feat: unify email identity and administrator security

apps/web/src/components/protected-layout.tsx

@@ -30,7 +30,7 @@ import {
 const adminSections: { key: string; label: string; icon: React.ReactNode; permissions: PermissionKey[] }[] = [
   { key: "overview", label: "数据总览", icon: <BarChart3 />, permissions: ["admin.overview.view"] },
   { key: "users", label: "账号管理", icon: <UserCog />, permissions: ["admin.users.view"] },
-  { key: "permissionGroups", label: "权限配额", icon: <ShieldCheck />, permissions: ["admin.permission_groups.view"] },
+  { key: "permissionGroups", label: "权限配置", icon: <ShieldCheck />, permissions: ["admin.permission_groups.view"] },
   { key: "domains", label: "域名管理", icon: <Globe2 />, permissions: ["admin.domains.view", "admin.dns.view"] },
   { key: "mailboxes", label: "邮箱管理", icon: <Mailbox />, permissions: ["admin.mailboxes.view"] },
   { key: "aliases", label: "邮件转发", icon: <Forward />, permissions: ["admin.aliases.view"] },
@@ -108,7 +108,7 @@ function ProtectedContent() {
                   </Avatar>
                   <div className="grid flex-1 text-left text-sm leading-tight">
                     <span className="truncate font-semibold">{user.displayName}</span>
-                    <span className="truncate text-xs text-muted-foreground">{user.loginName || user.email}</span>
+                    <span className="truncate text-xs text-muted-foreground">{user.email}</span>
                   </div>
                   <Badge variant={user.role === "admin" ? "default" : "secondary"} className="ml-auto text-[10px]">
                     {user.role === "admin" ? "管理员" : "普通用户"}

apps/web/src/index.css

@@ -24,6 +24,7 @@
     --input: 214.3 31.8% 91.4%;
     --ring: 216 22% 42%;
     --radius: 0.5rem;
+    --app-sidebar-width: 18rem;
     --sidebar-background: 0 0% 100%;
     --sidebar-foreground: 222.2 84% 4.9%;
     --sidebar-primary: 224 44% 12%;
@@ -85,7 +86,7 @@
 @layer components {
   .mail-shell-grid {
     display: grid;
-    grid-template-columns: clamp(236px, 17vw, 344px) minmax(0, 1fr);
+    grid-template-columns: var(--app-sidebar-width, 18rem) minmax(0, 1fr);
   }
 
   .mail-content-grid {

apps/web/src/lib/api-types.ts

@@ -240,3 +240,5 @@ export type PublicSettings = { openRegistration: boolean; turnstileEnabled: bool
 export type LoginPayload = { loginName?: string; email?: string; password?: string; turnstileToken?: string; challengeToken?: string; twoFactorCode?: string }
 export type LoginResponse = { user?: User; twoFactorRequired?: boolean; challengeToken?: string }
 export type RegisterPayload = { email: string; displayName: string; password: string; turnstileToken?: string; domainId?: string; localPart?: string }
+export type TwoFactorEnableResponse = { user: User; recoveryCodes: string[] }
+export type BulkMoveResult = { ok: boolean; moved: number; failed: number; message: string; items: { id: string; mailboxId?: string; ok: boolean; message: string }[] }

apps/web/src/lib/api.ts

@@ -1,4 +1,4 @@
-import type { User, AdminUser, AdminOverview, Domain, Mailbox, Alias, MailFolder, MailLabel, MailMessage, MailTranslation, DNSRecord, DNSCheckResult, ListResponse, SendPayload, DraftPayload, ScheduleSendPayload, ScheduledSend, SendQueueItem, SendQueueAuditEvent, SendQueueStatus, Contact, MailSignature, MailRule, MailRuleCondition, MailRuleAction, BlockedSender, MailStats, ForwardingSettings, ExternalImapAccount, ExternalImapAccountPayload, ExternalImapFolder, ExternalImapOAuthProvider, ExternalImapOAuthStartPayload, ExternalImapSyncRun, MailboxApplyOptions, MailTemplate, MaildirSyncHealth, SystemSettings, SystemSettingsPayload, SystemVersion, SystemUpdateResult, PublicSettings, LoginPayload, LoginResponse, RegisterPayload, PermissionGroup, PermissionInfo, PermissionKey, PermissionLimits, APIToken } from "./api-types"
+import type { User, AdminUser, AdminOverview, Domain, Mailbox, Alias, MailFolder, MailLabel, MailMessage, MailTranslation, DNSRecord, DNSCheckResult, ListResponse, SendPayload, DraftPayload, ScheduleSendPayload, ScheduledSend, SendQueueItem, SendQueueAuditEvent, SendQueueStatus, Contact, MailSignature, MailRule, MailRuleCondition, MailRuleAction, BlockedSender, MailStats, ForwardingSettings, ExternalImapAccount, ExternalImapAccountPayload, ExternalImapFolder, ExternalImapOAuthProvider, ExternalImapOAuthStartPayload, ExternalImapSyncRun, MailboxApplyOptions, MailTemplate, MaildirSyncHealth, SystemSettings, SystemSettingsPayload, SystemVersion, SystemUpdateResult, PublicSettings, LoginPayload, LoginResponse, RegisterPayload, PermissionGroup, PermissionInfo, PermissionKey, PermissionLimits, APIToken, TwoFactorEnableResponse, BulkMoveResult } from "./api-types"
 export * from "./api-types"
 
