backend/main.py

@@ -1094,6 +1094,9 @@ def delete_user(user_id: int, user=Depends(require_role("admin"))):
 @app.put("/api/users/{user_id}")
 def update_user(user_id: int, body: UserUpdate, user=Depends(require_role("admin"))):
     conn = get_db()
+    target = conn.execute("SELECT role, display_name, username FROM users WHERE id = ?", (user_id,)).fetchone()
+    old_role = target["role"] if target else "unknown"
+    target_name = (target["display_name"] or target["username"]) if target else "unknown"
     if body.role is not None:
         if body.role == "admin":
             conn.close()
@@ -1101,8 +1104,15 @@ def update_user(user_id: int, body: UserUpdate, user=Depends(require_role("admin
         conn.execute("UPDATE users SET role = ?, role_changed_at = datetime('now') WHERE id = ?", (body.role, user_id))
     if body.display_name is not None:
         conn.execute("UPDATE users SET display_name = ? WHERE id = ?", (body.display_name, user_id))
-    log_audit(conn, user["id"], "update_user", "user", user_id, None,
-              json.dumps({"role": body.role, "display_name": body.display_name}))
+    role_labels = {"admin": "管理员", "senior_editor": "高级编辑", "editor": "编辑", "viewer": "查看者"}
+    detail = {}
+    if body.role is not None and body.role != old_role:
+        detail["from_role"] = role_labels.get(old_role, old_role)
+        detail["to_role"] = role_labels.get(body.role, body.role)
+    if body.display_name is not None:
+        detail["display_name"] = body.display_name
+    log_audit(conn, user["id"], "update_user", "user", user_id, target_name,
+              json.dumps(detail, ensure_ascii=False))
     conn.commit()
     conn.close()
     return {"ok": True}

frontend/src/__tests__/newFeatures.test.js

@@ -0,0 +1,87 @@
+import { describe, it, expect } from 'vitest'
+import { parseMultiRecipes } from '../composables/useSmartPaste'
+import { getPinyinInitials, matchesPinyinInitials } from '../composables/usePinyinMatch'
+
+const oilNames = ['薰衣草','茶树','柠檬','芳香调理','永久花','椒样薄荷','乳香','檀香','天竺葵','佛手柑','生姜']
+
+// ---------------------------------------------------------------------------
+// parseMultiRecipes
+// ---------------------------------------------------------------------------
+describe('parseMultiRecipes', () => {
+  it('parses single recipe with name', () => {
+    const results = parseMultiRecipes('舒缓放松，薰衣草3，茶树2', oilNames)
+    expect(results).toHaveLength(1)
+    expect(results[0].name).toBe('舒缓放松')
+    expect(results[0].ingredients).toHaveLength(2)
+  })
+
+  it('parses recipe with space-separated parts', () => {
+    const results = parseMultiRecipes('长高 芳香调理8 永久花10', oilNames)
+    expect(results).toHaveLength(1)
+    expect(results[0].name).toBe('长高')
+    expect(results[0].ingredients.length).toBeGreaterThanOrEqual(2)
+  })
+
+  it('parses recipe with concatenated name+oil', () => {
+    const results = parseMultiRecipes('长高芳香调理8永久花10', oilNames)
+    expect(results).toHaveLength(1)
+    expect(results[0].name).toBe('长高')
+  })
+
+  it('parses multiple recipes', () => {
+    const results = parseMultiRecipes('舒缓放松，薰衣草3，茶树2，提神醒脑，柠檬5', oilNames)
+    expect(results).toHaveLength(2)
+    expect(results[0].name).toBe('舒缓放松')
+    expect(results[1].name).toBe('提神醒脑')
+  })
+
+  it('handles recipe with no name', () => {
+    const results = parseMultiRecipes('薰衣草3，茶树2', oilNames)
+    expect(results).toHaveLength(1)
+    expect(results[0].ingredients).toHaveLength(2)
+  })
+})
+
+// ---------------------------------------------------------------------------
+// Pinyin matching
+// ---------------------------------------------------------------------------
+describe('getPinyinInitials', () => {
+  it('returns correct initials for common oils', () => {
+    expect(getPinyinInitials('薰衣草')).toBe('xyc')
+    expect(getPinyinInitials('茶树')).toBe('cs')
+    expect(getPinyinInitials('生姜')).toBe('sj')
+  })
+
+  it('handles 忍冬花', () => {
+    expect(getPinyinInitials('忍冬花呵护')).toBe('rdhhh')
+  })
+})
+
+describe('matchesPinyinInitials', () => {
+  it('matches prefix only', () => {
+    expect(matchesPinyinInitials('生姜', 's')).toBe(true)
+    expect(matchesPinyinInitials('生姜', 'sj')).toBe(true)
+    expect(matchesPinyinInitials('茶树', 's')).toBe(false) // cs doesn't start with s
+    expect(matchesPinyinInitials('茶树', 'cs')).toBe(true)
+  })
+
+  it('does not match substring', () => {
+    expect(matchesPinyinInitials('茶树', 's')).toBe(false)
+  })
+
+  it('matches 忍冬花 with r', () => {
+    expect(matchesPinyinInitials('忍冬花呵护', 'r')).toBe(true)
+    expect(matchesPinyinInitials('忍冬花呵护', 'rdh')).toBe(true)
+    expect(matchesPinyinInitials('忍冬花呵护', 'l')).toBe(false)
+  })
+})
+
+// ---------------------------------------------------------------------------
+// EDITOR_ONLY_TAGS
+// ---------------------------------------------------------------------------
+describe('EDITOR_ONLY_TAGS', () => {
+  it('exports EDITOR_ONLY_TAGS from recipes store', async () => {
+    const { EDITOR_ONLY_TAGS } = await import('../stores/recipes')
+    expect(EDITOR_ONLY_TAGS).toContain('已审核')
+  })
+})

