Select(e => e.ToOptionDto()).ToList() ?? new List<GatewayOptionDto>();
+        }
+        #endregion
+
         #region 产品分类
         /// <summary>
         /// ProductCategoryEntity → ProductCategoryDto
@@ -935,5 +1030,217 @@ namespace Model.Mapper
             };
         }
         #endregion
+
+        #region 用户
+        public static UserDto ToDto(this UserEntity entity)
+        {
+            if (entity == null) return null;
+            return new UserDto
+            {
+                Id = entity.Id.ToString(),
+                UserName = entity.UserName,
+                RealName = entity.RealName,
+                Email = entity.Email,
+                Phone = entity.Phone,
+                OrgId = entity.OrgId.ToString(),
+                Position = entity.Position,
+                SkillTags = entity.SkillTags,
+                IsEnabled = entity.IsEnabled,
+                LastLoginTime = entity.LastLoginTime,
+                Avatar = entity.Avatar,
+                Remark = entity.Remark,
+                CreateTime = entity.CreateTime
+            };
+        }
+        public static List<UserDto> ToDtoList(this List<UserEntity> entities)
+            => entities?.Select(e => e.ToDto()).ToList() ?? new List<UserDto>();
+        public static UserEntity ToEntity(this UserDto dto)
+        {
+            if (dto == null) return null;
+            return new UserEntity
+            {
+                Id = ParseId(dto.Id),
+                UserName = dto.UserName,
+                RealName = dto.RealName,
+                Email = dto.Email,
+                Phone = dto.Phone,
+                OrgId = ParseId(dto.OrgId),
+                Position = dto.Position,
+                SkillTags = dto.SkillTags,
+                IsEnabled = dto.IsEnabled,
+                Avatar = dto.Avatar,
+                Remark = dto.Remark
+            };
+        }
+        public static UserOptionDto ToOptionDto(this UserEntity entity)
+        {
+            if (entity == null) return null;
+            return new UserOptionDto { Id = entity.Id.ToString(), UserName = entity.UserName, RealName = entity.RealName };
+        }
+        public static List<UserOptionDto> ToOptionDtoList(this List<UserEntity> entities)
+            => entities?.Select(e => e.ToOptionDto()).ToList() ?? new List<UserOptionDto>();
+        #endregion
+
+        #region 角色
+        public static RoleDto ToDto(this RoleEntity entity)
+        {
+            if (entity == null) return null;
+            return new RoleDto
+            {
+                Id = entity.Id.ToString(),
+                Code = entity.Code,
+                Name = entity.Name,
+                DataScope = entity.DataScope,
+                IsSystem = entity.IsSystem,
+                Sort = entity.Sort,
+                Remark = entity.Remark,
+                CreateTime = entity.CreateTime
+            };
+        }
+        public static List<RoleDto> ToDtoList(this List<RoleEntity> entities)
+            => entities?.Select(e => e.ToDto()).ToList() ?? new List<RoleDto>();
+        public static RoleEntity ToEntity(this RoleDto dto)
+        {
+            if (dto == null) return null;
+            return new RoleEntity
+            {
+                Id = ParseId(dto.Id),
+                Code = dto.Code,
+                Name = dto.Name,
+                DataScope = dto.DataScope,
+                IsSystem = dto.IsSystem,
+                Sort = dto.Sort,
+                Remark = dto.Remark
+            };
+        }
+        public static RoleOptionDto ToOptionDto(this RoleEntity entity)
+        {
+            if (entity == null) return null;
+            return new RoleOptionDto { Id = entity.Id.ToString(), Code = entity.Code, Name = entity.Name };
+        }
+        public static List<RoleOptionDto> ToOptionDtoList(this List<RoleEntity> entities)
+            => entities?.Select(e => e.ToOptionDto()).ToList() ?? new List<RoleOptionDto>();
+        #endregion
+
+        #region 权限
+        public static PermissionDto ToDto(this PermissionEntity entity)
+        {
+            if (entity == null) return null;
+            return new PermissionDto
+            {
+                Id = entity.Id.ToString(),
+                Code = entity.Code,
+                Name = entity.Name,
+                Group = entity.Group,
+                IsSystem = entity.IsSystem,
+                Sort = entity.Sort
+            };
+        }
+        public static List<PermissionDto> ToDtoList(this List<PermissionEntity> entities)
+            => entities?.Select(e => e.ToDto()).ToList() ?? new List<PermissionDto>();
+        public static PermissionEntity ToEntity(this PermissionDto dto)
+        {
+            if (dto == null) return null;
+            return new PermissionEntity
+            {
+                Id = ParseId(dto.Id),
+                Code = dto.Code,
+                Name = dto.Name,
+                Group = dto.Group,
+                IsSystem = dto.IsSystem,
+                Sort = dto.Sort
+            };
+        }
+        #endregion
+
+        #region 组织架构
+        public static OrgTreeDto ToTreeDto(this OrgEntity entity)
+        {
+            if (entity == null) return null;
+            return new OrgTreeDto
+            {
+                Id = entity.Id.ToString(),
+                ParentId = entity.ParentId.ToString(),
+                Name = entity.Name,
+                Code = entity.Code,
+                OrgType = entity.OrgType,
+                ShiftType = entity.ShiftType,
+                Leader = entity.Leader,
+                Phone = entity.Phone,
+                Sort = entity.Sort,
+                Remark = entity.Remark
+            };
+        }
+        public static OrgDto ToDto(this OrgEntity entity)
+        {
+            if (entity == null) return null;
+            return new OrgDto
+            {
+                Id = entity.Id.ToString(),
+                ParentId = entity.ParentId.ToString(),
+                Name = entity.Name,
+                Code = entity.Code,
+                OrgType = entity.OrgType,
+                ShiftType = entity.ShiftType,
+                Leader = entity.Leader,
+                Phone = entity.Phone,
+                Sort = entity.Sort,
+                Remark = entity.Remark
+            };
+        }
+        public static List<OrgDto> ToDtoList(this List<OrgEntity> entities)
+            => entities?.Select(e => e.ToDto()).ToList() ?? new List<OrgDto>();
+        public static OrgEntity ToEntity(this OrgDto dto)
+        {
+            if (dto == null) return null;
+            return new OrgEntity
+            {
+                Id = ParseId(dto.Id),
+                ParentId = ParseId(dto.ParentId),
+                Name = dto.Name,
+                Code = dto.Code,
+                OrgType = (byte)dto.OrgType,
+                ShiftType = (byte)dto.ShiftType,
+                Leader = dto.Leader,
+                Phone = dto.Phone,
+                Sort = dto.Sort,
+                Remark = dto.Remark
+            };
+        }
+        public static OrgOptionDto ToOptionDto(this OrgEntity entity)
+        {
+            if (entity == null) return null;
+            return new OrgOptionDto { Id = entity.Id.ToString(), Name = entity.Name, OrgType = entity.OrgType };
+        }
+        public static List<OrgOptionDto> ToOptionDtoList(this List<OrgEntity> entities)
+            => entities?.Select(e => e.ToOptionDto()).ToList() ?? new List<OrgOptionDto>();
+        #endregion
+
+        #region 审计日志
+        public static AuditLogDto ToDto(this AuditLogEntity entity)
+        {
+            if (entity == null) return null;
+            return new AuditLogDto
+            {
+                Id = entity.Id.ToString(),
+                UserId = entity.UserId.ToString(),
+                UserName = entity.UserName,
+                RoleId = entity.RoleId.ToString(),
+                RoleName = entity.RoleName,
+                OperationType = entity.OperationType,
+                OperationTarget = entity.OperationTarget,
+                TargetId = entity.TargetId.ToString(),
+                DeviceId = entity.DeviceId.ToString(),
+                OldValue = entity.OldValue,
+                NewValue = entity.NewValue,
+                Ip = entity.Ip,
+                Description = entity.Description,
+                OperateTime = entity.OperateTime,
+                CreateTime = entity.CreateTime
+            };
+        }
+        public static List<AuditLogDto> ToDtoList(this List<AuditLogEntity> entities)
+            => entities?.Select(e => e.ToDto()).ToList() ?? new List<AuditLogDto>();
+        #endregion
     }
 }

Service/Implement/Config/DeviceCommandService.cs

@@ -3,6 +3,7 @@ using Model;
 using Model.Dto.Config;
 using Model.Entity.Config;
 using ORM;
+using Service.Interface;
 using Service.Interface.Config;
 using SqlSugar;
 using System;
@@ -14,10 +15,18 @@ namespace Service.Implement.Config
     /// <summary>
     /// 设备指令下发 服务实现
     /// 目前无网关运行时/采集引擎：每次调用先落一条设备日志（始终可验证），
-    /// 设备在线时才实际尝试 Modbus 写（GatewayCode 需为 "ip:port"，默认 127.0.0.1:502）。
+    /// 设备在线时才实际尝试 Modbus 写（连接参数从网关表按 GatewayId 加载）。
+    /// 每次下发都写审计日志（操作人/角色/时间/前后值），满足实验室审计要求。
     /// </summary>
     public class DeviceCommandService : IDeviceCommandService
     {
+        private readonly IAuditRecorder _audit;
+
+        public DeviceCommandService(IAuditRecorder audit)
+        {
+            _audit = audit;
+        }
+
         public async Task<Result> SendCommandAsync(DeviceCommandDto dto)
         {
             if (dto == null || !long.TryParse(dto.Id, out var deviceId) || deviceId <= 0)
@@ -57,16 +66,26 @@ namespace Service.Implement.Config
                         : Result.Error("设备离线，指令已记录但未发送");
                 }
 
+                // 从网关表加载连接参数
+                var gateway = await SqlSugarContext.DbContext.Queryable<GatewayEntity>()
+                    .Where(x => x.Id == device.GatewayId && x.IsDel == 0).FirstAsync();
+                if (gateway == null)
+                    return Result.Error($"设备关联的网关不存在（GatewayId={device.GatewayId}）");
+                if (string.IsNullOrWhiteSpace(gateway.Host) || !gateway.Port.HasValue)
+                    return Result.Error($"网关「{gateway.Code}」未配置 IP 地址或端口号");
+
+                var host = gateway.Host!;
+                var port = gateway.Port!.Value;
+
                 // 实际 Modbus 写
-                var (host, port) = ParseGateway(device.GatewayCode);
                 using var modbus = new ModbusTcp();
                 modbus.ConfigureDevice(host, port, 3000, 3000);
                 bool connected = await modbus.ConnectAsync();
                 if (!connected)
                 {
                     await WriteLogAsync(device, "Error", "指令",
-                        $"网关 {device.GatewayCode} 连接失败，指令未发送（点 {point.Name ?? point.Code} 值 {dto.Value}）");
-                    return Result.Error($"网关 {device.GatewayCode} 连接失败，指令未发送");
+                        $"网关 {gateway.Code}({host}:{port}) 连接失败，指令未发送（点 {point.Name ?? point.Code} 值 {dto.Value}）");
+                    return Result.Error($"网关 {gateway.Code} 连接失败，指令未发送");
                 }
 
                 string desc;
@@ -95,6 +114,10 @@ namespace Service.Implement.Config
                     .Where(x => x.Id == device.Id).ExecuteCommandAsync();
 
                 await WriteLogAsync(device, "Info", "指令", $"下发成功：{desc}");
+                await _audit.RecordAsync("Command", "IotDevice", device.Id, device.Id,
+                    oldValue: null,
+                    newValue: $"点={point.Code}, 值={dto.Value}, 模拟={dto.IsSimulated}",
+                    description: $"设备 {device.Code} 下发指令：{desc}");
                 return Result.Success();
             }
             catch (Exception ex)
@@ -143,20 +166,6 @@ namespace Service.Implement.Config
             return new[] { (ushort)(bits >> 16), (ushort)(bits & 0xFFFF) };
         }
 
-        /// <summary>
-        /// 解析 GatewayCode 为 host:port；非法/缺失回退 127.0.0.1:502
-        /// </summary>
-        private static (string host, int port) ParseGateway(string? gatewayCode)
-        {
-            if (!string.IsNullOrWhiteSpace(gatewayCode))
-            {
-                var idx = gatewayCode.LastIndexOf(':');
-                if (idx > 0 && IPAddress.TryParse(gatewayCode[..idx], out _) && int.TryParse(gatewayCode[(idx + 1)..], out var p) && p > 0)
-                    return (gatewayCode[..idx], p);
-            }
-            return ("127.0.0.1", 502);
-        }
-
         /// <summary>
         /// 写一条设备日志（设备独享日志，前端设备日志抽屉可见）
         /// </summary>