 const REQUEST_TIMEOUT_MS = 15_000
@@ -102,7 +102,7 @@ export const api = {
   updateApiToken: (id: string, payload: { name?: string; expiresAt?: string; disabled?: boolean; scopes?: string[] }) => request<APIToken>(`/api/me/api-tokens/${id}`, { method: "POST", body: JSON.stringify(payload) }),
   deleteApiToken: (id: string) => request<{ ok: boolean }>(`/api/me/api-tokens/${id}`, { method: "DELETE" }),
   setupTwoFactor: () => request<{ secret: string; otpauthUrl: string }>("/api/me/2fa/setup", { method: "POST" }),
-  enableTwoFactor: (code: string) => request<{ user: User }>("/api/me/2fa/enable", { method: "POST", body: JSON.stringify({ code }) }),
+  enableTwoFactor: (code: string) => request<TwoFactorEnableResponse>("/api/me/2fa/enable", { method: "POST", body: JSON.stringify({ code }) }),
   disableTwoFactor: (code: string) => request<{ user: User }>("/api/me/2fa/disable", { method: "POST", body: JSON.stringify({ code }) }),
   contacts: () => request<ListResponse<Contact>>("/api/me/contacts"),
   createContact: (payload: { name: string; email: string; note: string }) => request<Contact>("/api/me/contacts", { method: "POST", body: JSON.stringify(payload) }),
@@ -154,8 +154,8 @@ export const api = {
   updatePermissionGroup: (id: string, payload: { name: string; description: string; permissions: PermissionKey[]; limits: PermissionLimits }) => request<PermissionGroup>(`/api/admin/permission-groups/${id}`, { method: "POST", body: JSON.stringify(payload) }),
   defaultPermissionLimits: () => request<PermissionLimits>("/api/admin/permission-limits/defaults"),
   deletePermissionGroup: (id: string) => request<{ ok: boolean }>(`/api/admin/permission-groups/${id}`, { method: "DELETE" }),
-  createUser: (payload: { loginName: string; displayName: string; role: "admin" | "user"; password: string; disabled: boolean; mailboxLimitOverride?: number; permissionGroupIds?: string[] }) => request<AdminUser>("/api/admin/users", { method: "POST", body: JSON.stringify(payload) }),
-  updateUser: (id: string, payload: { loginName?: string; displayName: string; role: "admin" | "user"; disabled: boolean; mailboxLimitOverride?: number; permissionGroupIds?: string[] }) => request<AdminUser>(`/api/admin/users/${id}`, { method: "POST", body: JSON.stringify(payload) }),
+  createUser: (payload: { email: string; displayName: string; role: "user"; password: string; disabled: boolean; mailboxLimitOverride?: number }) => request<AdminUser>("/api/admin/users", { method: "POST", body: JSON.stringify(payload) }),
+  updateUser: (id: string, payload: { email?: string; displayName: string; role: "admin" | "user"; disabled: boolean; mailboxLimitOverride?: number; permissionGroupIds?: string[] }) => request<AdminUser>(`/api/admin/users/${id}`, { method: "POST", body: JSON.stringify(payload) }),
   resetUserPassword: (id: string, password: string) => request<{ ok: boolean }>(`/api/admin/users/${id}/password`, { method: "POST", body: JSON.stringify({ password }) }),
   deleteUser: (id: string) => request<{ ok: boolean }>(`/api/admin/users/${id}`, { method: "DELETE" }),
   domains: () => request<ListResponse<Domain>>("/api/admin/domains"),
@@ -163,7 +163,7 @@ export const api = {
   updateDomain: (id: string, payload: { status: string }) => request<Domain>(`/api/admin/domains/${id}`, { method: "POST", body: JSON.stringify(payload) }),
   deleteDomain: (id: string) => request<{ ok: boolean }>(`/api/admin/domains/${id}`, { method: "DELETE" }),
   mailboxes: () => request<ListResponse<Mailbox>>("/api/admin/mailboxes"),
-  createMailbox: (payload: { domainId: string; localPart: string; displayName: string; password: string; quotaMb: number; role: "admin" | "user"; ownerLoginName?: string; ownerEmail?: string; userId?: string }) => request<Mailbox>("/api/admin/mailboxes", { method: "POST", body: JSON.stringify(payload) }),
+  createMailbox: (payload: { domainId: string; localPart: string; displayName: string; password: string; quotaMb: number; role: "user"; ownerEmail?: string; userId?: string }) => request<Mailbox>("/api/admin/mailboxes", { method: "POST", body: JSON.stringify(payload) }),
   updateMailbox: (id: string, payload: { userId: string; displayName: string; quotaMb: number; status: string }) => request<Mailbox>(`/api/admin/mailboxes/${id}`, { method: "POST", body: JSON.stringify(payload) }),
   deleteMailbox: (id: string) => request<{ ok: boolean }>(`/api/admin/mailboxes/${id}`, { method: "DELETE" }),
   aliases: () => request<ListResponse<Alias>>("/api/admin/aliases"),
@@ -295,5 +295,6 @@ export const api = {
   addLabel: (id: string, payload: { name: string; color?: string }) => request<{ labels: MailLabel[] }>(`/api/mail/messages/${id}/labels`, { method: "POST", body: JSON.stringify(payload) }),
   removeLabel: (id: string, labelID: string) => request<{ labels: MailLabel[] }>(`/api/mail/messages/${id}/labels/${labelID}`, { method: "DELETE" }),
   move: (id: string, folder: string) => request<{ ok: boolean }>(`/api/mail/messages/${id}/move`, { method: "POST", body: JSON.stringify({ folder }) }),
+  bulkMove: (ids: string[], folder: string) => request<BulkMoveResult>("/api/mail/messages/bulk-move", { method: "POST", body: JSON.stringify({ ids, folder }) }),
   delete: (id: string) => request<{ ok: boolean }>(`/api/mail/messages/${id}`, { method: "DELETE" }),
 }

