From 8043fa198bddf9caadd2e14b77593aec8ef37072 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=96=87=E7=9D=BF=20=E5=BC=A0?= <zzz0217asdf@163.com>
Date: Fri, 9 Oct 2026 09:39:41 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E9=85=8D=E7=BD=AE=E7=94=A8=E6=88=B7?=
 =?UTF-8?q?=E5=85=AC=E5=8F=B8=E6=8E=88=E6=9D=83=E4=B8=8E=E9=BB=98=E8=AE=A4?=
 =?UTF-8?q?=E5=85=AC=E5=8F=B8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 frontend/src/views/Users.test.js              |  85 +++++++-
 frontend/src/views/Users.vue                  |  48 ++++-
 internal/handler/api.go                       |  10 +-
 internal/model/model.go                       |  24 ++-
 internal/repository/user.go                   |  32 ++-
 internal/repository/user_organization.go      | 192 ++++++++++++++++++
 .../user_organization_integration_test.go     | 133 ++++++++++++
 internal/repository/user_organization_test.go | 140 +++++++++++++
 internal/repository/user_test.go              |   5 +
 internal/service/auth.go                      |  16 +-
 internal/service/auth_test.go                 |  27 +++
 11 files changed, 687 insertions(+), 25 deletions(-)
 create mode 100644 internal/repository/user_organization.go
 create mode 100644 internal/repository/user_organization_integration_test.go
 create mode 100644 internal/repository/user_organization_test.go

diff --git a/frontend/src/views/Users.test.js b/frontend/src/views/Users.test.js
index 1cfd8ac1..b62b10f4 100644
--- a/frontend/src/views/Users.test.js
+++ b/frontend/src/views/Users.test.js
@@ -7,7 +7,7 @@ import { organizationsApi } from '../api/organizations'
 
 const RoleSelectStub = {
   props: {
-    modelValue: Array,
+    modelValue: [Array, Number],
     multiple: Boolean
   },
   emits: ['update:modelValue'],
@@ -33,6 +33,7 @@ vi.mock('../stores/users', () => ({ useUsersStore: () => usersStore }))
 vi.mock('../stores/auth', () => ({ useAuthStore: () => ({ isAdmin: true }) }))
 vi.mock('../api/organizations', () => ({
   organizationsApi: {
+    list: vi.fn().mockResolvedValue({ data: [{ id: 1, name: '甲公司', status: 'active' }, { id: 2, name: '乙公司', status: 'inactive' }] }),
     listRoles: vi.fn()
   }
 }))
@@ -147,6 +148,8 @@ describe('新增用户后列表与搜索框保持一致', () => {
     state.form.username = 'lisi'
     state.form.password = '123456'
     state.form.role_ids = [2]
+    state.form.organization_ids = [1]
+    state.form.default_organization_id = 1
     await state.handleSave()
     await flushPromises()
 
@@ -176,6 +179,86 @@ describe('新增用户后列表与搜索框保持一致', () => {
   })
 })
 
+describe('用户公司授权', () => {
+  test('编辑普通用户非空授权时必须选择默认公司', async () => {
+    organizationsApi.listRoles.mockResolvedValue({ data: [{ id: 2, code: 'warehouse_admin', enabled: true, name: '仓库管理员' }] })
+    usersStore.updateUser.mockClear()
+    const wrapper = mountUsers()
+    await flushPromises()
+    const state = wrapper.vm.$.setupState
+    state.showEditModal({ id: 8, username: 'user', roles: [{ id: 2 }], organization_ids: [1], default_organization_id: null })
+    await state.handleSave()
+    expect(usersStore.updateUser).not.toHaveBeenCalled()
+    wrapper.unmount()
+  })
+
+  test('超级管理员无需逐项授权，可以选择启用公司作为默认公司', async () => {
+    organizationsApi.listRoles.mockResolvedValue({ data: [{ id: 1, code: 'super_admin', enabled: true, name: '超级管理员' }] })
+    const wrapper = mountUsers()
+    await flushPromises()
+    const state = wrapper.vm.$.setupState
+    state.showAddModal()
+    Object.assign(state.form, { username: 'admin2', password: 'secret', role_ids: [1], default_organization_id: 1 })
+    await state.handleSave()
+    expect(state.defaultOrganizations.map(item => item.id)).toEqual([1])
+    expect(usersStore.createUser).toHaveBeenLastCalledWith(expect.objectContaining({ organization_ids: [], default_organization_id: 1 }))
+    wrapper.unmount()
+  })
+
+  test('停用授权可以移除但不能重新分配给未持有的用户', async () => {
+    const wrapper = mountUsers()
+    await flushPromises()
+    const state = wrapper.vm.$.setupState
+    state.showEditModal({ id: 8, username: 'user', roles: [{ id: 2 }], organization_ids: [2], default_organization_id: null })
+    await flushPromises()
+    const options = () => wrapper.findAllComponents(RoleOptionStub).filter(option => option.props('label') === '乙公司（已停用）')
+    expect(options()[0].props('disabled')).toBe(false)
+    state.form.organization_ids = []
+    await flushPromises()
+    expect(options()[0].props('disabled')).toBe(true)
+    wrapper.unmount()
+  })
+
+  test('编辑展示历史停用授权，默认公司只提供已选启用公司', async () => {
+    const wrapper = mountUsers()
+    await flushPromises()
+    const state = wrapper.vm.$.setupState
+    state.showEditModal({ id: 8, username: 'user', roles: [{ id: 2 }], organization_ids: [1, 2], default_organization_id: 1 })
+    await flushPromises()
+    expect(state.form.organization_ids).toEqual([1, 2])
+    expect(wrapper.text()).toContain('乙公司（已停用）')
+    expect(state.defaultOrganizations.map(item => item.id)).toEqual([1])
+    state.form.organization_ids = [2]
+    await flushPromises()
+    expect(state.form.default_organization_id).toBeNull()
+    wrapper.unmount()
+  })
+
+  test('新增普通用户缺少公司授权时禁止保存', async () => {
+    usersStore.createUser.mockClear()
+    const wrapper = mountUsers()
+    await flushPromises()
+    const state = wrapper.vm.$.setupState
+    state.showAddModal()
+    Object.assign(state.form, { username: 'new', password: 'secret', role_ids: [2] })
+    await state.handleSave()
+    expect(usersStore.createUser).not.toHaveBeenCalled()
+    wrapper.unmount()
+  })
+
+  test('显式清空授权发送空集合和空默认公司', async () => {
+    const wrapper = mountUsers()
+    await flushPromises()
+    const state = wrapper.vm.$.setupState
+    state.showEditModal({ id: 8, username: 'user', roles: [{ id: 2 }], organization_ids: [1], default_organization_id: 1 })
+    state.form.organization_ids = []
+    await flushPromises()
+    await state.handleSave()
+    expect(usersStore.updateUser).toHaveBeenLastCalledWith(8, expect.objectContaining({ organization_ids: [], default_organization_id: null }))
+    wrapper.unmount()
+  })
+})
+
 // 已停用角色在下拉里怎么呈现，直接决定"编辑用户"这条路走不走得通：保存是全量替换
 // 角色，前端若摘不掉那个停用角色、后端又要求角色全部启用，这个用户就永远存不回去。
 // 现在后端已放行"本来就持有的停用角色"，前端这两条是配套：既让人摘得掉，也不让人
diff --git a/frontend/src/views/Users.vue b/frontend/src/views/Users.vue
index 1704f655..2146273f 100644
--- a/frontend/src/views/Users.vue
+++ b/frontend/src/views/Users.vue
@@ -75,6 +75,22 @@
             />
           </el-select>
         </el-form-item>
+        <el-form-item label="可访问公司" :required="!editingId && !isSuperAdmin">
+          <el-select v-model="form.organization_ids" multiple style="width: 100%" placeholder="请选择可访问公司">
+            <el-option
+              v-for="organization in organizations"
+              :key="organization.id"
+              :label="organization.status === 'active' ? organization.name : `${organization.name}（已停用）`"
+              :value="organization.id"
+              :disabled="organization.status !== 'active' && !form.organization_ids.includes(organization.id)"
+            />
+          </el-select>
+        </el-form-item>
+        <el-form-item label="默认公司" :required="!editingId && !isSuperAdmin">
+          <el-select v-model="form.default_organization_id" clearable style="width: 100%" placeholder="请选择默认公司" @clear="form.default_organization_id = null">
+            <el-option v-for="organization in defaultOrganizations" :key="organization.id" :label="organization.name" :value="organization.id" />
+          </el-select>
+        </el-form-item>
         <el-form-item label="描述">
           <el-input v-model="form.description" type="textarea" :rows="3" />
         </el-form-item>
@@ -90,7 +106,7 @@
 </template>
 