frontend/src/components/RecipeCard.vue

@@ -20,11 +20,9 @@
 <script setup>
 import { computed } from 'vue'
 import { useOilsStore } from '../stores/oils'
-import { useRecipesStore } from '../stores/recipes'
+import { useRecipesStore, EDITOR_ONLY_TAGS } from '../stores/recipes'
 import { useAuthStore } from '../stores/auth'
 
-const EDITOR_ONLY_TAGS = ['已审核']
-
 const props = defineProps({
   recipe: { type: Object, required: true },
   index: { type: Number, required: true },

frontend/src/stores/recipes.js

@@ -2,6 +2,8 @@ import { defineStore } from 'pinia'
 import { ref } from 'vue'
 import { api } from '../composables/useApi'
 
+export const EDITOR_ONLY_TAGS = ['已审核']
+
 export const useRecipesStore = defineStore('recipes', () => {
   const recipes = ref([])
   const allTags = ref([])

frontend/src/views/AuditLog.vue

@@ -153,9 +153,10 @@ function parsedDetail(log) {
   try {
     const d = JSON.parse(log.detail)
     const parts = []
+    if (d.from_role && d.to_role) parts.push(`${d.from_role} → ${d.to_role}`)
     if (d.from_user) parts.push(`来自: ${d.from_user}`)
     if (d.reason) parts.push(`原因: ${d.reason}`)
-    if (d.role) parts.push(`角色: ${d.role}`)
+    if (d.business_name) parts.push(`商户: ${d.business_name}`)
     if (d.display_name) parts.push(`显示名: ${d.display_name}`)
     if (d.original_log_id) parts.push(`恢复自 #${d.original_log_id}`)
     if (parts.length) return parts.join(' · ')

frontend/src/views/RecipeManager.vue

@@ -49,7 +49,7 @@
     </div>
     <div v-if="showTagFilter" class="tag-list-bar">
       <span
-        v-for="tag in recipeStore.allTags"
+        v-for="tag in visibleAllTags"
         :key="tag"
         class="tag-chip"
         :class="{ active: selectedTags.includes(tag) }"
@@ -109,7 +109,7 @@
         <span v-if="!auth.isAdmin" class="contrib-tag">已贡献 {{ sharedCount.adopted }}/{{ sharedCount.total }} 条</span>
         <span class="toggle-icon">{{ showMyRecipes ? '▾' : '▸' }}</span>
       </h3>
-      <template v-if="showMyRecipes || manageSearch">
+      <template v-if="showMyRecipes || manageSearch || selectedTags.length">
       <div class="recipe-list">
         <div
           v-for="d in myFilteredRecipes"
@@ -126,7 +126,7 @@
           <div class="row-info" @click="editDiaryRecipe(d)">
             <span class="row-name">{{ d.name }}</span>
             <span class="row-tags">
-              <span v-for="t in (d.tags || [])" :key="t" class="mini-tag">{{ t }}</span>
+              <span v-for="t in (d.tags || []).filter(t => auth.canEdit || !EDITOR_ONLY_TAGS.includes(t))" :key="t" class="mini-tag">{{ t }}</span>
             </span>
             <span class="row-cost">{{ oils.fmtPrice(oils.calcCost(d.ingredients || [])) }}</span>
             <span v-if="getDiaryShareStatus(d) === 'shared'" class="share-tag shared">已共享</span>
@@ -149,7 +149,7 @@
         <span>🌿 公共配方库 ({{ publicRecipes.length }})</span>
         <span class="toggle-icon">{{ showPublicRecipes ? '▾' : '▸' }}</span>
       </h3>
-      <div v-if="showPublicRecipes || manageSearch" class="recipe-list">
+      <div v-if="showPublicRecipes || manageSearch || selectedTags.length" class="recipe-list">
         <div
           v-for="r in publicFilteredRecipes"
           :key="r._id"
@@ -165,7 +165,7 @@
           <div class="row-info" @click="editRecipe(r)">
             <span class="row-name">{{ r.name }}</span>
             <span class="row-tags">
-              <span v-for="t in r.tags" :key="t" class="mini-tag">{{ t }}</span>
+              <span v-for="t in (r.tags || []).filter(t => auth.canEdit || !EDITOR_ONLY_TAGS.includes(t))" :key="t" class="mini-tag">{{ t }}</span>
             </span>
             <span class="row-cost">{{ oils.fmtPrice(oils.calcCost(r.ingredients)) }}</span>
           </div>
@@ -397,7 +397,7 @@
 import { ref, computed, reactive, onMounted, watch } from 'vue'
 import { useAuthStore } from '../stores/auth'
 import { useOilsStore } from '../stores/oils'
-import { useRecipesStore } from '../stores/recipes'
+import { useRecipesStore, EDITOR_ONLY_TAGS } from '../stores/recipes'
 import { useDiaryStore } from '../stores/diary'
 import { useUiStore } from '../stores/ui'
 import { api } from '../composables/useApi'
@@ -601,15 +601,22 @@ async function applyBatchTags() {
   for (const id of pubIds) {
     const recipe = recipeStore.recipes.find(r => r._id === id)
     if (!recipe) continue
+    let newTags = [...recipe.tags]
     let changed = false
     for (const t of tagsToAdd) {
-      if (!recipe.tags.includes(t)) { recipe.tags.push(t); changed = true }
+      if (!newTags.includes(t)) { newTags.push(t); changed = true }
     }
     for (const t of tagsToRemove) {
-      const idx = recipe.tags.indexOf(t)
-      if (idx >= 0) { recipe.tags.splice(idx, 1); changed = true }
+      const idx = newTags.indexOf(t)
+      if (idx >= 0) { newTags.splice(idx, 1); changed = true }
+    }
+    if (changed) {
+      await api(`/api/recipes/${recipe._id}`, {
+        method: 'PUT',
+        body: JSON.stringify({ tags: newTags }),
+      })
+      recipe.tags = newTags
     }
-    if (changed) await recipeStore.saveRecipe(recipe)
   }
   for (const id of diaryIds) {
     const d = diaryStore.userDiary.find(r => r.id === id)
@@ -737,7 +744,7 @@ function calcDilutionFromIngs() {
 }
 
