feat(user): 注销账号数据级联清理 + 后台删除端点

C 端与后台复用同一套 soft_delete_account:物理删除个人内容/行为/PII 表(比价/省钱/
签到/领券/任务/设备/价格上报/反馈/引导/埋点/看广告时长/邀请指纹)+ 清零余额 + 匿名化
user 行释放唯一约束;保留资金流水/邀请关系/广告幂等+对账表(对账/幂等/邀请人侧归属)。

- api/v1/user.py: DELETE /api/v1/user 加资金前置闸(未提现现金/邀请金 / 在审提现单 → 409)
- repositories/user.py: soft_delete_account 落地分类删除(补 ad_watch_log 埋点删除)
- repositories/wallet.py: 新增 get_invite_cash_balance_cents(邀请金 409 校验用)
- admin/routers/users.py: DELETE /admin/api/users/{id} 复用清理 + 审计,仅 super_admin
- admin/schemas/user.py: DeleteUserRequest(必填 reason 入审计)
- tests: 级联删除/余额归零/保留表存活 6 测 + admin 删除/审计/403/400/409 4 测

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

alembic/versions/admin_role_table.py

@@ -1,69 +0,0 @@
-"""admin_role 表(RBAC 角色 → 可见页面)+ 种子内建角色
-
-新增后台 RBAC:角色持有一组页面 key,登录后左侧只展示这些页。super_admin 内建全权(pages 存空、
-effective_pages 特判为全部)、不可编辑删除;operator/finance 播默认页集,可由 super_admin 增删改。
-admin_user.role 弱引用本表 name。全新环境顺序应用即得三条内建角色。
-
-Revision ID: admin_role_table
-Revises: comparison_product_names
-Create Date: 2026-07-04 00:00:00.000000
-"""
-from collections.abc import Sequence
-
-import sqlalchemy as sa
-from sqlalchemy.dialects import postgresql
-
-from alembic import op
-
-revision: str = "admin_role_table"
-down_revision: str | Sequence[str] | None = "comparison_product_names"
-branch_labels: str | Sequence[str] | None = None
-depends_on: str | Sequence[str] | None = None
-
-_JSON = sa.JSON().with_variant(postgresql.JSONB(), "postgresql")
-
-# 与 app/admin/permissions.py 的 BUILTIN_ROLES 同口径(迁移内联一份,不耦合 app 常量)。
-# 页集对齐 Prototypes/dashboard/permissions.md 的 ROLES。key 承重(require_role),label 为展示名。
-_BUILTIN = [
-    {"name": "super_admin", "label": "管理员", "pages": [], "is_builtin": True},
-    {"name": "operator", "label": "运营", "pages": [
-        "dashboard", "coupon-data", "ad-revenue-report", "comparison-records",
-        "cps", "device-liveness", "price-reports", "feedbacks",
-    ], "is_builtin": False},
-    {"name": "finance", "label": "财务", "pages": [
-        "dashboard", "ad-revenue-report", "cps", "withdraws",
-    ], "is_builtin": False},
-    {"name": "tech", "label": "技术", "pages": [
-        "dashboard", "device-liveness", "config", "ad-revenue", "event-logs", "audit-logs",
-    ], "is_builtin": False},
-]
-
-
-def upgrade() -> None:
-    op.create_table(
-        "admin_role",
-        sa.Column("id", sa.Integer(), primary_key=True, autoincrement=True),
-        sa.Column("name", sa.String(length=32), nullable=False),
-        sa.Column("label", sa.String(length=32), nullable=False, server_default=""),
-        sa.Column("pages", _JSON, nullable=False),
-        sa.Column("is_builtin", sa.Boolean(), nullable=False, server_default=sa.false()),
-        sa.Column(
-            "created_at", sa.DateTime(timezone=True),
-            server_default=sa.func.now(), nullable=False,
-        ),
-    )
-    op.create_index("ix_admin_role_name", "admin_role", ["name"], unique=True)
-
-    tbl = sa.table(
-        "admin_role",
-        sa.column("name", sa.String),
-        sa.column("label", sa.String),
-        sa.column("pages", _JSON),
-        sa.column("is_builtin", sa.Boolean),
-    )
-    op.bulk_insert(tbl, _BUILTIN)
-
-
-def downgrade() -> None:
-    op.drop_index("ix_admin_role_name", table_name="admin_role")
-    op.drop_table("admin_role")

alembic/versions/admin_user_plain_password.py

@@ -1,29 +0,0 @@
-"""admin_user 加 plain_password 列(明文登录密码,仅后台 UI 建/重置的账号留存)
-
-权限管理页需能复看某成员已确定的登录密码转交本人。系统只存哈希无法反推,故对「后台 UI 创建/重置」
-的管理员额外留存一份明文;脚本/起后台建的超管为 None(前端不显示密码)。旧账号无此列值 → 同样不显示。
-
-Revision ID: admin_user_plain_password
-Revises: admin_role_table
-Create Date: 2026-07-04 00:00:00.000000
-"""
-from collections.abc import Sequence
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision: str = "admin_user_plain_password"
-down_revision: str | Sequence[str] | None = "admin_role_table"
-branch_labels: str | Sequence[str] | None = None
-depends_on: str | Sequence[str] | None = None
-
-
-def upgrade() -> None:
-    with op.batch_alter_table("admin_user", schema=None) as batch_op:
-        batch_op.add_column(sa.Column("plain_password", sa.String(length=128), nullable=True))
-
-
-def downgrade() -> None:
-    with op.batch_alter_table("admin_user", schema=None) as batch_op:
-        batch_op.drop_column("plain_password")

alembic/versions/comparison_product_names.py

@@ -1,70 +0,0 @@
-"""comparison_record 加 product_names 列(下单商品名派生串)+ 回填历史行
-
-admin 比价记录页要把原「店/商品」一列拆成「店」+「商品」两列、并支持按商品名搜索。
-items 是 JSON(SQLite 下 json.dumps ensure_ascii 会把中文转义存成 \\uXXXX,无法直接 CAST+LIKE
-命中中文),故把商品名派生成普通文本列,跨库 LIKE 一致、可索引。
-
-写路径(upsert_record / harvest_done)已同步派生;本迁移建列并从已存 items 回填历史行。
-全新环境顺序应用即得空列 + 回填(表本为空,回填 no-op)。
-
-Revision ID: comparison_product_names
-Revises: comparison_record_trace_unique
-Create Date: 2026-07-04 00:00:00.000000
-"""
-
-import json
-from collections.abc import Sequence
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision: str = "comparison_product_names"
-down_revision: str | Sequence[str] | None = "comparison_record_trace_unique"
-branch_labels: str | Sequence[str] | None = None
-depends_on: str | Sequence[str] | None = None
-
-
-def _product_names(items) -> str | None:
-    """items([{name,...}]) → 顿号分隔的商品名串(去重保序)。与 repositories.comparison
-    ._product_names_from_items 同口径,迁移内联一份避免耦合 app 代码。"""
-    if isinstance(items, str):  # SQLite: items 以 JSON 文本存,取回是 str
-        try:
-            items = json.loads(items)
-        except (ValueError, TypeError):
-            return None
-    if not isinstance(items, list) or not items:
-        return None
-    names: list[str] = []
-    for it in items:
-        name = it.get("name") if isinstance(it, dict) else None
-        if not name:
-            continue
-        s = str(name).strip()
-        if s and s not in names:
-            names.append(s)
-    joined = "、".join(names)
-    return joined[:500] or None
-
-
-def upgrade() -> None:
-    with op.batch_alter_table("comparison_record", schema=None) as batch_op:
-        batch_op.add_column(sa.Column("product_names", sa.String(length=512), nullable=True))
-
-    # 回填:从已存 items 派生商品名。items 小(菜名列表),一次取回即可;只更新有商品名的行。
-    bind = op.get_bind()
-    rows = bind.execute(
-        sa.text("SELECT id, items FROM comparison_record")
-    ).fetchall()
-    for rid, items in rows:
-        pn = _product_names(items)
-        if pn:
-            bind.execute(
-                sa.text("UPDATE comparison_record SET product_names = :pn WHERE id = :id"),
-                {"pn": pn, "id": rid},
-            )
-
-
-def downgrade() -> None:
-    with op.batch_alter_table("comparison_record", schema=None) as batch_op:
-        batch_op.drop_column("product_names")

app/admin/main.py

@@ -4,6 +4,7 @@
 复用 App 的 DB/models/repositories/integrations;鉴权独立(admin JWT,见 app/admin/security.py)。
 现有 app.main:app 不 import 本模块,两进程互不影响。
 """
+
 from __future__ import annotations
 
 import logging
@@ -12,6 +13,7 @@ from contextlib import asynccontextmanager
 
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import PlainTextResponse, RedirectResponse
 
 from app.admin.routers.ad_audit import router as ad_audit_router
 from app.admin.routers.ad_config import router as ad_config_router
@@ -25,14 +27,13 @@ from app.admin.routers.coupon_data import router as coupon_data_router
 from app.admin.routers.cps import router as cps_router
 from app.admin.routers.dashboard import router as dashboard_router
 from app.admin.routers.device_liveness import router as device_liveness_router
-from app.admin.routers.ops_stat_config import router as ops_stat_config_router
 from app.admin.routers.event_logs import router as event_logs_router
 from app.admin.routers.feedback import router as feedback_router
 from app.admin.routers.feedback_qr import router as feedback_qr_router
 from app.admin.routers.onboarding import router as onboarding_router
 from app.admin.routers.ops_marquee_seed import router as ops_marquee_seed_router
+from app.admin.routers.ops_stat_config import router as ops_stat_config_router
 from app.admin.routers.price_report import router as price_report_router
-from app.admin.routers.roles import router as roles_router
 from app.admin.routers.users import router as users_router
 from app.admin.routers.wallet import router as wallet_router
 from app.admin.routers.withdraw import router as withdraw_router
@@ -85,6 +86,15 @@ def health() -> dict[str, str]:
     return {"status": "ok", "service": "admin"}
 
