# BD-2026-010 — Ops-E System

Status: Approved  
**ECR:** ECR-010  
**Date:** 2026-08-11  

## Backend Change Boundary

### In

- `admin_accounts.role` TEXT NOT NULL DEFAULT `super` CHECK (`super`,`ops`)  
- `users.status` CHECK (`active`,`banned`)（存量保持）  
- 表 `push_jobs`  
- AdminRepo：SetUserStatus · ListAdmins · UpdateAdminRole · PushJobs CRUD  
- admin.Service：RequireSuper · Ban/Unban · role on Me  
- DeviceAuth：banned → 40310 + revoke sessions  
- Handler 路由挂载；OpenAPI  

### Out

- 推送厂商 · Worker · 动态权限表 · Handler 直连 DB  

### Ownership

| Layer | Owner |
|-------|--------|
| Repository | AdminRepo |
| Service | admin.Service |
| Handler | AdminHandler |
| Middleware | DeviceAuth / AdminAuth |
| UI | admin-h5 UserDetail / Push / Admins |

## Architecture Evidence

仍：Handler → Service → Repository；无新外部依赖。

## Failure / Rollback

- down migration 删 role 列与 push_jobs；封禁用户需人工恢复 status  
- 错误码：40301 无权限 · 40310 用户已封禁  

## Test Strategy

- integration：ops 403 写接口；ban/unban + DeviceAuth；push CRUD  
- admin-h5 build