feat: 第一阶段基础框架搭建

后端 (Laravel 10 + Sanctum):
- RBAC 四层权限系统 (users→roles→permissions→menus)
- 门店隔离中间件 (BelongsToStore Trait + StoreIsolation Middleware)
- 操作日志中间件 (自动记录写操作)
- 权限检查中间件 (CheckPermission)
- 16张数据库表迁移 (系统基础+RBAC+字典+配置)
- 11个 Eloquent Model
- Auth API (登录/登出/用户信息)
- 系统设置模块 CRUD (门店/部门/职务/用户/角色/菜单/权限/字典/日志)
- 45条 RESTful API 路由
- InitSeeder 初始数据 (超管/角色/76权限/31菜单)

前端 (Vue 3 + Element Plus + Vite):
- Axios 请求封装 + Token 注入
- Pinia 状态管理 (user + permission store)
- 动态路由 (服务端菜单→前端路由自动生成)
- 后台布局 (侧边栏+顶栏+主内容区)
- 登录页 + 仪表盘首页
- 系统设置 7 个 CRUD 页面

技术方案文档 (7卷):
- 技术总览/数据库设计/API规范/RBAC设计/模块详设/小程序设计/部署方案

backend/app/Http/Controllers/Admin/System/DepartmentController.php

@@ -0,0 +1,80 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\Department;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class DepartmentController extends Controller
+{
+    /**
+     * 部门树
+     */
+    public function index(): JsonResponse
+    {
+        $departments = Department::orderBy('sort')->get()->toArray();
+        $tree = $this->buildTree($departments);
+        return $this->success($tree);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'parent_id' => 'integer',
+            'name' => 'required|string|max:50',
+            'sort' => 'integer',
+            'status' => 'in:0,1',
+        ]);
+
+        $data['store_id'] = $data['store_id'] ?? auth()->user()->store_id;
+        $department = Department::create($data);
+        return $this->success($department, '创建成功');
+    }
+
+    public function update(Request $request, Department $department): JsonResponse
+    {
+        $data = $request->validate([
+            'parent_id' => 'integer',
+            'name' => 'string|max:50',
+            'sort' => 'integer',
+            'status' => 'in:0,1',
+        ]);
+
+        // 不能设自己为上级
+        if (isset($data['parent_id']) && $data['parent_id'] == $department->id) {
+            return $this->error('不能设置自身为上级部门');
+        }
+
+        $department->update($data);
+        return $this->success($department, '更新成功');
+    }
+
+    public function destroy(Department $department): JsonResponse
+    {
+        if ($department->children()->exists()) {
+            return $this->error('该部门下还有子部门，无法删除');
+        }
+        if ($department->users()->exists()) {
+            return $this->error('该部门下还有员工，无法删除');
+        }
+        $department->delete();
+        return $this->success(null, '删除成功');
+    }
+
+    private function buildTree(array $items, int $parentId = 0): array
+    {
+        $tree = [];
+        foreach ($items as $item) {
+            if ($item['parent_id'] == $parentId) {
+                $children = $this->buildTree($items, $item['id']);
+                if ($children) {
+                    $item['children'] = $children;
+                }
+                $tree[] = $item;
+            }
+        }
+        return $tree;
+    }
+}

backend/app/Http/Controllers/Admin/System/DictionaryController.php

@@ -0,0 +1,91 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\Dictionary;
+use App\Models\DictionaryItem;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class DictionaryController extends Controller
+{
+    public function index(): JsonResponse
+    {
+        $dictionaries = Dictionary::withCount('items')->orderByDesc('id')->get();
+        return $this->success($dictionaries);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'name' => 'required|string|max:50',
+            'code' => 'required|string|max:50|unique:dictionaries,code',
+            'description' => 'nullable|string|max:255',
+        ]);
+
+        $dict = Dictionary::create($data);
+        return $this->success($dict, '创建成功');
+    }
+
+    /**
+     * 字典项列表
+     */
+    public function items(Dictionary $dictionary): JsonResponse
+    {
+        return $this->success($dictionary->items);
+    }
+
+    /**
+     * 新建字典项
+     */
+    public function storeItem(Request $request, Dictionary $dictionary): JsonResponse
+    {
+        $data = $request->validate([
+            'label' => 'required|string|max:100',
+            'value' => 'required|string|max:100',
+            'sort' => 'integer',
+            'status' => 'in:0,1',
+        ]);
+
+        $data['dictionary_id'] = $dictionary->id;
+        $item = DictionaryItem::create($data);
+        return $this->success($item, '创建成功');
+    }
+
+    /**
+     * 更新字典项
+     */
+    public function updateItem(Request $request, DictionaryItem $item): JsonResponse
+    {
+        $data = $request->validate([
+            'label' => 'string|max:100',
+            'value' => 'string|max:100',
+            'sort' => 'integer',
+            'status' => 'in:0,1',
+        ]);
+
+        $item->update($data);
+        return $this->success($item, '更新成功');
+    }
+
+    /**
+     * 删除字典项
+     */
+    public function destroyItem(DictionaryItem $item): JsonResponse
+    {
+        $item->delete();
+        return $this->success(null, '删除成功');
+    }
+
+    public function destroy(Dictionary $dictionary): JsonResponse
+    {
+        if ($dictionary->is_system) {
+            return $this->error('系统字典不可删除');
+        }
+
+        $dictionary->items()->delete();
+        $dictionary->delete();
+        return $this->success(null, '删除成功');
+    }
+}

