feat: Implement pagination and effective account validation for backdoor user login

2026-07-20 20:49:23 +08:00
parent de42645cae
commit 0c1c41772e
14 changed files with 268 additions and 93 deletions
--- a/docs/test-backdoor-login.md
+++ b/docs/test-backdoor-login.md
@@ -6,7 +6,9 @@
 http://47.111.103.66/shihezi/backDoor
 ```

-页面只显示 `sys_user` 中未删除、未停用的用户，支持按用户 ID、账号、姓名或手机号搜索。手机号会脱敏，身份证号不会展示。选择用户后，后端生成与 PC 单点登录相同类型的两小时 token，页面将 token 写入同源的 `access_token` 和 `refresh_token`，再根据 `/getInfo` 返回的用户类型进入求职门户或管理端。
+页面只显示 `sys_user` 中未删除、未停用的用户，支持按用户 ID、账号、姓名或手机号搜索。同一账号存在多条历史记录时，只显示 `create_time` 最新的有效记录；旧用户 ID 即使通过 `?id=` 直接访问也会被拒绝。手机号会脱敏，身份证号不会展示。选择用户后，后端生成与 PC 单点登录相同类型的两小时 token，页面将 token 写入同源的 `access_token` 和 `refresh_token`，然后无论用户类型都统一进入 `/shihezi/job-portal`。
+
+用户选择页采用全屏布局，每页显示 8 个账号并提供分页，不产生页面滚动条或横向表格滚动条。

 已知用户 ID 时，也可以直接访问：

@@ -53,5 +55,4 @@ http://127.0.0.1:9091/backDoor
 backdoor:
  login:
    portal-base-path: /shihezi
-    api-base-path: /api/shihezi
 ```
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/config/BackDoorLoginProperties.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/config/BackDoorLoginProperties.java
@@ -16,7 +16,6 @@ public class BackDoorLoginProperties
    private boolean enabled;
    private int maxUsers = DEFAULT_MAX_USERS;
    private String portalBasePath = "/shihezi";
-    private String apiBasePath = "/api/shihezi";

    public boolean isEnabled()
    {
@@ -48,16 +47,6 @@ public class BackDoorLoginProperties
        this.portalBasePath = portalBasePath;
    }

-    public String getApiBasePath()
-    {
-        return normalizeBasePath(apiBasePath, "/api/shihezi");
-    }
-
-    public void setApiBasePath(String apiBasePath)
-    {
-        this.apiBasePath = apiBasePath;
-    }
-
    private String normalizeBasePath(String value, String defaultValue)
    {
        if (value == null || value.trim().isEmpty())
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/BackDoorLoginController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/BackDoorLoginController.java
@@ -32,6 +32,7 @@ public class BackDoorLoginController
 {
    private static final Logger log = LoggerFactory.getLogger(BackDoorLoginController.class);
    private static final MediaType HTML_UTF8 = new MediaType("text", "html", StandardCharsets.UTF_8);
+    private static final int PAGE_SIZE = 8;

    private final BackDoorLoginService backDoorLoginService;
    private final BackDoorPageRenderer pageRenderer;
@@ -49,11 +50,12 @@ public class BackDoorLoginController
    @GetMapping(value = "/backDoor", produces = "text/html;charset=UTF-8")
    public ResponseEntity<String> backDoor(
            @RequestParam(value = "id", required = false) String id,
-            @RequestParam(value = "keyword", required = false) String keyword)
+            @RequestParam(value = "keyword", required = false) String keyword,
+            @RequestParam(value = "page", required = false) String page)
    {
        if (StringUtils.isBlank(id))
        {
-            return renderUserList(keyword);
+            return renderUserList(keyword, parsePage(page));
        }

        Long userId;
@@ -86,13 +88,14 @@ public class BackDoorLoginController
        }
    }

-    private ResponseEntity<String> renderUserList(String keyword)
+    private ResponseEntity<String> renderUserList(String keyword, int page)
    {
        try
        {
            List<SysUser> users = backDoorLoginService.listAvailableUsers(keyword, properties.getMaxUsers());
            return html(HttpStatus.OK,
-                    pageRenderer.renderUserList(users, StringUtils.trimToEmpty(keyword), properties.getMaxUsers()));
+                    pageRenderer.renderUserList(users, StringUtils.trimToEmpty(keyword), properties.getMaxUsers(),
+                            page, PAGE_SIZE));
        }
        catch (Exception e)
        {
@@ -101,6 +104,22 @@ public class BackDoorLoginController
        }
    }