apps/web/src/pages/admin.tsx

@@ -33,7 +33,7 @@ type PendingConfirm = { title: string; description?: string; confirmText: string
 const sectionMeta: Record<Section, { label: string; frontLabel: string; description: string }> = {
   overview: { label: "数据总览", frontLabel: "数据统计", description: "系统运行、DNS、邮箱和消息状态集中查看。" },
   users: { label: "账号管理", frontLabel: "账号设置", description: "管理登录账号、身份状态、邮箱数量上限和绑定邮箱。" },
-  permissionGroups: { label: "权限配额", frontLabel: "账号配额", description: "配置前台菜单权限、发信频率、附件和邮箱创建额度。" },
+  permissionGroups: { label: "权限配置", frontLabel: "账号权限", description: "配置自定义权限、发信频率、附件和邮箱创建额度。" },
   domains: { label: "域名管理", frontLabel: "邮箱地址", description: "维护邮件域名、DKIM 和 DNS 检测。" },
   mailboxes: { label: "邮箱管理", frontLabel: "邮箱管理", description: "创建、分配、停用邮箱，保持与前台邮箱列表一致。" },
   aliases: { label: "邮件转发", frontLabel: "邮件转发", description: "管理域名转发规则。" },
@@ -58,7 +58,15 @@ const projectRepositoryUrl = "https://github.com/zxyszx/NewSzxcn-Email"
 const projectTelegramUrl = "https://t.me/+EhII7MSyi3QwNDQ5"
 const defaultPermissionLimits: PermissionLimits = { maxAttachmentMb: 25, maxMailboxCount: 9, smtpDailyLimit: 200, smtpMinuteLimit: 20, imapMinuteLimit: 200, pop3MinuteLimit: 150 }
 const defaultMailboxLimitOverride = 9
-const accountLoginName = (user: Pick<AdminUser, "email" | "loginName">) => user.loginName || user.email
+const accountPrimaryEmail = (user: Pick<AdminUser, "email" | "loginName">) => user.email || user.loginName || ""
+
+function compareAdminUsers(left: AdminUser, right: AdminUser) {
+  if (left.role === "admin" && right.role !== "admin") return -1
+  if (left.role !== "admin" && right.role === "admin") return 1
+  return accountPrimaryEmail(left).localeCompare(accountPrimaryEmail(right), "en", { sensitivity: "base" }) ||
+    left.displayName.localeCompare(right.displayName, "en", { sensitivity: "base" }) ||
+    left.createdAt.localeCompare(right.createdAt)
+}
 