 
+@admin_app.get("/", include_in_schema=False)
+def root():
+    """根路径落脚点:直接访问 :8771 时,非 prod 跳 API 文档,prod 下给一句纯文本说明
+    (prod 关了 docs_url,不能跳一个不存在的页面,也不暴露文档)。避免浏览器打开根路径吃 404。"""
+    if not settings.is_prod:
+        return RedirectResponse(url="/admin/docs")
+    return PlainTextResponse("shaguabijia admin API. See /admin/api/*.")
+
+
 admin_app.include_router(auth_router)
 admin_app.include_router(dashboard_router)
 admin_app.include_router(device_liveness_router)
@@ -99,7 +109,6 @@ admin_app.include_router(feedback_router)
 admin_app.include_router(event_logs_router)
 admin_app.include_router(feedback_qr_router)
 admin_app.include_router(admins_router)
-admin_app.include_router(roles_router)
 admin_app.include_router(audit_router)
 admin_app.include_router(config_router)
 admin_app.include_router(comparison_router)

app/admin/permissions.py

@@ -1,80 +0,0 @@
-"""admin 后台「页面权限目录」—— RBAC 的权限侧单一真源。
-
-一个权限 = 一个页面(= 左侧导航项)。角色持有一组 page key,登录后左侧只展示这些页(见前端
-layout.tsx 按 pages 过滤导航)。key 必须与前端路由一级对齐(/dashboard → "dashboard")。
-
-super_admin 为内建全权角色,恒可见全部页(effective_pages 特判)。新增页面 = 这里加一条 +
-前端导航加对应项(key 一致即可被各角色勾选可见)。
-"""
-from __future__ import annotations
-
-SUPER_ADMIN_ROLE = "super_admin"
-
-# 分组镜像前端导航(app/(main)/layout.tsx 的 NAV_GROUPS);key = 路由一级
-PERMISSION_CATALOG: list[dict] = [
-    {"group": "看板", "pages": [
-        {"key": "dashboard", "label": "数据大盘"},
-        {"key": "coupon-data", "label": "领券数据"},
-        {"key": "ad-revenue-report", "label": "广告收益"},
-        {"key": "comparison-records", "label": "比价记录"},
-        {"key": "cps", "label": "CPS收益"},
-        {"key": "device-liveness", "label": "设备存活"},
-    ]},
-    {"group": "奖励审核", "pages": [
-        {"key": "withdraws", "label": "提现审核"},
-        {"key": "price-reports", "label": "低价审核"},
-        {"key": "feedbacks", "label": "用户反馈"},
-    ]},
-    {"group": "数据配置", "pages": [
-        {"key": "config", "label": "系统配置"},
-        {"key": "ad-revenue", "label": "广告配置"},
-        {"key": "users", "label": "用户管理"},
-    ]},
-    {"group": "其他", "pages": [
-        {"key": "admins", "label": "权限管理"},
-        {"key": "event-logs", "label": "埋点日志"},
-        {"key": "audit-logs", "label": "审计日志"},
-    ]},
-]
-
-# 全部页面 key(super_admin 有效可见 = 此全集;也用于校验角色 pages 合法性)
-ALL_PAGE_KEYS: list[str] = [p["key"] for g in PERMISSION_CATALOG for p in g["pages"]]
-_ALL_SET = set(ALL_PAGE_KEYS)
-
-# 内建角色定义(种子 / ensure 兜底的单一真源):(key, 中文展示名, 默认可见页)。
-# 页集对齐 Prototypes/dashboard/permissions.md 的 ROLES;super_admin 恒全权(pages 空、bypass)。
-# key 承重(require_role / admin_user.role),勿改;label 为 UI 展示名。
-BUILTIN_ROLES: list[dict] = [
-    {"name": SUPER_ADMIN_ROLE, "label": "管理员", "pages": []},
-    {"name": "operator", "label": "运营", "pages": [
-        "dashboard", "coupon-data", "ad-revenue-report", "comparison-records",
-        "cps", "device-liveness", "price-reports", "feedbacks",
-    ]},
-    {"name": "finance", "label": "财务", "pages": [
-        "dashboard", "ad-revenue-report", "cps", "withdraws",
-    ]},
-    {"name": "tech", "label": "技术", "pages": [
-        "dashboard", "device-liveness", "config", "ad-revenue", "event-logs", "audit-logs",
-    ]},
-]
-
-# 内建 key → 中文展示名(展示 / 自愈用)
-BUILTIN_LABELS: dict[str, str] = {r["name"]: r["label"] for r in BUILTIN_ROLES}
-
-
-def sanitize_pages(pages: list[str] | None) -> list[str]:
-    """过滤掉不在目录里的 key(去重、保序),防脏数据/目录收缩后的悬空 key。"""
-    seen: set[str] = set()
-    out: list[str] = []
-    for k in pages or []:
-        if k in _ALL_SET and k not in seen:
-            seen.add(k)
-            out.append(k)
-    return out
-
-
-def effective_pages(role_name: str, role_pages: list[str] | None) -> list[str]:
-    """某角色的有效可见页:super_admin → 全部;其余 → 其 pages 与目录取交(自愈悬空 key)。"""
-    if role_name == SUPER_ADMIN_ROLE:
-        return list(ALL_PAGE_KEYS)
-    return sanitize_pages(role_pages)

app/admin/repositories/admin_role.py

@@ -1,81 +0,0 @@
-"""admin_role 表 CRUD + 「角色 → 有效可见页」解析。"""
-from __future__ import annotations
-
-from sqlalchemy import select
-from sqlalchemy.orm import Session
-
-from app.admin.permissions import (
-    ALL_PAGE_KEYS,
-    BUILTIN_ROLES,
-    SUPER_ADMIN_ROLE,
-    sanitize_pages,
-)
-from app.models.admin_role import AdminRole
-
-
-def ensure_builtin_roles(db: Session) -> None:
-    """空表时播种内建角色(管理员/运营/财务/技术)。幂等:表非空即 no-op。
-    给 create_all 环境(测试 / 未跑迁移的全新库)兜底,迁移已播种则不重复。
-    仅 super_admin 为 is_builtin(锁定不可改删);运营/财务/技术可编辑页/删除。"""
-    if db.execute(select(AdminRole.id).limit(1)).first() is not None:
-        return
-    db.add_all([
-        AdminRole(
-            name=r["name"], label=r["label"], pages=list(r["pages"]),
-            is_builtin=(r["name"] == SUPER_ADMIN_ROLE),
-        )
-        for r in BUILTIN_ROLES
-    ])
-    db.commit()
-
-
-def list_roles(db: Session) -> list[AdminRole]:
-    ensure_builtin_roles(db)
-    # super_admin(内建)恒排最前,其余按创建序
-    return list(
-        db.execute(
-            select(AdminRole).order_by(AdminRole.is_builtin.desc(), AdminRole.id)
-        ).scalars().all()
-    )
-
-
-def get_role(db: Session, name: str) -> AdminRole | None:
-    return db.execute(
-        select(AdminRole).where(AdminRole.name == name)
-    ).scalar_one_or_none()
-
-
-def create_role(db: Session, *, name: str, label: str, pages: list[str]) -> AdminRole:
-    # 自定义角色:name(key)= label = 用户输入的名称
-    role = AdminRole(name=name, label=label, pages=sanitize_pages(pages), is_builtin=False)
-    db.add(role)
-    db.commit()
-    db.refresh(role)
-    return role
-
-
-def update_role(
-    db: Session, role: AdminRole, *, label: str | None = None, pages: list[str] | None = None
-) -> AdminRole:
-    # 只改展示名 label + 可见页;name(key)不可变(admin_user.role / require_role 承重)
-    if label is not None:
-        role.label = label
-    if pages is not None:
-        role.pages = sanitize_pages(pages)
-    db.commit()
-    db.refresh(role)
-    return role
-
-
-def delete_role(db: Session, role: AdminRole) -> None:
-    db.delete(role)
-    db.commit()
-
-
-def effective_pages_of(db: Session, role_name: str) -> list[str]:
-    """某角色名的有效可见页:super_admin → 全部;其余 → 查表 pages 与目录取交。"""
-    if role_name == SUPER_ADMIN_ROLE:
-        return list(ALL_PAGE_KEYS)
-    ensure_builtin_roles(db)
-    role = get_role(db, role_name)
-    return sanitize_pages(role.pages if role else None)

app/admin/repositories/admin_user.py

@@ -20,20 +20,12 @@ def get_by_username(db: Session, username: str) -> AdminUser | None:
 
 
 def create_admin(
-    db: Session,
-    *,
-    username: str,
-    password: str,
-    role: str = "operator",
-    plain_password: str | None = None,
+    db: Session, *, username: str, password: str, role: str = "operator"
 ) -> AdminUser:
-    """建管理员。plain_password 非空则额外留存明文(后台 UI 建的账号传,供权限管理页复看);
-    脚本/起后台建账号不传(留 None → 前端不显示密码)。"""
     admin = AdminUser(
         username=username,
         password_hash=hash_password(password),
         role=role,
-        plain_password=plain_password,
     )
     db.add(admin)
     db.commit()

app/admin/repositories/queries.py

@@ -148,14 +148,11 @@ def list_comparison_records(
     phone: str | None = None,
     status: str | None = None,
     business_type: str | None = None,
-    store: str | None = None,
-    product: str | None = None,
     limit: int = 20,
     cursor: int | None = None,
 ) -> tuple[list[ComparisonRecord], int | None, int]:
     """admin 比价记录列表(debug)。按 user_id 精确 或 phone 前缀定位用户 + status/业务类型筛,
-    store(店名)/product(商品名)子串模糊匹配,offset 分页(创建时间倒序、id 兜底)。
-    join User 取 phone/nickname 瞬态挂记录上。"""
+    offset 分页(创建时间倒序、id 兜底)。join User 取 phone/nickname 瞬态挂记录上。"""
     stmt = select(ComparisonRecord)
     if user_id is not None:
         stmt = stmt.where(ComparisonRecord.user_id == user_id)
@@ -169,11 +166,6 @@ def list_comparison_records(
         stmt = stmt.where(ComparisonRecord.status == status)
     if business_type:
         stmt = stmt.where(ComparisonRecord.business_type == business_type)
-    if store:
-        stmt = stmt.where(ComparisonRecord.store_name.like(f"%{store}%"))
-    if product:
-        # 商品名搜 product_names 派生文本列(非 items JSON:SQLite 下 JSON 中文被转义无法直接 LIKE)。
-        stmt = stmt.where(ComparisonRecord.product_names.like(f"%{product}%"))
     items, next_cursor, total = offset_paginate(
         db, stmt,
         (desc(ComparisonRecord.created_at), desc(ComparisonRecord.id)),

app/admin/routers/admins.py

@@ -5,8 +5,6 @@ from fastapi import APIRouter, Depends, HTTPException, Request
 
 from app.admin.audit import write_audit
 from app.admin.deps import AdminDb, CurrentAdmin, get_client_ip, require_role
-from app.admin.permissions import SUPER_ADMIN_ROLE
-from app.admin.repositories import admin_role as role_repo
 from app.admin.repositories import admin_user as admin_repo
 from app.admin.schemas.admin import AdminCreateRequest, AdminUpdateRequest
 from app.admin.schemas.auth import AdminOut
@@ -25,23 +23,9 @@ def _active_super_count(db: AdminDb) -> int:
     )
 
 
-def _validate_role(db: AdminDb, role: str) -> None:
-    """角色必须是 super_admin 或 admin_role 表里已存在的角色,否则 400。"""
-    if role == SUPER_ADMIN_ROLE:
-        return
-    role_repo.ensure_builtin_roles(db)  # 空表(测试/全新库)兜底播种,再校验
-    if role_repo.get_role(db, role) is None:
-        raise HTTPException(status_code=400, detail=f"角色不存在: {role}")
-
-
-@router.get("", response_model=list[AdminOut], summary="管理员列表(含明文密码,super_admin 专属)")
+@router.get("", response_model=list[AdminOut], summary="管理员列表")
 def list_admins(db: AdminDb) -> list[AdminOut]:
-    out: list[AdminOut] = []
-    for a in admin_repo.list_admins(db):
-        item = AdminOut.model_validate(a)
-        item.password = a.plain_password  # 明文:仅本 super_admin 专属路由下发,供权限管理页复看
-        out.append(item)
-    return out
+    return [AdminOut.model_validate(a) for a in admin_repo.list_admins(db)]
 
 
 @router.post("", response_model=AdminOut, summary="创建管理员")
@@ -50,10 +34,8 @@ def create_admin(
 ) -> AdminOut:
     if admin_repo.get_by_username(db, body.username) is not None:
         raise HTTPException(status_code=409, detail="用户名已存在")
-    _validate_role(db, body.role)
     new = admin_repo.create_admin(
-        db, username=body.username, password=body.password, role=body.role,
-        plain_password=body.password,  # UI 建的账号留存明文,供权限管理页复看
+        db, username=body.username, password=body.password, role=body.role
     )
     write_audit(
         db, admin, action="admin.create", target_type="admin", target_id=new.id,
@@ -85,9 +67,6 @@ def update_admin(
     if demotes_super and _active_super_count(db) <= 1:
         raise HTTPException(status_code=400, detail="不能降级/禁用最后一个超级管理员")
 