+    private int parsePage(String page)
+    {
+        if (StringUtils.isBlank(page))
+        {
+            return 1;
+        }
+        try
+        {
+            return Math.max(1, Integer.parseInt(page.trim()));
+        }
+        catch (NumberFormatException e)
+        {
+            return 1;
+        }
+    }
+
    private ResponseEntity<String> html(HttpStatus status, String body)
    {
        return ResponseEntity.status(status)
@@ -109,7 +128,7 @@ public class BackDoorLoginController
                .header(HttpHeaders.PRAGMA, "no-cache")
                .header("Content-Security-Policy",
                        "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; "
-                                + "connect-src 'self'; img-src data:; form-action 'self'; base-uri 'none'; "
+                                + "img-src data:; form-action 'self'; base-uri 'none'; "
                                + "frame-ancestors 'none'")
                .header("X-Content-Type-Options", "nosniff")
                .header("X-Frame-Options", "DENY")
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/BackDoorPageRenderer.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/BackDoorPageRenderer.java
@@ -17,6 +17,7 @@ import org.springframework.core.io.ClassPathResource;
 import org.springframework.stereotype.Component;
 import org.springframework.util.StreamUtils;
 import org.springframework.web.util.HtmlUtils;
+import org.springframework.web.util.UriUtils;

 /**
 * 渲染后门用户选择页和登录跳转页。
@@ -38,14 +39,24 @@ public class BackDoorPageRenderer
        this.errorTemplate = loadTemplate("backdoor/error.html");
    }

-    public String renderUserList(List<SysUser> users, String keyword, int maxUsers)
+    public String renderUserList(List<SysUser> users, String keyword, int maxUsers, int requestedPage, int pageSize)
    {
        List<SysUser> safeUsers = users == null ? Collections.emptyList() : users;
+        int safePageSize = Math.max(1, pageSize);
+        int totalPages = Math.max(1, (safeUsers.size() + safePageSize - 1) / safePageSize);
+        int currentPage = Math.max(1, Math.min(requestedPage, totalPages));
+        int fromIndex = Math.min((currentPage - 1) * safePageSize, safeUsers.size());
+        int toIndex = Math.min(fromIndex + safePageSize, safeUsers.size());
+        List<SysUser> pageUsers = safeUsers.subList(fromIndex, toIndex);
+
        return userListTemplate
-                .replace("@@ROWS@@", renderRows(safeUsers))
+                .replace("@@ROWS@@", renderRows(pageUsers))
                .replace("@@KEYWORD@@", html(keyword))
                .replace("@@COUNT@@", String.valueOf(safeUsers.size()))
-                .replace("@@MAX_USERS@@", String.valueOf(maxUsers));
+                .replace("@@MAX_USERS@@", String.valueOf(maxUsers))
+                .replace("@@CURRENT_PAGE@@", String.valueOf(currentPage))
+                .replace("@@TOTAL_PAGES@@", String.valueOf(totalPages))
+                .replace("@@PAGINATION@@", renderPagination(keyword, currentPage, totalPages));
    }

    public String renderLogin(LoginSession session, BackDoorLoginProperties properties)
@@ -58,7 +69,6 @@ public class BackDoorPageRenderer
                .replace("@@USER_NAME@@", html(displayName))
                .replace("@@TOKEN_JSON@@", javascriptString(session.getToken()))
                .replace("@@EXPIRE_AT@@", String.valueOf(expireAt))
-                .replace("@@API_BASE_PATH_JSON@@", javascriptString(properties.getApiBasePath()))
                .replace("@@PORTAL_BASE_PATH_JSON@@", javascriptString(properties.getPortalBasePath()));
    }

@@ -94,6 +104,44 @@ public class BackDoorPageRenderer
        return rows.toString();
    }

