添加默认系统管理员账号并限制唯一

backend/internal/models/user.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"time"
 
+	"golang.org/x/crypto/bcrypt"
 	"gorm.io/gorm"
 )
 
@@ -118,6 +119,33 @@ func SeedRoles(db *gorm.DB) error {
 	return nil
 }
 
+// SeedSystemAdmin 在没有 system_admin 用户时创建默认系统管理员账号。
+func SeedSystemAdmin(db *gorm.DB) error {
+	var existing User
+	if err := db.Where("username = ?", "system_admin").First(&existing).Error; err == nil {
+		return nil
+	} else if err != gorm.ErrRecordNotFound {
+		return err
+	}
+
+	var role Role
+	if err := db.Where("name = ?", RoleSystemAdmin).First(&role).Error; err != nil {
+		return err
+	}
+
+	hash, err := bcrypt.GenerateFromPassword([]byte("system_admin"), bcrypt.DefaultCost)
+	if err != nil {
+		return err
+	}
+
+	return db.Create(&User{
+		Username:     "system_admin",
+		PasswordHash: string(hash),
+		RoleID:       role.ID,
+		Status:       "active",
+	}).Error
+}
+
 func strPtr(s string) *string {
 	return &s
 }