 export function AdminPage() {
   const qc = useQueryClient()
@@ -245,14 +253,16 @@ function UsersSection({ users, permissionGroups }: { users: AdminUser[]; permiss
   const [pendingConfirm, setPendingConfirm] = React.useState<PendingConfirm | null>(null)
   const canCreate = hasPermission(user, "admin.users.create")
   const canDelete = hasPermission(user, "admin.users.delete")
-  const filteredUsers = users.filter((user) => {
-    const keyword = query.trim().toLowerCase()
-    const loginName = accountLoginName(user)
-    const matchesKeyword = !keyword || [loginName, user.email, user.displayName, ...(user.mailboxes || [])].some((value) => value.toLowerCase().includes(keyword))
-    const matchesRole = roleFilter === "all" || user.role === roleFilter
-    const matchesStatus = statusFilter === "all" || (statusFilter === "active" ? !user.disabled : user.disabled)
-    return matchesKeyword && matchesRole && matchesStatus
-  })
+  const filteredUsers = users
+    .filter((user) => {
+      const keyword = query.trim().toLowerCase()
+      const primaryEmail = accountPrimaryEmail(user)
+      const matchesKeyword = !keyword || [primaryEmail, user.email, user.displayName, ...(user.mailboxes || [])].some((value) => value.toLowerCase().includes(keyword))
+      const matchesRole = roleFilter === "all" || user.role === roleFilter
+      const matchesStatus = statusFilter === "all" || (statusFilter === "active" ? !user.disabled : user.disabled)
+      return matchesKeyword && matchesRole && matchesStatus
+    })
+    .sort(compareAdminUsers)
   const remove = useMutation({ mutationFn: api.deleteUser, onSuccess: () => { setPendingConfirm(null); invalidateAdmin(qc); toast({ title: "账号已删除" }) }, onError: (e) => toast({ title: "删除失败", description: e.message }) })
   return (
     <Card>
@@ -291,9 +301,9 @@ function UsersSection({ users, permissionGroups }: { users: AdminUser[]; permiss
               <div className="flex items-start justify-between gap-3">
                 <div className="min-w-0">
                   <div className="truncate font-medium">{user.displayName}</div>
-                  <div className="truncate text-xs text-muted-foreground">{accountLoginName(user)}</div>
+                  <div className="truncate text-xs text-muted-foreground">{accountPrimaryEmail(user)}</div>
                 </div>
-                <UserActions user={user} permissionGroups={permissionGroups} onDelete={canDelete ? () => setPendingConfirm({ title: "删除账号？", description: `将删除 ${accountLoginName(user)} 及其关联数据。`, confirmText: "删除账号", onConfirm: () => remove.mutate(user.id) }) : undefined} />
+                <UserActions user={user} permissionGroups={permissionGroups} onDelete={canDelete ? () => setPendingConfirm({ title: "删除账号？", description: `将删除 ${accountPrimaryEmail(user)} 及其关联数据。`, confirmText: "删除账号", onConfirm: () => remove.mutate(user.id) }) : undefined} />
               </div>
               <div className="mt-3 flex flex-wrap gap-2">
                 <RoleBadge user={user} />
@@ -307,20 +317,20 @@ function UsersSection({ users, permissionGroups }: { users: AdminUser[]; permiss
         </div>
         <div className="hidden md:block">
           <Table>
-            <TableHeader><TableRow><TableHead>账号</TableHead><TableHead>身份</TableHead><TableHead>权限配额</TableHead><TableHead className="w-[22rem]">邮箱</TableHead><TableHead>状态</TableHead><TableHead>创建</TableHead><TableHead className="w-16"></TableHead></TableRow></TableHeader>
+            <TableHeader><TableRow><TableHead>账号</TableHead><TableHead>身份</TableHead><TableHead>权限配置</TableHead><TableHead className="w-[22rem]">邮箱</TableHead><TableHead>状态</TableHead><TableHead>创建</TableHead><TableHead className="w-16"></TableHead></TableRow></TableHeader>
             <TableBody>
               {filteredUsers.map((user) => (
                 <TableRow key={user.id}>
                   <TableCell>
                     <div className="font-medium">{user.displayName}</div>
-                    <div className="text-xs text-muted-foreground">{accountLoginName(user)}</div>
+                    <div className="text-xs text-muted-foreground">{accountPrimaryEmail(user)}</div>
                   </TableCell>
                   <TableCell><RoleBadge user={user} /></TableCell>
                   <TableCell><UserPermissionGroupsCell user={user} /></TableCell>
                   <TableCell className="w-[22rem] max-w-[22rem]"><UserMailboxCell user={user} /></TableCell>
                   <TableCell><Badge variant={user.disabled ? "secondary" : "default"}>{user.disabled ? "停用" : "正常"}</Badge></TableCell>
                   <TableCell className="text-muted-foreground">{new Date(user.createdAt).toLocaleDateString()}</TableCell>
-                  <TableCell><UserActions user={user} permissionGroups={permissionGroups} onDelete={canDelete ? () => setPendingConfirm({ title: "删除账号？", description: `将删除 ${accountLoginName(user)} 及其关联数据。`, confirmText: "删除账号", onConfirm: () => remove.mutate(user.id) }) : undefined} /></TableCell>
+                  <TableCell><UserActions user={user} permissionGroups={permissionGroups} onDelete={canDelete ? () => setPendingConfirm({ title: "删除账号？", description: `将删除 ${accountPrimaryEmail(user)} 及其关联数据。`, confirmText: "删除账号", onConfirm: () => remove.mutate(user.id) }) : undefined} /></TableCell>
                 </TableRow>
               ))}
             </TableBody>
@@ -349,7 +359,7 @@ function PermissionGroupsSection({ groups, catalog }: { groups: PermissionGroup[
     onSuccess: () => {
       setPendingConfirm(null)
       invalidateAdmin(qc)
-      toast({ title: "权限配额已删除" })
+      toast({ title: "权限配置已删除" })
     },
     onError: (e) => toast({ title: "删除失败", description: e.message }),
   })
@@ -358,20 +368,20 @@ function PermissionGroupsSection({ groups, catalog }: { groups: PermissionGroup[
     if (!keyword) return true
     return [group.name, group.description, ...group.permissions].some((value) => value.toLowerCase().includes(keyword))
   })
-  const isEditable = (group: PermissionGroup) => group.id !== "pg_super_admin"
+  const isEditable = (group: PermissionGroup) => !group.system
   const isDeletable = (group: PermissionGroup) => !group.system && group.userCount === 0
   return (
     <Card>
       <CardHeader>
         <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
-          <CardTitle>权限配额</CardTitle>
+          <CardTitle>权限配置</CardTitle>
           {canCreate && <PermissionGroupDialog catalog={catalog} />}
         </div>
       </CardHeader>
       <CardContent className="space-y-4">
         <div className="relative">
           <Search className="absolute left-3 top-2.5 h-4 w-4 text-muted-foreground" />
-          <Input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="搜索权限配额、说明或权限键" className="pl-9" />
+          <Input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="搜索权限配置、说明或权限键" className="pl-9" />
         </div>
         <div className="grid gap-3 lg:grid-cols-2">
           {filtered.map((group) => (
@@ -389,14 +399,14 @@ function PermissionGroupsSection({ groups, catalog }: { groups: PermissionGroup[
                 {(canUpdate || canDelete) && <DropdownMenu>
                   <DropdownMenuTrigger asChild><Button variant="ghost" size="icon"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger>
                   <DropdownMenuContent align="end">
-                    <DropdownMenuItem disabled={!isEditable(group) || !canUpdate} onSelect={() => setEditing(group)}>编辑权限配额</DropdownMenuItem>
+                    <DropdownMenuItem disabled={!isEditable(group) || !canUpdate} onSelect={() => setEditing(group)}>编辑权限配置</DropdownMenuItem>
                     <DropdownMenuSeparator />
                     <DropdownMenuItem
                       className="text-destructive"
                       disabled={!isDeletable(group) || !canDelete}
-                      onSelect={() => setPendingConfirm({ title: "删除权限配额？", description: `${group.name} 删除后不能再分配给账号。`, confirmText: "删除权限配额", onConfirm: () => remove.mutate(group.id) })}
+                      onSelect={() => setPendingConfirm({ title: "删除权限配置？", description: `${group.name} 删除后不能再分配给账号。`, confirmText: "删除权限配置", onConfirm: () => remove.mutate(group.id) })}
                     >
-                      删除权限配额
+                      删除权限配置
                     </DropdownMenuItem>
                   </DropdownMenuContent>
                 </DropdownMenu>}
@@ -406,7 +416,7 @@ function PermissionGroupsSection({ groups, catalog }: { groups: PermissionGroup[
             </div>
           ))}
         </div>
-        {filtered.length === 0 && <Empty text="暂无匹配的权限配额" />}
+        {filtered.length === 0 && <Empty text="暂无匹配的权限配置" />}
       </CardContent>
       {editing && <PermissionGroupDialog group={editing} catalog={catalog} open={!!editing} onOpenChange={(open) => { if (!open) setEditing(null) }} />}
       <ConfirmDialog open={!!pendingConfirm} title={pendingConfirm?.title || ""} description={pendingConfirm?.description} confirmText={pendingConfirm?.confirmText || "删除"} destructive pending={remove.isPending} onOpenChange={(open) => { if (!open) setPendingConfirm(null) }} onConfirm={() => pendingConfirm?.onConfirm()} />
@@ -443,20 +453,20 @@ function PermissionGroupDialog({ group, catalog, open, onOpenChange }: { group?:
     onSuccess: () => {
       invalidateAdmin(qc)
       setDialogOpen(false)
-      toast({ title: group ? "权限配额已更新" : "权限配额已创建" })
+      toast({ title: group ? "权限配置已更新" : "权限配置已创建" })
     },
     onError: (e) => toast({ title: group ? "更新失败" : "创建失败", description: e.message }),
   })
   const trigger = group ? null : (
     <DialogTrigger asChild>
-      <Button size="sm"><Plus className="h-4 w-4" />权限配额</Button>
+      <Button size="sm"><Plus className="h-4 w-4" />权限配置</Button>
     </DialogTrigger>
   )
   return (
     <Dialog open={dialogOpen} onOpenChange={setDialogOpen}>
       {trigger}
       <DialogContent className="max-h-[86vh] overflow-y-auto sm:max-w-3xl">
-        <DialogHeader><DialogTitle>{group ? "编辑权限配额" : "创建权限配额"}</DialogTitle></DialogHeader>
+        <DialogHeader><DialogTitle>{group ? "编辑权限配置" : "创建权限配置"}</DialogTitle></DialogHeader>
         <form className="space-y-4" onSubmit={(event) => { event.preventDefault(); mutation.mutate(new FormData(event.currentTarget)) }}>
           <div className="grid gap-4 md:grid-cols-2">
             <Field name="name" label="名称" defaultValue={group?.name || ""} placeholder="例如：客服主管" />
@@ -1675,7 +1685,7 @@ function invalidateAdmin(qc: ReturnType<typeof useQueryClient>) { qc.invalidateQ
 