+    private String renderPagination(String keyword, int currentPage, int totalPages)
+    {
+        StringBuilder pagination = new StringBuilder(512);
+        appendPageLink(pagination, keyword, currentPage - 1, "上一页", currentPage == 1, false);
+        for (int page = 1; page <= totalPages; page++)
+        {
+            appendPageLink(pagination, keyword, page, String.valueOf(page), false, page == currentPage);
+        }
+        appendPageLink(pagination, keyword, currentPage + 1, "下一页", currentPage == totalPages, false);
+        return pagination.toString();
+    }
+
+    private void appendPageLink(StringBuilder target, String keyword, int page, String label,
+            boolean disabled, boolean current)
+    {
+        if (disabled)
+        {
+            target.append("<span class=\"page-link disabled\">").append(label).append("</span>");
+            return;
+        }
+        if (current)
+        {
+            target.append("<span class=\"page-link current\">").append(label).append("</span>");
+            return;
+        }
+
+        String href = "?page=" + page;
+        if (StringUtils.isNotBlank(keyword))
+        {
+            href += "&keyword=" + UriUtils.encodeQueryParam(keyword, StandardCharsets.UTF_8);
+        }
+        target.append("<a class=\"page-link\" href=\"")
+                .append(html(href))
+                .append("\">")
+                .append(label)
+                .append("</a>");
+    }
+
    private String maskPhone(String phone)
    {
        String value = StringUtils.trimToEmpty(phone);
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/service/BackDoorLoginService.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/service/BackDoorLoginService.java
@@ -63,6 +63,7 @@ public class BackDoorLoginService

        SysUser user = userMapper.selectUserById(userId);
        validateUser(user);
+        validateEffectiveAccount(user);

        LoginUser loginUser = (LoginUser) userDetailsService.createLoginUser(user);
        loginService.recordLoginInfo(user.getUserId());
@@ -92,6 +93,15 @@ public class BackDoorLoginService
        }
    }

+    private void validateEffectiveAccount(SysUser user)
+    {
+        Long effectiveUserId = userMapper.selectBackDoorEffectiveUserId(user.getUserName());
+        if (!user.getUserId().equals(effectiveUserId))
+        {
+            throw new ServiceException("该账号存在更新记录，请从用户列表选择有效账号");
+        }
+    }
+
    public static class LoginSession
    {
        private final SysUser user;
--- a/ruoyi-admin/src/main/resources/application-test.yml
+++ b/ruoyi-admin/src/main/resources/application-test.yml
@@ -151,4 +151,3 @@ backdoor:
    enabled: true
    max-users: 100
    portal-base-path: /shihezi
-    api-base-path: /api/shihezi
--- a/ruoyi-admin/src/main/resources/application.yml
+++ b/ruoyi-admin/src/main/resources/application.yml
@@ -66,7 +66,6 @@ backdoor:
    enabled: false
    max-users: 100
    portal-base-path: /shihezi
-    api-base-path: /api/shihezi

 # PageHelper分页插件
 pagehelper:
--- a/ruoyi-admin/src/main/resources/backdoor/login.html
+++ b/ruoyi-admin/src/main/resources/backdoor/login.html
@@ -51,10 +51,9 @@
    <div class="spinner" id="spinner" aria-hidden="true"></div>
    <h1>正在进入系统</h1>
    <p>正在以 <span class="user">@@USER_NAME@@</span> 的身份建立登录状态…</p>
-    <p class="error" id="error">登录状态已建立，但自动跳转失败，请手动选择入口。</p>
+    <p class="error" id="error">无法建立登录状态，请返回用户列表后重试。</p>
    <div class="actions" id="actions">
      <a id="portalLink" href="#">进入求职门户</a>
-      <a id="managementLink" class="secondary" href="#">进入管理端</a>
      <a class="secondary" href="?">返回用户列表</a>
    </div>
  </main>
@@ -64,11 +63,12 @@

      const token = @@TOKEN_JSON@@;
      const expireAt = @@EXPIRE_AT@@;
-      const apiBase = @@API_BASE_PATH_JSON@@;
      const portalBase = @@PORTAL_BASE_PATH_JSON@@;
      const portalUrl = portalBase + '/job-portal';
-      const managementUrl = portalBase + '/management/management/list/index?type=1';