backend/app/Http/Controllers/Admin/System/MenuController.php

@@ -0,0 +1,71 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\Menu;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class MenuController extends Controller
+{
+    /**
+     * 菜单树
+     */
+    public function index(): JsonResponse
+    {
+        return $this->success(Menu::tree());
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'parent_id' => 'integer',
+            'name' => 'required|string|max:50',
+            'path' => 'nullable|string|max:255',
+            'component' => 'nullable|string|max:255',
+            'icon' => 'nullable|string|max:50',
+            'permission_code' => 'nullable|string|max:100',
+            'type' => 'required|in:1,2,3',
+            'visible' => 'in:0,1',
+            'sort' => 'integer',
+            'status' => 'in:0,1',
+        ]);
+
+        $menu = Menu::create($data);
+        return $this->success($menu, '创建成功');
+    }
+
+    public function update(Request $request, Menu $menu): JsonResponse
+    {
+        $data = $request->validate([
+            'parent_id' => 'integer',
+            'name' => 'string|max:50',
+            'path' => 'nullable|string|max:255',
+            'component' => 'nullable|string|max:255',
+            'icon' => 'nullable|string|max:50',
+            'permission_code' => 'nullable|string|max:100',
+            'type' => 'in:1,2,3',
+            'visible' => 'in:0,1',
+            'sort' => 'integer',
+            'status' => 'in:0,1',
+        ]);
+
+        if (isset($data['parent_id']) && $data['parent_id'] == $menu->id) {
+            return $this->error('不能设置自身为上级菜单');
+        }
+
+        $menu->update($data);
+        return $this->success($menu, '更新成功');
+    }
+
+    public function destroy(Menu $menu): JsonResponse
+    {
+        if ($menu->children()->exists()) {
+            return $this->error('该菜单下还有子菜单，无法删除');
+        }
+
+        $menu->delete();
+        return $this->success(null, '删除成功');
+    }
+}

backend/app/Http/Controllers/Admin/System/OperationLogController.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\OperationLog;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class OperationLogController extends Controller
+{
+    public function index(Request $request): JsonResponse
+    {
+        $query = OperationLog::query();
+
+        $user = auth()->user();
+        if (!$user->is_super) {
+            $query->where('store_id', $user->store_id);
+        }
+
+        if ($request->keyword) {
+            $query->where(function ($q) use ($request) {
+                $q->where('user_name', 'like', "%{$request->keyword}%")
+                  ->orWhere('target', 'like', "%{$request->keyword}%");
+            });
+        }
+        if ($request->module) {
+            $query->where('module', $request->module);
+        }
+        if ($request->start_date && $request->end_date) {
+            $query->whereBetween('created_at', [$request->start_date, $request->end_date . ' 23:59:59']);
+        }
+
+        $logs = $query->orderByDesc('created_at')
+            ->paginate($request->input('page_size', 20));
+
+        return $this->paginate($logs);
+    }
+}

backend/app/Http/Controllers/Admin/System/PermissionController.php

@@ -0,0 +1,62 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\Permission;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class PermissionController extends Controller
+{
+    /**
+     * 权限树
+     */
+    public function index(): JsonResponse
+    {
+        return $this->success(Permission::tree());
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'parent_id' => 'integer',
+            'name' => 'required|string|max:50',
+            'code' => 'required|string|max:100|unique:permissions,code',
+            'module' => 'nullable|string|max:50',
+            'type' => 'required|in:1,2,3',
+            'description' => 'nullable|string|max:255',
+            'sort' => 'integer',
+        ]);
+
+        $permission = Permission::create($data);
+        return $this->success($permission, '创建成功');
+    }
+
+    public function update(Request $request, Permission $permission): JsonResponse
+    {
+        $data = $request->validate([
+            'parent_id' => 'integer',
+            'name' => 'string|max:50',
+            'code' => 'string|max:100|unique:permissions,code,' . $permission->id,
+            'module' => 'nullable|string|max:50',
+            'type' => 'in:1,2,3',
+            'description' => 'nullable|string|max:255',
+            'sort' => 'integer',
+        ]);
+
+        $permission->update($data);
+        return $this->success($permission, '更新成功');
+    }
+
+    public function destroy(Permission $permission): JsonResponse
+    {
+        if ($permission->children()->exists()) {
+            return $this->error('该权限下有子权限，无法删除');
+        }
+
+        $permission->roles()->detach();
+        $permission->delete();
+        return $this->success(null, '删除成功');
+    }
+}