Service/Implement/Config/DeviceService.cs

@@ -3,11 +3,13 @@ using Model.Dto.Config;
 using Model.Entity.Config;
 using Model.Mapper;
 using ORM;
+using Service.Interface;
 using Service.Interface.Config;
 using SqlSugar;
 using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Text.Json;
 using System.Threading.Tasks;
 
 namespace Service.Implement.Config
@@ -17,10 +19,17 @@ namespace Service.Implement.Config
     /// </summary>
     public class DeviceService : IDeviceService
     {
+        private readonly IAuditRecorder _audit;
+
+        public DeviceService(IAuditRecorder audit)
+        {
+            _audit = audit;
+        }
+
         /// <summary>
         /// 分页查询设备列表（支持关键字搜索编号/名称/类型，可按所属产品筛选）
         /// </summary>
-        public async Task<Result<List<IotDeviceDto>>> GetPagedAsync(int pageIndex, int pageSize, RefAsync<int> total, string? keyword, long? productId = null)
+        public async Task<Result<List<IotDeviceDto>>> GetPagedAsync(int pageIndex, int pageSize, RefAsync<int> total, string? keyword, long? productId = null, long? gatewayId = null)
         {
             try
             {
@@ -29,11 +38,13 @@ namespace Service.Implement.Config
                     .WhereIF(!string.IsNullOrWhiteSpace(keyword),
                         x => x.Code.Contains(keyword!) || x.Name.Contains(keyword!) || x.DeviceType.Contains(keyword!))
                     .WhereIF(productId.HasValue && productId.Value > 0, x => x.ProductId == productId!.Value)
+                    .WhereIF(gatewayId.HasValue && gatewayId.Value > 0, x => x.GatewayId == gatewayId!.Value)
                     .OrderBy(x => x.CreateTime, OrderByType.Desc)
                     .ToPageListAsync(pageIndex, pageSize, total);
 
                 var dtos = list.ToDtoList();
                 await FillProductNames(dtos);
+                await FillGatewayNames(dtos);
                 return Result<List<IotDeviceDto>>.Success(dtos);
             }
             catch (Exception ex)
@@ -57,6 +68,7 @@ namespace Service.Implement.Config
 
                 var dto = entity.ToDto();
                 await FillProductNames(new List<IotDeviceDto> { dto });
+                await FillGatewayNames(new List<IotDeviceDto> { dto });
                 return Result<IotDeviceDto>.Success(dto);
             }
             catch (Exception ex)
@@ -87,6 +99,10 @@ namespace Service.Implement.Config
                 // 初始离线
                 entity.OnlineStatus = IotDeviceOnlineStatusEnum.Offline;
                 await SqlSugarContext.DbContext.Insertable(entity).ExecuteCommandAsync();
+
+                await _audit.RecordAsync("Create", "IotDevice", entity.Id, entity.Id,
+                    null, JsonSerializer.Serialize(new { entity.Code, entity.Name, entity.DeviceType, entity.GatewayId, entity.SlaveId }),
+                    description: $"新增设备 {entity.Code}（{entity.Name}）");
                 return Result.Success();
             }
             catch (Exception ex)
@@ -112,9 +128,18 @@ namespace Service.Implement.Config
                 if (exists)
                     return Result.Error($"设备编号【{entity.Code}】已存在");
 
+                // 操作前值（审计）：先查旧记录
+                var oldEntity = await SqlSugarContext.DbContext.Queryable<IotDeviceEntity>()
+                    .Where(x => x.Id == entity.Id).FirstAsync();
+
                 await SqlSugarContext.DbContext.Updateable(entity)
                     .IgnoreColumns(x => new { x.CreateTime, x.IsDel, x.OnlineStatus, x.LastCollectTime, x.LastError })
                     .ExecuteCommandAsync();
+
+                await _audit.RecordAsync("Update", "IotDevice", entity.Id, entity.Id,
+                    oldValue: oldEntity == null ? null : JsonSerializer.Serialize(new { oldEntity.Code, oldEntity.Name, oldEntity.DeviceType, oldEntity.GatewayId, oldEntity.SlaveId }),
+                    newValue: JsonSerializer.Serialize(new { entity.Code, entity.Name, entity.DeviceType, entity.GatewayId, entity.SlaveId }),
+                    description: $"修改设备 {entity.Code}（{entity.Name}）");
                 return Result.Success();
             }
             catch (Exception ex)
@@ -133,10 +158,17 @@ namespace Service.Implement.Config
 
             try
             {
+                var oldEntity = await SqlSugarContext.DbContext.Queryable<IotDeviceEntity>()
+                    .Where(x => x.Id == id && x.IsDel == 0).FirstAsync();
+
                 await SqlSugarContext.DbContext.Updateable<IotDeviceEntity>()
                     .SetColumns(x => x.IsDel == 1)
                     .Where(x => x.Id == id)
                     .ExecuteCommandAsync();
+
+                await _audit.RecordAsync("Delete", "IotDevice", id, id,
+                    oldValue: oldEntity == null ? null : JsonSerializer.Serialize(new { oldEntity.Code, oldEntity.Name }),
+                    description: $"删除设备 {oldEntity?.Code}（{oldEntity?.Name}）");
                 return Result.Success();
             }
             catch (Exception ex)
@@ -165,6 +197,31 @@ namespace Service.Implement.Config
             }
         }
 
+        /// <summary>
+        /// 给设备 DTO 填充所属网关名称（GatewayName 展示用）
+        /// </summary>
+        private async Task FillGatewayNames(List<IotDeviceDto> dtos)
+        {
+            if (dtos == null || dtos.Count == 0)
+                return;
+
+            var ids = dtos.Where(x => long.TryParse(x.GatewayId, out var gid) && gid > 0)
+                          .Select(x => long.Parse(x.GatewayId!)).Distinct().ToList();
+            if (ids.Count == 0)
+                return;
+
+            var gateways = await SqlSugarContext.DbContext.Queryable<GatewayEntity>()
+                .Where(x => ids.Contains(x.Id) && x.IsDel == 0)
+                .ToListAsync();
+            var map = gateways.ToDictionary(g => g.Id, g => $"{g.Code}({g.Name})");
+
+            foreach (var d in dtos)
+            {
+                if (long.TryParse(d.GatewayId, out var gid) && map.TryGetValue(gid, out var name))
+                    d.GatewayName = name;
+            }
+        }
+
         /// <summary>
         /// 给设备 DTO 填充所属产品的型号/名称（ProductName 展示用）
         /// </summary>

Service/Implement/Config/GatewayService.cs

@@ -1,12 +1,262 @@
-using Service.Interface;
+using Model;
+using Model.Dto.Config;
+using Model.Entity.Config;
+using Model.Mapper;
+using ORM;
+using Service.Interface.Config;
+using SqlSugar;
+using System.IO.Ports;
+using System.Net;
+using System.Net.Sockets;
 
-namespace Service.Implement
+namespace Service.Implement.Config
 {
     /// <summary>
     /// 网关管理 服务实现
     /// </summary>
     public class GatewayService : IGatewayService
     {
-        // TODO: 实现 网关管理 相关方法
+        public async Task<Result<List<GatewayDto>>> GetPagedAsync(int pageIndex, int pageSize, RefAsync<int> total, string? keyword = null, int? protocolType = null)
+        {
+            try
+            {
+                var list = await SqlSugarContext.DbContext.Queryable<GatewayEntity>()
+                    .Where(x => x.IsDel == 0)
+                    .WhereIF(!string.IsNullOrWhiteSpace(keyword), x => x.Code.Contains(keyword!) || x.Name.Contains(keyword!))
+                    .WhereIF(protocolType.HasValue, x => x.ProtocolType == (IotDeviceProtocolEnum)protocolType!.Value)
+                    .OrderBy(x => x.CreateTime, OrderByType.Desc)
+                    .ToPageListAsync(pageIndex, pageSize, total);
+                return Result<List<GatewayDto>>.Success(list.ToDtoList());
+            }
+            catch (Exception ex)
+            {
+                return Result<List<GatewayDto>>.Error("查询网关列表失败", ex);
+            }
+        }
+
+        public async Task<Result<GatewayDto>> GetByIdAsync(long id)
+        {
+            try
+            {
+                var entity = await SqlSugarContext.DbContext.Queryable<GatewayEntity>()
+                    .Where(x => x.Id == id && x.IsDel == 0).FirstAsync();
+                if (entity == null) return Result<GatewayDto>.Error("网关不存在");
+                return Result<GatewayDto>.Success(entity.ToDto());
+            }
+            catch (Exception ex)
+            {
+                return Result<GatewayDto>.Error("查询网关详情失败", ex);
+            }
+        }
+
+        public async Task<Result<GatewayDto>> AddAsync(GatewayDto dto)
+        {
+            try
+            {
+                // 编码唯一校验
+                var exists = await SqlSugarContext.DbContext.Queryable<GatewayEntity>()
+                    .Where(x => x.Code == dto.Code && x.IsDel == 0).AnyAsync();
+                if (exists) return Result<GatewayDto>.Error($"网关编码「{dto.Code}」已存在");
+
+                var entity = dto.ToEntity();
+                entity.Id = 0; // 雪花ID自动生成
+                var id = await SqlSugarContext.DbContext.Insertable(entity).ExecuteReturnSnowflakeIdAsync();
+                entity.Id = id;
+                return Result<GatewayDto>.Success(entity.ToDto());
+            }
+            catch (Exception ex)
+            {
+                return Result<GatewayDto>.Error("新增网关失败", ex);
+            }
+        }
+
+        public async Task<Result<GatewayDto>> UpdateAsync(GatewayDto dto)
+        {
+            try
+            {
+                if (!long.TryParse(dto.Id, out var id) || id <= 0)
+                    return Result<GatewayDto>.Error("网关Id无效");
+
+                var entity = await SqlSugarContext.DbContext.Queryable<GatewayEntity>()
+                    .Where(x => x.Id == id && x.IsDel == 0).FirstAsync();
+                if (entity == null) return Result<GatewayDto>.Error("网关不存在");
+
+                // 编码唯一校验（排除自身）
+                var codeExists = await SqlSugarContext.DbContext.Queryable<GatewayEntity>()
+                    .Where(x => x.Code == dto.Code && x.Id != id && x.IsDel == 0).AnyAsync();
+                if (codeExists) return Result<GatewayDto>.Error($"网关编码「{dto.Code}」已存在");
+
+                var newEntity = dto.ToEntity();
+                newEntity.Id = id;
+                await SqlSugarContext.DbContext.Updateable(newEntity)
+                    .IgnoreColumns(x => new { x.CreateTime, x.IsDel })
+                    .ExecuteCommandAsync();
+                return Result<GatewayDto>.Success(newEntity.ToDto());
+            }
+            catch (Exception ex)
+            {
+                return Result<GatewayDto>.Error("修改网关失败", ex);
+            }
+        }
+
+        public async Task<Result> DeleteAsync(long id)
+        {
+            try
+            {
+                var entity = await SqlSugarContext.DbContext.Queryable<GatewayEntity>()
+                    .Where(x => x.Id == id && x.IsDel == 0).FirstAsync();
+                if (entity == null) return Result.Error("网关不存在");
+
+                // 软删除网关
+                await SqlSugarContext.DbContext.Updateable<GatewayEntity>()
+                    .SetColumns(x => x.IsDel == 1)
+                    .Where(x => x.Id == id).ExecuteCommandAsync();
+
+                // 该网关下设备的 GatewayId 置 0（不级联删除设备）
+                await SqlSugarContext.DbContext.Updateable<IotDeviceEntity>()
+                    .SetColumns(x => x.GatewayId == 0)
+                    .Where(x => x.GatewayId == id).ExecuteCommandAsync();
+
+                return Result.Success();
+            }
+            catch (Exception ex)
+            {
+                return Result.Error("删除网关失败", ex);
+            }
+        }
+
+        /// <summary>
+        /// 测试网关连接：TCP 尝试 TcpClient.ConnectAsync 3s 超时，串口尝试 SerialPort.Open，
+        /// 成功则 OnlineStatus=Online+更新 LastConnectedTime，失败则 OnlineStatus=Fault+记录 LastError
+        /// </summary>
+        public async Task<Result<GatewayTestResultDto>> TestConnectionAsync(long id)
+        {
+            try
+            {
+                var entity = await SqlSugarContext.DbContext.Queryable<GatewayEntity>()
+                    .Where(x => x.Id == id && x.IsDel == 0).FirstAsync();
+                if (entity == null) return Result<GatewayTestResultDto>.Error("网关不存在");
+
+                bool success = false;
+                string message = "";
+                var now = DateTime.Now;
+
+                switch (entity.ProtocolType)
+                {
+                    case IotDeviceProtocolEnum.ModbusTcp:
+                    case IotDeviceProtocolEnum.Tcp:
+                    case IotDeviceProtocolEnum.S7:
+                        // TCP 类：尝试连接 IP:Port
+                        if (string.IsNullOrWhiteSpace(entity.Host) || !entity.Port.HasValue)
+                        {
+                            message = "未配置 IP 地址或端口号";
+                        }
+                        else
+                        {
+                            (success, message) = await TestTcpAsync(entity.Host, entity.Port!.Value, 3000);
+                        }
+                        break;
+
+                    case IotDeviceProtocolEnum.ModbusRtu:
+                    case IotDeviceProtocolEnum.Serial:
+                        // 串口类：尝试打开串口
+                        if (string.IsNullOrWhiteSpace(entity.ComPort))
+                        {
+                            message = "未配置串口号";
+                        }
+                        else
+                        {
+                            (success, message) = TestSerial(entity.ComPort, entity.BaudRate ?? 9600);
+                        }
+                        break;
+
+                    default:
+                        message = $"暂不支持 {entity.ProtocolType} 协议的连接测试";
+                        break;
+                }
+
+                // 更新网关状态
+                await SqlSugarContext.DbContext.Updateable<GatewayEntity>()
+                    .SetColumns(x => new GatewayEntity
+                    {
+                        OnlineStatus = success ? (byte)1 : (byte)3,
+                        LastConnectedTime = success ? now : x.LastConnectedTime,
+                        LastError = success ? null : message
+                    })
+                    .Where(x => x.Id == id).ExecuteCommandAsync();
+
+                return Result<GatewayTestResultDto>.Success(new GatewayTestResultDto
+                {
+                    Success = success,
+                    Message = success ? $"连接成功（{entity.Host}:{entity.Port ?? 0}）" : message
+                });
+            }
+            catch (Exception ex)
+            {
+                return Result<GatewayTestResultDto>.Error("测试连接失败", ex);
+            }
+        }
+
+        public async Task<Result<List<GatewayOptionDto>>> GetOptionsAsync()
+        {
+            try
+            {
+                var list = await SqlSugarContext.DbContext.Queryable<GatewayEntity>()
+                    .Where(x => x.IsDel == 0 && x.IsEnabled)
+                    .OrderBy(x => x.Code)
+                    .ToListAsync();
+                return Result<List<GatewayOptionDto>>.Success(list.ToOptionDtoList());
+            }
+            catch (Exception ex)
+            {
+                return Result<List<GatewayOptionDto>>.Error("查询网关选项失败", ex);
+            }
+        }
+
+        #region 私有：连接测试方法
+
+        private static async Task<(bool success, string message)> TestTcpAsync(string host, int port, int timeoutMs)
+        {
+            try
+            {
+                using var client = new TcpClient();
+                var cts = new System.Threading.CancellationTokenSource(timeoutMs);
+                await client.ConnectAsync(host, port, cts.Token);
+                return (true, "");
+            }
+            catch (OperationCanceledException)
+            {
+                return (false, $"连接超时（{timeoutMs / 1000}s）：{host}:{port}");
+            }
+            catch (SocketException ex)
+            {
+                return (false, $"连接失败：{host}:{port}（{ex.Message}）");
+            }
+            catch (Exception ex)
+            {
+                return (false, $"连接异常：{ex.Message}");
+            }
+        }
+
+        private static (bool success, string message) TestSerial(string comPort, int baudRate)
+        {
+            try
+            {
+                using var sp = new SerialPort(comPort, baudRate);
+                sp.Open();
+                sp.Close();
+                return (true, "");
+            }
+            catch (UnauthorizedAccessException)
+            {
+                return (false, $"串口 {comPort} 被占用");
+            }
+            catch (Exception ex)
+            {
+                return (false, $"打开串口 {comPort} 失败：{ex.Message}");
+            }
+        }
+
+        #endregion
     }
 }