+      document.getElementById('portalLink').href = portalUrl;
+
+      try {
        ['userInfo', 'getInfoCache', 'appUserId', 'resume_userId'].forEach(function (key) {
          localStorage.removeItem(key);
          sessionStorage.removeItem(key);
@@ -78,29 +78,12 @@
        localStorage.setItem('refresh_token', token);
        localStorage.setItem('expireTime', String(expireAt));
        localStorage.removeItem('lcToken');
-
-      document.getElementById('portalLink').href = portalUrl;
-      document.getElementById('managementLink').href = managementUrl;
-
-      fetch(apiBase + '/getInfo', {
-        method: 'GET',
-        cache: 'no-store',
-        credentials: 'same-origin',
-        headers: { 'Authorization': 'Bearer ' + token }
-      })
-        .then(function (response) {
-          if (!response.ok) throw new Error('HTTP ' + response.status);
-          return response.json();
-        })
-        .then(function (result) {
-          if (result.code !== 200) throw new Error('getInfo failed');
-          window.location.replace(result.userType === 'common' ? portalUrl : managementUrl);
-        })
-        .catch(function () {
+        window.location.replace(portalUrl);
+      } catch (error) {
        document.getElementById('spinner').style.display = 'none';
        document.getElementById('error').style.display = 'block';
        document.getElementById('actions').style.display = 'flex';
-        });
+      }
    }());
  </script>
 </body>
--- a/ruoyi-admin/src/main/resources/backdoor/user-list.html
+++ b/ruoyi-admin/src/main/resources/backdoor/user-list.html
@@ -8,31 +8,31 @@
  <title>测试用户登录</title>
  <style>
    * { box-sizing: border-box; }
+    html, body { width: 100%; height: 100%; overflow: hidden; }
    body {
      margin: 0;
-      min-height: 100vh;
-      padding: 40px 20px;
+      padding: 0;
      color: #1f2937;
      background: linear-gradient(145deg, #eef4ff 0%, #f7f9fc 48%, #eef7f4 100%);
      font: 14px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", "PingFang SC", "Microsoft YaHei", sans-serif;
    }
    .panel {
-      width: min(1120px, 100%);
-      margin: 0 auto;
+      display: flex;
+      width: 100%;
+      height: 100vh;
+      min-height: 0;
+      flex-direction: column;
      overflow: hidden;
-      border: 1px solid rgba(15, 23, 42, .08);
-      border-radius: 18px;
      background: rgba(255, 255, 255, .96);
-      box-shadow: 0 22px 55px rgba(31, 41, 55, .10);
    }
-    header { padding: 28px 30px 22px; border-bottom: 1px solid #edf0f5; }
-    h1 { margin: 0; color: #111827; font-size: 24px; line-height: 1.35; }
-    .subtitle { margin: 8px 0 0; color: #6b7280; }
+    header { flex: none; padding: 16px 28px 14px; border-bottom: 1px solid #edf0f5; }
+    h1 { margin: 0; color: #111827; font-size: 22px; line-height: 1.3; }
+    .subtitle { margin: 4px 0 0; color: #6b7280; }
    .warning {
-      margin-top: 18px;
-      padding: 10px 13px;
+      margin-top: 10px;
+      padding: 8px 12px;
      border: 1px solid #f5d995;
-      border-radius: 9px;
+      border-radius: 8px;
      color: #7c4a03;
      background: #fff9e8;
    }
@@ -41,10 +41,11 @@
      gap: 10px;
      align-items: center;
      justify-content: space-between;
-      padding: 18px 30px;
+      flex: none;
+      padding: 11px 28px;
      border-bottom: 1px solid #edf0f5;
    }
-    form { display: flex; flex: 1; max-width: 620px; gap: 9px; }
+    form { display: flex; flex: 1; max-width: 760px; gap: 9px; }
    input {
      min-width: 0;
      flex: 1;
@@ -70,16 +71,24 @@
      line-height: 40px;
    }
    .count { flex: none; color: #6b7280; }
-    .table-wrap { overflow-x: auto; }
-    table { width: 100%; border-collapse: collapse; }
-    th, td { padding: 14px 16px; border-bottom: 1px solid #edf0f5; text-align: left; white-space: nowrap; }
+    .table-wrap { min-height: 0; flex: 1; overflow: hidden; }
+    table { width: 100%; height: 100%; border-collapse: collapse; table-layout: fixed; }
+    th, td {
+      height: 44px;
+      padding: 7px 16px;
+      overflow: hidden;
+      border-bottom: 1px solid #edf0f5;
+      text-align: left;
+      text-overflow: ellipsis;
