feat(group): 业务组禁用后限制用户登录和配置拉取

server/internal/service/auth.go

@@ -31,6 +31,15 @@ func (s *AuthService) Login(userName, password string) (string, *model.LoginUser
 		return "", nil, errors.New("用户不存在或已禁用")
 	}
 
+	// 检查业务组是否启用
+	if user.GroupId != nil {
+		var group model.BusinessGroup
+		has, _ := dao.Engine.ID(*user.GroupId).Get(&group)
+		if !has || !group.Enabled {
+			return "", nil, errors.New("所属业务组已禁用")
+		}
+	}
+
 	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
 		return "", nil, errors.New("密码错误")
 	}
@@ -93,6 +102,15 @@ func (s *AuthService) ValidateToken(tokenString string) (*model.LoginUserInfo, e
 		return nil, errors.New("user is disabled")
 	}
 
+	// 检查业务组是否启用
+	if user.GroupId != nil {
+		var group model.BusinessGroup
+		has, _ := dao.Engine.ID(*user.GroupId).Get(&group)
+		if !has || !group.Enabled {
+			return nil, errors.New("group is disabled")
+		}
+	}
+
 	// 检查 token 是否在登出后签发
 	if user.LastLogoutAt != nil {
 		iat := int64(claims["iat"].(float64))