-    if body.role is not None:
-        _validate_role(db, body.role)
-
     changes: dict = {}
     if body.role is not None and body.role != target.role:
         changes["role"] = {"before": target.role, "after": body.role}
@@ -98,7 +77,6 @@ def update_admin(
     if body.password is not None:
         changes["password"] = "reset"
         target.password_hash = hash_password(body.password)
-        target.plain_password = body.password  # 同步留存明文,权限管理页复看保持一致
     if not changes:
         raise HTTPException(status_code=400, detail="无任何变更字段")
     db.commit()
@@ -108,27 +86,3 @@ def update_admin(
         detail=changes, ip=get_client_ip(request), commit=True,
     )
     return AdminOut.model_validate(target)
-
-
-@router.delete("/{admin_id}", summary="删除管理员(带审计)")
-def delete_admin(admin_id: int, request: Request, admin: CurrentAdmin, db: AdminDb) -> dict:
-    target = admin_repo.get_by_id(db, admin_id)
-    if target is None:
-        raise HTTPException(status_code=404, detail="管理员不存在")
-    if admin_id == admin.id:
-        raise HTTPException(status_code=400, detail="不能删除自己")
-    # 防自锁:删掉某个 active super_admin 前,确认后仍至少剩 1 个,否则进「零可用超管」死局。
-    if (
-        target.role == "super_admin"
-        and target.status == "active"
-        and _active_super_count(db) <= 1
-    ):
-        raise HTTPException(status_code=400, detail="不能删除最后一个超级管理员")
-    username = target.username
-    db.delete(target)
-    db.commit()
-    write_audit(
-        db, admin, action="admin.delete", target_type="admin", target_id=admin_id,
-        detail={"username": username, "role": target.role}, ip=get_client_ip(request), commit=True,
-    )
-    return {"deleted": True}

app/admin/routers/auth.py

@@ -6,7 +6,6 @@ import logging
 from fastapi import APIRouter, Depends, HTTPException
 
 from app.admin.deps import AdminDb, CurrentAdmin
-from app.admin.repositories import admin_role as role_repo
 from app.admin.repositories import admin_user as admin_repo
 from app.admin.schemas.auth import AdminLoginRequest, AdminLoginResponse, AdminOut
 from app.admin.security import create_admin_token
@@ -18,13 +17,6 @@ logger = logging.getLogger("shagua.admin.auth")
 router = APIRouter(prefix="/admin/api/auth", tags=["admin-auth"])
 
 
-def _admin_out_with_pages(admin, db: AdminDb) -> AdminOut:  # noqa: ANN001
-    """AdminOut + 当前角色有效可见页(前端左侧导航按此过滤)。"""
-    out = AdminOut.model_validate(admin)
-    out.pages = role_repo.effective_pages_of(db, admin.role)
-    return out
-
-
 @router.post(
     "/login",
     response_model=AdminLoginResponse,
@@ -47,10 +39,10 @@ def login(req: AdminLoginRequest, db: AdminDb) -> AdminLoginResponse:
     return AdminLoginResponse(
         access_token=token,
         expires_in=expires_in,
-        admin=_admin_out_with_pages(admin, db),
+        admin=AdminOut.model_validate(admin),
     )
 
 
-@router.get("/me", response_model=AdminOut, summary="当前管理员(含有效可见页)")
-def me(admin: CurrentAdmin, db: AdminDb) -> AdminOut:
-    return _admin_out_with_pages(admin, db)
+@router.get("/me", response_model=AdminOut, summary="当前管理员")
+def me(admin: CurrentAdmin) -> AdminOut:
+    return AdminOut.model_validate(admin)

app/admin/routers/comparison.py

@@ -32,15 +32,12 @@ def list_comparison_records(
     phone: Annotated[str | None, Query(description="手机号前缀")] = None,
     status: Annotated[str | None, Query(pattern="^(success|failed|cancelled)$")] = None,
     business_type: Annotated[str | None, Query()] = None,
-    store: Annotated[str | None, Query(description="店名子串模糊匹配")] = None,
-    product: Annotated[str | None, Query(description="商品名子串模糊匹配")] = None,
     limit: Annotated[int, Query(ge=1, le=100)] = 20,
     cursor: Annotated[int | None, Query()] = None,
 ) -> CursorPage[AdminComparisonListItem]:
     items, next_cursor, total = queries.list_comparison_records(
         db, user_id=user_id, phone=phone, status=status,
-        business_type=business_type, store=store, product=product,
-        limit=limit, cursor=cursor,
+        business_type=business_type, limit=limit, cursor=cursor,
     )
     return CursorPage(
         items=[AdminComparisonListItem.model_validate(r) for r in items],

app/admin/routers/config.py

@@ -55,14 +55,9 @@ def _item(db, key: str) -> ConfigItemOut:
     raise HTTPException(status_code=404, detail="未知配置项")
 
 
-@router.get("", response_model=list[ConfigItemOut], summary="所有可配项 + 当前值(不含 hidden)")
+@router.get("", response_model=list[ConfigItemOut], summary="所有可配项 + 当前值")
 def list_config(db: AdminDb) -> list[ConfigItemOut]:
-    # hidden 项(已下线/由专用页管理,如福利页任务·里程碑·看广告调参、首页轮播数据源)不在本页渲染。
-    return [
-        ConfigItemOut(**item)
-        for item in app_config.list_all(db)
-        if not CONFIG_DEFS[item["key"]].get("hidden")
-    ]
+    return [ConfigItemOut(**item) for item in app_config.list_all(db)]
 
 
 @router.patch("/{key}", response_model=ConfigItemOut, summary="改某项配置(带审计)")

app/admin/routers/ops_marquee_seed.py

@@ -8,7 +8,6 @@ from __future__ import annotations
 from typing import Annotated
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request
-from pydantic import BaseModel
 
 from app.admin.audit import write_audit
 from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
@@ -23,11 +22,7 @@ from app.admin.schemas.ops_marquee_seed import (
 )
 from app.models.admin import AdminUser
 from app.models.ops_marquee_seed import OpsMarqueeSeed
-from app.repositories import app_config, ops_marquee
-
-
-class MarqueeModeUpdate(BaseModel):
-    mode: str  # mixed / real / seed
+from app.repositories import ops_marquee
 
 router = APIRouter(
     prefix="/admin/api/marquee-seeds",
@@ -62,33 +57,6 @@ def preview_feed(
     return OpsSavingsFeedPreviewOut(items=ops_marquee.get_feed(db, limit=limit))
 
 
-# 注:/mode 两个端点须在 /{seed_id} 之前注册,否则 PATCH /mode 会被 /{seed_id} 抢先按 id 解析。
-@router.get("/mode", summary="首页轮播数据源模式(mixed/real/seed)")
-def get_feed_mode(db: AdminDb) -> dict:
-    """当前轮播取数模式:mixed=真实优先+种子补位(默认)/ real=只真实 / seed=只种子·合成。"""
-    return {"mode": ops_marquee.get_feed_mode(db)}
-
-
-@router.patch("/mode", summary="改首页轮播数据源模式(带审计)")
-def set_feed_mode(
-    body: MarqueeModeUpdate,
-    request: Request,
-    admin: Annotated[AdminUser, Depends(require_role("operator"))],
-    db: AdminDb,
-) -> dict:
-    if body.mode not in ops_marquee.FEED_MODES:
-        raise HTTPException(status_code=400, detail="mode 需为 mixed / real / seed")
-    before = ops_marquee.get_feed_mode(db)
-    app_config.set_value(db, "marquee_feed_mode", body.mode, admin_id=admin.id, commit=False)
-    write_audit(
-        db, admin, action="ops_marquee_seed.set_mode", target_type="config",
-        target_id="marquee_feed_mode", detail={"before": before, "after": body.mode},
-        ip=get_client_ip(request), commit=False,
-    )
-    db.commit()
-    return {"mode": body.mode}
-
-
 @router.post("", response_model=OpsMarqueeSeedOut, summary="新增轮播种子(带审计)")
 def create_seed(
     body: OpsMarqueeSeedCreate,

app/admin/routers/roles.py

@@ -1,129 +0,0 @@
-"""admin RBAC 角色管理(仅 super_admin):列角色 / 权限目录 / 增删改角色。均写审计。
-
-角色 = 一组「可见页面」(见 app/admin/permissions.py)。角色登录后台后左侧只展示其 pages 对应导航项。
-只有 super_admin(内建全权角色)能进本组端点(dependencies=require_role() 无参 = 仅 super_admin)。
-"""
-from __future__ import annotations
-
-from fastapi import APIRouter, Depends, HTTPException, Request
-from sqlalchemy import func, select
-
-from app.admin.audit import write_audit
-from app.admin.deps import AdminDb, CurrentAdmin, get_client_ip, require_role
-from app.admin.permissions import (
-    PERMISSION_CATALOG,
-    SUPER_ADMIN_ROLE,
-    effective_pages,
-    sanitize_pages,
-)
-from app.admin.repositories import admin_role as role_repo
-from app.admin.schemas.role import (
-    PermissionGroup,
-    RoleCreateRequest,
-    RoleOut,
-    RoleUpdateRequest,
-)
-from app.models.admin import AdminUser
-from app.models.admin_role import AdminRole
-
-router = APIRouter(
-    prefix="/admin/api/roles",
-    tags=["admin-roles"],
-    dependencies=[Depends(require_role())],  # 无参 = 仅 super_admin
-)
-
-
-def _usage_counts(db: AdminDb) -> dict[str, int]:
-    rows = db.execute(
-        select(AdminUser.role, func.count(AdminUser.id)).group_by(AdminUser.role)
-    ).all()
-    return {r: c for r, c in rows}
-
-
-def _to_out(role: AdminRole, usage: dict[str, int]) -> RoleOut:
-    return RoleOut(
-        id=role.id,
-        name=role.name,
-        label=role.label or role.name,
-        pages=effective_pages(role.name, role.pages),
-        is_builtin=role.is_builtin,
-        in_use=usage.get(role.name, 0),
-    )
-
-
-@router.get("", response_model=list[RoleOut], summary="角色列表(含可见页 + 使用数)")
-def list_roles(db: AdminDb) -> list[RoleOut]:
-    usage = _usage_counts(db)
-    return [_to_out(r, usage) for r in role_repo.list_roles(db)]
-
-
-@router.get("/catalog", response_model=list[PermissionGroup], summary="页面权限目录(分组)")
-def get_catalog() -> list[PermissionGroup]:
-    return [PermissionGroup(**g) for g in PERMISSION_CATALOG]
-
-
-@router.post("", response_model=RoleOut, summary="新增角色(带审计)")
-def create_role(
-    body: RoleCreateRequest, request: Request, admin: CurrentAdmin, db: AdminDb
-) -> RoleOut:
-    name = body.name.strip()
-    if not name:
-        raise HTTPException(status_code=400, detail="角色名称不能为空")
-    if name == SUPER_ADMIN_ROLE:
-        raise HTTPException(status_code=400, detail="super_admin 为内建角色,不能新建")
-    if role_repo.get_role(db, name) is not None:
-        raise HTTPException(status_code=409, detail="角色名称已存在")
-    # 自定义角色:name(key)= label = 输入名称
-    role = role_repo.create_role(db, name=name, label=name, pages=body.pages)
-    write_audit(
-        db, admin, action="role.create", target_type="role", target_id=str(role.id),
-        detail={"name": name, "pages": role.pages}, ip=get_client_ip(request), commit=True,
-    )
-    return _to_out(role, _usage_counts(db))
-
-
-@router.patch("/{role_id}", response_model=RoleOut, summary="改角色(展示名/可见页,带审计)")
-def update_role(
-    role_id: int, body: RoleUpdateRequest, request: Request, admin: CurrentAdmin, db: AdminDb
-) -> RoleOut:
-    role = db.get(AdminRole, role_id)
-    if role is None:
-        raise HTTPException(status_code=404, detail="角色不存在")
-    if role.is_builtin:
-        raise HTTPException(status_code=400, detail="内建角色「管理员」不可编辑")
-
-    new_label = body.label.strip() if body.label is not None else None
-    changes: dict = {}
-    if new_label and new_label != role.label:
-        changes["label"] = {"before": role.label, "after": new_label}
-    if body.pages is not None:
-        changes["pages"] = {"before": role.pages, "after": sanitize_pages(body.pages)}
-    if not changes:
-        raise HTTPException(status_code=400, detail="无任何变更字段")
-
-    # 只改展示名 + 可见页;key(name)不可变,故无需级联 admin_user.role
-    role_repo.update_role(db, role, label=new_label, pages=body.pages)
-    write_audit(
-        db, admin, action="role.update", target_type="role", target_id=str(role_id),
-        detail=changes, ip=get_client_ip(request), commit=True,
-    )
-    return _to_out(role, _usage_counts(db))
-
-
-@router.delete("/{role_id}", summary="删角色(带审计;内建/在用不可删)")
-def delete_role(role_id: int, request: Request, admin: CurrentAdmin, db: AdminDb) -> dict:
-    role = db.get(AdminRole, role_id)
-    if role is None:
-        raise HTTPException(status_code=404, detail="角色不存在")
-    if role.is_builtin:
-        raise HTTPException(status_code=400, detail="内建角色不可删除")
-    used = _usage_counts(db).get(role.name, 0)
-    if used > 0:
-        raise HTTPException(status_code=400, detail=f"该角色仍有 {used} 名管理员在用,请先改派再删")
-    name = role.name
-    role_repo.delete_role(db, role)
-    write_audit(
-        db, admin, action="role.delete", target_type="role", target_id=str(role_id),
-        detail={"name": name}, ip=get_client_ip(request), commit=True,
-    )
-    return {"deleted": True}