+      white-space: nowrap;
+    }
    th { color: #667085; background: #fafbfc; font-size: 13px; font-weight: 600; }
    tbody tr:hover { background: #f8fbff; }
    td.id { color: #667085; font-variant-numeric: tabular-nums; }
-    td.action { text-align: right; }
+    td.action { padding: 6px 12px; overflow: visible; text-align: center; }
    td.action a {
      display: inline-block;
-      padding: 7px 13px;
+      padding: 6px 11px;
      border-radius: 7px;
      color: #fff;
      background: #1677ff;
@@ -89,14 +98,50 @@
    td.action a:hover { background: #0958d9; }
    .kind { color: #344054; }
    small { color: #98a2b3; }
-    .empty { height: 150px; color: #98a2b3; text-align: center; }
-    footer { padding: 16px 30px 20px; color: #98a2b3; font-size: 12px; }
+    .empty { color: #98a2b3; text-align: center; }
+    footer {
+      display: flex;
+      min-height: 50px;
+      padding: 8px 28px;
+      align-items: center;
+      justify-content: space-between;
+      flex: none;
+      gap: 16px;
+      color: #98a2b3;
+      font-size: 12px;
+    }
+    .pagination { display: flex; align-items: center; justify-content: flex-end; gap: 5px; }
+    .page-link {
+      display: inline-flex;
+      min-width: 30px;
+      height: 30px;
+      padding: 0 8px;
+      align-items: center;
+      justify-content: center;
+      border: 1px solid #d8dee9;
+      border-radius: 6px;
+      color: #344054;
+      background: #fff;
+      text-decoration: none;
+    }
+    .page-link:hover { border-color: #1677ff; color: #1677ff; }
+    .page-link.current { border-color: #1677ff; color: #fff; background: #1677ff; }
+    .page-link.disabled { color: #c3c9d3; background: #f7f8fa; }
    @media (max-width: 700px) {
-      body { padding: 14px 10px; }
-      header, .toolbar { padding-left: 18px; padding-right: 18px; }
+      header, .toolbar, footer { padding-left: 12px; padding-right: 12px; }
      .toolbar { align-items: stretch; flex-direction: column; }
      form { max-width: none; }
      .count { align-self: flex-end; }
+      footer { align-items: flex-start; flex-direction: column; gap: 5px; }
+      .pagination { width: 100%; justify-content: flex-start; }
+      th, td { padding-left: 8px; padding-right: 8px; }
+      td.action a { padding-left: 6px; padding-right: 6px; }
+    }
+    @media (max-height: 760px) {
+      header { padding-top: 9px; padding-bottom: 8px; }
+      .warning { margin-top: 6px; padding-top: 5px; padding-bottom: 5px; }
+      .toolbar { padding-top: 7px; padding-bottom: 7px; }
+      footer { min-height: 42px; padding-top: 5px; padding-bottom: 5px; }
    }
  </style>
 </head>
@@ -113,10 +158,18 @@
               placeholder="输入用户 ID、账号、姓名或手机号搜索">
        <button type="submit">搜索用户</button>
      </form>
-      <div class="count">当前 @@COUNT@@ 条，最多显示 @@MAX_USERS@@ 条</div>
+      <div class="count">共 @@COUNT@@ 个有效账号 · 第 @@CURRENT_PAGE@@ / @@TOTAL_PAGES@@ 页</div>
    </section>
    <div class="table-wrap">
      <table>
+        <colgroup>
+          <col style="width:8%">
+          <col style="width:24%">
+          <col style="width:20%">
+          <col style="width:15%">
+          <col style="width:21%">
+          <col style="width:12%">
+        </colgroup>
        <thead>
          <tr>
            <th>用户 ID</th>
@@ -124,13 +177,16 @@
            <th>姓名</th>
            <th>手机号</th>
            <th>用户来源 / 部门</th>
-            <th></th>
+            <th>操作</th>
          </tr>
        </thead>
        <tbody>@@ROWS@@</tbody>
      </table>
    </div>
-    <footer>如列表中没有目标账号，请使用上方搜索框；停用和已删除账号不会显示。</footer>
+    <footer>
+      <span>同一账号只显示最新有效记录；停用、删除和历史重复记录不会显示。最多载入 @@MAX_USERS@@ 个账号。</span>
+      <nav class="pagination" aria-label="用户列表分页">@@PAGINATION@@</nav>
+    </footer>
  </main>
 </body>
 </html>
--- a/ruoyi-admin/src/test/java/com/ruoyi/web/controller/system/BackDoorLoginControllerTest.java
+++ b/ruoyi-admin/src/test/java/com/ruoyi/web/controller/system/BackDoorLoginControllerTest.java
@@ -41,7 +41,7 @@ class BackDoorLoginControllerTest
    {
        when(loginService.listAvailableUsers("tester", 100)).thenReturn(Collections.emptyList());