 function UserMailboxCell({ user }: { user: AdminUser }) {
   const { toast } = useToast()
-  const loginAddress = accountLoginName(user)
+  const loginAddress = accountPrimaryEmail(user)
   const mailboxes = user.mailboxes || []
   const [mailboxQuery, setMailboxQuery] = React.useState("")
   const normalizedQuery = mailboxQuery.trim().toLowerCase()
@@ -1776,7 +1786,7 @@ function PermissionGroupPicker({ groups, value, onChange }: { groups: Permission
   }
   return (
     <div className="space-y-2">
-      <Label>权限配额</Label>
+      <Label>自定义权限配置</Label>
       <div className="grid gap-2 md:grid-cols-2">
         {groups.map((group) => {
           const checked = value.includes(group.id)
@@ -1791,7 +1801,7 @@ function PermissionGroupPicker({ groups, value, onChange }: { groups: Permission
           )
         })}
       </div>
-      {groups.length === 0 && <Empty text="暂无可分配权限配额" />}
+      {groups.length === 0 && <Empty text="暂无可分配自定义权限配置" />}
     </div>
   )
 }
@@ -1815,13 +1825,14 @@ function UserActions({ user, permissionGroups, onDelete }: { user: AdminUser; pe
   const canUpdate = hasPermission(currentUser, "admin.users.update")
   const canResetPassword = hasPermission(currentUser, "admin.users.reset_password")
   const update = useMutation({
-    mutationFn: (payload: { displayName: string; role: "admin" | "user"; disabled: boolean; permissionGroupIds?: string[] }) => api.updateUser(user.id, payload),
+    mutationFn: (payload: { email: string; displayName: string; role: "admin" | "user"; disabled: boolean; permissionGroupIds?: string[] }) => api.updateUser(user.id, payload),
     onSuccess: () => { invalidateAdmin(qc); toast({ title: "账号已更新" }) },
     onError: (e) => toast({ title: "更新失败", description: e.message }),
   })
-  function quickPatch(patch: Partial<{ role: "admin" | "user"; disabled: boolean }>) {
-    const role = patch.role || user.role
+  function quickPatch(patch: Partial<{ disabled: boolean }>) {
+    const role = user.role
     update.mutate({
+      email: accountPrimaryEmail(user),
       displayName: user.displayName,
       role,
       disabled: patch.disabled ?? user.disabled,
@@ -1829,27 +1840,24 @@ function UserActions({ user, permissionGroups, onDelete }: { user: AdminUser; pe
     })
   }
   if (!canUpdate && !canResetPassword && !onDelete) return null
-  return <><DropdownMenu><DropdownMenuTrigger asChild><Button variant="ghost" size="icon"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger><DropdownMenuContent align="end">{canUpdate && <DropdownMenuItem onSelect={() => setEditOpen(true)}>编辑账号</DropdownMenuItem>}{canResetPassword && <DropdownMenuItem onSelect={() => setPasswordOpen(true)}>重置密码</DropdownMenuItem>}{!user.protected && canUpdate && <><DropdownMenuSeparator /><DropdownMenuItem onSelect={() => quickPatch({ disabled: !user.disabled })}>{user.disabled ? "启用账号" : "停用账号"}</DropdownMenuItem><DropdownMenuItem onSelect={() => quickPatch({ role: user.role === "admin" ? "user" : "admin" })}>{user.role === "admin" ? "设为普通用户" : "设为管理员"}</DropdownMenuItem></>}{!user.protected && onDelete && <><DropdownMenuSeparator /><DropdownMenuItem className="text-destructive" onSelect={onDelete}>删除账号</DropdownMenuItem></>}</DropdownMenuContent></DropdownMenu>{canUpdate && <EditUserDialog user={user} permissionGroups={permissionGroups} open={editOpen} onOpenChange={setEditOpen} />}{canResetPassword && <ResetPasswordDialog user={user} open={passwordOpen} onOpenChange={setPasswordOpen} />}</>
+  return <><DropdownMenu><DropdownMenuTrigger asChild><Button variant="ghost" size="icon"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger><DropdownMenuContent align="end">{canUpdate && <DropdownMenuItem onSelect={() => setEditOpen(true)}>编辑账号</DropdownMenuItem>}{canResetPassword && <DropdownMenuItem onSelect={() => setPasswordOpen(true)}>重置密码</DropdownMenuItem>}{!user.protected && user.role !== "admin" && canUpdate && <><DropdownMenuSeparator /><DropdownMenuItem onSelect={() => quickPatch({ disabled: !user.disabled })}>{user.disabled ? "启用账号" : "停用账号"}</DropdownMenuItem></>}{!user.protected && user.role !== "admin" && onDelete && <><DropdownMenuSeparator /><DropdownMenuItem className="text-destructive" onSelect={onDelete}>删除账号</DropdownMenuItem></>}</DropdownMenuContent></DropdownMenu>{canUpdate && <EditUserDialog user={user} permissionGroups={permissionGroups} open={editOpen} onOpenChange={setEditOpen} />}{canResetPassword && <ResetPasswordDialog user={user} open={passwordOpen} onOpenChange={setPasswordOpen} />}</>
 }
 