app/admin/routers/users.py

@@ -13,6 +13,7 @@ from app.admin.schemas.common import CursorPage, OkResponse
 from app.admin.schemas.user import (
     AdminUserListItem,
     AdminUserOverview,
+    DeleteUserRequest,
     GrantCashRequest,
     GrantCoinsRequest,
     SetDebugTraceRequest,
@@ -132,6 +133,40 @@ def set_user_status(
     return OkResponse()
 
 
+@router.delete("/{user_id}", response_model=OkResponse, summary="注销/删除账号(清理个人数据 + 匿名化,带审计)")
+def delete_user(
+    user_id: int,
+    body: DeleteUserRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("super_admin"))],
+    db: AdminDb,
+) -> OkResponse:
+    """后台删除账号:复用 C 端自助注销同一套清理逻辑(soft_delete_account)——物理删除个人内容/
+    行为/PII 表 + 清零余额 + 匿名化 user 行释放唯一约束,保留资金流水/邀请关系/广告幂等+对账表。
+    仅 super_admin 可操作(最高危、不可逆)。资金安全同 C 端:有未提现现金/邀请金 / 在审提现单 → 409 拒绝。
+    """
+    user = user_repo.get_user_by_id(db, user_id)
+    if user is None:
+        raise HTTPException(status_code=404, detail="用户不存在")
+    if user.status == "deleted":
+        raise HTTPException(status_code=400, detail="账号已注销,请勿重复操作")
+    # 资金前置校验(与 C 端 delete_account 端点一致):余额一旦清零拿不回,有活钱先拦下。
+    if wallet_repo.get_cash_balance_cents(db, user_id) > 0:
+        raise HTTPException(status_code=409, detail="该账户还有未提现的现金余额,请先处理后再删除")
+    if wallet_repo.get_invite_cash_balance_cents(db, user_id) > 0:
+        raise HTTPException(status_code=409, detail="该账户还有未提现的邀请奖励金,请先处理后再删除")
+    if wallet_repo.has_reviewing_withdraw(db, user_id):
+        raise HTTPException(status_code=409, detail="该账户有提现正在审核中,请等审核完成后再删除")
+    # 先写审计(commit=False,挂进 session),再由 soft_delete_account 做清理 + 最终 commit —— 一次 commit
+    # 同时落审计行与清理结果,保持"改了就有痕、有痕就改了"原子(soft_delete_account 内部 commit 会一并 flush)。
+    write_audit(
+        db, admin, action="user.delete", target_type="user", target_id=user_id,
+        detail={"reason": body.reason, "phone": user.phone}, ip=get_client_ip(request), commit=False,
+    )
+    user_repo.soft_delete_account(db, user)
+    return OkResponse()
+
+
 @router.post("/{user_id}/debug-trace", response_model=OkResponse, summary="开关调试链接权限")
 def set_user_debug_trace(
     user_id: int,

app/admin/schemas/admin.py

@@ -6,19 +6,19 @@ from typing import Literal
 
 from pydantic import BaseModel, ConfigDict, Field
 
-# 角色不再硬编码枚举:改为任意角色名(自定义角色由 admin_role 表管理),存在性在路由层校验。
+_Role = Literal["super_admin", "finance", "operator"]
 
 
 class AdminCreateRequest(BaseModel):
     username: str = Field(..., min_length=3, max_length=64)
     password: str = Field(..., min_length=8, max_length=72)  # bcrypt ≤72 字节
-    role: str = Field("operator", min_length=1, max_length=32)
+    role: _Role = "operator"
 
 
 class AdminUpdateRequest(BaseModel):
     """改角色 / 启用禁用 / 重置密码,字段都可选(只改传了的)。"""
 
-    role: str | None = Field(None, min_length=1, max_length=32)
+    role: _Role | None = None
     status: Literal["active", "disabled"] | None = None
     password: str | None = Field(None, min_length=8, max_length=72)
 

app/admin/schemas/auth.py

@@ -20,12 +20,6 @@ class AdminOut(BaseModel):
     status: str
     created_at: datetime
     last_login_at: datetime | None = None
-    # 该管理员当前角色的有效可见页(= 左侧导航项 key);仅登录 / /me 填充,列表接口默认空。
-    # 前端据此过滤左侧导航(super_admin = 全部页)。见 app/admin/permissions.py。
-    pages: list[str] = []
-    # 明文登录密码:仅「管理员账号列表」(super_admin 专属路由)填充,供权限管理页编辑时复看;
-    # 无留存(脚本建的超管 / 旧账号)为 None → 前端不显示。登录 / /me 不下发(保持 None)。
-    password: str | None = None
 
 
 class AdminLoginResponse(BaseModel):

app/admin/schemas/comparison.py

@@ -23,7 +23,6 @@ class AdminComparisonListItem(BaseModel):
     status: str
     information: str | None = None
     store_name: str | None = None
-    product_names: str | None = None   # 下单商品名派生串(顿号分隔;「商品」列展示 + 商品搜索)
     source_platform_name: str | None = None
     best_platform_name: str | None = None
     source_price_cents: int | None = None

app/admin/schemas/role.py

@@ -1,35 +0,0 @@
-"""admin RBAC 角色 + 权限目录 schemas。"""
-from __future__ import annotations
-
-from pydantic import BaseModel, Field
-
-
-class PermissionPage(BaseModel):
-    key: str
-    label: str
-
-
-class PermissionGroup(BaseModel):
-    group: str
-    pages: list[PermissionPage]
-
-
-class RoleOut(BaseModel):
-    id: int
-    name: str             # 角色 key(承重,不可变)
-    label: str            # 展示名(UI 显示)
-    pages: list[str]      # 有效可见页 key(super_admin = 全部页)
-    is_builtin: bool      # 内建角色(super_admin):不可编辑/删除
-    in_use: int           # 使用该角色的管理员数(删除前端提示 / 拦截用)
-
-
-class RoleCreateRequest(BaseModel):
-    # 新增自定义角色:name 即用户输入的名称(同时作 key 与展示名)
-    name: str = Field(..., min_length=1, max_length=32)
-    pages: list[str] = Field(default_factory=list)
-
-
-class RoleUpdateRequest(BaseModel):
-    # 只改展示名 + 可见页;key 不可变
-    label: str | None = Field(None, min_length=1, max_length=32)
-    pages: list[str] | None = None

app/admin/schemas/user.py

@@ -115,3 +115,9 @@ class SetUserStatusRequest(BaseModel):
 
 class SetDebugTraceRequest(BaseModel):
     enabled: bool = Field(..., description="是否给该用户开「复制调试链接」权限")
+
+
+class DeleteUserRequest(BaseModel):
+    reason: str = Field(..., min_length=1, max_length=128, description="删除原因(必填,入审计)")
+
+    _v_reason = field_validator("reason")(_strip_reason)

app/api/v1/user.py

@@ -98,15 +98,19 @@ def onboarding_status(
     return OnboardingStatusResponse(completed=completed)
 
 
-@router.delete("", response_model=OkResponse, summary="注销账号(软删除)")
+@router.delete("", response_model=OkResponse, summary="注销账号(清理个人数据 + 匿名化)")
 def delete_account(user: CurrentUser, db: DbSession) -> OkResponse:
-    # 资金前置校验:注销是软删 + 匿名化,余额一旦留在 deleted 行就锁死(既退不出、新号也
-    # 拿不回)。有可提现现金 / 在审提现单 → 拒绝注销,引导用户先把钱处理掉。
+    # 资金前置校验:注销会物理清理个人数据 + 清零余额 + 匿名化,余额一旦清零就再也拿不回。
+    # 有可提现现金 / 邀请奖励金 / 在审提现单 → 拒绝注销,引导用户先把钱处理掉。
     # (pending 提现转账已在途、对账 worker 不依赖 user.status 照常到账,故不拦 pending。)
     if wallet_repo.get_cash_balance_cents(db, user.id) > 0:
         raise HTTPException(
             status_code=409, detail="账户还有未提现的现金余额,请先提现后再注销"
         )
+    if wallet_repo.get_invite_cash_balance_cents(db, user.id) > 0:
+        raise HTTPException(
+            status_code=409, detail="账户还有未提现的邀请奖励金,请先提现后再注销"
+        )
     if wallet_repo.has_reviewing_withdraw(db, user.id):
         raise HTTPException(
             status_code=409, detail="有提现正在审核中,请等审核完成后再注销"