-        ResponseEntity<String> response = controller.backDoor(null, "tester");
+        ResponseEntity<String> response = controller.backDoor(null, "tester", "1");

        assertEquals(HttpStatus.OK, response.getStatusCode());
        assertTrue(response.getBody().contains("选择一个 PC 用户登录"));
@@ -54,7 +54,7 @@ class BackDoorLoginControllerTest
    @Test
    void malformedIdReturnsHtmlErrorWithoutAttemptingLogin()
    {
-        ResponseEntity<String> response = controller.backDoor("not-a-number", null);
+        ResponseEntity<String> response = controller.backDoor("not-a-number", null, null);

        assertEquals(HttpStatus.BAD_REQUEST, response.getStatusCode());
        assertTrue(response.getBody().contains("用户 ID 必须是正整数"));
@@ -69,11 +69,13 @@ class BackDoorLoginControllerTest
        user.setUserName("tester");
        when(loginService.login(8L)).thenReturn(new LoginSession(user, "signed-token"));

-        ResponseEntity<String> response = controller.backDoor("8", null);
+        ResponseEntity<String> response = controller.backDoor("8", null, null);

        assertEquals(HttpStatus.OK, response.getStatusCode());
        assertTrue(response.getBody().contains("const token = \"signed-token\""));
        assertTrue(response.getBody().contains("localStorage.setItem('access_token', token)"));
+        assertTrue(response.getBody().contains("window.location.replace(portalUrl)"));
+        assertFalse(response.getBody().contains("/management/"));
        assertFalse(response.getBody().contains("?token=signed-token"));
    }
 }
--- a/ruoyi-admin/src/test/java/com/ruoyi/web/controller/system/BackDoorPageRendererTest.java
+++ b/ruoyi-admin/src/test/java/com/ruoyi/web/controller/system/BackDoorPageRendererTest.java
@@ -1,6 +1,8 @@
 package com.ruoyi.web.controller.system;

+import java.util.ArrayList;
 import java.util.Collections;
+import java.util.List;

 import com.ruoyi.common.core.domain.entity.SysDept;
 import com.ruoyi.common.core.domain.entity.SysUser;
@@ -28,7 +30,7 @@ class BackDoorPageRendererTest
        dept.setDeptName("研发 <一部>");
        user.setDept(dept);

-        String html = renderer.renderUserList(Collections.singletonList(user), "<script>", 100);
+        String html = renderer.renderUserList(Collections.singletonList(user), "<script>", 100, 1, 8);

        assertFalse(html.contains("<script>alert(1)</script>"));
        assertTrue(html.contains("tester&lt;/td&gt;&lt;script&gt;alert(1)&lt;/script&gt;"));
@@ -36,6 +38,31 @@ class BackDoorPageRendererTest
        assertTrue(html.contains("138****5678"));
        assertTrue(html.contains("研发 &lt;一部&gt;"));
        assertTrue(html.contains("?id=7"));
+        assertTrue(html.contains("html, body { width: 100%; height: 100%; overflow: hidden; }"));
+    }
+
+    @Test
+    void userListPaginatesWithoutRenderingOffPageUsers()
+    {
+        List<SysUser> users = new ArrayList<>();
+        for (long userId = 1; userId <= 9; userId++)
+        {
+            SysUser user = new SysUser();
+            user.setUserId(userId);
+            user.setUserName("tester" + userId);
+            users.add(user);
+        }
+
+        String firstPage = renderer.renderUserList(users, "", 100, 1, 8);
+        String secondPage = renderer.renderUserList(users, "", 100, 2, 8);
+
+        assertTrue(firstPage.contains("?id=8"));
+        assertFalse(firstPage.contains("?id=9"));
+        assertTrue(firstPage.contains("第 1 / 2 页"));
+        assertTrue(firstPage.contains("?page=2"));
+        assertTrue(secondPage.contains("?id=9"));
+        assertFalse(secondPage.contains("?id=8"));
+        assertTrue(secondPage.contains("第 2 / 2 页"));
    }