Service/Implement/System/AuditLogService.cs

@@ -0,0 +1,45 @@
+using Model;
+using Model.Dto.System;
+using Model.Entity.System;
+using Model.Mapper;
+using ORM;
+using Service.Interface;
+using SqlSugar;
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+
+namespace Service.Implement
+{
+    /// <summary>
+    /// 审计日志 服务实现（查询端；写入端在各业务服务中直接插 AuditLogEntity，或经 AuditHelper）
+    /// </summary>
+    public class AuditLogService : IAuditLogService
+    {
+        public async Task<Result<List<AuditLogDto>>> GetPagedAsync(int pageIndex, int pageSize, RefAsync<int> total,
+            string? keyword = null, string? operationType = null, string? operationTarget = null,
+            DateTime? startTime = null, DateTime? endTime = null)
+        {
+            try
+            {
+                var list = await SqlSugarContext.DbContext.Queryable<AuditLogEntity>()
+                    .Where(x => x.IsDel == 0)
+                    .WhereIF(!string.IsNullOrWhiteSpace(keyword),
+                        x => (x.UserName != null && x.UserName.Contains(keyword!))
+                          || (x.Description != null && x.Description.Contains(keyword!))
+                          || (x.RoleName != null && x.RoleName.Contains(keyword!)))
+                    .WhereIF(!string.IsNullOrWhiteSpace(operationType), x => x.OperationType == operationType)
+                    .WhereIF(!string.IsNullOrWhiteSpace(operationTarget), x => x.OperationTarget == operationTarget)
+                    .WhereIF(startTime.HasValue, x => x.OperateTime >= startTime!.Value)
+                    .WhereIF(endTime.HasValue, x => x.OperateTime <= endTime!.Value)
+                    .OrderBy(x => x.OperateTime, OrderByType.Desc)
+                    .ToPageListAsync(pageIndex, pageSize, total);
+                return Result<List<AuditLogDto>>.Success(list.ToDtoList());
+            }
+            catch (Exception ex)
+            {
+                return Result<List<AuditLogDto>>.Error("查询审计日志失败", ex);
+            }
+        }
+    }
+}

Service/Implement/System/AuditRecorder.cs

@@ -0,0 +1,58 @@
+using Microsoft.Extensions.Logging;
+using Model.Entity.System;
+using ORM;
+using Service.Interface;
+using SqlSugar;
+
+namespace Service.Implement
+{
+    /// <summary>
+    /// 审计日志记录器实现：操作人/角色自动取自 ICurrentUser（JWT Claims），失败不抛出（审计不应阻断业务）
+    /// </summary>
+    public class AuditRecorder : IAuditRecorder
+    {
+        private readonly ICurrentUser _currentUser;
+        private readonly ILogger<AuditRecorder> _logger;
+
+        public AuditRecorder(ICurrentUser currentUser, ILogger<AuditRecorder> logger)
+        {
+            _currentUser = currentUser;
+            _logger = logger;
+        }
+
+        public async Task RecordAsync(string operationType, string operationTarget, long targetId,
+            long deviceId = 0, string? oldValue = null, string? newValue = null,
+            string? ip = null, string? description = null)
+        {
+            try
+            {
+                var now = DateTime.Now;
+                var roleId = _currentUser.RoleIds.FirstOrDefault();
+                var roleName = _currentUser.RoleNames.FirstOrDefault();
+                await SqlSugarContext.DbContext.Insertable(new AuditLogEntity
+                {
+                    UserId = _currentUser.UserId,
+                    UserName = _currentUser.UserName,
+                    RoleId = roleId,
+                    RoleName = roleName ?? "",
+                    OperationType = operationType,
+                    OperationTarget = operationTarget,
+                    TargetId = targetId,
+                    DeviceId = deviceId,
+                    OldValue = oldValue,
+                    NewValue = newValue,
+                    Ip = ip,
+                    Description = description,
+                    OperateTime = now,
+                    CreateTime = now
+                }).ExecuteCommandAsync();
+            }
+            catch (Exception ex)
+            {
+                // 审计失败只记日志，不阻断业务
+                _logger.LogError(ex, "写审计日志失败（{OperationType} {OperationTarget} {TargetId}）",
+                    operationType, operationTarget, targetId);
+            }
+        }
+    }
+}

Service/Implement/System/AuthService.cs

@@ -0,0 +1,252 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Text;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging;
+using Microsoft.IdentityModel.Tokens;
+using Model;
+using Model.Dto.System;
+using Model.Entity.System;
+using Model.Mapper;
+using ORM;
+using Service.Interface;
+using SqlSugar;
+
+namespace Service.Implement
+{
+    /// <summary>
+    /// 认证授权 服务实现：登录校验 → 加载角色/权限 → 签发 JWT（权限编码写入 Claims）
+    /// </summary>
+    public class AuthService : IAuthService
+    {
+        private readonly IConfiguration _configuration;
+        private readonly ICurrentUser _currentUser;
+        private readonly ILogger<AuthService> _logger;
+
+        public AuthService(IConfiguration configuration, ICurrentUser currentUser, ILogger<AuthService> logger)
+        {
+            _configuration = configuration;
+            _currentUser = currentUser;
+            _logger = logger;
+        }
+
+        public async Task<Result<LoginResultDto>> LoginAsync(LoginDto dto, string? ip)
+        {
+            if (dto == null || string.IsNullOrWhiteSpace(dto.UserName) || string.IsNullOrWhiteSpace(dto.Password))
+                return Result<LoginResultDto>.Error("用户名和密码不能为空");
+
+            try
+            {
+                var user = await SqlSugarContext.DbContext.Queryable<UserEntity>()
+                    .Where(x => x.UserName == dto.UserName && x.IsDel == 0).FirstAsync();
+                if (user == null)
+                    return Result<LoginResultDto>.Error("用户名或密码错误");
+                if (user.IsEnabled == 0)
+                    return Result<LoginResultDto>.Error("账号已被禁用，请联系管理员");
+                if (!PasswordHelper.Verify(dto.Password, user.PasswordHash))
+                    return Result<LoginResultDto>.Error("用户名或密码错误");
+
+                // 加载角色与权限
+                var (roleIds, roleNames, permissionCodes, dataScope) = await LoadUserAuthAsync(user.Id);
+
+                // 签发 JWT
+                var token = GenerateJwt(user, roleIds, roleNames, permissionCodes, dataScope);
+
+                // 更新最后登录时间
+                await SqlSugarContext.DbContext.Updateable<UserEntity>()
+                    .SetColumns(x => x.LastLoginTime == DateTime.Now)
+                    .Where(x => x.Id == user.Id).ExecuteCommandAsync();
+
+                // 登录审计
+                await WriteAuditAsync(user.Id, user.UserName, roleIds.FirstOrDefault(), roleNames.FirstOrDefault(),
+                    "Login", "User", user.Id, 0, null, null, ip, $"用户 {user.UserName} 登录系统");
+
+                var userDto = user.ToDto();
+                userDto.RoleIds = roleIds.Select(r => r.ToString()).ToList();
+                userDto.RoleNames = string.Join(",", roleNames);
+                return Result<LoginResultDto>.Success(new LoginResultDto
+                {
+                    Token = token,
+                    RefreshToken = token,
+                    User = userDto,
+                    Permissions = permissionCodes
+                });
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "登录异常");
+                return Result<LoginResultDto>.Error("登录失败", ex);
+            }
+        }
+
+        public async Task<Result> LogoutAsync()
+        {
+            if (!_currentUser.IsAuthenticated)
+                return Result.Success();
+            try
+            {
+                await WriteAuditAsync(_currentUser.UserId, _currentUser.UserName,
+                    _currentUser.RoleIds.FirstOrDefault(), _currentUser.RoleNames.FirstOrDefault(),
+                    "Logout", "User", _currentUser.UserId, 0, null, null, null,
+                    $"用户 {_currentUser.UserName} 退出登录");
+                return Result.Success();
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "退出登录记录审计失败");
+                return Result.Success(); // 退出本身不应失败
+            }
+        }
+
+        public async Task<Result<LoginResultDto>> GetMeAsync()
+        {
+            if (!_currentUser.IsAuthenticated)
+                return Result<LoginResultDto>.Error("未登录或 Token 已失效");
+
+            try
+            {
+                var user = await SqlSugarContext.DbContext.Queryable<UserEntity>()
+                    .Where(x => x.Id == _currentUser.UserId && x.IsDel == 0).FirstAsync();
+                if (user == null)
+                    return Result<LoginResultDto>.Error("用户不存在或已被删除");
+
+                var userDto = user.ToDto();
+                userDto.RoleIds = _currentUser.RoleIds.Select(r => r.ToString()).ToList();
+                userDto.RoleNames = string.Join(",", _currentUser.RoleNames);
+                return Result<LoginResultDto>.Success(new LoginResultDto
+                {
+                    Token = "",
+                    RefreshToken = "",
+                    User = userDto,
+                    Permissions = _currentUser.Permissions
+                });
+            }
+            catch (Exception ex)
+            {
+                return Result<LoginResultDto>.Error("获取当前用户信息失败", ex);
+            }
+        }
+
+        public async Task<Result> ChangePasswordAsync(ChangePasswordDto dto)
+        {
+            if (dto == null || string.IsNullOrWhiteSpace(dto.OldPassword) || string.IsNullOrWhiteSpace(dto.NewPassword))
+                return Result.Error("原密码和新密码不能为空");
+            if (dto.NewPassword.Length < 6)
+                return Result.Error("新密码长度不能少于 6 位");
+            if (!_currentUser.IsAuthenticated)
+                return Result.Error("未登录或 Token 已失效");
+
+            try
+            {
+                var user = await SqlSugarContext.DbContext.Queryable<UserEntity>()
+                    .Where(x => x.Id == _currentUser.UserId && x.IsDel == 0).FirstAsync();
+                if (user == null)
+                    return Result.Error("用户不存在或已被删除");
+                if (!PasswordHelper.Verify(dto.OldPassword, user.PasswordHash))
+                    return Result.Error("原密码错误");
+
+                await SqlSugarContext.DbContext.Updateable<UserEntity>()
+                    .SetColumns(x => x.PasswordHash == PasswordHelper.Hash(dto.NewPassword))
+                    .Where(x => x.Id == user.Id).ExecuteCommandAsync();
+
+                await WriteAuditAsync(user.Id, user.UserName, _currentUser.RoleIds.FirstOrDefault(), _currentUser.RoleNames.FirstOrDefault(),
+                    "Update", "User", user.Id, 0, null, null, null, $"用户 {user.UserName} 修改了自己的密码");
+                return Result.Success();
+            }
+            catch (Exception ex)
+            {
+                return Result.Error("修改密码失败", ex);
+            }
+        }
+
+        /// <summary>
+        /// 加载用户的角色Id/角色名/权限编码/数据范围（取所有角色的并集，数据范围取最宽）
+        /// </summary>
+        public static async Task<(List<long> roleIds, List<string> roleNames, List<string> permissions, byte dataScope)>
+            LoadUserAuthAsync(long userId)
+        {
+            var db = SqlSugarContext.DbContext;
+            var roleIds = await db.Queryable<UserRoleEntity>()
+                .Where(x => x.UserId == userId)
+                .Select(x => x.RoleId)
+                .ToListAsync();
+
+            var roleList = new List<RoleEntity>();
+            if (roleIds.Count > 0)
+                roleList = await db.Queryable<RoleEntity>()
+                    .Where(x => roleIds.Contains(x.Id) && x.IsDel == 0).ToListAsync();
+
+            var permissionCodes = new List<string>();
+            if (roleIds.Count > 0)
+            {
+                var permIds = await db.Queryable<RolePermissionEntity>()
+                    .Where(x => roleIds.Contains(x.RoleId))
+                    .Select(x => x.PermissionId)
+                    .ToListAsync();
+                if (permIds.Count > 0)
+                {
+                    var perms = await db.Queryable<PermissionEntity>()
+                        .Where(x => permIds.Contains(x.Id) && x.IsDel == 0).ToListAsync();
+                    permissionCodes = perms.Select(p => p.Code).Distinct().ToList();
+                }
+            }
+
+            // 数据范围取最宽：任一角色是"全部"即为全部
+            var dataScope = roleList.Count > 0 ? roleList.Min(r => r.DataScope) : (byte)2;
+            return (roleIds, roleList.Select(r => r.Name).ToList(), permissionCodes, dataScope);
+        }
+
+        /// <summary>生成 JWT：把用户身份 + 角色 + 权限编码全部写入 Claims（授权过滤器免查库）</summary>
+        private string GenerateJwt(UserEntity user, List<long> roleIds, List<string> roleNames, List<string> permissions, byte dataScope)
+        {
+            var jwt = _configuration.GetSection("Jwt");
+            var secret = jwt["SecretKey"]!;
+            var issuer = jwt["Issuer"] ?? "IOT-API";
+            var audience = jwt["Audience"] ?? "IOT-Web";
+            var expireMinutes = double.TryParse(jwt["ExpireMinutes"], out var m) ? m : 480;
+
+            var claims = new List<Claim>
+            {
+                new(JwtRegisteredClaimNames.Sub, user.Id.ToString()),
+                new(ClaimTypes.NameIdentifier, user.Id.ToString()),
+                new(ClaimTypes.Name, user.UserName),
+                new("roleIds", string.Join(",", roleIds)),
+                new("roleNames", string.Join(",", roleNames)),
+                new("permissions", string.Join(",", permissions)),
+                new("dataScope", dataScope.ToString()),
+                new(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString("N"))
+            };
+
+            var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secret));
+            var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
+            var token = new JwtSecurityToken(issuer, audience, claims,
+                expires: DateTime.Now.AddMinutes(expireMinutes), signingCredentials: creds);
+            return new JwtSecurityTokenHandler().WriteToken(token);
+        }
+
+        /// <summary>写一条审计日志</summary>
+        private static async Task WriteAuditAsync(long userId, string? userName, long? roleId, string? roleName,
+            string operationType, string operationTarget, long targetId, long deviceId,
+            string? oldValue, string? newValue, string? ip, string? description)
+        {
+            var now = DateTime.Now;
+            await SqlSugarContext.DbContext.Insertable(new AuditLogEntity
+            {
+                UserId = userId,
+                UserName = userName ?? "",
+                RoleId = roleId ?? 0,
+                RoleName = roleName ?? "",
+                OperationType = operationType,
+                OperationTarget = operationTarget,
+                TargetId = targetId,
+                DeviceId = deviceId,
+                OldValue = oldValue,
+                NewValue = newValue,
+                Ip = ip,
+                Description = description,
+                OperateTime = now,
+                CreateTime = now
+            }).ExecuteCommandAsync();
+        }
+    }
+}