app/core/config_schema.py

@@ -11,10 +11,7 @@ from typing import Any
 
 from app.core import rewards as r
 
-# type 约定(给前端渲染编辑控件用):int / int_list / dict_str_int / bool / enum
-# hidden=True:仍是合法可配项(业务照常 get_value / admin 可经专用端点读写),但**不在通用
-#   「系统配置」页渲染**(admin/routers/config.py:list_config 按此过滤)。用于把已下线/已改由
-#   专用页管理的项从福利页 Tab 收起,同时保留后端默认值与写入能力。
+# type 约定(给前端渲染编辑控件用):int / int_list / dict_str_int / bool
 CONFIG_DEFS: dict[str, dict[str, Any]] = {
     "signin_rewards": {
         "default": list(r.SIGNIN_REWARDS), "label": "签到 7 天金币档位",
@@ -33,21 +30,18 @@ CONFIG_DEFS: dict[str, dict[str, Any]] = {
         "default": r.WITHDRAW_MAX_CENTS, "label": "提现最高额(分)",
         "group": "钱包", "type": "int",
     },
-    # 从福利页 Tab 收起(hidden)的项:任务 / 里程碑 整组 + 看广告组里的「单次金币(遗留展示值)/
-    # 每轮次数 / 比价领券信息流广告开关 comparing_ad_enabled」。key 与默认值保留、后端业务照常读取,
-    # 仅不在配置页渲染。看广告组保留可见的:每日上限 / 单次金币上限 / 关闭后冷却。
     "task_rewards": {
         "default": dict(r.TASK_REWARDS), "label": "一次性任务奖励",
-        "group": "任务", "type": "dict_str_int", "help": "task_key → 金币。", "hidden": True,
+        "group": "任务", "type": "dict_str_int", "help": "task_key → 金币。",
     },
     "record_milestones": {
         "default": list(r.RECORD_MILESTONES), "label": "比价里程碑金币档位",
-        "group": "里程碑", "type": "int_list", "hidden": True,
+        "group": "里程碑", "type": "int_list",
         "help": "累计成功比价第 1~N 档解锁发的金币。",
     },
     "ad_reward_coin": {
         "default": r.AD_REWARD_COIN, "label": "看广告单次金币",
-        "group": "看广告", "type": "int", "hidden": True,
+        "group": "看广告", "type": "int",
         "help": "历史兼容/测试展示值;正式发放按 eCPM 公式计算。",
     },
     "ad_daily_limit": {
@@ -60,7 +54,7 @@ CONFIG_DEFS: dict[str, dict[str, Any]] = {
     },
     "ad_round_count": {
         "default": r.VIDEO_ROUND_REQUIRED_COUNT, "label": "每轮看广告次数",
-        "group": "看广告", "type": "int", "hidden": True, "help": "当前为 1,表示每次广告关闭后触发短冷却。",
+        "group": "看广告", "type": "int", "help": "当前为 1,表示每次广告关闭后触发短冷却。",
     },
     "ad_cooldown_sec": {
         "default": r.VIDEO_ROUND_COOLDOWN_SECONDS, "label": "广告关闭后冷却(秒)",
@@ -73,7 +67,7 @@ CONFIG_DEFS: dict[str, dict[str, Any]] = {
     },
     "comparing_ad_enabled": {
         "default": True, "label": "比价/领券期信息流广告",
-        "group": "看广告", "type": "bool", "hidden": True,
+        "group": "看广告", "type": "bool",
         "help": (
             "开启后,比价进行中 + 领券等候期会在悬浮窗展示穿山甲信息流广告(变现行为);"
             "关闭则全程不出广告。客户端按 app 启动 / 每场比价开始时拉取并缓存,故为「最终一致」的"
@@ -90,10 +84,4 @@ CONFIG_DEFS: dict[str, dict[str, Any]] = {
             "提现页「批量对账」手动按钮不受影响。"
         ),
     },
-    # 首页轮播数据源(hidden:不进通用配置 Tab,由「首页轮播种子」页的专用端点 /marquee-seeds/mode 读写)。
-    "marquee_feed_mode": {
-        "default": "mixed", "label": "首页轮播数据源",
-        "group": "首页轮播", "type": "enum", "hidden": True,
-        "help": "mixed=真实优先+种子补位(默认);real=只用真实比价记录;seed=只用种子/合成(演示)。",
-    },
 }

app/models/__init__.py

@@ -5,7 +5,6 @@ from app.models.ad_pangle_revenue import AdPangleDailyRevenue  # noqa: F401
 from app.models.ad_reward import AdRewardRecord  # noqa: F401
 from app.models.ad_watch_log import AdWatchLog  # noqa: F401
 from app.models.admin import AdminAuditLog, AdminUser  # noqa: F401
-from app.models.admin_role import AdminRole  # noqa: F401
 from app.models.analytics_event import AnalyticsEvent  # noqa: F401
 from app.models.app_config import AppConfig  # noqa: F401
 from app.models.comparison import ComparisonRecord  # noqa: F401

app/models/admin.py

@@ -25,9 +25,6 @@ class AdminUser(Base):
     id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
     username: Mapped[str] = mapped_column(String(64), unique=True, index=True, nullable=False)
     password_hash: Mapped[str] = mapped_column(String(255), nullable=False)
-    # 明文登录密码:仅「后台 UI 创建/重置」的管理员留存,供超管在权限管理页复看转交。
-    # 脚本/起后台时建的超管账号不写(为 None → 前端「不显示密码」)。⚠️ 内部工具便利取舍,见 create/list。
-    plain_password: Mapped[str | None] = mapped_column(String(128), nullable=True)
     # super_admin(全权+管账号)/ finance(钱:提现+金币)/ operator(用户+反馈+大盘)
     role: Mapped[str] = mapped_column(String(20), nullable=False, default="operator")
     # active / disabled

app/models/admin_role.py

@@ -1,42 +0,0 @@
-"""admin 角色 → 可见页面(权限)映射表。
-
-RBAC 的「角色」侧:每个角色持有一组「页面 key」(= 左侧导航项),决定该角色登录后台后左边能看到
-哪些页。super_admin 是内建全权角色(is_builtin=True),恒可见全部页(effective_pages 里特判,
-不依赖本表存的 pages)、不可编辑/删除。其余角色(含 operator/finance)可由 super_admin 增删改。
-
-admin_user.role 存的是本表的 name(字符串弱引用,不建外键——与既有 require_role 字符串口径一致;
-删除在用角色由业务层拦截,见 routers/roles.py)。页面 key 清单见 app/admin/permissions.py。
-"""
-from __future__ import annotations
-
-from datetime import datetime
-
-from sqlalchemy import JSON, Boolean, DateTime, Integer, String, func
-from sqlalchemy.dialects.postgresql import JSONB
-from sqlalchemy.orm import Mapped, mapped_column
-
-from app.db.base import Base
-
-_JSON = JSON().with_variant(JSONB(), "postgresql")
-
-
-class AdminRole(Base):
-    __tablename__ = "admin_role"
-
-    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
-    # 角色标识 key(不可变,承重):admin_user.role 引用它、require_role 按它鉴权。
-    # 内建 = super_admin/operator/finance/tech(英文,勿改);自定义 = 创建时的名称。
-    name: Mapped[str] = mapped_column(String(32), unique=True, index=True, nullable=False)
-    # 展示名(可改):内建 = 管理员/运营/财务/技术;自定义默认 = name。UI 一律展示 label。
-    label: Mapped[str] = mapped_column(String(32), nullable=False, default="")
-    # 该角色可见页面 key 列表(= 左侧导航项),见 app/admin/permissions.py 的 PERMISSION_CATALOG
-    pages: Mapped[list] = mapped_column(_JSON, nullable=False, default=list)
-    # 内建角色(当前仅 super_admin):不可编辑/删除,恒全权
-    is_builtin: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
-
-    created_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), server_default=func.now(), nullable=False
-    )
-
-    def __repr__(self) -> str:  # pragma: no cover
-        return f"<AdminRole name={self.name} pages={len(self.pages)} builtin={self.is_builtin}>"

app/models/comparison.py

@@ -86,10 +86,6 @@ class ComparisonRecord(Base):
 
     # ===== 订单概要 =====
     store_name: Mapped[str | None] = mapped_column(String(128), nullable=True)
-    # 下单商品名拼接串(顿号分隔,从 items[].name 去重派生),供 admin 列表「商品」列展示 + 商品名搜索。
-    # items 是 JSON(SQLite 下 json.dumps ensure_ascii 把中文转义,无法直接 CAST+LIKE),故另派生成普通
-    # 文本列——跨库 LIKE 一致、可加索引。写路径(upsert_record / harvest_done)落库时同步派生。
-    product_names: Mapped[str | None] = mapped_column(String(512), nullable=True)
     total_dish_count: Mapped[int | None] = mapped_column(Integer, nullable=True)
     skipped_dish_count: Mapped[int | None] = mapped_column(Integer, nullable=True)
 

app/repositories/comparison.py

@@ -24,23 +24,6 @@ def _yuan_to_cents(yuan: float | None) -> int | None:
     return round(yuan * 100)
 
 
-def _product_names_from_items(items: list | None) -> str | None:
-    """下单商品 items([{name, qty, specs?}])→ 顿号分隔的商品名串(去重保序),
-    供 admin「商品」列展示 + 商品名 LIKE 搜索。空 / 无名 → None;超列宽(512)截断留余量。"""
-    if not items:
-        return None
-    names: list[str] = []
-    for it in items:
-        name = it.get("name") if isinstance(it, dict) else None
-        if not name:
-            continue
-        s = str(name).strip()
-        if s and s not in names:
-            names.append(s)
-    joined = "、".join(names)
-    return joined[:500] or None
-
-
 def _derive(payload: ComparisonRecordIn) -> dict:
     """从上报 payload 派生结构化列(best/saved/is_source_best/status)。"""
     results = payload.comparison_results
@@ -98,12 +81,10 @@ def upsert_record(
     新客户端不再 POST(改由 compare.py 透传壳 harvest 落库)。
     """
     derived = _derive(payload)
-    items = [it.model_dump(exclude_none=True) for it in payload.items]
     fields = dict(
         device_id=payload.device_id,
         business_type=payload.business_type,
         store_name=payload.store_name,
-        product_names=_product_names_from_items(items),
         source_platform_id=payload.source_platform_id,
         source_platform_name=payload.source_platform_name,
         source_package=payload.source_package,
@@ -112,7 +93,7 @@ def upsert_record(
         trace_url=payload.trace_url,
         total_dish_count=payload.total_dish_count,
         skipped_dish_count=payload.skipped_dish_count,
-        items=items,
+        items=[it.model_dump(exclude_none=True) for it in payload.items],
         comparison_results=[r.model_dump() for r in payload.comparison_results],
         skipped_dish_names=list(payload.skipped_dish_names),
         # 客户端环境 / 性能(debug,客户端上报;旧客户端为 None)
@@ -307,8 +288,6 @@ def harvest_done(
     行不存在(理论上帧0已建;防御)则新建。"""
     results = done_params.get("comparison_results") or []
     derived = _derive_from_results(results)
-    # 菜品:pricebot 已把源单菜品塞进 comparison_results[源行].items
-    items = next((r.get("items") or [] for r in results if r.get("is_source")), [])
     fields = dict(
         business_type=business_type or "food",
         information=done_params.get("information") or None,
@@ -319,8 +298,8 @@ def harvest_done(
         skipped_dish_count=done_params.get("skipped_dish_count"),
         skipped_dish_names=list(done_params.get("skipped_dish_names") or []),
         comparison_results=results,
-        items=items,
-        product_names=_product_names_from_items(items),
+        # 菜品:pricebot 已把源单菜品塞进 comparison_results[源行].items
+        items=next((r.get("items") or [] for r in results if r.get("is_source")), []),
         raw_payload=done_params,
         **derived,
         **_device_cols_from_info(device_info),

app/repositories/ops_marquee.py

@@ -29,17 +29,6 @@ from app.core.rewards import CN_TZ
 from app.models.comparison import ComparisonRecord
 from app.models.ops_marquee_seed import OpsMarqueeSeed
 from app.models.user import User
-from app.repositories import app_config
-
-# 首页轮播数据源模式(存 app_config.marquee_feed_mode):
-#   mixed=真实优先+种子补位+合成兜底(默认,原行为);real=只真实(不足则少/空);seed=只种子+合成兜底。
-FEED_MODES = ("mixed", "real", "seed")
-
-
-def get_feed_mode(db: Session) -> str:
-    """读首页轮播数据源模式;非法/未配置回退 mixed(= 原行为)。"""
-    mode = app_config.get_value(db, "marquee_feed_mode")
-    return mode if mode in FEED_MODES else "mixed"
 