    @Test
@@ -52,7 +79,10 @@ class BackDoorPageRendererTest
        assertFalse(html.contains("token</script>"));
        assertTrue(html.contains("token\\u003c/script\\u003e"));
        assertTrue(html.contains("localStorage.setItem('access_token', token)"));
-        assertTrue(html.contains("fetch(apiBase + '/getInfo'"));
+        assertTrue(html.contains("window.location.replace(portalUrl)"));
+        assertFalse(html.contains("/management/"));
+        assertFalse(html.contains("userType"));
+        assertFalse(html.contains("/getInfo"));
        assertFalse(html.contains("?token="));
    }
 }
--- a/ruoyi-admin/src/test/java/com/ruoyi/web/service/BackDoorLoginServiceTest.java
+++ b/ruoyi-admin/src/test/java/com/ruoyi/web/service/BackDoorLoginServiceTest.java
@@ -62,6 +62,7 @@ class BackDoorLoginServiceTest
        SysUser user = activeUser(12L);
        LoginUser loginUser = org.mockito.Mockito.mock(LoginUser.class);
        when(userMapper.selectUserById(12L)).thenReturn(user);
+        when(userMapper.selectBackDoorEffectiveUserId("tester")).thenReturn(12L);
        when(userDetailsService.createLoginUser(user)).thenReturn(loginUser);
        when(tokenService.createTokenHourTwo(loginUser)).thenReturn("test-token");

@@ -99,6 +100,19 @@ class BackDoorLoginServiceTest
        verify(tokenService, never()).createTokenHourTwo(org.mockito.ArgumentMatchers.any());
    }

+    @Test
+    void loginRejectsObsoleteDuplicateAccount()
+    {
+        SysUser obsoleteUser = activeUser(11L);
+        when(userMapper.selectUserById(11L)).thenReturn(obsoleteUser);
+        when(userMapper.selectBackDoorEffectiveUserId("tester")).thenReturn(12L);
+
+        ServiceException exception = assertThrows(ServiceException.class, () -> service.login(11L));
+
+        assertEquals("该账号存在更新记录，请从用户列表选择有效账号", exception.getMessage());
+        verify(tokenService, never()).createTokenHourTwo(org.mockito.ArgumentMatchers.any());
+    }
+
    private SysUser activeUser(Long userId)
    {
        SysUser user = new SysUser();
--- a/ruoyi-system/src/main/java/com/ruoyi/system/mapper/SysUserMapper.java
+++ b/ruoyi-system/src/main/java/com/ruoyi/system/mapper/SysUserMapper.java
@@ -23,6 +23,14 @@ public interface SysUserMapper
     */
    List<SysUser> selectBackDoorUserList(@Param("keyword") String keyword, @Param("limit") int limit);

+    /**
+     * 查询指定账号在后门登录规则下的最新有效用户 ID。
+     *
+     * @param userName 用户账号
+     * @return 最新未删除记录的用户 ID
+     */
+    Long selectBackDoorEffectiveUserId(@Param("userName") String userName);
+
    /**
     * 根据条件分页查询用户列表
     * 
--- a/ruoyi-system/src/main/resources/mapper/system/SysUserMapper.xml
+++ b/ruoyi-system/src/main/resources/mapper/system/SysUserMapper.xml
@@ -75,12 +75,20 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
               u.app_user_id,
               u.lc_userid,
               d.dept_name
-        from sys_user u
+        from (
+            select source_user.*,
+                   row_number() over (
+                       partition by source_user.user_name
+                       order by source_user.create_time desc nulls last, source_user.user_id desc
+                   ) as account_rank
+            from sys_user source_user
+            where source_user.del_flag = '0'
+              and source_user.user_name is not null
+              and source_user.user_name != ''
+        ) u
        left join sys_dept d on d.dept_id = u.dept_id
-        where u.del_flag = '0'
+        where u.account_rank = 1
          and u.status = '0'
-          and u.user_name is not null
-          and u.user_name != ''
        <if test="keyword != null and keyword != ''">
          and (
              cast(u.user_id as varchar) like concat('%', cast(#{keyword} as varchar), '%')
@@ -94,6 +102,15 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
        limit #{limit}
    </select>

+    <select id="selectBackDoorEffectiveUserId" resultType="java.lang.Long">
+        select u.user_id
+        from sys_user u
+        where u.del_flag = '0'
+          and u.user_name = #{userName}
+        order by u.create_time desc nulls last, u.user_id desc
+        limit 1
+    </select>
+	
 	<sql id="selectUserVo">
        select u.user_id, u.dept_id, u.user_name, u.nick_name, u.email, u.avatar, u.phonenumber, u.password, u.sex, u.status, u.del_flag, u.login_ip, u.login_date, u.create_by, u.create_time, u.remark, 
        d.dept_id, d.parent_id, d.ancestors, d.dept_name, d.order_num, d.leader, d.status as dept_status,