-function CreateUserDialog({ permissionGroups }: { permissionGroups: PermissionGroup[] }) {
+function CreateUserDialog(_props: { permissionGroups: PermissionGroup[] }) {
   const qc = useQueryClient()
   const { toast } = useToast()
   const [open, setOpen] = React.useState(false)
-  const [role, setRole] = React.useState<"admin" | "user">("user")
   const [status, setStatus] = React.useState("active")
-  const [permissionGroupIds, setPermissionGroupIds] = React.useState<string[]>([])
   const create = useMutation({
     mutationFn: (form: FormData) => api.createUser({
-      loginName: String(form.get("loginName") || ""),
+      email: String(form.get("email") || ""),
       displayName: String(form.get("displayName") || ""),
       password: String(form.get("password") || ""),
-      role,
+      role: "user",
       disabled: status === "disabled",
-      mailboxLimitOverride: role === "user" ? mailboxLimitFromForm(form) : undefined,
-      permissionGroupIds: role === "user" ? permissionGroupIds : [],
+      mailboxLimitOverride: mailboxLimitFromForm(form),
     }),
-    onSuccess: () => { invalidateAdmin(qc); setOpen(false); setPermissionGroupIds([]); toast({ title: "账号已创建" }) },
+    onSuccess: () => { invalidateAdmin(qc); setOpen(false); toast({ title: "账号已创建" }) },
     onError: (e) => toast({ title: "创建失败", description: e.message }),
   })
   return (
@@ -1858,15 +1866,14 @@ function CreateUserDialog({ permissionGroups }: { permissionGroups: PermissionGr
       <DialogContent>
         <DialogHeader><DialogTitle>创建账号</DialogTitle></DialogHeader>
         <form className="space-y-4" onSubmit={(event) => { event.preventDefault(); create.mutate(new FormData(event.currentTarget)) }}>
-          <Field name="loginName" label="登录名" type="text" autoComplete="off" placeholder="admin" />
+          <Field name="email" label="主登录邮箱" type="email" autoComplete="off" placeholder="user@example.com" />
           <Field name="displayName" label="显示名称" placeholder="账号名称" />
           <Field name="password" label="初始密码" type="password" minLength={6} />
           <div className="grid grid-cols-2 gap-3">
-            <SelectField label="身份" value={role} onValueChange={(value) => setRole(value as "admin" | "user")} items={[["user", "普通用户"], ["admin", "管理员"]]} />
+            <SelectField label="身份" value="user" onValueChange={() => undefined} items={[["user", "普通用户"]]} disabled />
             <SelectField label="状态" value={status} onValueChange={setStatus} items={[["active", "正常"], ["disabled", "停用"]]} />
           </div>
-          {role === "user" && <MailboxLimitField defaultValue={defaultMailboxLimitOverride} />}
-          {role === "user" && <PermissionGroupPicker groups={permissionGroups} value={permissionGroupIds} onChange={setPermissionGroupIds} />}
+          <MailboxLimitField defaultValue={defaultMailboxLimitOverride} />
           <DialogFooter><Button disabled={create.isPending}>{create.isPending ? "创建中..." : "创建"}</Button></DialogFooter>
         </form>
       </DialogContent>
@@ -1898,7 +1905,7 @@ function EditUserDialog({ user, permissionGroups, open, onOpenChange }: { user:
   }, [user, open])
   const mut = useMutation({
     mutationFn: (form: FormData) => api.updateUser(user.id, {
-      loginName: String(form.get("loginName") || ""),
+      email: String(form.get("email") || ""),
       displayName: String(form.get("displayName") || ""),
       role,
       disabled: disabled === "disabled",
@@ -1913,11 +1920,11 @@ function EditUserDialog({ user, permissionGroups, open, onOpenChange }: { user:
       <DialogContent>
         <DialogHeader><DialogTitle>编辑账号</DialogTitle></DialogHeader>
         <form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)) }}>
-          <Field name="loginName" label="登录名" defaultValue={accountLoginName(user)} type="text" autoComplete="off" />
+          <Field name="email" label="主登录邮箱" defaultValue={accountPrimaryEmail(user)} type="email" autoComplete="off" />
           <Field name="displayName" label="显示名称" defaultValue={user.displayName} />
           <div className="grid grid-cols-2 gap-3">
-            <SelectField label="身份" value={role} onValueChange={(value) => setRole(value as "admin" | "user")} items={[["user", "普通用户"], ["admin", "管理员"]]} disabled={user.protected} />
-            <SelectField label="状态" value={disabled} onValueChange={setDisabled} items={[["active", "正常"], ["disabled", "停用"]]} disabled={user.protected} />
+            <SelectField label="身份" value={role} onValueChange={(value) => setRole(value as "admin" | "user")} items={user.role === "admin" ? [["admin", "管理员"]] : [["user", "普通用户"]]} disabled />
+            <SelectField label="状态" value={disabled} onValueChange={setDisabled} items={[["active", "正常"], ["disabled", "停用"]]} disabled={user.protected || user.role === "admin"} />
           </div>
           {role === "user" && !user.protected && <MailboxLimitField defaultValue={effectiveMailboxLimit(user)} />}
           {role === "user" && !user.protected && <PermissionGroupPicker groups={permissionGroups} value={permissionGroupIds} onChange={setPermissionGroupIds} />}
@@ -1930,7 +1937,7 @@ function EditUserDialog({ user, permissionGroups, open, onOpenChange }: { user:
 