 # feed 运行时随机源(每次请求结果不同 = 轮播想要的「鲜活感」)
 _rng = random.Random()
@@ -223,56 +212,50 @@ def get_feed(db: Session, limit: int = 8) -> list[dict]:
     展示时间统一「刷新」成相对现在的最近时刻(从 now 往前**随机抖动**递减),保证轮播永远像刚发生、
     节奏自然不机械(真实用户/金额不变,只换展示时间——避免旧测试数据 / 低谷期记录显示成过时时间)。
     """
-    mode = get_feed_mode(db)  # mixed / real / seed(运营可在「首页轮播种子」页切换)
+    # 真实条:取较多近期记录(带 ~30s 缓存)后按 user 去重;金额超上限的异常值已在查询剔除。
+    rows = _recent_real_rows(db)
 
     items: list[dict] = []
     used_names: set[str] = set()
+    seen_users: set[int] = set()
+    for uid, sc, nick in rows:
+        if uid in seen_users:
+            continue
+        seen_users.add(uid)
+        name = _mask_real(nick, uid)
+        used_names.add(name)  # 真实名按昵称/id 稳定;偶发撞名可接受
+        items.append({"masked_user": name, "saved_amount_cents": int(sc)})
+        if len(items) >= limit:
+            break
 
-    # 真实条(mixed / real):取较多近期记录(带 ~30s 缓存)后按 user 去重;金额超上限的异常值已在查询剔除。
-    if mode != "seed":
-        rows = _recent_real_rows(db)
-        seen_users: set[int] = set()
-        for uid, sc, nick in rows:
-            if uid in seen_users:
-                continue
-            seen_users.add(uid)
-            name = _mask_real(nick, uid)
-            used_names.add(name)  # 真实名按昵称/id 稳定;偶发撞名可接受
-            items.append({"masked_user": name, "saved_amount_cents": int(sc)})
-            if len(items) >= limit:
-                break
-
-    # 种子补位 + 合成兜底(mixed / seed):mixed 下补真实不足的部分,seed 下全量用种子/合成。
-    # real 模式**跳过**——只出真实,不掺任何假数据(真实不足则少于 limit,为 0 时返回空)。
-    if mode != "real":
-        need = limit - len(items)
-        if need > 0:
-            seeds = db.execute(
-                select(OpsMarqueeSeed).where(OpsMarqueeSeed.enabled.is_(True))
-            ).scalars().all()
-            # 公平随机抽取 need 个(池子够大则不放回抽样;否则全用并打散),让所有启用种子都有机会露出。
-            chosen = _rng.sample(seeds, need) if len(seeds) > need else list(seeds)
-            _rng.shuffle(chosen)
-            for s in chosen:
-                # 用户名:旧的「用户****xxx」统一模板名 / 留空 → 一律走新混合合成(避开同屏撞名、自愈历史种子);
-                # 仅运营手动设的非模板真名才原样用。
-                fixed = (s.masked_user or "").strip()
-                name = fixed if fixed and not fixed.startswith("用户****") else _unique_name(used_names)
-                used_names.add(name)
-                # 金额:在 [min,max] 取长尾随机值(小额居多、偶尔大额;固定金额则 min==max)。
-                lo = max(0, int(s.min_cents))
-                hi = max(lo, int(s.max_cents))
-                items.append({"masked_user": name, "saved_amount_cents": _skewed_amount(lo, hi)})
-
-        # 兜底:真实 + 种子仍凑不满 limit(种子被全停用 / 数量太少)→ 用内置合成补满,
-        # 保证轮播既不空也不稀疏(稀疏的几条循环同样像假)。
-        while len(items) < limit:
-            name = _unique_name(used_names)
+    need = limit - len(items)
+    if need > 0:
+        seeds = db.execute(
+            select(OpsMarqueeSeed).where(OpsMarqueeSeed.enabled.is_(True))
+        ).scalars().all()
+        # 公平随机抽取 need 个(池子够大则不放回抽样;否则全用并打散),让所有启用种子都有机会露出。
+        chosen = _rng.sample(seeds, need) if len(seeds) > need else list(seeds)
+        _rng.shuffle(chosen)
+        for s in chosen:
+            # 用户名:旧的「用户****xxx」统一模板名 / 留空 → 一律走新混合合成(避开同屏撞名、自愈历史种子);
+            # 仅运营手动设的非模板真名才原样用。
+            fixed = (s.masked_user or "").strip()
+            name = fixed if fixed and not fixed.startswith("用户****") else _unique_name(used_names)
             used_names.add(name)
-            items.append({
-                "masked_user": name,
-                "saved_amount_cents": _skewed_amount(_FALLBACK_MIN_CENTS, _FALLBACK_MAX_CENTS),
-            })
+            # 金额:在 [min,max] 取长尾随机值(小额居多、偶尔大额;固定金额则 min==max)。
+            lo = max(0, int(s.min_cents))
+            hi = max(lo, int(s.max_cents))
+            items.append({"masked_user": name, "saved_amount_cents": _skewed_amount(lo, hi)})
+
+    # 兜底:真实 + 种子仍凑不满 limit(种子被全停用 / 数量太少)→ 用内置合成补满,
+    # 保证轮播既不空也不稀疏(稀疏的几条循环同样像假)。
+    while len(items) < limit:
+        name = _unique_name(used_names)
+        used_names.add(name)
+        items.append({
+            "masked_user": name,
+            "saved_amount_cents": _skewed_amount(_FALLBACK_MIN_CENTS, _FALLBACK_MAX_CENTS),
+        })
 
     # 统一赋「最近」时间:从 now 往前**随机抖动**递减,避免固定节奏被看出规律。
     # 首条几十秒前;其余多数 1~5 分钟,偶尔扎堆(20~55s)或较长(5~9 分钟),降序、像真实流水。

app/repositories/ops_stat.py

@@ -318,14 +318,11 @@ def update_config(
         row.random_current = _monotonic(row, random_initial)
         row.random_last_tick_at = now
     elif apply_now:
-        # 立即更新:不等钟点,马上刷新一次。
-        # random:走一档增长;real/manual:直接落到「配置目标值」(manual_value / max(真实,保底)),
-        # **显式保存即所见即所得,绕过「只增不减」护栏**——运营手动改值就是要按配置显示(含调小)。
-        # (护栏仍作用于自动 tick 的 _refresh:防门面在两次保存之间被真实刷新/自增长悄悄缩水。)
+        # 立即更新:不等钟点,马上刷新一次
         if row.mode == "random" and row.random_current is not None:
             row.random_current = _grow(row, row.random_current, 1)
         else:
-            row.random_current = _current_target(db, row)
+            row.random_current = _monotonic(row, _current_target(db, row))
         row.random_last_tick_at = now
     elif row.random_current is None:
         # 首次无值:按当前模式播种,使配置后立即有合理展示值

app/repositories/user.py

@@ -8,10 +8,29 @@ import secrets
 import string
 from datetime import datetime, timezone
 
-from sqlalchemy import select
+from sqlalchemy import delete, select
 from sqlalchemy.orm import Session
 
+from app.models.ad_watch_log import AdWatchLog
+from app.models.analytics_event import AnalyticsEvent
+from app.models.comparison import ComparisonRecord
+from app.models.comparison_milestone import ComparisonMilestoneClaim
+from app.models.coupon_state import (
+    CouponClaimRecord,
+    CouponDailyCompletion,
+    CouponPromptEngagement,
+    CouponSession,
+)
+from app.models.device import DeviceLiveness
+from app.models.feedback import Feedback
+from app.models.invite_fingerprint import InviteFingerprint
+from app.models.onboarding import OnboardingCompletion
+from app.models.price_report import PriceReport
+from app.models.savings import SavingsRecord
+from app.models.signin import SigninBoostRecord, SigninRecord
+from app.models.task import UserTask
 from app.models.user import User
+from app.models.wallet import CoinAccount
 
 
 # ===== 创建时分配的标识:用户名(对外展示账号 ID)+ 默认昵称 =====
@@ -114,19 +133,63 @@ def set_avatar_url(db: Session, user: User, *, avatar_url: str) -> User:
 
 
 def soft_delete_account(db: Session, user: User) -> None:
-    """注销账号:软删除 + 匿名化 + 释放唯一约束/外部绑定。
+    """注销账号:物理删除个人数据 + 清零余额 + 匿名化保留财务/关系 + 释放唯一约束。
 
-    把 phone 改成 `deleted_<id>` 释放手机号唯一约束,允许同号码重新注册成全新账号;
-    清空 PII(昵称/头像),保留行用于审计。status=deleted 后将无法再登录该行
-    (登录接口校验 status==active)。
+    删除策略(按"删了是否破坏对账 / 影响别人 / 是否 PII"分类):
+      物理删除(个人内容/成绩/行为/PII,只涉本人、删了不碰账目也不影响别人):比价/
+        省钱/签到/领券/任务/里程碑领取/埋点/引导标记/设备活跃/价格上报/反馈/看广告时长日志
+        (ad_watch_log:前端上报时长、不可信、非发奖依据,纯行为埋点),以及
+        邀请指纹(含 IP/机型/UA 的 PII,按 inviter_user_id 存 = 本人作为邀请人留的)。
+      清零保留:coin_account 的金币/现金/邀请金/累计收益归零(现金/邀请金已由端点
+        前置校验=0),行保留 —— 避免碰资金流水外键,也留作审计。
+      保留 + 随本行匿名化与身份解绑(动了会破坏对账/在途到账/发奖幂等/误伤邀请人):
+        三本资金流水(coin/cash/invite_cash_transaction)、提现单(pending 在途照常到账)、
+        微信转账授权(worker 对账 pending 要用)、广告发奖幂等记录(ad_reward 有 trans_id、
+        ad_feed_reward_record 有 client_event_id 唯一键,删了幂等键会致回调/重放重复发奖)、
+        广告 eCPM 收益记录(ad_ecpm_record 是内部收益统计/对账口径,同资金流水按对账保留)、
+        邀请关系(inviter/invitee 双向、不含 PII,删了会破坏邀请人侧归属)。这些表的 user_id
+        指向已匿名化的本行,身份已解绑。
 