Service/Implement/System/DataSeeder.cs

@@ -0,0 +1,124 @@
+using Model.Entity.System;
+using ORM;
+
+namespace Service.Implement
+{
+    /// <summary>
+    /// RBAC 数据种子：预定义 4 个系统角色 + 6 个权限 + 默认管理员账号（admin/admin123）
+    /// 幂等：按 Code 查存在性，存在则跳过；可重复执行
+    /// </summary>
+    public static class DataSeeder
+    {
+        /// <summary>数据范围：1=全部, 2=本实验室</summary>
+        public const byte DataScopeAll = 1;
+        public const byte DataScopeLab = 2;
+
+        /// <summary>6 个系统权限编码</summary>
+        public static readonly (string Code, string Name, string Group)[] Permissions =
+        {
+            ("device:view",       "查看设备", "device"),
+            ("device:edit",       "编辑设备", "device"),
+            ("device:control",    "控制设备", "device"),
+            ("alert:confirm",     "确认告警", "alert"),
+            ("inspection:manage", "巡检管理", "inspection"),
+            ("user:manage",       "用户管理", "user")
+        };
+
+        /// <summary>
+        /// 4 个预定义角色：超级管理员(全部) / 实验室管理员(本实验室) / 设备操作员(本实验室) / 维修工程师(本实验室)
+        /// 权限矩阵严格按需求文档
+        /// </summary>
+        public static readonly (string Code, string Name, byte DataScope, string[] Permissions)[] Roles =
+        {
+            ("superadmin",  "超级管理员",   DataScopeAll, new[] { "device:view", "device:edit", "device:control", "alert:confirm", "inspection:manage", "user:manage" }),
+            ("labadmin",    "实验室管理员", DataScopeLab, new[] { "device:view", "device:edit", "device:control", "alert:confirm", "inspection:manage" }),
+            ("operator",    "设备操作员",   DataScopeLab, new[] { "device:view", "inspection:manage" }),
+            ("maintengineer", "维修工程师", DataScopeLab, new[] { "device:view", "device:edit", "device:control", "alert:confirm" })
+        };
+
+        public static void Seed()
+        {
+            try
+            {
+                var db = SqlSugarContext.DbContext;
+                var now = DateTime.Now;
+
+                // 1. 权限种子
+                var permIdByCode = new Dictionary<string, long>();
+                foreach (var (code, name, group) in Permissions)
+                {
+                    var existing = db.Queryable<PermissionEntity>().Where(x => x.Code == code).First();
+                    if (existing != null) { permIdByCode[code] = existing.Id; continue; }
+                    var perm = new PermissionEntity
+                    {
+                        Code = code, Name = name, Group = group, IsSystem = 1,
+                        Sort = Array.FindIndex(Permissions, p => p.Code == code),
+                        CreateTime = now
+                    };
+                    var id = db.Insertable(perm).ExecuteReturnSnowflakeId();
+                    permIdByCode[code] = id;
+                }
+
+                // 2. 角色种子 + 角色-权限关联
+                foreach (var (code, name, scope, perms) in Roles)
+                {
+                    var role = db.Queryable<RoleEntity>().Where(x => x.Code == code).First();
+                    long roleId;
+                    if (role == null)
+                    {
+                        role = new RoleEntity
+                        {
+                            Code = code, Name = name, DataScope = scope, IsSystem = 1,
+                            Sort = Array.FindIndex(Roles, r => r.Code == code),
+                            Remark = "系统预定义角色",
+                            CreateTime = now
+                        };
+                        roleId = db.Insertable(role).ExecuteReturnSnowflakeId();
+                    }
+                    else
+                    {
+                        roleId = role.Id;
+                    }
+
+                    // 补齐角色-权限关联（只加不删，避免覆盖管理员自定义调整）
+                    foreach (var permCode in perms)
+                    {
+                        if (!permIdByCode.TryGetValue(permCode, out var permId)) continue;
+                        var linkExists = db.Queryable<RolePermissionEntity>()
+                            .Where(x => x.RoleId == roleId && x.PermissionId == permId).Any();
+                        if (!linkExists)
+                        {
+                            db.Insertable(new RolePermissionEntity { RoleId = roleId, PermissionId = permId, CreateTime = now }).ExecuteCommand();
+                        }
+                    }
+                }
+
+                // 3. 默认管理员账号（admin/admin123，挂在超级管理员角色）
+                var adminExists = db.Queryable<UserEntity>().Where(x => x.UserName == "admin" && x.IsDel == 0).Any();
+                if (!adminExists)
+                {
+                    var superAdmin = db.Queryable<RoleEntity>().Where(x => x.Code == "superadmin").First();
+                    var admin = new UserEntity
+                    {
+                        UserName = "admin",
+                        PasswordHash = PasswordHelper.Hash("admin123"),
+                        RealName = "系统管理员",
+                        IsEnabled = 1,
+                        Remark = "系统默认管理员（首次登录后请修改密码）",
+                        CreateTime = now
+                    };
+                    var adminId = db.Insertable(admin).ExecuteReturnSnowflakeId();
+                    if (superAdmin != null)
+                    {
+                        db.Insertable(new UserRoleEntity { UserId = adminId, RoleId = superAdmin.Id, CreateTime = now }).ExecuteCommand();
+                    }
+                }
+            }
+            catch (Exception)
+            {
+                // 种子失败不阻断启动（例如表刚建好并发场景），下次启动会重试
+                throw;
+            }
+        }
+    }
+}