backend/app/Http/Controllers/Admin/System/PositionController.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\Position;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class PositionController extends Controller
+{
+    public function index(Request $request): JsonResponse
+    {
+        $positions = Position::orderBy('sort')
+            ->paginate($request->input('page_size', 50));
+
+        return $this->paginate($positions);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'name' => 'required|string|max:50',
+            'sort' => 'integer',
+        ]);
+
+        $data['store_id'] = auth()->user()->store_id;
+        $position = Position::create($data);
+        return $this->success($position, '创建成功');
+    }
+
+    public function update(Request $request, Position $position): JsonResponse
+    {
+        $data = $request->validate([
+            'name' => 'string|max:50',
+            'sort' => 'integer',
+        ]);
+
+        $position->update($data);
+        return $this->success($position, '更新成功');
+    }
+
+    public function destroy(Position $position): JsonResponse
+    {
+        $position->delete();
+        return $this->success(null, '删除成功');
+    }
+}

backend/app/Http/Controllers/Admin/System/RoleController.php

@@ -0,0 +1,98 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\Role;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class RoleController extends Controller
+{
+    public function index(Request $request): JsonResponse
+    {
+        $query = Role::withCount('users');
+
+        if ($request->keyword) {
+            $query->where('name', 'like', "%{$request->keyword}%");
+        }
+
+        // 门店角色 + 全局角色
+        $user = auth()->user();
+        if (!$user->is_super) {
+            $query->where(function ($q) use ($user) {
+                $q->where('store_id', $user->store_id)
+                  ->orWhereNull('store_id');
+            });
+        }
+
+        $roles = $query->orderByDesc('id')
+            ->paginate($request->input('page_size', 20));
+
+        return $this->paginate($roles);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'name' => 'required|string|max:50',
+            'code' => 'required|string|max:50|unique:roles,code',
+            'description' => 'nullable|string|max:255',
+        ]);
+
+        $user = auth()->user();
+        $data['store_id'] = $user->is_super ? null : $user->store_id;
+
+        $role = Role::create($data);
+        return $this->success($role, '创建成功');
+    }
+
+    public function show(Role $role): JsonResponse
+    {
+        $role->load('permissions');
+        return $this->success($role);
+    }
+
+    public function update(Request $request, Role $role): JsonResponse
+    {
+        if ($role->is_system) {
+            return $this->error('系统内置角色不可编辑');
+        }
+
+        $data = $request->validate([
+            'name' => 'string|max:50',
+            'description' => 'nullable|string|max:255',
+        ]);
+
+        $role->update($data);
+        return $this->success($role, '更新成功');
+    }
+
+    /**
+     * 分配权限
+     */
+    public function assignPermissions(Request $request, Role $role): JsonResponse
+    {
+        $request->validate([
+            'permission_ids' => 'required|array',
+            'permission_ids.*' => 'exists:permissions,id',
+        ]);
+
+        $role->permissions()->sync($request->permission_ids);
+        return $this->success(null, '权限分配成功');
+    }
+
+    public function destroy(Role $role): JsonResponse
+    {
+        if ($role->is_system) {
+            return $this->error('系统内置角色不可删除');
+        }
+        if ($role->users()->exists()) {
+            return $this->error('该角色下还有用户，无法删除');
+        }
+
+        $role->permissions()->detach();
+        $role->delete();
+        return $this->success(null, '删除成功');
+    }
+}

