f

internal/domains/user/entities/user.go

@@ -39,6 +39,13 @@ type User struct {
 	LoginCount  int        `gorm:"default:0" json:"login_count" comment:"登录次数统计"`
 	Permissions string     `gorm:"type:text" json:"permissions" comment:"权限列表(JSON格式存储)"`
 
+	// 用户黑名单（网安合规：纳入后拦截登录与 API）
+	IsBlacklisted   bool       `gorm:"column:is_blacklisted;default:false;index" json:"is_blacklisted" comment:"是否已列入黑名单"`
+	BlacklistReason string     `gorm:"column:blacklist_reason;type:varchar(500)" json:"blacklist_reason,omitempty" comment:"纳入黑名单原因"`
+	BlacklistSource string     `gorm:"column:blacklist_source;type:varchar(50)" json:"blacklist_source,omitempty" comment:"来源：self_发现/police_公安通报/test"`
+	BlacklistedAt   *time.Time `gorm:"column:blacklisted_at" json:"blacklisted_at,omitempty" comment:"黑名单生效时间"`
+	BlacklistedBy   string     `gorm:"column:blacklisted_by;type:varchar(36)" json:"blacklisted_by,omitempty" comment:"操作人用户ID"`
+
 	// 时间戳字段
 	CreatedAt time.Time      `gorm:"autoCreateTime" json:"created_at" comment:"创建时间"`
 	UpdatedAt time.Time      `gorm:"autoUpdateTime" json:"updated_at" comment:"更新时间"`
@@ -457,7 +464,7 @@ func (u *User) ResetPassword(newPassword, confirmPassword string) error {
 // CanLogin 检查用户是否可以登录
 func (u *User) CanLogin() bool {
 	// 检查用户是否被删除
-	if !u.DeletedAt.Time.IsZero() {
+	if u.IsDeleted() {
 		return false
 	}
 
@@ -466,14 +473,62 @@ func (u *User) CanLogin() bool {
 		return false
 	}
 
-	// 如果是管理员，检查是否激活
-	if u.IsAdmin() && !u.Active {
+	// 黑名单用户禁止登录
+	if u.IsBlacklisted {
+		return false
+	}
+
+	// 未激活禁止登录（普通用户与管理员一致）
+	if !u.Active {
 		return false
 	}
 
 	return true
 }
 
+// IsOnBlacklist 是否在黑名单中
+func (u *User) IsOnBlacklist() bool {
+	return u.IsBlacklisted
+}
+
+// AddToBlacklist 纳入黑名单（立即生效）
+func (u *User) AddToBlacklist(reason, source, operatorUserID string) error {
+	if u.IsAdmin() {
+		return fmt.Errorf("不能将管理员列入黑名单")
+	}
+	if u.IsBlacklisted {
+		return fmt.Errorf("用户已在黑名单中")
+	}
+	if reason == "" {
+		return NewValidationError("纳入原因不能为空")
+	}
+	if source == "" {
+		source = "self"
+	}
+	now := time.Now()
+	u.IsBlacklisted = true
+	u.BlacklistReason = reason
+	u.BlacklistSource = source
+	u.BlacklistedAt = &now
+	u.BlacklistedBy = operatorUserID
+	u.Active = false
+	return nil
+}
+
+// RemoveFromBlacklist 移出黑名单并恢复激活
+func (u *User) RemoveFromBlacklist() error {
+	if !u.IsBlacklisted {
+		return fmt.Errorf("用户不在黑名单中")
+	}
+	u.IsBlacklisted = false
+	u.BlacklistReason = ""
+	u.BlacklistSource = ""
+	u.BlacklistedAt = nil
+	u.BlacklistedBy = ""
+	u.Active = true
+	return nil
+}
+
 // IsActive 检查用户是否处于活跃状态
 func (u *User) IsActive() bool {
 	return u.DeletedAt.Time.IsZero()

internal/domains/user/repositories/queries/user_queries.go

@@ -6,11 +6,12 @@ type ListUsersQuery struct {
 	PageSize  int    `json:"page_size"`
 	Phone     string `json:"phone"`
 	UserType  string `json:"user_type"`           // 用户类型: user/admin
-	IsActive  *bool  `json:"is_active"`           // 是否激活
-	IsCertified *bool `json:"is_certified"`       // 是否已认证
-	CompanyName string `json:"company_name"`      // 企业名称
-	StartDate string `json:"start_date"`
-	EndDate   string `json:"end_date"`
+	IsActive      *bool  `json:"is_active"`      // 是否激活
+	IsCertified   *bool  `json:"is_certified"`  // 是否已认证
+	IsBlacklisted *bool  `json:"is_blacklisted"` // 是否黑名单
+	CompanyName   string `json:"company_name"`  // 企业名称
+	StartDate     string `json:"start_date"`
+	EndDate       string `json:"end_date"`
 }
 
 // ListSMSCodesQuery 短信验证码列表查询参数

internal/domains/user/services/user_auth_service.go

@@ -8,23 +8,27 @@ import (
 
 	"hyapi-server/internal/domains/user/entities"
 	"hyapi-server/internal/domains/user/repositories"
+	securityEntities "hyapi-server/internal/domains/security/entities"
+	securityServices "hyapi-server/internal/domains/security/services"
 )
 
 // UserAuthService 用户认证领域服务
-// 负责用户认证相关的业务逻辑，包括密码验证、登录状态管理等
 type UserAuthService struct {
-	userRepo repositories.UserRepository
-	logger   *zap.Logger
+	userRepo  repositories.UserRepository
+	blacklist *securityServices.BlacklistService
+	logger    *zap.Logger
 }
 
 // NewUserAuthService 创建用户认证领域服务
 func NewUserAuthService(
 	userRepo repositories.UserRepository,
+	blacklist *securityServices.BlacklistService,
 	logger *zap.Logger,
 ) *UserAuthService {
 	return &UserAuthService{
-		userRepo: userRepo,
-		logger:   logger,
+		userRepo:  userRepo,
+		blacklist: blacklist,
+		logger:    logger,
 	}
 }
 
@@ -35,6 +39,17 @@ func (s *UserAuthService) ValidatePassword(ctx context.Context, phone, password
 		return nil, fmt.Errorf("用户名或密码错误")
 	}
 
+	if user.IsOnBlacklist() {
+		if s.blacklist != nil {
+			s.blacklist.RecordHit(&securityEntities.BlacklistHitRecord{
+				HitType: securityEntities.HitTypeUserLogin,
+				UserID:  user.ID,
+				Phone:   user.Phone,
+				Reason:  user.BlacklistReason,
+			})
+		}
+		return nil, fmt.Errorf("账号已被列入黑名单，无法登录")
+	}
 	if !user.CanLogin() {
 		return nil, fmt.Errorf("用户状态异常，无法登录")
 	}
@@ -54,6 +69,17 @@ func (s *UserAuthService) ValidateUserLogin(ctx context.Context, phone string) (
 		return nil, fmt.Errorf("用户不存在")
 	}
 
+	if user.IsOnBlacklist() {
+		if s.blacklist != nil {
+			s.blacklist.RecordHit(&securityEntities.BlacklistHitRecord{
+				HitType: securityEntities.HitTypeUserLogin,
+				UserID:  user.ID,
+				Phone:   user.Phone,
+				Reason:  user.BlacklistReason,
+			})
+		}
+		return nil, fmt.Errorf("账号已被列入黑名单，无法登录")
+	}
 	if !user.CanLogin() {
 		return nil, fmt.Errorf("用户状态异常，无法登录")
 	}