Service/Implement/System/OrgService.cs

@@ -0,0 +1,332 @@
+using Model;
+using Model.Dto.System;
+using Model.Entity.System;
+using Model.Mapper;
+using ORM;
+using Service.Interface;
+using SqlSugar;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+
+namespace Service.Implement
+{
+    /// <summary>
+    /// 组织架构管理 服务实现
+    /// </summary>
+    public class OrgService : IOrgService
+    {
+        private readonly IAuditRecorder _audit;
+
+        public OrgService(IAuditRecorder audit)
+        {
+            _audit = audit;
+        }
+
+        public async Task<Result<List<OrgTreeDto>>> GetTreeAsync()
+        {
+            try
+            {
+                var db = SqlSugarContext.DbContext;
+                var all = await db.Queryable<OrgEntity>()
+                    .Where(x => x.IsDel == 0)
+                    .OrderBy(x => x.Sort).OrderBy(x => x.Code)
+                    .ToListAsync();
+
+                // 聚合每个组织下的用户角色 + 数据范围（ScopeSummary/用户数展示用）
+                var users = await db.Queryable<UserEntity>()
+                    .Where(x => x.IsDel == 0)
+                    .Select(x => new { x.Id, x.OrgId })
+                    .ToListAsync();
+                var userIds = users.Select(u => u.Id).ToList();
+                var roleLinks = userIds.Count > 0
+                    ? await db.Queryable<UserRoleEntity>().Where(x => userIds.Contains(x.UserId)).ToListAsync()
+                    : new List<UserRoleEntity>();
+                var roleIds = roleLinks.Select(l => l.RoleId).Distinct().ToList();
+                var roles = roleIds.Count > 0
+                    ? await db.Queryable<RoleEntity>().Where(x => roleIds.Contains(x.Id) && x.IsDel == 0).ToListAsync()
+                    : new List<RoleEntity>();
+                var roleMap = roles.ToDictionary(r => r.Id, r => r);
+
+                // userId -> 角色数据范围标签列表（如「超级管理员·全部」）
+                var userScopeTags = new Dictionary<long, List<string>>();
+                foreach (var link in roleLinks)
+                {
+                    if (!roleMap.TryGetValue(link.RoleId, out var role)) continue;
+                    var tag = $"{role.Name}·{ScopeLabel(role.DataScope)}";
+                    if (!userScopeTags.TryGetValue(link.UserId, out var list))
+                        userScopeTags[link.UserId] = list = new List<string>();
+                    if (!list.Contains(tag)) list.Add(tag);
+                }
+
+                // orgId -> 直接挂靠用户Id列表
+                var orgUsers = users.GroupBy(u => u.OrgId).ToDictionary(g => g.Key, g => g.Select(u => u.Id).ToList());
+
+                var tree = BuildTreeWithStats(all, 0, orgUsers, userScopeTags);
+                return Result<List<OrgTreeDto>>.Success(tree);
+            }
+            catch (Exception ex)
+            {
+                return Result<List<OrgTreeDto>>.Error("查询组织树失败", ex);
+            }
+        }
+
+        /// <summary>
+        /// 建树并聚合统计：用户数（含下级）+ 数据权限摘要（子树内用户角色的数据范围并集）
+        /// </summary>
+        private static List<OrgTreeDto> BuildTreeWithStats(List<OrgEntity> all, long parentId,
+            Dictionary<long, List<long>> orgUsers, Dictionary<long, List<string>> userScopeTags)
+        {
+            var nodes = new List<OrgTreeDto>();
+            foreach (var entity in all.Where(x => x.ParentId == parentId).OrderBy(x => x.Sort).ThenBy(x => x.Code))
+            {
+                var node = entity.ToTreeDto();
+                node.Children = BuildTreeWithStats(all, entity.Id, orgUsers, userScopeTags);
+
+                // 本节点直接用户
+                orgUsers.TryGetValue(entity.Id, out var directUserIds);
+                node.UserCount = directUserIds?.Count ?? 0;
+
+                // 汇总子树：用户总数 + 数据权限标签并集
+                var scopes = new List<string>();
+                if (directUserIds != null)
+                {
+                    foreach (var uid in directUserIds)
+                        if (userScopeTags.TryGetValue(uid, out var tags))
+                            foreach (var t in tags)
+                                if (!scopes.Contains(t)) scopes.Add(t);
+                }
+                var total = node.UserCount;
+                foreach (var child in node.Children)
+                {
+                    total += child.TotalUserCount;
+                    foreach (var t in child.ScopeSummary)
+                        if (!scopes.Contains(t)) scopes.Add(t);
+                }
+                node.TotalUserCount = total;
+                node.ScopeSummary = scopes;
+
+                nodes.Add(node);
+            }
+            return nodes;
+        }
+
+        /// <summary>数据范围标签：1=全部, 2=本组织及下级</summary>
+        private static string ScopeLabel(byte dataScope) => dataScope == 1 ? "全部" : "本组织及下级";
+
+        public async Task<Result<OrgDto>> AddAsync(OrgDto dto)
+        {
+            if (dto == null || string.IsNullOrWhiteSpace(dto.Name) || string.IsNullOrWhiteSpace(dto.Code))
+                return Result<OrgDto>.Error("组织名称和编码不能为空");
+
+            try
+            {
+                var exists = await SqlSugarContext.DbContext.Queryable<OrgEntity>()
+                    .Where(x => x.Code == dto.Code && x.IsDel == 0).AnyAsync();
+                if (exists) return Result<OrgDto>.Error($"组织编码「{dto.Code}」已存在");
+
+                // 父节点校验 + 层级固定校验（根节点必须是公司）
+                var parentId = ParseParent(dto.ParentId);
+                if (parentId > 0)
+                {
+                    var parent = await SqlSugarContext.DbContext.Queryable<OrgEntity>()
+                        .Where(x => x.Id == parentId && x.IsDel == 0).FirstAsync();
+                    if (parent == null) return Result<OrgDto>.Error("父级组织不存在");
+                    var hierarchyError = ValidateHierarchy(parent.OrgType, (byte)dto.OrgType);
+                    if (hierarchyError != null) return Result<OrgDto>.Error(hierarchyError.Msg);
+                }
+                else if (dto.OrgType != 1)
+                {
+                    return Result<OrgDto>.Error("根节点只能是公司");
+                }
+
+                // 班次仅班组有效
+                var shiftType = dto.OrgType == 4 ? (byte)Math.Max(1, dto.ShiftType) : (byte)0;
+
+                var entity = dto.ToEntity();
+                entity.Id = 0;
+                entity.ParentId = parentId;
+                entity.ShiftType = shiftType;
+                entity.CreateTime = DateTime.Now;
+                var id = await SqlSugarContext.DbContext.Insertable(entity).ExecuteReturnSnowflakeIdAsync();
+                entity.Id = id;
+
+                await _audit.RecordAsync("Create", "Org", id, 0,
+                    newValue: $"[{OrgTypeName(entity.OrgType)}] {entity.Code}({entity.Name})",
+                    description: $"新增组织 {entity.Name}");
+                return Result<OrgDto>.Success(entity.ToDto());
+            }
+            catch (Exception ex)
+            {
+                return Result<OrgDto>.Error("新增组织失败", ex);
+            }
+        }
+
+        public async Task<Result<OrgDto>> UpdateAsync(OrgDto dto)
+        {
+            if (dto == null || !long.TryParse(dto.Id, out var id) || id <= 0)
+                return Result<OrgDto>.Error("组织Id无效");
+
+            try
+            {
+                var entity = await SqlSugarContext.DbContext.Queryable<OrgEntity>()
+                    .Where(x => x.Id == id && x.IsDel == 0).FirstAsync();
+                if (entity == null) return Result<OrgDto>.Error("组织不存在或已被删除");
+
+                var codeExists = await SqlSugarContext.DbContext.Queryable<OrgEntity>()
+                    .Where(x => x.Code == dto.Code && x.Id != id && x.IsDel == 0).AnyAsync();
+                if (codeExists) return Result<OrgDto>.Error($"组织编码「{dto.Code}」已存在");
+
+                var parentId = ParseParent(dto.ParentId);
+                if (parentId == id)
+                    return Result<OrgDto>.Error("父级不能是自己");
+
+                // 层级固定：组织类型创建后不可变更
+                if (dto.OrgType != entity.OrgType)
+                    return Result<OrgDto>.Error($"组织层级固定，类型不可变更（当前为「{OrgTypeName(entity.OrgType)}」）");
+
+                // 换父级时不能挂到自己的子孙下面（否则成环），且层级必须匹配
+                if (parentId != entity.ParentId && parentId > 0)
+                {
+                    var all = await SqlSugarContext.DbContext.Queryable<OrgEntity>()
+                        .Where(x => x.IsDel == 0).ToListAsync();
+                    var subtreeIds = CollectSubtreeIds(all, id);
+                    if (subtreeIds.Contains(parentId))
+                        return Result<OrgDto>.Error("不能把组织挂到自己的下级下面");
+                    var newParent = all.FirstOrDefault(x => x.Id == parentId);
+                    if (newParent == null)
+                        return Result<OrgDto>.Error("目标父级组织不存在");
+                    var hierarchyError = ValidateHierarchy(newParent.OrgType, entity.OrgType);
+                    if (hierarchyError != null) return Result<OrgDto>.Error(hierarchyError.Msg);
+                }
+
+                var oldEntity = entity;
+                var newEntity = dto.ToEntity();
+                newEntity.Id = id;
+                newEntity.ParentId = parentId;
+                newEntity.OrgType = entity.OrgType; // 类型不可变
+                // 班次仅班组有效
+                newEntity.ShiftType = entity.OrgType == 4 ? (byte)Math.Max(1, dto.ShiftType) : (byte)0;
+                await SqlSugarContext.DbContext.Updateable(newEntity)
+                    .IgnoreColumns(x => new { x.CreateTime, x.IsDel })
+                    .ExecuteCommandAsync();
+
+                await _audit.RecordAsync("Update", "Org", id, 0,
+                    oldValue: $"[{OrgTypeName(oldEntity.OrgType)}] {oldEntity.Name}",
+                    newValue: $"[{OrgTypeName(newEntity.OrgType)}] {newEntity.Name}",
+                    description: $"修改组织 {newEntity.Name}");
+                return Result<OrgDto>.Success(newEntity.ToDto());
+            }
+            catch (Exception ex)
+            {
+                return Result<OrgDto>.Error("修改组织失败", ex);
+            }
+        }
+
+        public async Task<Result> DeleteAsync(long id)
+        {
+            if (id <= 0) return Result.Error("组织Id无效");
+            try
+            {
+                var entity = await SqlSugarContext.DbContext.Queryable<OrgEntity>()
+                    .Where(x => x.Id == id && x.IsDel == 0).FirstAsync();
+                if (entity == null) return Result.Error("组织不存在或已被删除");
+
+                var hasChildren = await SqlSugarContext.DbContext.Queryable<OrgEntity>()
+                    .Where(x => x.ParentId == id && x.IsDel == 0).AnyAsync();
+                if (hasChildren)
+                    return Result.Error($"组织「{entity.Name}」下存在子组织，请先删除子组织");
+
+                var hasUsers = await SqlSugarContext.DbContext.Queryable<UserEntity>()
+                    .Where(x => x.OrgId == id && x.IsDel == 0).AnyAsync();
+                if (hasUsers)
+                    return Result.Error($"组织「{entity.Name}」下仍有用户，请先移出用户");
+
+                await SqlSugarContext.DbContext.Updateable<OrgEntity>()
+                    .SetColumns(x => x.IsDel == 1)
+                    .Where(x => x.Id == id).ExecuteCommandAsync();
+
+                await _audit.RecordAsync("Delete", "Org", id, 0,
+                    oldValue: $"[{OrgTypeName(entity.OrgType)}] {entity.Code}({entity.Name})",
+                    description: $"删除组织 {entity.Name}");
+                return Result.Success();
+            }
+            catch (Exception ex)
+            {
+                return Result.Error("删除组织失败", ex);
+            }
+        }
+
+        public async Task<Result<List<OrgOptionDto>>> GetOptionsAsync()
+        {
+            try
+            {
+                var list = await SqlSugarContext.DbContext.Queryable<OrgEntity>()
+                    .Where(x => x.IsDel == 0)
+                    .OrderBy(x => x.Sort).OrderBy(x => x.Code)
+                    .ToListAsync();
+                return Result<List<OrgOptionDto>>.Success(list.ToOptionDtoList());
+            }
+            catch (Exception ex)
+            {
+                return Result<List<OrgOptionDto>>.Error("查询组织选项失败", ex);
+            }
+        }
+
+        public async Task<List<long>> GetSubtreeIdsAsync(long orgId)
+        {
+            if (orgId <= 0) return new List<long>();
+            var all = await SqlSugarContext.DbContext.Queryable<OrgEntity>()
+                .Where(x => x.IsDel == 0).ToListAsync();
+            return CollectSubtreeIds(all, orgId);
+        }
+
+        #region 私有工具
+
+        /// <summary>收集指定组织及其全部子孙 Id（含自身）</summary>
+        public static List<long> CollectSubtreeIds(List<OrgEntity> all, long orgId)
+        {
+            var result = new List<long>();
+            var stack = new Stack<long>();
+            stack.Push(orgId);
+            while (stack.Count > 0)
+            {
+                var current = stack.Pop();
+                result.Add(current);
+                foreach (var child in all.Where(x => x.ParentId == current))
+                    stack.Push(child.Id);
+            }
+            return result;
+        }
+
+        private static long ParseParent(string? parentId)
+            => long.TryParse(parentId, out var v) ? v : 0;
+
+        /// <summary>层级固定校验：公司(1)→实验室(2)→部门(3)→班组(4)，子级类型必须=父级类型+1</summary>
+        private static Result? ValidateHierarchy(byte parentType, byte childType)
+        {
+            var validChild = parentType switch
+            {
+                1 => (byte)2, // 公司下只能建实验室
+                2 => (byte)3, // 实验室下只能建部门
+                3 => (byte)4, // 部门下只能建班组
+                _ => (byte)0  // 班组不能再有下级
+            };
+            if (childType != validChild)
+                return Result.Error($"组织层级固定：公司→实验室→部门→班组，该节点下只能建「{OrgTypeName(validChild)}」");
+            return null;
+        }
+
+        private static string OrgTypeName(byte orgType) => orgType switch
+        {
+            1 => "公司",
+            2 => "实验室",
+            3 => "部门",
+            4 => "班组",
+            _ => "组织"
+        };
+
+        #endregion
+    }
+}

Service/Implement/System/PasswordHelper.cs

@@ -0,0 +1,49 @@
+using System.Security.Cryptography;
+using System.Text;
+
+namespace Service.Implement
+{
+    /// <summary>
+    /// 密码哈希工具（PBKDF2-SHA256，格式 salt$hash，盐随机 16 字节）
+    /// </summary>
+    public static class PasswordHelper
+    {
+        private const int Iterations = 10_000;
+        private const int SaltSize = 16;
+        private const int HashSize = 32;
+
+        /// <summary>生成密码哈希（salt$hash）</summary>
+        public static string Hash(string password)
+        {
+            var salt = RandomNumberGenerator.GetBytes(SaltSize);
+            var hash = Rfc2898DeriveBytes.Pbkdf2(password, salt, Iterations, HashAlgorithmName.SHA256, HashSize);
+            return $"{Convert.ToHexString(salt)}${Convert.ToHexString(hash)}";
+        }
+
+        /// <summary>校验密码是否匹配</summary>
+        public static bool Verify(string password, string? stored)
+        {
+            if (string.IsNullOrWhiteSpace(stored)) return false;
+            var parts = stored.Split('$');
+            if (parts.Length != 2) return false;
+            var salt = Convert.FromHexString(parts[0]);
+            var expected = Convert.FromHexString(parts[1]);
+            var actual = Rfc2898DeriveBytes.Pbkdf2(password, salt, Iterations, HashAlgorithmName.SHA256, expected.Length);
+            return CryptographicOperations.FixedTimeEquals(actual, expected);
+        }
+
+        /// <summary>生成随机盐字符串（供外部使用）</summary>
+        public static string NewSalt()
+        {
+            var salt = RandomNumberGenerator.GetBytes(SaltSize);
+            return Convert.ToHexString(salt).ToLowerInvariant();
+        }
+
+        /// <summary>SHA256（供 RefreshToken 等场景）</summary>
+        public static string Sha256(string input)
+        {
+            var bytes = SHA256.HashData(Encoding.UTF8.GetBytes(input));
+            return Convert.ToHexString(bytes).ToLowerInvariant();
+        }
+    }
+}