 <script setup>
-import { ref, reactive, onMounted } from 'vue'
+import { ref, reactive, computed, watch, onMounted } from 'vue'
 import { useUsersStore } from '../stores/users'
 import { useAuthStore } from '../stores/auth'
 import { organizationsApi } from '../api/organizations'
@@ -110,20 +126,31 @@ const editingId = ref(null)
 const deleteId = ref(null)
 const searchKeyword = ref('')
 const roles = ref([])
+const organizations = ref([])
 
 const form = reactive({
   username: '',
   password: '',
   role_ids: [],
+  organization_ids: [],
+  default_organization_id: null,
   description: ''
 })
 
+const isSuperAdmin = computed(() => roles.value.some(role => role.code === 'super_admin' && role.enabled && form.role_ids.includes(role.id)))
+const defaultOrganizations = computed(() => organizations.value.filter(organization => organization.status === 'active' && (isSuperAdmin.value || form.organization_ids.includes(organization.id))))
+watch(defaultOrganizations, available => {
+  if (form.default_organization_id != null && !available.some(organization => organization.id === form.default_organization_id)) {
+    form.default_organization_id = null
+  }
+})
+
 onMounted(() => {
   if (!authStore.isAdmin) {
     ElMessage.warning('无权限访问')
     return
   }
-  Promise.all([usersStore.fetchUsers(), loadRoles()])
+  Promise.all([usersStore.fetchUsers(), loadRoles(), loadOrganizations()])
 })
 
 async function loadRoles() {
@@ -131,6 +158,11 @@ async function loadRoles() {
   roles.value = response.data || []
 }
 
+async function loadOrganizations() {
+  const response = await organizationsApi.list()
+  organizations.value = response.data || []
+}
+
 // 列表的 tag 和编辑下拉都用它。已停用的角色照旧显示（用户可能正持有它，编辑时得
 // 看得见、摘得掉），但必须把"已停用"标出来：停用意味着不再授予权限，只显示角色名
 // 会让管理员以为这个角色还在生效。
@@ -153,7 +185,7 @@ function showAddModal() {
   }
   editingId.value = null
   dialogTitle.value = '新增用户'
-  Object.assign(form, { username: '', password: '', role_ids: [], description: '' })
+  Object.assign(form, { username: '', password: '', role_ids: [], organization_ids: [], default_organization_id: null, description: '' })
   dialogVisible.value = true
 }
 
