全新的 ui，soybean admin

backend/src/routes/users.js

@@ -10,7 +10,10 @@ const { authMiddleware, requireSuperAdmin } = require('../middleware/auth');
 const { hashPassword } = require('../utils/password');
 
 router.use(authMiddleware);
-router.use(requireSuperAdmin);
+// NOTE: requireSuperAdmin is applied per-route, NOT globally,
+// because router-level middleware runs for ALL requests entering
+// this router, even those that don't match any route here
+// (e.g. /api/dashboard/today), causing unintended 403 responses.
 
 function userToDict(user) {
   return {
@@ -33,7 +36,7 @@ async function countSuperAdmins(excludeId = null) {
 }
 
 // GET /api/users/
-router.get('/api/users/', async (req, res) => {
+router.get('/api/users/', requireSuperAdmin, async (req, res) => {
   try {
     const skip = parseInt(req.query.skip || '0', 10);
     const limit = Math.min(parseInt(req.query.limit || '100', 10), 1000);
@@ -61,7 +64,7 @@ router.get('/api/users/', async (req, res) => {
 });
 
 // POST /api/users/
-router.post('/api/users/', async (req, res) => {
+router.post('/api/users/', requireSuperAdmin, async (req, res) => {
   try {
     const username = (req.body.username || '').trim();
     const password = req.body.password || '';
@@ -98,7 +101,7 @@ router.post('/api/users/', async (req, res) => {
 });
 
 // PUT /api/users/:user_id
-router.put('/api/users/:user_id', async (req, res) => {
+router.put('/api/users/:user_id', requireSuperAdmin, async (req, res) => {
   try {
     const userId = parseInt(req.params.user_id, 10);
     const dbUser = await DashboardUser.findByPk(userId);
@@ -147,7 +150,7 @@ router.put('/api/users/:user_id', async (req, res) => {
 });
 
 // DELETE /api/users/:user_id
-router.delete('/api/users/:user_id', async (req, res) => {
+router.delete('/api/users/:user_id', requireSuperAdmin, async (req, res) => {
   try {
     const userId = parseInt(req.params.user_id, 10);