-    ⚠️ 注销必须连同释放 user 上其余唯一约束/外部身份,否则 deleted 行永久占着槽位,
-    对应资源再也无法被复用:
+    ⚠️ 匿名化必须连同释放 user 其余唯一约束/外部身份,否则 deleted 行永久占着槽位:
       - wechat_openid: 不清 → 这个微信再也无法被任何账号绑定(提现通道彻底锁死);
       - invite_code:   不清 → 邀请码槽位被占 + 裸查仍命中死号(发奖已被 bind 的
         status==active 校验兜住,清掉更干净)。
-    资金安全(未提现现金 / 在审提现单)由调用方 delete_account 端点前置校验,这里只匿名化。
+    资金安全(未提现现金/邀请金 / 在审提现单)由调用方 delete_account 端点前置校验。
     """
+    uid = user.id
+
+    # 1) 物理删除个人内容/行为/成绩/PII 数据(不碰资金流水/账户/邀请关系/广告幂等)
+    personal_deletions = [
+        delete(ComparisonRecord).where(ComparisonRecord.user_id == uid),
+        delete(SavingsRecord).where(SavingsRecord.user_id == uid),
+        delete(SigninRecord).where(SigninRecord.user_id == uid),
+        delete(SigninBoostRecord).where(SigninBoostRecord.user_id == uid),
+        delete(CouponClaimRecord).where(CouponClaimRecord.user_id == uid),
+        delete(CouponDailyCompletion).where(CouponDailyCompletion.user_id == uid),
+        delete(CouponPromptEngagement).where(CouponPromptEngagement.user_id == uid),
+        delete(CouponSession).where(CouponSession.user_id == uid),
+        delete(UserTask).where(UserTask.user_id == uid),
+        delete(ComparisonMilestoneClaim).where(ComparisonMilestoneClaim.user_id == uid),
+        delete(DeviceLiveness).where(DeviceLiveness.user_id == uid),
+        delete(PriceReport).where(PriceReport.user_id == uid),
+        delete(Feedback).where(Feedback.user_id == uid),
+        delete(OnboardingCompletion).where(OnboardingCompletion.user_id == uid),
+        delete(AnalyticsEvent).where(AnalyticsEvent.user_id == uid),
+        delete(AdWatchLog).where(AdWatchLog.user_id == uid),
+        delete(InviteFingerprint).where(InviteFingerprint.inviter_user_id == uid),
+    ]
+    for stmt in personal_deletions:
+        db.execute(stmt)
+
+    # 2) 清零余额账户(现金/邀请金已前置=0;金币/累计收益一并归零,行保留不碰流水外键)
+    acc = db.get(CoinAccount, uid)
+    if acc is not None:
+        acc.coin_balance = 0
+        acc.cash_balance_cents = 0
+        acc.invite_cash_balance_cents = 0
+        acc.total_coin_earned = 0
+
+    # 3) 匿名化本行 + 释放唯一约束/外部身份(保留行:审计锚 + 资金流水/邀请关系外键不断)
     user.status = "deleted"
     user.phone = f"deleted_{user.id}"
     user.nickname = None

app/repositories/wallet.py

@@ -383,6 +383,16 @@ def get_cash_balance_cents(db: Session, user_id: int) -> int:
     return val or 0
 
 
+def get_invite_cash_balance_cents(db: Session, user_id: int) -> int:
+    """只读查邀请奖励金余额(分)。账户不存在返回 0,**不创建账户**(同 get_cash_balance_cents)。
+    注销前置校验用:邀请奖励金与金币兑换现金物理隔离,注销会把账户余额一并清零,若不单独
+    校验,用户没提现的返佣金会被直接清零吞掉。"""
+    val = db.execute(
+        select(CoinAccount.invite_cash_balance_cents).where(CoinAccount.user_id == user_id)
+    ).scalar_one_or_none()
+    return val or 0
+
+
 def has_reviewing_withdraw(db: Session, user_id: int) -> bool:
     """用户是否有「待审核(reviewing)」的提现单。
 

tests/test_admin_config.py

@@ -68,14 +68,7 @@ def test_list_config(admin_client: TestClient, token: str) -> None:
     r = admin_client.get("/admin/api/config", headers=_auth(token))
     assert r.status_code == 200, r.text
     items = {i["key"]: i for i in r.json()}
-    # 非 hidden 项照常返回;看广告组保留可见的:每日上限 / 单次金币上限 / 关闭后冷却。
-    assert "signin_rewards" in items and "ad_daily_limit" in items and "ad_cooldown_sec" in items
-    # hidden 项(任务/里程碑、首页轮播数据源、看广告组的单次金币/每轮次数/信息流广告开关)不在配置页返回。
-    for hidden_key in (
-        "task_rewards", "record_milestones", "marquee_feed_mode",
-        "ad_reward_coin", "ad_round_count", "comparing_ad_enabled",
-    ):
-        assert hidden_key not in items, f"{hidden_key} 应被 hidden 过滤"
+    assert "signin_rewards" in items and "ad_daily_limit" in items
     assert items["signin_rewards"]["value"] == [
         200, 200, 300, 200, 400, 400, 800,
     ]

tests/test_admin_roles.py

@@ -1,152 +0,0 @@
-"""Admin RBAC 角色/权限测试:可见页下发、角色 CRUD 仅 super_admin、内建/在用保护。"""
-from __future__ import annotations
-
-import pytest
-from fastapi.testclient import TestClient
-
-from app.admin.main import admin_app
-from app.admin.repositories import admin_user as admin_repo
-from app.core.security import hash_password
-from app.db.session import SessionLocal
-
-
-@pytest.fixture()
-def admin_client() -> TestClient:
-    return TestClient(admin_app)
-
-
-def _token(username: str, role: str) -> str:
-    db = SessionLocal()
-    try:
-        a = admin_repo.get_by_username(db, username)
-        if a is None:
-            admin_repo.create_admin(db, username=username, password="pass1234", role=role)
-        else:
-            a.password_hash = hash_password("pass1234")
-            a.role = role
-            a.status = "active"
-            db.commit()
-    finally:
-        db.close()
-    c = TestClient(admin_app)
-    return c.post(
-        "/admin/api/auth/login", json={"username": username, "password": "pass1234"}
-    ).json()["access_token"]
-
-
-@pytest.fixture()
-def super_token() -> str:
-    return _token("r_super", "super_admin")
-
-
-@pytest.fixture()
-def operator_token() -> str:
-    return _token("r_operator", "operator")
-
-
-def _auth(t: str) -> dict:
-    return {"Authorization": f"Bearer {t}"}
-
-
-def test_super_pages_all_operator_limited(admin_client, super_token, operator_token) -> None:
-    su = admin_client.get("/admin/api/auth/me", headers=_auth(super_token)).json()
-    assert "admins" in su["pages"] and "dashboard" in su["pages"]  # 超管全页
-    op = admin_client.get("/admin/api/auth/me", headers=_auth(operator_token)).json()
-    assert "dashboard" in op["pages"] and "admins" not in op["pages"]  # 运营看不到管理员页
-
-
-def test_roles_endpoints_super_only(admin_client, super_token, operator_token) -> None:
-    assert admin_client.get("/admin/api/roles", headers=_auth(super_token)).status_code == 200
-    assert admin_client.get("/admin/api/roles", headers=_auth(operator_token)).status_code == 403
-
-
-def test_role_crud(admin_client, super_token) -> None:
-    cat = admin_client.get("/admin/api/roles/catalog", headers=_auth(super_token)).json()
-    assert any(g["group"] == "看板" for g in cat)
-
-    r = admin_client.post(
-        "/admin/api/roles", json={"name": "审核", "pages": ["dashboard", "feedbacks", "xx-bad"]},
-        headers=_auth(super_token),
-    )
-    assert r.status_code == 200, r.text
-    rid = r.json()["id"]
-    assert set(r.json()["pages"]) == {"dashboard", "feedbacks"}  # 非法 key 被过滤
-
-    # 重名 409
-    assert admin_client.post(
-        "/admin/api/roles", json={"name": "审核", "pages": []}, headers=_auth(super_token)
-    ).status_code == 409
-
-    # 改可见页
-    u = admin_client.patch(
-        f"/admin/api/roles/{rid}", json={"pages": ["dashboard"]}, headers=_auth(super_token)
-    )
-    assert u.status_code == 200 and u.json()["pages"] == ["dashboard"]
-
-    # 删
-    assert admin_client.delete(f"/admin/api/roles/{rid}", headers=_auth(super_token)).status_code == 200
-
-
-def test_builtin_super_admin_protected(admin_client, super_token) -> None:
-    roles = admin_client.get("/admin/api/roles", headers=_auth(super_token)).json()
-    sa = next(r for r in roles if r["name"] == "super_admin")
-    assert sa["is_builtin"] and len(sa["pages"]) >= 10  # 全部页
-    assert admin_client.patch(
-        f"/admin/api/roles/{sa['id']}", json={"pages": []}, headers=_auth(super_token)
-    ).status_code == 400
-    assert admin_client.delete(
-        f"/admin/api/roles/{sa['id']}", headers=_auth(super_token)
-    ).status_code == 400
-
-
-def test_delete_role_in_use_blocked(admin_client, super_token) -> None:
-    admin_client.post(
-        "/admin/api/admins",
-        json={"username": "role_holder", "password": "pass1234", "role": "operator"},
-        headers=_auth(super_token),
-    )
-    roles = admin_client.get("/admin/api/roles", headers=_auth(super_token)).json()
-    op = next(r for r in roles if r["name"] == "operator")
-    assert op["in_use"] >= 1
-    assert admin_client.delete(
-        f"/admin/api/roles/{op['id']}", headers=_auth(super_token)
-    ).status_code == 400
-
-
-def test_builtin_roles_labels_and_pages(admin_client, super_token) -> None:
-    roles = {r["name"]: r for r in admin_client.get("/admin/api/roles", headers=_auth(super_token)).json()}
-    # 中文展示名(key 不变)
-    assert roles["super_admin"]["label"] == "管理员"
-    assert roles["operator"]["label"] == "运营"
-    assert roles["finance"]["label"] == "财务"
-    assert roles["tech"]["label"] == "技术"
-    # 页集对齐 Prototypes/dashboard/permissions.md 的 ROLES
-    assert set(roles["finance"]["pages"]) == {"dashboard", "ad-revenue-report", "cps", "withdraws"}
-    assert set(roles["tech"]["pages"]) == {
-        "dashboard", "device-liveness", "config", "ad-revenue", "event-logs", "audit-logs",
-    }
-
-
-def test_ui_created_admin_shows_password_script_admin_hidden(admin_client, super_token) -> None:
-    # UI 建号:账号列表回显明文登录密码(供权限管理页编辑复看)
-    admin_client.post(
-        "/admin/api/admins",
-        json={"username": "pw_show_user", "password": "pass1234", "role": "operator"},
-        headers=_auth(super_token),
-    )
-    admins = {a["username"]: a for a in admin_client.get("/admin/api/admins", headers=_auth(super_token)).json()}
-    assert admins["pw_show_user"]["password"] == "pass1234"
-    # 经 repo/脚本直建的账号(r_super,无留存明文)→ password 为 None,前端不显示
-    assert admins["r_super"]["password"] is None
-    # 登录 / me 不下发明文(保持 None)
-    me = admin_client.get("/admin/api/auth/me", headers=_auth(super_token)).json()
-    assert me.get("password") is None
-
-
-def test_create_admin_rejects_unknown_role(admin_client, super_token) -> None:
-    r = admin_client.post(
-        "/admin/api/admins",
-        json={"username": "bad_role_user", "password": "pass1234", "role": "不存在的角色"},
-        headers=_auth(super_token),
-    )
-    assert r.status_code == 400