@@ -168,6 +200,8 @@ function showEditModal(row) {
     username: row.username,
     password: '',
     role_ids: (row.roles || []).map(role => role.id),
+    organization_ids: [...(row.organization_ids || [])],
+    default_organization_id: row.default_organization_id ?? null,
     description: row.description || ''
   })
   dialogVisible.value = true
@@ -186,6 +220,14 @@ async function handleSave() {
     ElMessage.warning('请至少选择一个角色')
     return
   }
+  if (!isSuperAdmin.value && ((!editingId.value && form.organization_ids.length === 0) || (form.organization_ids.length > 0 && form.default_organization_id == null))) {
+    ElMessage.warning('请选择可访问公司及默认公司')
+    return
+  }
+  if (form.default_organization_id != null && !defaultOrganizations.value.some(organization => organization.id === form.default_organization_id)) {
+    ElMessage.warning('默认公司必须为已授权的启用公司')
+    return
+  }
   saveLoading.value = true
   try {
     const data = { ...form }
diff --git a/internal/handler/api.go b/internal/handler/api.go
index 5c7352ad..857a7d9a 100644
--- a/internal/handler/api.go
+++ b/internal/handler/api.go
@@ -1063,6 +1063,7 @@ func (h *Handler) ListUsers(c *gin.Context) {
 
 func (h *Handler) CreateUser(c *gin.Context) {
 	var req struct {
+		model.UserOrganizationInput
 		Username    string  `json:"username" binding:"required"`
 		Password    string  `json:"password" binding:"required"`
 		RoleIDs     []int64 `json:"role_ids" binding:"required,min=1"`
@@ -1074,7 +1075,8 @@ func (h *Handler) CreateUser(c *gin.Context) {
 		return
 	}
 
-	user, err := h.authSvc.CreateUser(req.Username, req.Password, req.Description, req.RoleIDs)
+	req.ActorUserID = middleware.GetCurrentUserID(c)
+	user, err := h.authSvc.CreateUser(req.Username, req.Password, req.Description, req.RoleIDs, req.UserOrganizationInput)
 	if err != nil {
 		if message := roleErrorText(err); message != "" {
 			response.BadRequest(c, message)
@@ -1095,6 +1097,7 @@ func (h *Handler) UpdateUser(c *gin.Context) {
 	}
 
 	var req struct {
+		model.UserOrganizationInput
 		Password    string  `json:"password"`
 		RoleIDs     []int64 `json:"role_ids" binding:"required,min=1"`
 		Description string  `json:"description"`
@@ -1105,7 +1108,8 @@ func (h *Handler) UpdateUser(c *gin.Context) {
 		return
 	}
 
-	err = h.authSvc.UpdateUser(id, req.Description, req.RoleIDs, req.Password)
+	req.ActorUserID = middleware.GetCurrentUserID(c)
+	err = h.authSvc.UpdateUser(id, req.Description, req.RoleIDs, req.Password, req.UserOrganizationInput)
 	if err != nil {
 		if message := roleErrorText(err); message != "" {
 			response.BadRequest(c, message)
@@ -1150,6 +1154,8 @@ func (h *Handler) DeleteUser(c *gin.Context) {
 // "请求参数有误"，用户看不出问题出在角色上。
 func roleErrorText(err error) string {
 	switch {
+	case errors.Is(err, repository.ErrInvalidOrganizations):
+		return err.Error()
 	case errors.Is(err, repository.ErrInvalidRoles):
 		return "所选角色无效或已被停用，请重新选择"
 	case errors.Is(err, repository.ErrLastSuperAdmin):
diff --git a/internal/model/model.go b/internal/model/model.go
index c215b44a..798d5e0e 100644
--- a/internal/model/model.go
+++ b/internal/model/model.go
@@ -1,6 +1,7 @@
 package model
 
 import (
+	"encoding/json"
 	"fmt"
 	"time"
 
@@ -305,13 +306,22 @@ type MaterialLog struct {
 
 // User represents a system user
 type User struct {
-	ID          int64     `json:"id"`
-	Username    string    `json:"username"`
-	Password    string    `json:"-"`
-	Role        string    `json:"role"`
-	Roles       []Role    `json:"roles"`
-	Description string    `json:"description"`
-	CreatedAt   time.Time `json:"created_at"`
+	OrganizationIDs       []int64   `json:"organization_ids"`
+	DefaultOrganizationID *int64    `json:"default_organization_id"`
+	ID                    int64     `json:"id"`
+	Username              string    `json:"username"`
+	Password              string    `json:"-"`
+	Role                  string    `json:"role"`
+	Roles                 []Role    `json:"roles"`
+	Description           string    `json:"description"`
+	CreatedAt             time.Time `json:"created_at"`
+}
+
+// RawMessage distinguishes an omitted default from an explicit null on edits.
+type UserOrganizationInput struct {
+	OrganizationIDs       *[]int64        `json:"organization_ids"`
+	DefaultOrganizationID json.RawMessage `json:"default_organization_id"`
+	ActorUserID           int64           `json:"-"`
 }
 
 // LoginRequest represents login request
diff --git a/internal/repository/user.go b/internal/repository/user.go
index dad0fcf3..3b9b8182 100644
--- a/internal/repository/user.go
+++ b/internal/repository/user.go
@@ -48,7 +48,7 @@ func (r *UserRepository) GetByID(id int64) (*model.User, error) {
 	return user, nil
 }
 
-func (r *UserRepository) Create(user *model.User, roleIDs []int64) error {
+func (r *UserRepository) Create(user *model.User, roleIDs []int64, organization ...model.UserOrganizationInput) error {
 	tx, err := database.DB.Begin()
 	if err != nil {
 		return err
@@ -66,6 +66,11 @@ func (r *UserRepository) Create(user *model.User, roleIDs []int64) error {
 	if err = assignRolesTx(tx, user.ID, roleIDs); err != nil {
 		return err
 	}
+	if len(organization) > 0 {
+		if err := replaceUserOrganizationsTx(tx, user.ID, organization[0], true); err != nil {
+			return err
+		}
+	}
 	return tx.Commit()
 }
 
@@ -116,15 +121,15 @@ func (r *UserRepository) List(search string, limit, offset int) ([]model.User, i
 	return users, total, nil
 }
 
-func (r *UserRepository) Update(user *model.User, roleIDs []int64) error {
-	return r.update(user, roleIDs, false)
+func (r *UserRepository) Update(user *model.User, roleIDs []int64, organization ...model.UserOrganizationInput) error {
+	return r.update(user, roleIDs, false, organization...)
 }
 
-func (r *UserRepository) UpdateWithPassword(user *model.User, roleIDs []int64) error {
-	return r.update(user, roleIDs, true)
+func (r *UserRepository) UpdateWithPassword(user *model.User, roleIDs []int64, organization ...model.UserOrganizationInput) error {
+	return r.update(user, roleIDs, true, organization...)
 }
 