 function ResetPasswordDialog({ user, open, onOpenChange }: { user: AdminUser; open: boolean; onOpenChange: (open: boolean) => void }) {
   const { toast } = useToast(); const mut = useMutation({ mutationFn: (form: FormData) => api.resetUserPassword(user.id, String(form.get("password") || "")), onSuccess: () => { onOpenChange(false); toast({ title: "密码已重置" }) }, onError: (e) => toast({ title: "重置失败", description: e.message }) })
-  return <Dialog open={open} onOpenChange={onOpenChange}><DialogContent><DialogHeader><DialogTitle>重置密码</DialogTitle></DialogHeader><form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)); e.currentTarget.reset() }}><Field name="loginName" label="登录名" value={accountLoginName(user)} readOnly /><Field name="password" label="新密码" type="password" minLength={6} /><DialogFooter><Button disabled={mut.isPending}>{mut.isPending ? "重置中..." : "重置"}</Button></DialogFooter></form></DialogContent></Dialog>
+  return <Dialog open={open} onOpenChange={onOpenChange}><DialogContent><DialogHeader><DialogTitle>重置密码</DialogTitle></DialogHeader><form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)); e.currentTarget.reset() }}><Field name="email" label="主登录邮箱" value={accountPrimaryEmail(user)} readOnly /><Field name="password" label="新密码" type="password" minLength={6} /><DialogFooter><Button disabled={mut.isPending}>{mut.isPending ? "重置中..." : "重置"}</Button></DialogFooter></form></DialogContent></Dialog>
 }
 