 function editRecipe(recipe) {
-  editingRecipe.value = recipe
+  editingRecipe.value = { _id: recipe._id, _version: recipe._version, name: recipe.name }
   formName.value = recipe.name
   const ings = recipe.ingredients || []
   formIngredients.value = ings.filter(i => i.oil !== '椰子油').map(i => ({ ...i, _search: i.oil, _open: false }))
@@ -1009,12 +1016,17 @@ async function saveCurrentRecipe() {
   }
 
   if (editingRecipe.value && editingRecipe.value._id) {
-    // Editing an existing public recipe
+    // Editing an existing public recipe — safety check
+    const mappedIngs = cleanIngs.map(i => ({ oil_name: i.oil, drops: i.drops }))
+    if (mappedIngs.length === 0) {
+      const ok = await showConfirm('配方中没有精油成分，确定保存吗？这将清空所有成分。')
+      if (!ok) return
+    }
     const payload = {
       _id: editingRecipe.value._id,
       _version: editingRecipe.value._version,
       name: formName.value.trim(),
-      ingredients: cleanIngs.map(i => ({ oil_name: i.oil, drops: i.drops })),
+      ingredients: mappedIngs,
       note: formNote.value,
       tags: formTags.value,
     }
@@ -1116,6 +1128,11 @@ async function loadContribution() {
 const previewRecipeIndex = ref(null)
 const previewRecipeData = ref(null)
 const showBatchMenu = ref(false)
+const visibleAllTags = computed(() => {
+  const tags = recipeStore.allTags
+  if (auth.canEdit) return tags
+  return tags.filter(t => !EDITOR_ONLY_TAGS.includes(t))
+})
 const showBatchTagPicker = ref(false)
 const batchTagsSelected = ref([])
 const batchNewTag = ref('')

frontend/src/views/RecipeSearch.vue

@@ -169,7 +169,7 @@ import { ref, computed, onMounted, nextTick, watch } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
 import { useAuthStore } from '../stores/auth'
 import { useOilsStore } from '../stores/oils'
-import { useRecipesStore } from '../stores/recipes'
+import { useRecipesStore, EDITOR_ONLY_TAGS } from '../stores/recipes'
 import { useDiaryStore } from '../stores/diary'
 import { useUiStore } from '../stores/ui'
 import { api } from '../composables/useApi'
@@ -315,7 +315,8 @@ const exactResults = computed(() => {
   const q = searchQuery.value.trim().toLowerCase()
   return recipeStore.recipes.filter(r => {
     const nameMatch = r.name.toLowerCase().includes(q)
-    const tagMatch = r.tags && r.tags.some(t => t.toLowerCase().includes(q))
+    const visibleTags = auth.canEdit ? (r.tags || []) : (r.tags || []).filter(t => !EDITOR_ONLY_TAGS.includes(t))
+    const tagMatch = visibleTags.some(t => t.toLowerCase().includes(q))
     return nameMatch || tagMatch
   }).sort((a, b) => a.name.localeCompare(b.name, 'zh'))
 })