-func (r *UserRepository) update(user *model.User, roleIDs []int64, updatePassword bool) error {
+func (r *UserRepository) update(user *model.User, roleIDs []int64, updatePassword bool, organization ...model.UserOrganizationInput) error {
 	tx, err := database.DB.Begin()
 	if err != nil {
 		return err
@@ -138,6 +143,10 @@ func (r *UserRepository) update(user *model.User, roleIDs []int64, updatePasswor
 	if err := protectLastSuperAdminTx(tx, user.ID, roleIDs); err != nil {
 		return err
 	}
+	var lockedID int64
+	if err := tx.QueryRow(`SELECT id FROM users WHERE id = ? FOR UPDATE`, user.ID).Scan(&lockedID); err != nil {
+		return err
+	}
 	if updatePassword {
 		_, err = tx.Exec(`UPDATE users SET password = ?, description = ? WHERE id = ?`, user.Password, user.Description, user.ID)
 	} else {
@@ -152,6 +161,11 @@ func (r *UserRepository) update(user *model.User, roleIDs []int64, updatePasswor
 	if err = insertUserRolesTx(tx, user.ID, roleIDs); err != nil {
 		return err
 	}
+	if len(organization) > 0 {
+		if err := replaceUserOrganizationsTx(tx, user.ID, organization[0], false); err != nil {
+			return err
+		}
+	}
 	return tx.Commit()
 }
 
@@ -203,7 +217,11 @@ func loadRolesForUsers(queryer interface {
 			user.Roles = append(user.Roles, role)
 		}
 	}
-	return rows.Err()
+	if err := rows.Err(); err != nil {
+		return err
+	}
+	rows.Close()
+	return loadOrganizationsForUsers(queryer, users)
 }
 