backend/app/Http/Controllers/Admin/System/StoreController.php

@@ -0,0 +1,73 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\Store;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class StoreController extends Controller
+{
+    public function index(Request $request): JsonResponse
+    {
+        $query = Store::with('region');
+
+        if ($request->keyword) {
+            $query->where('name', 'like', "%{$request->keyword}%");
+        }
+        if ($request->has('status')) {
+            $query->where('status', $request->status);
+        }
+
+        $stores = $query->orderByDesc('id')
+            ->paginate($request->input('page_size', 20));
+
+        return $this->paginate($stores);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'region_id' => 'required|exists:regions,id',
+            'name' => 'required|string|max:100',
+            'code' => 'nullable|string|max:20|unique:stores,code',
+            'address' => 'nullable|string|max:255',
+            'phone' => 'nullable|string|max:20',
+            'status' => 'in:0,1',
+        ]);
+
+        $store = Store::create($data);
+        return $this->success($store, '创建成功');
+    }
+
+    public function show(Store $store): JsonResponse
+    {
+        $store->load('region');
+        return $this->success($store);
+    }
+
+    public function update(Request $request, Store $store): JsonResponse
+    {
+        $data = $request->validate([
+            'region_id' => 'exists:regions,id',
+            'name' => 'string|max:100',
+            'code' => 'nullable|string|max:20|unique:stores,code,' . $store->id,
+            'address' => 'nullable|string|max:255',
+            'phone' => 'nullable|string|max:20',
+            'status' => 'in:0,1',
+        ]);
+
+        $store->update($data);
+        return $this->success($store, '更新成功');
+    }
+
+    public function destroy(Store $store): JsonResponse
+    {
+        if ($store->users()->exists()) {
+            return $this->error('该门店下还有员工，无法删除');
+        }
+        $store->delete();
+        return $this->success(null, '删除成功');
+    }
+}

backend/app/Http/Controllers/Admin/System/UserController.php

@@ -0,0 +1,123 @@
+<?php
+
+namespace App\Http\Controllers\Admin\System;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+
+class UserController extends Controller
+{
+    public function index(Request $request): JsonResponse
+    {
+        $query = User::with(['department', 'position', 'roles']);
+
+        if ($request->keyword) {
+            $query->where(function ($q) use ($request) {
+                $q->where('name', 'like', "%{$request->keyword}%")
+                  ->orWhere('phone', 'like', "%{$request->keyword}%")
+                  ->orWhere('username', 'like', "%{$request->keyword}%");
+            });
+        }
+        if ($request->department_id) {
+            $query->where('department_id', $request->department_id);
+        }
+        if ($request->has('status')) {
+            $query->where('status', $request->status);
+        }
+
+        $users = $query->orderByDesc('id')
+            ->paginate($request->input('page_size', 20));
+
+        return $this->paginate($users);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'username' => 'required|string|max:50|unique:users,username',
+            'password' => 'required|string|min:6',
+            'name' => 'required|string|max:50',
+            'phone' => 'nullable|string|max:20',
+            'email' => 'nullable|email|max:100',
+            'department_id' => 'nullable|exists:departments,id',
+            'position_id' => 'nullable|exists:positions,id',
+            'status' => 'in:0,1,2',
+            'role_ids' => 'array',
+            'role_ids.*' => 'exists:roles,id',
+        ]);
+
+        $roleIds = $data['role_ids'] ?? [];
+        unset($data['role_ids']);
+
+        $data['store_id'] = auth()->user()->store_id;
+        $user = User::create($data);
+
+        if ($roleIds) {
+            $user->roles()->sync($roleIds);
+        }
+
+        return $this->success($user->load('roles'), '创建成功');
+    }
+
+    public function show(User $user): JsonResponse
+    {
+        $user->load(['department', 'position', 'roles']);
+        return $this->success($user);
+    }
+
+    public function update(Request $request, User $user): JsonResponse
+    {
+        $data = $request->validate([
+            'name' => 'string|max:50',
+            'phone' => 'nullable|string|max:20',
+            'email' => 'nullable|email|max:100',
+            'department_id' => 'nullable|exists:departments,id',
+            'position_id' => 'nullable|exists:positions,id',
+            'role_ids' => 'array',
+            'role_ids.*' => 'exists:roles,id',
+        ]);
+
+        $roleIds = $data['role_ids'] ?? null;
+        unset($data['role_ids']);
+
+        $user->update($data);
+
+        if ($roleIds !== null) {
+            $user->roles()->sync($roleIds);
+        }
+
+        return $this->success($user->load('roles'), '更新成功');
+    }
+
+    /**
+     * 更新状态
+     */
+    public function updateStatus(Request $request, User $user): JsonResponse
+    {
+        $request->validate(['status' => 'required|in:0,1,2']);
+        $user->update(['status' => $request->status]);
+        return $this->success(null, '状态更新成功');
+    }
+
+    /**
+     * 重置密码
+     */
+    public function resetPassword(Request $request, User $user): JsonResponse
+    {
+        $request->validate(['password' => 'required|string|min:6']);
+        $user->update(['password' => $request->password]);
+        return $this->success(null, '密码重置成功');
+    }
+
+    public function destroy(User $user): JsonResponse
+    {
+        if ($user->is_super) {
+            return $this->error('超级管理员不可删除');
+        }
+        $user->delete();
+        return $this->success(null, '删除成功');
+    }
+}