Service/Implement/System/RoleService.cs

@@ -1,4 +1,14 @@
+using Model;
+using Model.Dto.System;
+using Model.Entity.System;
+using Model.Mapper;
+using ORM;
 using Service.Interface;
+using SqlSugar;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
 
 namespace Service.Implement
 {
@@ -7,6 +17,272 @@ namespace Service.Implement
     /// </summary>
     public class RoleService : IRoleService
     {
-        // TODO: 实现 角色权限管理 相关方法
+        public async Task<Result<List<RoleDto>>> GetPagedAsync(int pageIndex, int pageSize, RefAsync<int> total, string? keyword = null)
+        {
+            try
+            {
+                var list = await SqlSugarContext.DbContext.Queryable<RoleEntity>()
+                    .Where(x => x.IsDel == 0)
+                    .WhereIF(!string.IsNullOrWhiteSpace(keyword), x => x.Code.Contains(keyword!) || x.Name.Contains(keyword!))
+                    .OrderBy(x => x.Sort).OrderBy(x => x.CreateTime, OrderByType.Desc)
+                    .ToPageListAsync(pageIndex, pageSize, total);
+
+                var dtos = list.ToDtoList();
+                await FillPermissionsAsync(dtos);
+                return Result<List<RoleDto>>.Success(dtos);
+            }
+            catch (Exception ex)
+            {
+                return Result<List<RoleDto>>.Error("查询角色列表失败", ex);
+            }
+        }
+
+        public async Task<Result<RoleDto>> GetByIdAsync(long id)
+        {
+            try
+            {
+                var entity = await SqlSugarContext.DbContext.Queryable<RoleEntity>()
+                    .Where(x => x.Id == id && x.IsDel == 0).FirstAsync();
+                if (entity == null) return Result<RoleDto>.Error("角色不存在或已被删除");
+                var dto = entity.ToDto();
+                await FillPermissionsAsync(new List<RoleDto> { dto });
+                return Result<RoleDto>.Success(dto);
+            }
+            catch (Exception ex)
+            {
+                return Result<RoleDto>.Error("查询角色详情失败", ex);
+            }
+        }
+
+        public async Task<Result<RoleDto>> AddAsync(RoleDto dto)
+        {
+            if (dto == null || string.IsNullOrWhiteSpace(dto.Code) || string.IsNullOrWhiteSpace(dto.Name))
+                return Result<RoleDto>.Error("角色编码和名称不能为空");
+
+            try
+            {
+                var exists = await SqlSugarContext.DbContext.Queryable<RoleEntity>()
+                    .Where(x => x.Code == dto.Code && x.IsDel == 0).AnyAsync();
+                if (exists) return Result<RoleDto>.Error($"角色编码「{dto.Code}」已存在");
+
+                var entity = dto.ToEntity();
+                entity.Id = 0;
+                entity.IsSystem = 0; // 新建角色一律非系统内置
+                entity.CreateTime = DateTime.Now;
+                var id = await SqlSugarContext.DbContext.Insertable(entity).ExecuteReturnSnowflakeIdAsync();
+                entity.Id = id;
+
+                if (dto.PermissionIds != null && dto.PermissionIds.Count > 0)
+                {
+                    var permIds = dto.PermissionIds.Select(long.Parse).Where(p => p > 0).ToList();
+                    await ReplaceRolePermissionsAsync(id, permIds);
+                }
+
+                var result = entity.ToDto();
+                await FillPermissionsAsync(new List<RoleDto> { result });
+                return Result<RoleDto>.Success(result);
+            }
+            catch (Exception ex)
+            {
+                return Result<RoleDto>.Error("新增角色失败", ex);
+            }
+        }
+
+        public async Task<Result<RoleDto>> UpdateAsync(RoleDto dto)
+        {
+            if (dto == null || !long.TryParse(dto.Id, out var id) || id <= 0)
+                return Result<RoleDto>.Error("角色Id无效");
+
+            try
+            {
+                var entity = await SqlSugarContext.DbContext.Queryable<RoleEntity>()
+                    .Where(x => x.Id == id && x.IsDel == 0).FirstAsync();
+                if (entity == null) return Result<RoleDto>.Error("角色不存在或已被删除");
+
+                // 系统内置角色不允许改编码
+                if (entity.IsSystem == 1 && dto.Code != entity.Code)
+                    return Result<RoleDto>.Error($"系统内置角色「{entity.Name}」不允许修改编码");
+
+                var codeExists = await SqlSugarContext.DbContext.Queryable<RoleEntity>()
+                    .Where(x => x.Code == dto.Code && x.Id != id && x.IsDel == 0).AnyAsync();
+                if (codeExists) return Result<RoleDto>.Error($"角色编码「{dto.Code}」已存在");
+
+                var newEntity = dto.ToEntity();
+                newEntity.Id = id;
+                newEntity.IsSystem = entity.IsSystem; // 内置标记不可被前端覆盖
+                await SqlSugarContext.DbContext.Updateable(newEntity)
+                    .IgnoreColumns(x => new { x.CreateTime, x.IsDel, x.IsSystem })
+                    .ExecuteCommandAsync();
+
+                // 权限变化时同步更新关联（传入 null 表示不改权限）
+                if (dto.PermissionIds != null)
+                {
+                    var permIds = dto.PermissionIds.Select(long.Parse).Where(p => p > 0).ToList();
+                    var guard = await EnsureAdminRemainsAfterRoleChangeAsync(id, permIds);
+                    if (guard != null) return Result<RoleDto>.Error(guard.Msg);
+                    await ReplaceRolePermissionsAsync(id, permIds);
+                }
+
+                var result = newEntity.ToDto();
+                await FillPermissionsAsync(new List<RoleDto> { result });
+                return Result<RoleDto>.Success(result);
+            }
+            catch (Exception ex)
+            {
+                return Result<RoleDto>.Error("修改角色失败", ex);
+            }
+        }
+
+        public async Task<Result> DeleteAsync(long id)
+        {
+            if (id <= 0) return Result.Error("角色Id无效");
+            try
+            {
+                var entity = await SqlSugarContext.DbContext.Queryable<RoleEntity>()
+                    .Where(x => x.Id == id && x.IsDel == 0).FirstAsync();
+                if (entity == null) return Result.Error("角色不存在或已被删除");
+                if (entity.IsSystem == 1)
+                    return Result.Error($"系统内置角色「{entity.Name}」不允许删除");
+
+                var usedByUser = await SqlSugarContext.DbContext.Queryable<UserRoleEntity>()
+                    .Where(x => x.RoleId == id).AnyAsync();
+                if (usedByUser)
+                    return Result.Error("该角色下存在用户，请先移除角色下的用户再删除");
+
+                await SqlSugarContext.DbContext.Updateable<RoleEntity>()
+                    .SetColumns(x => x.IsDel == 1)
+                    .Where(x => x.Id == id).ExecuteCommandAsync();
+                await SqlSugarContext.DbContext.Deleteable<RolePermissionEntity>()
+                    .Where(x => x.RoleId == id).ExecuteCommandAsync();
+                return Result.Success();
+            }
+            catch (Exception ex)
+            {
+                return Result.Error("删除角色失败", ex);
+            }
+        }
+
+        public async Task<Result> AssignPermissionsAsync(long roleId, List<long> permissionIds)
+        {
+            if (roleId <= 0) return Result.Error("角色Id无效");
+            try
+            {
+                var exists = await SqlSugarContext.DbContext.Queryable<RoleEntity>()
+                    .Where(x => x.Id == roleId && x.IsDel == 0).AnyAsync();
+                if (!exists) return Result.Error("角色不存在或已被删除");
+
+                // 防锁死：移除角色的用户管理权限后，系统必须仍有其它可管理用户的管理员
+                var newIds = permissionIds ?? new List<long>();
+                var guard = await EnsureAdminRemainsAfterRoleChangeAsync(roleId, newIds);
+                if (guard != null) return guard;
+
+                await ReplaceRolePermissionsAsync(roleId, newIds);
+                return Result.Success();
+            }
+            catch (Exception ex)
+            {
+                return Result.Error("分配权限失败", ex);
+            }
+        }
+
+        public async Task<Result<List<RoleOptionDto>>> GetOptionsAsync()
+        {
+            try
+            {
+                var list = await SqlSugarContext.DbContext.Queryable<RoleEntity>()
+                    .Where(x => x.IsDel == 0)
+                    .OrderBy(x => x.Sort).OrderBy(x => x.Code)
+                    .ToListAsync();
+                return Result<List<RoleOptionDto>>.Success(list.ToOptionDtoList());
+            }
+            catch (Exception ex)
+            {
+                return Result<List<RoleOptionDto>>.Error("查询角色选项失败", ex);
+            }
+        }
+
+        public async Task<Result<List<PermissionDto>>> GetPermissionsAsync()
+        {
+            try
+            {
+                var list = await SqlSugarContext.DbContext.Queryable<PermissionEntity>()
+                    .Where(x => x.IsDel == 0)
+                    .OrderBy(x => x.Sort).OrderBy(x => x.Code)
+                    .ToListAsync();
+                return Result<List<PermissionDto>>.Success(list.ToDtoList());
+            }
+            catch (Exception ex)
+            {
+                return Result<List<PermissionDto>>.Error("查询权限列表失败", ex);
+            }
+        }
+
+        /// <summary>全量覆盖角色-权限关联</summary>
+        private static async Task ReplaceRolePermissionsAsync(long roleId, List<long> permissionIds)
+        {
+            var db = SqlSugarContext.DbContext;
+            await db.Deleteable<RolePermissionEntity>().Where(x => x.RoleId == roleId).ExecuteCommandAsync();
+            if (permissionIds.Count > 0)
+            {
+                var now = DateTime.Now;
+                var links = permissionIds.Distinct().Select(p => new RolePermissionEntity { RoleId = roleId, PermissionId = p, CreateTime = now }).ToList();
+                await db.Insertable(links).ExecuteCommandAsync();
+            }
+        }
+
+        /// <summary>
+        /// 防锁死校验：当 roleId 将失去 user:manage 权限时，系统必须仍存在
+        /// 「已启用且通过其它角色拥有 user:manage 权限」的用户，否则返回 Error
+        /// </summary>
+        private async Task<Result?> EnsureAdminRemainsAfterRoleChangeAsync(long roleId, List<long> newPermissionIds)
+        {
+            var db = SqlSugarContext.DbContext;
+            var managePermId = await db.Queryable<PermissionEntity>()
+                .Where(x => x.Code == "user:manage" && x.IsDel == 0)
+                .Select(x => x.Id).FirstAsync();
+            if (managePermId == 0) return null;
+
+            bool currentlyHas = await db.Queryable<RolePermissionEntity>()
+                .AnyAsync(x => x.RoleId == roleId && x.PermissionId == managePermId);
+            bool willHave = newPermissionIds.Contains(managePermId);
+            if (currentlyHas && !willHave)
+            {
+                var otherRoleIds = await db.Queryable<RolePermissionEntity>()
+                    .Where(x => x.PermissionId == managePermId && x.RoleId != roleId)
+                    .Select(x => x.RoleId).ToListAsync();
+                var otherUserIds = otherRoleIds.Count > 0
+                    ? await db.Queryable<UserRoleEntity>().Where(x => otherRoleIds.Contains(x.RoleId)).Select(x => x.UserId).ToListAsync()
+                    : new List<long>();
+                var exists = otherUserIds.Count > 0 && await db.Queryable<UserEntity>()
+                    .AnyAsync(x => otherUserIds.Contains(x.Id) && x.IsDel == 0 && x.IsEnabled == 1);
+                if (!exists)
+                    return Result.Error("操作被拒绝：移除该角色的用户管理权限后，系统将没有任何可管理用户的管理员");
+            }
+            return null;
+        }
+
+        /// <summary>给角色 DTO 填充权限Id列表与权限编码列表</summary>
+        private static async Task FillPermissionsAsync(List<RoleDto> dtos)
+        {
+            if (dtos == null || dtos.Count == 0) return;
+            var db = SqlSugarContext.DbContext;
+            var roleIds = dtos.Select(d => long.Parse(d.Id)).ToList();
+
+            var links = await db.Queryable<RolePermissionEntity>()
+                .Where(x => roleIds.Contains(x.RoleId)).ToListAsync();
+            var permIds = links.Select(l => l.PermissionId).Distinct().ToList();
+            var perms = permIds.Count > 0
+                ? await db.Queryable<PermissionEntity>().Where(x => permIds.Contains(x.Id) && x.IsDel == 0).ToListAsync()
+                : new List<PermissionEntity>();
+            var permMap = perms.ToDictionary(p => p.Id, p => p.Code);
+
+            foreach (var d in dtos)
+            {
+                var rid = long.Parse(d.Id);
+                var myPermIds = links.Where(l => l.RoleId == rid).Select(l => l.PermissionId).ToList();
+                d.PermissionIds = myPermIds.Select(p => p.ToString()).ToList();
+                d.PermissionCodes = myPermIds.Where(p => permMap.ContainsKey(p)).Select(p => permMap[p]).ToList();
+            }
+        }
     }
 }