 func assignRolesTx(tx *sql.Tx, userID int64, roleIDs []int64) error {
diff --git a/internal/repository/user_organization.go b/internal/repository/user_organization.go
new file mode 100644
index 00000000..d095a384
--- /dev/null
+++ b/internal/repository/user_organization.go
@@ -0,0 +1,192 @@
+package repository
+
+import (
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/wmms/wmms/internal/model"
+)
+
+var ErrInvalidOrganizations = errors.New("公司授权或默认公司无效，请选择启用且已授权的公司")
+
+type userOrganizationState struct {
+	UserID                int64   `json:"user_id"`
+	OrganizationIDs       []int64 `json:"organization_ids"`
+	DefaultOrganizationID *int64  `json:"default_organization_id"`
+}
+
+func replaceUserOrganizationsTx(tx *sql.Tx, userID int64, input model.UserOrganizationInput, creating bool) error {
+	if input.OrganizationIDs == nil && len(input.DefaultOrganizationID) == 0 && !creating {
+		return nil
+	}
+	ids := []int64{}
+	if input.OrganizationIDs != nil {
+		for _, id := range *input.OrganizationIDs {
+			if id <= 0 {
+				return ErrInvalidOrganizations
+			}
+			ids = append(ids, id)
+		}
+		ids = uniqueRoleIDs(ids)
+		sort.Slice(ids, func(i, j int) bool { return ids[i] < ids[j] })
+	}
+	old := userOrganizationState{UserID: userID, OrganizationIDs: []int64{}}
+	rows, err := tx.Query(`SELECT organization_id, is_default FROM user_organizations WHERE user_id = ? ORDER BY organization_id FOR UPDATE`, userID)
+	if err != nil {
+		return err
+	}
+	for rows.Next() {
+		var id int64
+		var def bool
+		if err := rows.Scan(&id, &def); err != nil {
+			rows.Close()
+			return err
+		}
+		old.OrganizationIDs = append(old.OrganizationIDs, id)
+		if def {
+			value := id
+			old.DefaultOrganizationID = &value
+		}
+	}
+	err = rows.Err()
+	rows.Close()
+	if err != nil {
+		return err
+	}
+	if input.OrganizationIDs == nil {
+		ids = append(ids, old.OrganizationIDs...)
+	}
+	// Decode into an independent value so replacing the default cannot mutate
+	// the original state retained for the audit record.
+	var def *int64
+	if old.DefaultOrganizationID != nil {
+		value := *old.DefaultOrganizationID
+		def = &value
+	}
+	if len(input.DefaultOrganizationID) > 0 {
+		if err := json.Unmarshal(input.DefaultOrganizationID, &def); err != nil {
+			return ErrInvalidOrganizations
+		}
+	}
+	if def != nil && *def <= 0 {
+		return ErrInvalidOrganizations
+	}
+	var admin bool
+	if err := tx.QueryRow(`SELECT EXISTS(SELECT 1 FROM user_roles ur JOIN roles r ON r.id=ur.role_id WHERE ur.user_id=? AND r.code='super_admin' AND r.enabled=1)`, userID).Scan(&admin); err != nil {
+		return err
+	}
+	contains := func(values []int64, id int64) bool {
+		for _, value := range values {
+			if value == id {
+				return true
+			}
+		}
+		return false
+	}
+	if !admin {
+		if creating && (len(ids) == 0 || def == nil) {
+			return ErrInvalidOrganizations
+		}
+		if len(ids) > 0 && def == nil {
+			return ErrInvalidOrganizations
+		}
+		if def != nil && !contains(ids, *def) {
+			return ErrInvalidOrganizations
+		}
+	} else if def != nil && !contains(ids, *def) {
+		ids = append(ids, *def)
+		sort.Slice(ids, func(i, j int) bool { return ids[i] < ids[j] })
+	}
+	if len(ids) > 0 {
+		args := make([]interface{}, len(ids))
+		for i, id := range ids {
+			args[i] = id
+		}
+		placeholders := strings.TrimSuffix(strings.Repeat("?,", len(ids)), ",")
+		rows, err := tx.Query(fmt.Sprintf(`SELECT id, status FROM organizations WHERE id IN (%s) ORDER BY id FOR UPDATE`, placeholders), args...)
+		if err != nil {
+			return err
+		}
+		count := 0
+		invalid := false
+		for rows.Next() {
+			var id int64
+			var status string
+			if err := rows.Scan(&id, &status); err != nil {
+				rows.Close()
+				return err
+			}
+			count++
+			if status != "active" && (!contains(old.OrganizationIDs, id) || (def != nil && *def == id)) {
+				invalid = true
+			}
+		}
+		err = rows.Err()
+		rows.Close()
+		if err != nil {
+			return err
+		}
+		if invalid || count != len(ids) {
+			return ErrInvalidOrganizations
+		}
+	}
+	if _, err := tx.Exec(`DELETE FROM user_organizations WHERE user_id = ?`, userID); err != nil {
+		return err
+	}
+	for _, id := range ids {
+		if _, err := tx.Exec(`INSERT INTO user_organizations (user_id, organization_id, is_default) VALUES (?, ?, ?)`, userID, id, def != nil && *def == id); err != nil {
+			return err
+		}
+	}
+	next := userOrganizationState{UserID: userID, OrganizationIDs: ids, DefaultOrganizationID: def}
+	oldJSON, err := json.Marshal(old)
+	if err != nil {
+		return err
+	}
+	newJSON, err := json.Marshal(next)
+	if err != nil {
+		return err
+	}
+	return writeOrganizationAudit(tx, &model.OrganizationAuditLog{ActorUserID: input.ActorUserID, Action: "organization_access_changed", OldValue: oldJSON, NewValue: newJSON})
+}
+
+func loadOrganizationsForUsers(q interface {
+	Query(string, ...interface{}) (*sql.Rows, error)
+}, users []*model.User) error {
+	if len(users) == 0 {
+		return nil
+	}
+	args := make([]interface{}, len(users))
+	byID := map[int64]*model.User{}
+	for i, user := range users {
+		user.OrganizationIDs = []int64{}
+		user.DefaultOrganizationID = nil
+		args[i] = user.ID
+		byID[user.ID] = user
+	}
+	placeholders := strings.TrimSuffix(strings.Repeat("?, ", len(users)), ", ")
+	rows, err := q.Query(fmt.Sprintf(`SELECT user_id, organization_id, is_default FROM user_organizations WHERE user_id IN (%s) ORDER BY user_id, organization_id`, placeholders), args...)
+	if err != nil {
+		return err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var userID, id int64
+		var def bool
+		if err := rows.Scan(&userID, &id, &def); err != nil {
+			return err
+		}
+		if user := byID[userID]; user != nil {
+			user.OrganizationIDs = append(user.OrganizationIDs, id)
+			if def {
+				value := id
+				user.DefaultOrganizationID = &value
+			}
+		}
+	}
+	return rows.Err()
+}
diff --git a/internal/repository/user_organization_integration_test.go b/internal/repository/user_organization_integration_test.go
new file mode 100644
index 00000000..9f38adc7
--- /dev/null
+++ b/internal/repository/user_organization_integration_test.go
@@ -0,0 +1,133 @@
+package repository
+
+import (
+	"encoding/json"
+	"errors"
+	"reflect"
+	"testing"
+
+	"github.com/wmms/wmms/internal/model"
+)
+
+// Exercise actual commits and rollbacks: a mock rollback alone cannot prove
+// that role, grant and audit writes remain atomic or leave other users intact.
+func TestUserOrganizationConfigurationMySQL(t *testing.T) {
+	db := isolationDB(t, false)
+	mustSQL(t, db, `INSERT INTO users(id,username,password) VALUES(100,'actor','x');
+ INSERT INTO organizations(id,code,name,status) VALUES(2,'TWO','Two','active'),(3,'THREE','Three','inactive');`)
+	input := func(ids []int64, def string) model.UserOrganizationInput {
+		return model.UserOrganizationInput{OrganizationIDs: &ids, DefaultOrganizationID: json.RawMessage(def), ActorUserID: 100}
+	}
+	repo := NewUserRepository()
+	ordinary := &model.User{Username: "ordinary", Password: "x", Description: "before"}
+	if err := repo.Create(ordinary, []int64{2}, input([]int64{2, 1, 2}, "2")); err != nil {
+		t.Fatal(err)
+	}
+	other := &model.User{Username: "other", Password: "x"}
+	if err := repo.Create(other, []int64{2}, input([]int64{1}, "1")); err != nil {
+		t.Fatal(err)
+	}
+	admin := &model.User{Username: "admin", Password: "x"}
+	if err := repo.Create(admin, []int64{1}, input(nil, "null")); err != nil {
+		t.Fatal(err)
+	}
+	read := func(id int64) *model.User {
+		t.Helper()
+		user, err := repo.GetByID(id)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return user
+	}
+	assertGrants := func(id int64, ids []int64, def *int64) {
+		t.Helper()
+		user := read(id)
+		if !reflect.DeepEqual(user.OrganizationIDs, ids) || !reflect.DeepEqual(user.DefaultOrganizationID, def) {
+			t.Fatalf("user %d grants=%v default=%v, want %v/%v", id, user.OrganizationIDs, user.DefaultOrganizationID, ids, def)
+		}
+	}
+	one, two := int64(1), int64(2)
+	assertGrants(ordinary.ID, []int64{1, 2}, &two)
+	assertGrants(admin.ID, []int64{}, nil)
+	if err := repo.Update(admin, []int64{1}, model.UserOrganizationInput{DefaultOrganizationID: json.RawMessage("2"), ActorUserID: 100}); err != nil {
+		t.Fatal(err)
+	}
+	assertGrants(admin.ID, []int64{2}, &two)
+
+	// Historical inactive grants survive detail/list reads and an explicit save,
+	// but new disabled grants and disabled defaults remain invalid.
+	mustSQL(t, db, `INSERT INTO user_organizations(user_id,organization_id,is_default) VALUES(?,3,0)`, ordinary.ID)
+	assertGrants(ordinary.ID, []int64{1, 2, 3}, &two)
+	if err := repo.Update(ordinary, []int64{2}, input([]int64{1, 2, 3}, "2")); err != nil {
+		t.Fatal(err)
+	}
+	if err := repo.Update(ordinary, []int64{2}, model.UserOrganizationInput{}); err != nil {
+		t.Fatal(err)
+	}
+	assertGrants(ordinary.ID, []int64{1, 2, 3}, &two)
+	if err := repo.Update(ordinary, []int64{2}, input([]int64{1, 2}, "2")); err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		name string
+		ids  []int64
+		def  string
+	}{
+		{"new inactive grant", []int64{1, 3}, "1"},
+		{"missing company", []int64{999}, "999"},
+		{"default outside grants", []int64{1}, "2"},
+		{"missing default", []int64{1}, "null"},
+		{"inactive default", []int64{3}, "3"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if err := repo.Update(ordinary, []int64{3}, input(tc.ids, tc.def)); !errors.Is(err, ErrInvalidOrganizations) {
