feat: Improve user list sorting

Author: fit2cloud-chenyw

backend/apps/system/api/user.py

@@ -58,17 +58,34 @@ async def pager(
     status: Optional[int] = Query(None, description=f"{PLACEHOLDER_PREFIX}status"),
     origins: Optional[list[int]] = Query(None, description=f"{PLACEHOLDER_PREFIX}origin"),
     oidlist: Optional[list[int]] = Query(None, description=f"{PLACEHOLDER_PREFIX}oid"),
+    order_by: Optional[str] = Query(None, description="排序字段"),
+    desc: Optional[bool] = Query(False, description="是否降序"),
 ):
     pagination = PaginationParams(page=pageNum, size=pageSize)
     paginator = Paginator(session)
-    filters = {}
-    
+
+    # 允许排序的字段白名单（防止 SQL 注入）
+    SORT_COLUMNS = {
+        'account': UserModel.account,
+        'create_time': UserModel.create_time,
+        'name': UserModel.name,
+        'email': UserModel.email,
+        'status': UserModel.status,
+    }
+    sort_field = SORT_COLUMNS.get(order_by, UserModel.account)
+    sort_clause = sort_field.desc() if desc else sort_field.asc()
+
+    # SELECT 列必须包含 ORDER BY 列（PostgreSQL DISTINCT 约束）
+    select_columns = [UserModel.id, UserModel.account]
+    if order_by and order_by != 'account':
+        select_columns.append(sort_field)
+
     origin_stmt = (
-        select(UserModel.id, UserModel.account)
+        select(*select_columns)
         .join(UserWsModel, UserModel.id == UserWsModel.uid, isouter=True)
         .where(UserModel.id != 1)
         .distinct()
-        .order_by(UserModel.account)
+        .order_by(sort_clause)
     )
 
     if oidlist:
@@ -89,16 +106,15 @@ async def pager(
 
     user_page = await paginator.get_paginated_response(
         stmt=origin_stmt,
-        pagination=pagination,
-        **filters)
+        pagination=pagination)
     uid_list = [item.get('id') for item in user_page.items]
     if not uid_list:
         return user_page
     stmt = (
         select(UserModel, UserWsModel.oid.label('ws_oid'))
         .join(UserWsModel, UserModel.id == UserWsModel.uid, isouter=True)
         .where(UserModel.id.in_(uid_list))
-        .order_by(UserModel.account, UserModel.create_time)
+        .order_by(sort_clause)
     )
     user_workspaces = session.exec(stmt).all()
     merged = defaultdict(list)

frontend/src/views/system/user/User.vue

@@ -96,6 +96,7 @@
         :data="state.tableData"
         style="width: 100%"
         @selection-change="handleSelectionChange"
+        @sort-change="handleSortChange"
       >
         <el-table-column type="selection" width="55" />
         <el-table-column prop="name" show-overflow-tooltip :label="$t('user.name')" width="280" />
@@ -651,6 +652,8 @@ const state = reactive<any>({
     currentPage: 1,
     pageSize: 20,
     total: 0,
+    sortColumn: '',
+    sortOrder: '',  // 'ascending' | 'descending' | ''
   },
 })
 
@@ -1004,6 +1007,11 @@ const configParams = () => {
     })
   })
 
+  if (state.pageInfo.sortColumn) {
+    str += str ? `&order_by=${state.pageInfo.sortColumn}` : `order_by=${state.pageInfo.sortColumn}`
+    str += `&desc=${state.pageInfo.sortOrder === 'descending'}`
+  }
+
   if (str.length) {
     str = `?${str}`
   }
@@ -1146,6 +1154,12 @@ const handleCurrentChange = (val: number) => {
   state.pageInfo.currentPage = val
   search()
 }
+const handleSortChange = ({ prop, order }: any) => {
+  state.pageInfo.sortColumn = order ? prop : ''
+  state.pageInfo.sortOrder = order || ''
+  state.pageInfo.currentPage = 1
+  search()
+}
 const formatSpaceName = (row_oid_list: Array<any>) => {
   if (!row_oid_list?.length) {
     return '-'