修改后台权限

backend/src/test/java/com/yoyuzh/admin/AdminControllerIntegrationTest.java

@@ -106,7 +106,9 @@ class AdminControllerIntegrationTest {
                 .andExpect(jsonPath("$.data.items[0].username").value("alice"))
                 .andExpect(jsonPath("$.data.items[0].phoneNumber").value("13800138000"))
                 .andExpect(jsonPath("$.data.items[0].role").value("USER"))
-                .andExpect(jsonPath("$.data.items[0].banned").value(false));
+                .andExpect(jsonPath("$.data.items[0].banned").value(false))
+                .andExpect(jsonPath("$.data.items[0].storageQuotaBytes").isNumber())
+                .andExpect(jsonPath("$.data.items[0].maxUploadSizeBytes").isNumber());
 
         mockMvc.perform(get("/api/admin/summary"))
                 .andExpect(status().isOk())
@@ -153,6 +155,24 @@ class AdminControllerIntegrationTest {
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.data.id").value(portalUser.getId()));
 
+        mockMvc.perform(patch("/api/admin/users/{userId}/storage-quota", portalUser.getId())
+                        .contentType("application/json")
+                        .content("""
+                                {"storageQuotaBytes":1073741824}
+                                """))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.data.id").value(portalUser.getId()))
+                .andExpect(jsonPath("$.data.storageQuotaBytes").value(1073741824L));
+
+        mockMvc.perform(patch("/api/admin/users/{userId}/max-upload-size", portalUser.getId())
+                        .contentType("application/json")
+                        .content("""
+                                {"maxUploadSizeBytes":10485760}
+                                """))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.data.id").value(portalUser.getId()))
+                .andExpect(jsonPath("$.data.maxUploadSizeBytes").value(10485760L));
+
         mockMvc.perform(post("/api/admin/users/{userId}/password/reset", secondaryUser.getId()))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.data.temporaryPassword").isNotEmpty());

backend/src/test/java/com/yoyuzh/files/FileServiceEdgeCaseTest.java

@@ -179,6 +179,29 @@ class FileServiceEdgeCaseTest {
                 .hasMessageContaining("文件大小超出限制");
     }
 
+    @Test
+    void shouldRejectUploadExceedingUserMaxUploadSizeLimit() {
+        User user = createUser(1L);
+        user.setMaxUploadSizeBytes(1024L);
+
+        assertThatThrownBy(() -> fileService.initiateUpload(user,
+                new InitiateUploadRequest("/docs", "large.bin", "application/octet-stream", 1025L)))
+                .isInstanceOf(BusinessException.class)
+                .hasMessageContaining("文件大小超出限制");
+    }
+
+    @Test
+    void shouldRejectUploadWhenUserStorageQuotaInsufficient() {
+        User user = createUser(1L);
+        user.setStorageQuotaBytes(1024L);
+        when(storedFileRepository.sumFileSizeByUserId(1L)).thenReturn(900L);
+
+        assertThatThrownBy(() -> fileService.initiateUpload(user,
+                new InitiateUploadRequest("/docs", "quota.bin", "application/octet-stream", 200L)))
+                .isInstanceOf(BusinessException.class)
+                .hasMessageContaining("存储空间不足");
+    }
+
     // --- rename no-op when name unchanged ---
 
     @Test