+				t.Fatalf("got %v", err)
+			}
+			if read(ordinary.ID).Roles[0].ID != 2 {
+				t.Fatal("invalid grants persisted replacement roles")
+			}
+			assertGrants(ordinary.ID, []int64{1, 2}, &two)
+		})
+	}
+
+	var auditCount int
+	if err := db.QueryRow(`SELECT COUNT(*) FROM organization_audit_logs`).Scan(&auditCount); err != nil {
+		t.Fatal(err)
+	}
+	// Force a failure at the final write after user, role and grant replacement.
+	mustSQL(t, db, `CREATE TRIGGER reject_access_audit BEFORE INSERT ON organization_audit_logs FOR EACH ROW SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='audit rejected'`)
+	ordinary.Description = "must rollback"
+	if err := repo.Update(ordinary, []int64{3}, input([]int64{}, "null")); err == nil {
+		t.Fatal("audit failure accepted")
+	}
+	stored := read(ordinary.ID)
+	if stored.Description != "before" || stored.Roles[0].ID != 2 {
+		t.Fatalf("user/roles failed rollback: %+v", stored)
+	}
+	assertGrants(ordinary.ID, []int64{1, 2}, &two)
+	var afterCount int
+	if err := db.QueryRow(`SELECT COUNT(*) FROM organization_audit_logs`).Scan(&afterCount); err != nil || afterCount != auditCount {
+		t.Fatalf("audit rollback: count=%d err=%v", afterCount, err)
+	}
+	mustSQL(t, db, `DROP TRIGGER reject_access_audit`)
+	if err := repo.Update(ordinary, []int64{999}, input([]int64{}, "null")); !errors.Is(err, ErrInvalidRoles) {
+		t.Fatalf("invalid role error=%v", err)
+	}
+	assertGrants(ordinary.ID, []int64{1, 2}, &two)
+	if err := repo.Update(ordinary, []int64{2}, input([]int64{}, "null")); err != nil {
+		t.Fatal(err)
+	}
+	assertGrants(ordinary.ID, []int64{}, nil)
+	assertGrants(other.ID, []int64{1}, &one)
+	if err := repo.Update(admin, []int64{2}, input([]int64{1}, "1")); !errors.Is(err, ErrLastSuperAdmin) {
+		t.Fatalf("last admin error=%v", err)
+	}
+
+	// A historical disabled super-admin role grants no exemption from creation
+	// requirements. Validation must read enabled DB roles, not the legacy Role.
+	mustSQL(t, db, `UPDATE roles SET enabled=0 WHERE code='super_admin'`)
+	invalid := &model.User{Username: "disabled-admin", Password: "x", Role: "super_admin"}
+	if err := repo.Create(invalid, []int64{2}, input(nil, "null")); !errors.Is(err, ErrInvalidOrganizations) {
+		t.Fatalf("legacy admin bypass: %v", err)
+	}
+}
diff --git a/internal/repository/user_organization_test.go b/internal/repository/user_organization_test.go
new file mode 100644
index 00000000..046aae32
--- /dev/null
+++ b/internal/repository/user_organization_test.go
@@ -0,0 +1,140 @@
+package repository
+
+import (
+	"encoding/json"
+	"errors"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/wmms/wmms/internal/model"
+	"github.com/wmms/wmms/pkg/database"
+)
+
+func TestUserOrganizationReplacement(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		ids    []int64
+		def    string
+		active int
+		valid  bool
+	}{
+		{"deduplicates", []int64{2, 2}, "2", 1, true},
+		{"disabled", []int64{2}, "2", 0, false},
+		{"missing", []int64{9}, "9", 0, false},
+		{"default outside set", []int64{2}, "3", 1, false},
+		{"nonempty without default", []int64{2}, "null", 1, false},
+		{"invalid id", []int64{-1}, "null", 0, false},
+		{"revoke all", []int64{}, "null", 0, true},
+		{"empty with default", []int64{}, "2", 0, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			db, mock, _ := sqlmock.New()
+			defer db.Close()
+			mock.ExpectBegin()
+			tx, _ := db.Begin()
+			if tc.name != "invalid id" {
+				mock.ExpectQuery("SELECT organization_id, is_default FROM user_organizations").WithArgs(int64(7)).WillReturnRows(sqlmock.NewRows([]string{"organization_id", "is_default"}).AddRow(1, true))
+				mock.ExpectQuery("SELECT EXISTS").WithArgs(int64(7)).WillReturnRows(sqlmock.NewRows([]string{"admin"}).AddRow(false))
+				if len(tc.ids) > 0 && tc.name != "default outside set" && tc.name != "nonempty without default" {
+					mock.ExpectQuery("SELECT id, status FROM organizations").WithArgs(tc.ids[0]).WillReturnRows(func() *sqlmock.Rows {
+						rows := sqlmock.NewRows([]string{"id", "status"})
+						if tc.active > 0 {
+							rows.AddRow(tc.ids[0], "active")
+						}
+						return rows
+					}())
+				}
+			}
+			if tc.valid {
+				mock.ExpectExec("DELETE FROM user_organizations").WithArgs(int64(7)).WillReturnResult(sqlmock.NewResult(0, 1))
+				if len(tc.ids) > 0 {
+					mock.ExpectExec("INSERT INTO user_organizations").WithArgs(int64(7), int64(2), true).WillReturnResult(sqlmock.NewResult(0, 1))
+				}
+				mock.ExpectExec("INSERT INTO organization_audit_logs").WithArgs(int64(99), nil, "organization_access_changed", sqlmock.AnyArg(), sqlmock.AnyArg()).WillReturnResult(sqlmock.NewResult(1, 1))
+			}
+			err := replaceUserOrganizationsTx(tx, 7, model.UserOrganizationInput{OrganizationIDs: &tc.ids, DefaultOrganizationID: json.RawMessage(tc.def), ActorUserID: 99}, false)
+			if tc.valid && err != nil {
+				t.Fatal(err)
+			}
+			if !tc.valid && !errors.Is(err, ErrInvalidOrganizations) {
+				t.Fatalf("want invalid organizations, got %v", err)
+			}
+			mock.ExpectRollback()
+			_ = tx.Rollback()
+			if err := mock.ExpectationsWereMet(); err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+
+func TestUserOrganizationOmittedPreservesAccess(t *testing.T) {
+	db, mock, _ := sqlmock.New()
+	defer db.Close()
+	mock.ExpectBegin()
+	tx, _ := db.Begin()
+	if err := replaceUserOrganizationsTx(tx, 7, model.UserOrganizationInput{ActorUserID: 99}, false); err != nil {
+		t.Fatal(err)
+	}
+	mock.ExpectRollback()
+	_ = tx.Rollback()
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestUserOrganizationDefaultChangeAuditsOriginalDefault(t *testing.T) {
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	mock.ExpectBegin()
+	tx, err := db.Begin()
+	if err != nil {
+		t.Fatal(err)
+	}
+	mock.ExpectQuery("SELECT organization_id, is_default FROM user_organizations").WithArgs(int64(7)).WillReturnRows(sqlmock.NewRows([]string{"organization_id", "is_default"}).AddRow(1, false).AddRow(2, true))
+	mock.ExpectQuery("SELECT EXISTS").WithArgs(int64(7)).WillReturnRows(sqlmock.NewRows([]string{"admin"}).AddRow(false))
+	mock.ExpectQuery("SELECT id, status FROM organizations").WithArgs(int64(1), int64(2)).WillReturnRows(sqlmock.NewRows([]string{"id", "status"}).AddRow(1, "active").AddRow(2, "active"))
+	mock.ExpectExec("DELETE FROM user_organizations").WithArgs(int64(7)).WillReturnResult(sqlmock.NewResult(0, 2))
+	mock.ExpectExec("INSERT INTO user_organizations").WithArgs(int64(7), int64(1), true).WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO user_organizations").WithArgs(int64(7), int64(2), false).WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO organization_audit_logs").WithArgs(int64(99), nil, "organization_access_changed", `{"user_id":7,"organization_ids":[1,2],"default_organization_id":2}`, `{"user_id":7,"organization_ids":[1,2],"default_organization_id":1}`).WillReturnResult(sqlmock.NewResult(1, 1))
+	if err := replaceUserOrganizationsTx(tx, 7, model.UserOrganizationInput{DefaultOrganizationID: json.RawMessage("1"), ActorUserID: 99}, false); err != nil {
+		t.Fatal(err)
+	}
+	mock.ExpectRollback()
+	_ = tx.Rollback()
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestUserOrganizationAuditFailureRollsBackUserAndRoles(t *testing.T) {
+	db, mock, _ := sqlmock.New()
+	defer db.Close()
+	database.DB = db
+	defer func() { database.DB = nil }()
+	mock.ExpectBegin()
+	mock.ExpectQuery("SELECT COUNT.*FROM roles").WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(1))
+	mock.ExpectQuery("SELECT id FROM roles WHERE code").WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(1))
+	mock.ExpectQuery("SELECT COUNT.*FROM user_roles WHERE user_id").WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(0))
+	mock.ExpectQuery("SELECT id FROM users WHERE id.*FOR UPDATE").WithArgs(int64(7)).WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(7))
+	mock.ExpectExec("UPDATE users").WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("DELETE FROM user_roles").WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO user_roles").WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectQuery("SELECT organization_id, is_default FROM user_organizations").WillReturnRows(sqlmock.NewRows([]string{"organization_id", "is_default"}).AddRow(2, true))
+	mock.ExpectQuery("SELECT EXISTS").WillReturnRows(sqlmock.NewRows([]string{"admin"}).AddRow(false))
+	mock.ExpectExec("DELETE FROM user_organizations").WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO organization_audit_logs").WillReturnError(errors.New("audit unavailable"))
+	mock.ExpectRollback()
+	ids := []int64{}
+	err := NewUserRepository().Update(&model.User{ID: 7}, []int64{2}, model.UserOrganizationInput{OrganizationIDs: &ids, DefaultOrganizationID: json.RawMessage("null"), ActorUserID: 99})
+	if err == nil || err.Error() != "audit unavailable" {
+		t.Fatalf("got %v", err)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/internal/repository/user_test.go b/internal/repository/user_test.go
index d568c273..19b3758d 100644
--- a/internal/repository/user_test.go
+++ b/internal/repository/user_test.go
@@ -35,6 +35,7 @@ func TestListUsersIncludesAllAssignedRoles(t *testing.T) {
 			AddRow(7, 2, "warehouse_admin", "仓库管理员", true, now, now).
 			AddRow(7, 3, "purchaser", "采购人员", true, now, now))
 