Service/Implement/System/UserService.cs

@@ -1,12 +1,409 @@
+using Model;
+using Model.Dto.System;
+using Model.Entity.System;
+using Model.Mapper;
+using ORM;
 using Service.Interface;
+using SqlSugar;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
 
 namespace Service.Implement
 {
     /// <summary>
     /// 用户管理 服务实现
+    /// 数据权限：当前用户角色 DataScope=1 看全部；=2 只能看自己组织及下级组织下的用户
     /// </summary>
     public class UserService : IUserService
     {
-        // TODO: 实现 用户管理 相关方法
+        private readonly IOrgService _orgService;
+        private readonly ICurrentUser _currentUser;
+
+        public UserService(IOrgService orgService, ICurrentUser currentUser)
+        {
+            _orgService = orgService;
+            _currentUser = currentUser;
+        }
+
+        public async Task<Result<List<UserDto>>> GetPagedAsync(int pageIndex, int pageSize, RefAsync<int> total, string? keyword = null, long? roleId = null, long? orgId = null)
+        {
+            try
+            {
+                // 按角色筛选时先查出该角色下的用户Id
+                List<long>? userIdsInRole = null;
+                if (roleId.HasValue && roleId.Value > 0)
+                {
+                    userIdsInRole = await SqlSugarContext.DbContext.Queryable<UserRoleEntity>()
+                        .Where(x => x.RoleId == roleId!.Value)
+                        .Select(x => x.UserId)
+                        .ToListAsync();
+                    if (userIdsInRole.Count == 0)
+                        return Result<List<UserDto>>.Success(new List<UserDto>());
+                }
+
+                // 数据范围过滤：DataScope=2 时只允许看本组织及下级的用户
+                List<long>? allowedOrgIds = null;
+                if (_currentUser.IsAuthenticated && _currentUser.DataScope != 1)
+                {
+                    var me = await SqlSugarContext.DbContext.Queryable<UserEntity>()
+                        .Where(x => x.Id == _currentUser.UserId).FirstAsync();
+                    if (me != null && me.OrgId > 0)
+                        allowedOrgIds = await _orgService.GetSubtreeIdsAsync(me.OrgId);
+                    else
+                        return Result<List<UserDto>>.Success(new List<UserDto>()); // 无组织归属则看不到任何用户
+                }
+
+                // 前端按组织节点筛选时叠加（同时受数据范围约束）
+                List<long>? orgFilterIds = null;
+                if (orgId.HasValue && orgId.Value > 0)
+                {
+                    orgFilterIds = await _orgService.GetSubtreeIdsAsync(orgId.Value);
+                    if (allowedOrgIds != null)
+                        orgFilterIds = orgFilterIds.Where(allowedOrgIds.Contains).ToList();
+                }
+
+                var list = await SqlSugarContext.DbContext.Queryable<UserEntity>()
+                    .Where(x => x.IsDel == 0)
+                    .WhereIF(!string.IsNullOrWhiteSpace(keyword), x => x.UserName.Contains(keyword!) || (x.RealName != null && x.RealName.Contains(keyword!)))
+                    .WhereIF(userIdsInRole != null, x => userIdsInRole!.Contains(x.Id))
+                    .WhereIF(allowedOrgIds != null, x => allowedOrgIds!.Contains(x.OrgId))
+                    .WhereIF(orgFilterIds != null, x => orgFilterIds!.Contains(x.OrgId))
+                    .OrderBy(x => x.CreateTime, OrderByType.Desc)
+                    .ToPageListAsync(pageIndex, pageSize, total);
+
+                var dtos = list.ToDtoList();
+                await FillRolesAsync(dtos);
+                await FillOrgNamesAsync(dtos);
+                return Result<List<UserDto>>.Success(dtos);
+            }
+            catch (Exception ex)
+            {
+                return Result<List<UserDto>>.Error("查询用户列表失败", ex);
+            }
+        }
+
+        public async Task<Result<UserDto>> GetByIdAsync(long id)
+        {
+            try
+            {
+                var entity = await SqlSugarContext.DbContext.Queryable<UserEntity>()
+                    .Where(x => x.Id == id && x.IsDel == 0).FirstAsync();
+                if (entity == null) return Result<UserDto>.Error("用户不存在或已被删除");
+                var dto = entity.ToDto();
+                await FillRolesAsync(new List<UserDto> { dto });
+                await FillOrgNamesAsync(new List<UserDto> { dto });
+                return Result<UserDto>.Success(dto);
+            }
+            catch (Exception ex)
+            {
+                return Result<UserDto>.Error("查询用户详情失败", ex);
+            }
+        }
+
+        public async Task<Result<UserDto>> AddAsync(UserDto dto)
+        {
+            if (dto == null || string.IsNullOrWhiteSpace(dto.UserName))
+                return Result<UserDto>.Error("用户名不能为空");
+
+            try
+            {
+                var exists = await SqlSugarContext.DbContext.Queryable<UserEntity>()
+                    .Where(x => x.UserName == dto.UserName && x.IsDel == 0).AnyAsync();
+                if (exists) return Result<UserDto>.Error($"用户名「{dto.UserName}」已存在");
+
+                var entity = dto.ToEntity();
+                entity.Id = 0;
+                entity.CreateTime = DateTime.Now;
+                // 新增用户初始密码必填（前端通过 InitialPassword 明文传入，落库前 PBKDF2 哈希）
+                var initialPassword = dto.InitialPassword;
+                if (string.IsNullOrWhiteSpace(initialPassword) || initialPassword.Length < 6)
+                    return Result<UserDto>.Error("初始密码不能为空且长度不少于 6 位");
+                entity.PasswordHash = PasswordHelper.Hash(initialPassword);
+
+                // 角色先解析校验再落库，避免"用户已插入但角色解析失败"留下无角色用户
+                var newRoleIds = new List<long>();
+                if (dto.RoleIds != null && dto.RoleIds.Count > 0)
+                {
+                    foreach (var r in dto.RoleIds)
+                    {
+                        if (!long.TryParse(r, out var rid) || rid <= 0)
+                            return Result<UserDto>.Error($"角色Id无效：{r}");
+                        newRoleIds.Add(rid);
+                    }
+                }
+
+                var id = await SqlSugarContext.DbContext.Insertable(entity).ExecuteReturnSnowflakeIdAsync();
+                entity.Id = id;
+
+                if (newRoleIds.Count > 0)
+                    await ReplaceUserRolesAsync(id, newRoleIds);
+
+                var result = entity.ToDto();
+                await FillRolesAsync(new List<UserDto> { result });
+                return Result<UserDto>.Success(result);
+            }
+            catch (Exception ex)
+            {
+                return Result<UserDto>.Error("新增用户失败", ex);
+            }
+        }
+
+        public async Task<Result<UserDto>> UpdateAsync(UserDto dto)
+        {
+            if (dto == null || !long.TryParse(dto.Id, out var id) || id <= 0)
+                return Result<UserDto>.Error("用户Id无效");
+
+            try
+            {
+                var entity = await SqlSugarContext.DbContext.Queryable<UserEntity>()
+                    .Where(x => x.Id == id && x.IsDel == 0).FirstAsync();
+                if (entity == null) return Result<UserDto>.Error("用户不存在或已被删除");
+
+                var nameExists = await SqlSugarContext.DbContext.Queryable<UserEntity>()
+                    .Where(x => x.UserName == dto.UserName && x.Id != id && x.IsDel == 0).AnyAsync();
+                if (nameExists) return Result<UserDto>.Error($"用户名「{dto.UserName}」已存在");
+
+                // 防锁死：把自己禁用不允许；禁用或改角色后必须仍存在可管理用户的管理员
+                if (dto.IsEnabled == 0 && id == _currentUser.UserId)
+                    return Result<UserDto>.Error("不能禁用当前登录的账号");
+                if (dto.IsEnabled == 0 || dto.RoleIds != null)
+                {
+                    var guard = await EnsureAnotherActiveAdminAsync(id);
+                    if (guard != null) return Result<UserDto>.Error(guard.Msg);
+                }
+
+                var newEntity = dto.ToEntity();
+                newEntity.Id = id;
+                // 密码、登录时间不允许在此接口覆盖
+                await SqlSugarContext.DbContext.Updateable(newEntity)
+                    .IgnoreColumns(x => new { x.CreateTime, x.IsDel, x.PasswordHash, x.LastLoginTime })
+                    .ExecuteCommandAsync();
+
+                // 角色变化时同步更新关联（传入 null 表示不改角色）
+                if (dto.RoleIds != null)
+                {
+                    var roleIds = dto.RoleIds.Select(long.Parse).Where(r => r > 0).ToList();
+                    await ReplaceUserRolesAsync(id, roleIds);
+                }
+
+                var result = newEntity.ToDto();
+                await FillRolesAsync(new List<UserDto> { result });
+                return Result<UserDto>.Success(result);
+            }
+            catch (Exception ex)
+            {
+                return Result<UserDto>.Error("修改用户失败", ex);
+            }
+        }
+
+        public async Task<Result> DeleteAsync(long id)
+        {
+            if (id <= 0) return Result.Error("用户Id无效");
+            if (id == _currentUser.UserId)
+                return Result.Error("不能删除当前登录的账号");
+
+            try
+            {
+                var exists = await SqlSugarContext.DbContext.Queryable<UserEntity>()
+                    .Where(x => x.Id == id && x.IsDel == 0).AnyAsync();
+                if (!exists) return Result.Error("用户不存在或已被删除");
+
+                // 防锁死：删除后必须仍存在可管理用户的管理员
+                var guard = await EnsureAnotherActiveAdminAsync(id);
+                if (guard != null) return guard;
+
+                await SqlSugarContext.DbContext.Updateable<UserEntity>()
+                    .SetColumns(x => x.IsDel == 1)
+                    .Where(x => x.Id == id).ExecuteCommandAsync();
+                await SqlSugarContext.DbContext.Deleteable<UserRoleEntity>()
+                    .Where(x => x.UserId == id).ExecuteCommandAsync();
+                return Result.Success();
+            }
+            catch (Exception ex)
+            {
+                return Result.Error("删除用户失败", ex);
+            }
+        }
+
+        public async Task<Result> AssignRolesAsync(long userId, List<long> roleIds)
+        {
+            if (userId <= 0) return Result.Error("用户Id无效");
+            try
+            {
+                var exists = await SqlSugarContext.DbContext.Queryable<UserEntity>()
+                    .Where(x => x.Id == userId && x.IsDel == 0).AnyAsync();
+                if (!exists) return Result.Error("用户不存在或已被删除");
+
+                // 防锁死：改角色后必须仍存在可管理用户的管理员
+                var guard = await EnsureAnotherActiveAdminAsync(userId);
+                if (guard != null) return guard;
+
+                await ReplaceUserRolesAsync(userId, roleIds ?? new List<long>());
+                return Result.Success();
+            }
+            catch (Exception ex)
+            {
+                return Result.Error("分配角色失败", ex);
+            }
+        }
+
+        public async Task<Result> ResetPasswordAsync(long userId, string newPassword)
+        {
+            if (userId <= 0) return Result.Error("用户Id无效");
+            if (string.IsNullOrWhiteSpace(newPassword) || newPassword.Length < 6)
+                return Result.Error("新密码不能为空且长度不少于 6 位");
+            try
+            {
+                var exists = await SqlSugarContext.DbContext.Queryable<UserEntity>()
+                    .Where(x => x.Id == userId && x.IsDel == 0).AnyAsync();
+                if (!exists) return Result.Error("用户不存在或已被删除");
+
+                await SqlSugarContext.DbContext.Updateable<UserEntity>()
+                    .SetColumns(x => x.PasswordHash == PasswordHelper.Hash(newPassword))
+                    .Where(x => x.Id == userId).ExecuteCommandAsync();
+                return Result.Success();
+            }
+            catch (Exception ex)
+            {
+                return Result.Error("重置密码失败", ex);
+            }
+        }
+
+        public async Task<Result> SetEnabledAsync(long userId, bool enabled)
+        {
+            if (userId <= 0) return Result.Error("用户Id无效");
+            if (!enabled && userId == _currentUser.UserId)
+                return Result.Error("不能禁用当前登录的账号");
+            try
+            {
+                // 防锁死：禁用后必须仍存在可管理用户的管理员
+                if (!enabled)
+                {
+                    var guard = await EnsureAnotherActiveAdminAsync(userId);
+                    if (guard != null) return guard;
+                }
+
+                await SqlSugarContext.DbContext.Updateable<UserEntity>()
+                    .SetColumns(x => x.IsEnabled == (byte)(enabled ? 1 : 0))
+                    .Where(x => x.Id == userId).ExecuteCommandAsync();
+                return Result.Success();
+            }
+            catch (Exception ex)
+            {
+                return Result.Error("设置用户状态失败", ex);
+            }
+        }
+
+        public async Task<Result<List<UserOptionDto>>> GetOptionsAsync()
+        {
+            try
+            {
+                var list = await SqlSugarContext.DbContext.Queryable<UserEntity>()
+                    .Where(x => x.IsDel == 0 && x.IsEnabled == 1)
+                    .OrderBy(x => x.UserName)
+                    .ToListAsync();
+                return Result<List<UserOptionDto>>.Success(list.ToOptionDtoList());
+            }
+            catch (Exception ex)
+            {
+                return Result<List<UserOptionDto>>.Error("查询用户选项失败", ex);
+            }
+        }
+
+        /// <summary>全量覆盖用户-角色关联</summary>
+        private static async Task ReplaceUserRolesAsync(long userId, List<long> roleIds)
+        {
+            var db = SqlSugarContext.DbContext;
+            await db.Deleteable<UserRoleEntity>().Where(x => x.UserId == userId).ExecuteCommandAsync();
+            if (roleIds.Count > 0)
+            {
+                var now = DateTime.Now;
+                var links = roleIds.Distinct().Select(r => new UserRoleEntity { UserId = userId, RoleId = r, CreateTime = now }).ToList();
+                await db.Insertable(links).ExecuteCommandAsync();
+            }
+        }
+
+        /// <summary>
+        /// 防锁死校验：排除 excludeUserId 后，系统必须仍存在「已启用且拥有 user:manage 权限」的用户，
+        /// 否则返回 Error（保证管理员不会把所有管理员删光/禁用光导致无人可登录管理）
+        /// </summary>
+        private async Task<Result?> EnsureAnotherActiveAdminAsync(long excludeUserId)
+        {
+            var db = SqlSugarContext.DbContext;
+            var permId = await db.Queryable<PermissionEntity>()
+                .Where(x => x.Code == "user:manage" && x.IsDel == 0)
+                .Select(x => x.Id).FirstAsync();
+            if (permId == 0) return null; // 权限码不存在时不拦，避免权限体系变更后管理功能彻底锁死
+
+            var roleIds = await db.Queryable<RolePermissionEntity>()
+                .Where(x => x.PermissionId == permId)
+                .Select(x => x.RoleId).ToListAsync();
+            if (roleIds.Count == 0) return null;
+
+            var userIds = await db.Queryable<UserRoleEntity>()
+                .Where(x => roleIds.Contains(x.RoleId))
+                .Select(x => x.UserId).ToListAsync();
+            if (userIds.Count == 0)
+                return Result.Error("操作被拒绝：系统将没有任何可管理用户的管理员");
+
+            var exists = await db.Queryable<UserEntity>()
+                .AnyAsync(x => userIds.Contains(x.Id) && x.IsDel == 0 && x.IsEnabled == 1 && x.Id != excludeUserId);
+            return exists ? null : Result.Error("操作被拒绝：系统至少需要保留一名已启用且拥有用户管理权限的账号");
+        }
+
+        /// <summary>给用户 DTO 填充所属组织名称（组织链路径，如 公司/实验室/部门）</summary>
+        private async Task FillOrgNamesAsync(List<UserDto> dtos)
+        {
+            if (dtos == null || dtos.Count == 0) return;
+            var orgIds = dtos.Where(d => long.TryParse(d.OrgId, out var oid) && oid > 0)
+                             .Select(d => long.Parse(d.OrgId)).Distinct().ToList();
+            if (orgIds.Count == 0) return;
+
+            var allOrgs = await SqlSugarContext.DbContext.Queryable<OrgEntity>()
+                .Where(x => x.IsDel == 0).ToListAsync();
+            var orgMap = allOrgs.ToDictionary(o => o.Id, o => o);
+
+            foreach (var d in dtos)
+            {
+                if (!long.TryParse(d.OrgId, out var oid) || !orgMap.TryGetValue(oid, out var org))
+                    continue;
+                // 沿父级向上拼组织路径
+                var path = new List<string>();
+                var cursor = org;
+                var guard = 0;
+                while (cursor != null && guard++ < 10)
+                {
+                    path.Insert(0, cursor.Name);
+                    cursor = cursor.ParentId > 0 && orgMap.TryGetValue(cursor.ParentId, out var parent) ? parent : null;
+                }
+                d.OrgName = string.Join(" / ", path);
+            }
+        }
+
+        /// <summary>给用户 DTO 填充角色Id列表与角色名称</summary>
+        private static async Task FillRolesAsync(List<UserDto> dtos)
+        {
+            if (dtos == null || dtos.Count == 0) return;
+            var db = SqlSugarContext.DbContext;
+            var userIds = dtos.Select(d => long.Parse(d.Id)).ToList();
+
+            var links = await db.Queryable<UserRoleEntity>()
+                .Where(x => userIds.Contains(x.UserId)).ToListAsync();
+            var roleIds = links.Select(l => l.RoleId).Distinct().ToList();
+            var roles = roleIds.Count > 0
+                ? await db.Queryable<RoleEntity>().Where(x => roleIds.Contains(x.Id) && x.IsDel == 0).ToListAsync()
+                : new List<RoleEntity>();
+            var roleMap = roles.ToDictionary(r => r.Id, r => r.Name);
+
+            foreach (var d in dtos)
+            {
+                var uid = long.Parse(d.Id);
+                var myRoleIds = links.Where(l => l.UserId == uid).Select(l => l.RoleId).ToList();
+                d.RoleIds = myRoleIds.Select(r => r.ToString()).ToList();
+                d.RoleNames = string.Join(",", myRoleIds.Where(r => roleMap.ContainsKey(r)).Select(r => roleMap[r]));
+            }
+        }
     }
 }

