feat(group): 业务组禁用后限制用户登录和配置拉取

server/internal/handler/config_api.go

@@ -53,6 +53,16 @@ func (h *ConfigApiHandler) FetchAllConfigs(c *gin.Context) {
 		return
 	}
 
+	// check if app's group is enabled
+	if app.GroupId != nil {
+		var group model.BusinessGroup
+		has, _ := dao.Engine.ID(*app.GroupId).Get(&group)
+		if !has || !group.Enabled {
+			c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: "业务组已禁用"})
+			return
+		}
+	}
+
 	// validate token if app has token configured
 	if app.Token != "" && app.Token != req.Token {
 		c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: "Token 无效"})

server/internal/handler/group.go

@@ -124,6 +124,30 @@ func (h *GroupHandler) Update(c *gin.Context) {
 	c.JSON(http.StatusOK, model.WrapperResponse{Code: 0})
 }
 
+func (h *GroupHandler) Switch(c *gin.Context) {
+	id, _ := strconv.Atoi(c.Param("id"))
+	userInfo := middleware.GetUserInfo(c)
+	if !userInfo.IsSuperAdmin() {
+		c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: "超级管理员才能操作"})
+		return
+	}
+
+	var group model.BusinessGroup
+	has, _ := dao.Engine.ID(id).Get(&group)
+	if !has {
+		c.JSON(http.StatusOK, model.WrapperResponse{Code: 404, Msg: "业务组不存在"})
+		return
+	}
+
+	group.Enabled = !group.Enabled
+	now := time.Now()
+	group.UpdatedAt = &now
+	group.UpdatedBy = userInfo.Name
+	dao.Engine.ID(group.Id).Cols("enabled", "updated_at", "updated_by").Update(&group)
+
+	c.JSON(http.StatusOK, model.WrapperResponse{Code: 0, Data: true})
+}
+
 func (h *GroupHandler) Options(c *gin.Context) {
 	var groups []model.BusinessGroup
 	dao.Engine.Where("enabled = 1").Find(&groups)

server/internal/service/auth.go

@@ -31,6 +31,15 @@ func (s *AuthService) Login(userName, password string) (string, *model.LoginUser
 		return "", nil, errors.New("用户不存在或已禁用")
 	}
 
+	// 检查业务组是否启用
+	if user.GroupId != nil {
+		var group model.BusinessGroup
+		has, _ := dao.Engine.ID(*user.GroupId).Get(&group)
+		if !has || !group.Enabled {
+			return "", nil, errors.New("所属业务组已禁用")
+		}
+	}
+
 	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
 		return "", nil, errors.New("密码错误")
 	}
@@ -93,6 +102,15 @@ func (s *AuthService) ValidateToken(tokenString string) (*model.LoginUserInfo, e
 		return nil, errors.New("user is disabled")
 	}
 
+	// 检查业务组是否启用
+	if user.GroupId != nil {
+		var group model.BusinessGroup
+		has, _ := dao.Engine.ID(*user.GroupId).Get(&group)
+		if !has || !group.Enabled {
+			return nil, errors.New("group is disabled")
+		}
+	}
+
 	// 检查 token 是否在登出后签发
 	if user.LastLogoutAt != nil {
 		iat := int64(claims["iat"].(float64))