+	mock.ExpectQuery("SELECT user_id, organization_id, is_default FROM user_organizations").WithArgs(int64(7)).WillReturnRows(sqlmock.NewRows([]string{"user_id", "organization_id", "is_default"}).AddRow(7, 2, true).AddRow(7, 9, false))
 	users, total, err := NewUserRepository().List("", 20, 0)
 	if err != nil {
 		t.Fatalf("list users: %v", err)
@@ -45,6 +46,9 @@ func TestListUsersIncludesAllAssignedRoles(t *testing.T) {
 	if users[0].Roles[1].Name != "采购人员" {
 		t.Fatalf("role names not loaded: %+v", users[0].Roles)
 	}
+	if len(users[0].OrganizationIDs) != 2 || users[0].OrganizationIDs[1] != 9 || users[0].DefaultOrganizationID == nil || *users[0].DefaultOrganizationID != 2 {
+		t.Fatalf("organization grants not loaded: %+v", users[0])
+	}
 	if err := mock.ExpectationsWereMet(); err != nil {
 		t.Fatal(err)
 	}
@@ -137,6 +141,7 @@ func TestUpdateKeepsDisabledRoleAlreadyAssignedToUser(t *testing.T) {
 	mock.ExpectQuery(regexp.QuoteMeta(`SELECT COUNT(*) FROM user_roles WHERE user_id = ? AND role_id = ?`)).
 		WithArgs(int64(7), int64(1)).
 		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(0))
+	mock.ExpectQuery("SELECT id FROM users WHERE id.*FOR UPDATE").WithArgs(int64(7)).WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(7))
 	mock.ExpectExec(regexp.QuoteMeta(`UPDATE users SET description = ? WHERE id = ?`)).
 		WithArgs("改个描述", int64(7)).
 		WillReturnResult(sqlmock.NewResult(0, 1))
diff --git a/internal/service/auth.go b/internal/service/auth.go
index 0ba5ec65..ef2ffdb7 100644
--- a/internal/service/auth.go
+++ b/internal/service/auth.go
@@ -158,7 +158,7 @@ func (s *AuthService) ListUsers(search string, limit, offset int) ([]model.User,
 }
 