Service/Interface/Config/IDeviceService.cs

@@ -14,7 +14,7 @@ namespace Service.Interface.Config
         /// <summary>
         /// 分页查询设备列表（支持关键字搜索编号/名称/类型，可按所属产品筛选）
         /// </summary>
-        Task<Result<List<IotDeviceDto>>> GetPagedAsync(int pageIndex, int pageSize, RefAsync<int> total, string? keyword, long? productId = null);
+        Task<Result<List<IotDeviceDto>>> GetPagedAsync(int pageIndex, int pageSize, RefAsync<int> total, string? keyword, long? productId = null, long? gatewayId = null);
 
         /// <summary>
         /// 根据 Id 获取设备详情

Service/Interface/Config/IGatewayService.cs

@@ -1,10 +1,25 @@
-namespace Service.Interface
+using Model;
+using Model.Dto.Config;
+using Model.Entity.Config;
+using ORM;
+using SqlSugar;
+using System.Net.Sockets;
+using System.Net;
+using System.IO.Ports;
+
+namespace Service.Interface.Config
 {
     /// <summary>
     /// 网关管理 服务接口
     /// </summary>
     public interface IGatewayService
     {
-        // TODO: 定义 网关管理 相关方法
+        Task<Result<List<GatewayDto>>> GetPagedAsync(int pageIndex, int pageSize, RefAsync<int> total, string? keyword = null, int? protocolType = null);
+        Task<Result<GatewayDto>> GetByIdAsync(long id);
+        Task<Result<GatewayDto>> AddAsync(GatewayDto dto);
+        Task<Result<GatewayDto>> UpdateAsync(GatewayDto dto);
+        Task<Result> DeleteAsync(long id);
+        Task<Result<GatewayTestResultDto>> TestConnectionAsync(long id);
+        Task<Result<List<GatewayOptionDto>>> GetOptionsAsync();
     }
 }

Service/Interface/System/IAuditLogService.cs

@@ -0,0 +1,19 @@
+using Model;
+using Model.Dto.System;
+using SqlSugar;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+
+namespace Service.Interface
+{
+    /// <summary>
+    /// 审计日志 服务接口
+    /// </summary>
+    public interface IAuditLogService
+    {
+        /// <summary>分页查询审计日志（可按操作人/操作类型/操作对象/时间段筛选）</summary>
+        Task<Result<List<AuditLogDto>>> GetPagedAsync(int pageIndex, int pageSize, RefAsync<int> total,
+            string? keyword = null, string? operationType = null, string? operationTarget = null,
+            DateTime? startTime = null, DateTime? endTime = null);
+    }
+}

Service/Interface/System/IAuditRecorder.cs

@@ -0,0 +1,23 @@
+namespace Service.Interface
+{
+    /// <summary>
+    /// 审计日志记录器：业务服务注入后一行代码记录关键操作（操作人/角色自动取自当前登录上下文）
+    /// </summary>
+    public interface IAuditRecorder
+    {
+        /// <summary>
+        /// 记录一条审计日志
+        /// </summary>
+        /// <param name="operationType">操作类型（Create/Update/Delete/Login/Command等）</param>
+        /// <param name="operationTarget">操作对象（IotDevice/Gateway/User/Role等）</param>
+        /// <param name="targetId">操作对象Id</param>
+        /// <param name="deviceId">关联设备Id（0=无关）</param>
+        /// <param name="oldValue">操作前值（JSON 或摘要）</param>
+        /// <param name="newValue">操作后值（JSON 或摘要）</param>
+        /// <param name="ip">操作IP（null 自动留空）</param>
+        /// <param name="description">操作描述</param>
+        Task RecordAsync(string operationType, string operationTarget, long targetId,
+            long deviceId = 0, string? oldValue = null, string? newValue = null,
+            string? ip = null, string? description = null);
+    }
+}

Service/Interface/System/IAuthService.cs

@@ -0,0 +1,23 @@
+using Model;
+using Model.Dto.System;
+
+namespace Service.Interface
+{
+    /// <summary>
+    /// 认证授权 服务接口（登录 / 当前用户 / 修改密码）
+    /// </summary>
+    public interface IAuthService
+    {
+        /// <summary>用户名密码登录，签发 JWT 并返回用户信息+权限列表</summary>
+        Task<Result<LoginResultDto>> LoginAsync(LoginDto dto, string? ip);
+
+        /// <summary>退出登录（记录审计日志，JWT 无状态因此不做服务端吊销）</summary>
+        Task<Result> LogoutAsync();
+
+        /// <summary>获取当前登录用户信息 + 权限列表</summary>
+        Task<Result<LoginResultDto>> GetMeAsync();
+
+        /// <summary>当前用户修改自己的密码</summary>
+        Task<Result> ChangePasswordAsync(ChangePasswordDto dto);
+    }
+}

Service/Interface/System/ICurrentUser.cs

@@ -0,0 +1,19 @@
+namespace Service.Interface
+{
+    /// <summary>
+    /// 当前登录用户上下文（从 JWT Claims 解析，IOT_API 实现注入）
+    /// </summary>
+    public interface ICurrentUser
+    {
+        bool IsAuthenticated { get; }
+        long UserId { get; }
+        string UserName { get; }
+        List<long> RoleIds { get; }
+        List<string> RoleNames { get; }
+        /// <summary>当前用户拥有的权限编码列表（登录时写入 Token）</summary>
+        List<string> Permissions { get; }
+        /// <summary>数据范围（1=全部, 2=本实验室）</summary>
+        byte DataScope { get; }
+        bool HasPermission(string code);
+    }
+}

Service/Interface/System/IOrgService.cs

@@ -0,0 +1,31 @@
+using Model;
+using Model.Dto.System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+
+namespace Service.Interface
+{
+    /// <summary>
+    /// 组织架构管理 服务接口（公司/实验室/部门/班组树）
+    /// </summary>
+    public interface IOrgService
+    {
+        /// <summary>完整组织树（嵌套子级）</summary>
+        Task<Result<List<OrgTreeDto>>> GetTreeAsync();
+
+        /// <summary>新增组织节点</summary>
+        Task<Result<OrgDto>> AddAsync(OrgDto dto);
+
+        /// <summary>修改组织节点（系统节点层级类型变更需校验无子级）</summary>
+        Task<Result<OrgDto>> UpdateAsync(OrgDto dto);
+
+        /// <summary>删除组织节点（有子级或有用户挂靠时不可删）</summary>
+        Task<Result> DeleteAsync(long id);
+
+        /// <summary>组织下拉选项（平铺）</summary>
+        Task<Result<List<OrgOptionDto>>> GetOptionsAsync();
+
+        /// <summary>取指定组织及其全部子孙组织 Id（数据权限过滤用）</summary>
+        Task<List<long>> GetSubtreeIdsAsync(long orgId);
+    }
+}

Service/Interface/System/IRoleService.cs

@@ -1,3 +1,9 @@
+using Model;
+using Model.Dto.System;
+using SqlSugar;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+
 namespace Service.Interface
 {
     /// <summary>
@@ -5,6 +11,27 @@ namespace Service.Interface
     /// </summary>
     public interface IRoleService
     {
-        // TODO: 定义 角色权限管理 相关方法
+        /// <summary>分页查询角色列表（关键字匹配编码/名称）</summary>
+        Task<Result<List<RoleDto>>> GetPagedAsync(int pageIndex, int pageSize, RefAsync<int> total, string? keyword = null);
+
+        Task<Result<RoleDto>> GetByIdAsync(long id);
+
+        /// <summary>新增角色（校验编码唯一）</summary>
+        Task<Result<RoleDto>> AddAsync(RoleDto dto);
+
+        /// <summary>修改角色（系统内置角色不允许改编码）</summary>
+        Task<Result<RoleDto>> UpdateAsync(RoleDto dto);
+
+        /// <summary>删除角色（系统内置角色不可删；有关联用户时不可删）</summary>
+        Task<Result> DeleteAsync(long id);
+
+        /// <summary>分配权限（全量覆盖该角色的权限关联）</summary>
+        Task<Result> AssignPermissionsAsync(long roleId, List<long> permissionIds);
+
+        /// <summary>角色下拉选项</summary>
+        Task<Result<List<RoleOptionDto>>> GetOptionsAsync();
+
+        /// <summary>查询全部权限列表</summary>
+        Task<Result<List<PermissionDto>>> GetPermissionsAsync();
     }
 }

Service/Interface/System/IUserService.cs

@@ -1,3 +1,9 @@
+using Model;
+using Model.Dto.System;
+using SqlSugar;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+
 namespace Service.Interface
 {
     /// <summary>
@@ -5,6 +11,30 @@ namespace Service.Interface
     /// </summary>
     public interface IUserService
     {
-        // TODO: 定义 用户管理 相关方法
+        /// <summary>分页查询用户列表（关键字匹配用户名/姓名，可按角色、组织节点筛选；受数据范围约束）</summary>
+        Task<Result<List<UserDto>>> GetPagedAsync(int pageIndex, int pageSize, RefAsync<int> total, string? keyword = null, long? roleId = null, long? orgId = null);
+
+        Task<Result<UserDto>> GetByIdAsync(long id);
+
+        /// <summary>新增用户（校验用户名唯一，密码必填，可同时分配角色）</summary>
+        Task<Result<UserDto>> AddAsync(UserDto dto);
+
+        /// <summary>修改用户（不改密码，角色走 AssignRoles）</summary>
+        Task<Result<UserDto>> UpdateAsync(UserDto dto);
+
+        /// <summary>删除用户（软删，同时清理角色关联）</summary>
+        Task<Result> DeleteAsync(long id);
+
+        /// <summary>分配角色（全量覆盖该用户的角色关联）</summary>
+        Task<Result> AssignRolesAsync(long userId, List<long> roleIds);
+
+        /// <summary>管理员重置用户密码</summary>
+        Task<Result> ResetPasswordAsync(long userId, string newPassword);
+
+        /// <summary>启用/禁用用户</summary>
+        Task<Result> SetEnabledAsync(long userId, bool enabled);
+
+        /// <summary>用户下拉选项</summary>
+        Task<Result<List<UserOptionDto>>> GetOptionsAsync();
     }
 }

Service/Service.csproj

@@ -11,6 +11,7 @@
     <PackageReference Include="Microsoft.Extensions.Http" Version="8.0.0" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.0" />
     <PackageReference Include="RestSharp" Version="106.15.0" />
+    <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="7.0.0" />
   </ItemGroup>
 
   <ItemGroup>