tests/test_admin_write.py

@@ -476,3 +476,100 @@ def test_withdraw_reconcile(admin_client: TestClient, finance_token: str, monkey
     )
     assert r.status_code == 200, r.text
     assert "checked" in r.json() and "resolved" in r.json()
+
+
+# ===== 删除账号(super_admin,复用 soft_delete_account + 审计) =====
+
+def test_admin_delete_user_purges_and_audits(
+    admin_client: TestClient, super_token: str
+) -> None:
+    """super_admin 删除:user 行匿名化 + 个人数据被清 + 落审计(action=user.delete,含 reason)。"""
+    uid = _seed_user("13900000031")
+    db = SessionLocal()
+    try:
+        db.add(Feedback(user_id=uid, content="待清理", contact="wx", status="pending"))
+        db.commit()
+    finally:
+        db.close()
+
+    r = admin_client.request(
+        "DELETE", f"/admin/api/users/{uid}",
+        json={"reason": "违规账号"}, headers=_auth(super_token),
+    )
+    assert r.status_code == 200, r.text
+    db = SessionLocal()
+    try:
+        u = db.get(User, uid)
+        assert u is not None and u.status == "deleted"
+        assert u.phone == f"deleted_{uid}"
+        # 个人表被清(复用 C 端 soft_delete_account 同一套级联删除)
+        fbs = db.execute(
+            select(Feedback).where(Feedback.user_id == uid)
+        ).scalars().all()
+        assert fbs == []
+        # 审计:业务 + 审计同一 commit 一起落(改了就有痕)
+        logs = db.execute(
+            select(AdminAuditLog).where(
+                AdminAuditLog.action == "user.delete", AdminAuditLog.target_id == str(uid)
+            )
+        ).scalars().all()
+        assert len(logs) == 1 and logs[0].detail["reason"] == "违规账号"
+    finally:
+        db.close()
+
+
+def test_admin_delete_user_forbidden_for_operator(
+    admin_client: TestClient, operator_token: str
+) -> None:
+    """删除是最高危操作:operator/finance 都不可,仅 super_admin。且拒绝后账号不被删。"""
+    uid = _seed_user("13900000032")
+    r = admin_client.request(
+        "DELETE", f"/admin/api/users/{uid}",
+        json={"reason": "x"}, headers=_auth(operator_token),
+    )
+    assert r.status_code == 403
+    db = SessionLocal()
+    try:
+        assert db.get(User, uid).status == "active"  # 未被删
+    finally:
+        db.close()
+
+
+def test_admin_delete_user_blocked_when_cash_positive(
+    admin_client: TestClient, super_token: str, finance_token: str
+) -> None:
+    """有未提现现金 → 409 拒绝(同 C 端资金前置闸),账号不被删。"""
+    uid = _seed_user("13900000033")
+    # 用 finance 给该用户灌现金
+    admin_client.post(
+        f"/admin/api/users/{uid}/cash", json={"amount_cents": 100, "reason": "底"},
+        headers=_auth(finance_token),
+    )
+    r = admin_client.request(
+        "DELETE", f"/admin/api/users/{uid}",
+        json={"reason": "x"}, headers=_auth(super_token),
+    )
+    assert r.status_code == 409, r.text
+    assert "现金" in r.json()["detail"]
+    db = SessionLocal()
+    try:
+        assert db.get(User, uid).status == "active"
+    finally:
+        db.close()
+
+
+def test_admin_delete_user_rejects_already_deleted(
+    admin_client: TestClient, super_token: str
+) -> None:
+    uid = _seed_user("13900000034")
+    r = admin_client.request(
+        "DELETE", f"/admin/api/users/{uid}",
+        json={"reason": "首删"}, headers=_auth(super_token),
+    )
+    assert r.status_code == 200, r.text
+    # 再删已注销账号 → 400
+    r = admin_client.request(
+        "DELETE", f"/admin/api/users/{uid}",
+        json={"reason": "重复"}, headers=_auth(super_token),
+    )
+    assert r.status_code == 400

tests/test_delete_account.py

@@ -1,14 +1,18 @@
-"""注销账号(DELETE /api/v1/user):软删 + 释放唯一约束 + 资金前置校验。
+"""注销账号(DELETE /api/v1/user):数据级联清理 + 软删 + 释放唯一约束 + 资金前置校验。
 
 覆盖:
   - 干净注销:status=deleted + phone 匿名化 + wechat_openid/invite_code 等唯一槽全部释放
   - 回归原始 bug:注销释放 openid 后,别的账号能绑同一个微信
   - 资金前置闸:有可提现现金 / 在审提现单 → 409 拒绝注销,账号不被删
   - 注销后旧 token 即时失效(status==active 闸)
+  - 级联清理:个人内容/成绩/行为/PII 表被物理删空、余额清零;财务流水/邀请关系/广告幂等
+    +对账表按策略保留(soft_delete_account 的分类落地断言)
 """
 from __future__ import annotations
 
-from sqlalchemy import select
+from datetime import date, datetime, timezone
+
+from sqlalchemy import func, select
 
 from app.db.session import SessionLocal
 from app.models.user import User
@@ -139,3 +143,130 @@ def test_deleted_user_old_token_is_rejected(client) -> None:
     # 注销后旧 token 立即失效(get_current_user 校验 status==active)
     r = client.get("/api/v1/user/onboarding/status", params={"device_id": "d"}, headers=_auth(token))
     assert r.status_code == 401, r.text
+
+
+# ===== 级联清理:个人表删空 / 余额清零 / 保留表存活 =====
+
+def _count(model, col, uid: int) -> int:
+    db = SessionLocal()
+    try:
+        return db.execute(
+            select(func.count()).select_from(model).where(col == uid)
+        ).scalar_one()
+    finally:
+        db.close()
+
+
+def test_delete_purges_personal_data_zeroes_balance_keeps_ledgers(client) -> None:
+    """注销后:① 个人内容/行为/PII 表按 user_id 被物理删空;② 金币等余额清零;
+    ③ 资金流水 / 邀请关系 / 广告幂等+对账表保留(soft_delete_account 分类策略的端到端断言)。"""
+    from app.models.ad_ecpm import AdEcpmRecord
+    from app.models.ad_feed_reward import AdFeedRewardRecord
+    from app.models.ad_watch_log import AdWatchLog
+    from app.models.analytics_event import AnalyticsEvent
+    from app.models.comparison import ComparisonRecord
+    from app.models.comparison_milestone import ComparisonMilestoneClaim
+    from app.models.coupon_state import (
+        CouponClaimRecord,
+        CouponDailyCompletion,
+        CouponPromptEngagement,
+        CouponSession,
+    )
+    from app.models.device import DeviceLiveness
+    from app.models.feedback import Feedback
+    from app.models.invite import InviteRelation
+    from app.models.invite_fingerprint import InviteFingerprint
+    from app.models.onboarding import OnboardingCompletion
+    from app.models.price_report import PriceReport
+    from app.models.savings import SavingsRecord
+    from app.models.signin import SigninBoostRecord, SigninRecord
+    from app.models.task import UserTask
+    from app.models.wallet import CoinTransaction
+
+    phone = "13900000007"
+    token = _login(client, phone)
+    client.get("/api/v1/wallet/account", headers=_auth(token))  # 建 coin_account
+    uid = _get_user(phone).id
+
+    db = SessionLocal()
+    try:
+        # 余额:给金币 + 累计收益(现金/邀请金保持 0,否则命中 409 前置闸)
+        acc = db.get(CoinAccount, uid)
+        acc.coin_balance = 500
+        acc.total_coin_earned = 500
+
+        # 每张"应删"表各灌 1 行(user_id 维度;指纹按 inviter_user_id)
+        db.add_all([
+            ComparisonRecord(user_id=uid, trace_id="del_test_comparison"),
+            SavingsRecord(user_id=uid, order_amount_cents=1, saved_amount_cents=1),
+            SigninRecord(user_id=uid, signin_date=date(2026, 7, 4), cycle_day=1, streak=1, coin_awarded=1),
+            SigninBoostRecord(user_id=uid, signin_date=date(2026, 7, 4), coin_awarded=1),
+            CouponClaimRecord(user_id=uid, device_id="del_cc", coupon_id="c1", claim_date=date(2026, 7, 4), status="success"),
+            CouponDailyCompletion(user_id=uid, device_id="del_cd", complete_date=date(2026, 7, 4)),
+            CouponPromptEngagement(user_id=uid, device_id="del_ce", engage_date=date(2026, 7, 4), engage_type="shown"),
+            CouponSession(user_id=uid, trace_id="del_test_couponsession", device_id="d1", status="started",
+                          started_at=datetime(2026, 7, 4, tzinfo=timezone.utc), started_date=date(2026, 7, 4)),
+            UserTask(user_id=uid, task_key="del_test_usertask"),
+            ComparisonMilestoneClaim(user_id=uid, milestone=1),
+            DeviceLiveness(user_id=uid, device_id="del_test_dl"),
+            PriceReport(user_id=uid, reported_platform_id="p1", reported_platform_name="x", reported_price_cents=1),
+            Feedback(user_id=uid, content="x", contact="x"),
+            OnboardingCompletion(user_id=uid, device_id="del_test_ob"),
+            AnalyticsEvent(user_id=uid, event="x", device_id="del_test_an", client_ts=1),
+            AdWatchLog(user_id=uid, watch_date="2026-07-04"),
+            InviteFingerprint(inviter_user_id=uid, ip="1.2.3.4"),
+        ])
+        # 每张"应保留"表各灌 1 行
+        db.add_all([
+            CoinTransaction(user_id=uid, amount=1, balance_after=1, biz_type="signin"),
+            InviteRelation(inviter_user_id=uid, invitee_user_id=999999),
+            AdEcpmRecord(user_id=uid, ad_type="reward_video", ecpm_raw="100", report_date="2026-07-04"),
+            AdFeedRewardRecord(user_id=uid, client_event_id="del_test_afr", ecpm_raw="100", reward_date="2026-07-04"),
+        ])
+        db.commit()
+    finally:
+        db.close()
+
+    # 灌完先确认确实各有 1 行(否则"删空"断言可能因根本没灌进去而假过)
+    deleted_specs = [
+        (ComparisonRecord, ComparisonRecord.user_id),
+        (SavingsRecord, SavingsRecord.user_id),
+        (SigninRecord, SigninRecord.user_id),
+        (SigninBoostRecord, SigninBoostRecord.user_id),
+        (CouponClaimRecord, CouponClaimRecord.user_id),
+        (CouponDailyCompletion, CouponDailyCompletion.user_id),
+        (CouponPromptEngagement, CouponPromptEngagement.user_id),
+        (CouponSession, CouponSession.user_id),
+        (UserTask, UserTask.user_id),
+        (ComparisonMilestoneClaim, ComparisonMilestoneClaim.user_id),
+        (DeviceLiveness, DeviceLiveness.user_id),
+        (PriceReport, PriceReport.user_id),
+        (Feedback, Feedback.user_id),
+        (OnboardingCompletion, OnboardingCompletion.user_id),
+        (AnalyticsEvent, AnalyticsEvent.user_id),
+        (AdWatchLog, AdWatchLog.user_id),
+        (InviteFingerprint, InviteFingerprint.inviter_user_id),
+    ]
+    for model, col in deleted_specs:
+        assert _count(model, col, uid) == 1, f"seed missing for {model.__name__}"
+
+    r = client.delete("/api/v1/user", headers=_auth(token))
+    assert r.status_code == 200, r.text
+
+    # ① 应删表全部删空
+    for model, col in deleted_specs:
+        assert _count(model, col, uid) == 0, f"{model.__name__} 未被删空(残留 PII/行为)"
+
+    # ② 余额清零(行保留,不碰流水外键)
+    acc = SessionLocal().get(CoinAccount, uid)
+    assert acc is not None
+    assert acc.coin_balance == 0
+    assert acc.total_coin_earned == 0
+    assert acc.cash_balance_cents == 0
+    assert acc.invite_cash_balance_cents == 0
+
+    # ③ 保留表存活(资金流水 / 邀请关系 / 广告幂等+对账)
+    assert _count(CoinTransaction, CoinTransaction.user_id, uid) == 1
+    assert _count(InviteRelation, InviteRelation.inviter_user_id, uid) == 1
+    assert _count(AdEcpmRecord, AdEcpmRecord.user_id, uid) == 1
+    assert _count(AdFeedRewardRecord, AdFeedRewardRecord.user_id, uid) == 1