 // CreateUser creates a new user
-func (s *AuthService) CreateUser(username, password, description string, roleIDs []int64) (*model.User, error) {
+func (s *AuthService) CreateUser(username, password, description string, roleIDs []int64, organization ...model.UserOrganizationInput) (*model.User, error) {
 	// Hash password
 	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
 	if err != nil {
@@ -171,14 +171,20 @@ func (s *AuthService) CreateUser(username, password, description string, roleIDs
 		Description: description,
 	}
 
-	if err := s.userRepo.Create(user, roleIDs); err != nil {
+	// Service callers always validate company access. Repository calls without
+	// input are reserved for the legacy bootstrap users created before migration.
+	input := model.UserOrganizationInput{}
+	if len(organization) > 0 {
+		input = organization[0]
+	}
+	if err := s.userRepo.Create(user, roleIDs, input); err != nil {
 		return nil, err
 	}
 	return s.userRepo.GetByID(user.ID)
 }
 
 // UpdateUser updates a user (admin function)
-func (s *AuthService) UpdateUser(id int64, description string, roleIDs []int64, newPassword string) error {
+func (s *AuthService) UpdateUser(id int64, description string, roleIDs []int64, newPassword string, organization ...model.UserOrganizationInput) error {
 	user, err := s.userRepo.GetByID(id)
 	if err != nil {
 		return err
@@ -192,10 +198,10 @@ func (s *AuthService) UpdateUser(id int64, description string, roleIDs []int64,
 			return err
 		}
 		user.Password = string(hashedPassword)
-		return s.userRepo.UpdateWithPassword(user, roleIDs)
+		return s.userRepo.UpdateWithPassword(user, roleIDs, organization...)
 	}
 
-	return s.userRepo.Update(user, roleIDs)
+	return s.userRepo.Update(user, roleIDs, organization...)
 }
 
 // DeleteUser deletes a user
diff --git a/internal/service/auth_test.go b/internal/service/auth_test.go
index b5530194..670faf10 100644
--- a/internal/service/auth_test.go
+++ b/internal/service/auth_test.go
@@ -1,9 +1,13 @@
 package service
 
 import (
+	"errors"
 	"testing"
 
+	"github.com/DATA-DOG/go-sqlmock"
 	"github.com/wmms/wmms/internal/model"
+	"github.com/wmms/wmms/internal/repository"
+	"github.com/wmms/wmms/pkg/database"
 )
 
 func TestGeneratedTokenCarriesEveryUserRole(t *testing.T) {
@@ -29,3 +33,26 @@ func TestGeneratedTokenCarriesEveryUserRole(t *testing.T) {
 		t.Fatalf("unexpected token roles: %+v", token.Roles)
 	}
 }
+
+func TestUserCreateOrganizationOmittedRejectsOrdinaryUser(t *testing.T) {
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatal(err)
+	}
+	database.DB = db
+	t.Cleanup(func() { database.DB = nil; db.Close() })
+	mock.ExpectBegin()
+	mock.ExpectExec("INSERT INTO users").WithArgs("new", sqlmock.AnyArg(), "").WillReturnResult(sqlmock.NewResult(7, 1))
+	mock.ExpectQuery("SELECT COUNT.*FROM roles").WithArgs(int64(2), int64(7)).WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(1))
+	mock.ExpectExec("INSERT INTO user_roles").WithArgs(int64(7), int64(2)).WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectQuery("SELECT organization_id, is_default FROM user_organizations").WithArgs(int64(7)).WillReturnRows(sqlmock.NewRows([]string{"organization_id", "is_default"}))
+	mock.ExpectQuery("SELECT EXISTS").WithArgs(int64(7)).WillReturnRows(sqlmock.NewRows([]string{"admin"}).AddRow(false))
+	mock.ExpectRollback()
+	_, err = NewAuthService().CreateUser("new", "secret", "", []int64{2})
+	if !errors.Is(err, repository.ErrInvalidOrganizations) {
+		t.Fatalf("want invalid organizations, got %v", err)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Fatal(err)
+	}
+}