 function EditMailboxDialog({ mailbox, users, open, onOpenChange }: { mailbox: MailboxType; users: AdminUser[]; open: boolean; onOpenChange: (open: boolean) => void }) {
@@ -1947,10 +1954,56 @@ function CreateDomainDialog() {
 }
 
 function CreateMailboxDialog({ domains, users }: { domains: Domain[]; users: AdminUser[] }) {
-  const qc = useQueryClient(); const { toast } = useToast(); const [open, setOpen] = React.useState(false); const [domainId, setDomainId] = React.useState(""); const [role, setRole] = React.useState("user"); const [ownerMode, setOwnerMode] = React.useState("new"); const [userId, setUserId] = React.useState("")
-  React.useEffect(() => { if (!domainId && domains[0]) setDomainId(domains[0].id); if (!userId && users[0]) setUserId(users[0].id) }, [domains, domainId, users, userId])
-  const mut = useMutation({ mutationFn: (form: FormData) => api.createMailbox({ domainId, localPart: String(form.get("localPart")), displayName: String(form.get("displayName")), password: String(form.get("password")), quotaMb: Number(form.get("quotaMb") || 1024), role: role as "admin" | "user", ownerLoginName: String(form.get("ownerLoginName") || ""), userId: ownerMode === "existing" ? userId : "" }), onSuccess: () => { invalidateAdmin(qc); setOpen(false); toast({ title: "邮箱已创建" }) }, onError: (e) => toast({ title: "创建失败", description: e.message }) })
-  return <Dialog open={open} onOpenChange={setOpen}><DialogTrigger asChild><Button><Plus className="h-4 w-4" />邮箱</Button></DialogTrigger><DialogContent><DialogHeader><DialogTitle>创建邮箱</DialogTitle></DialogHeader><form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)) }}><DomainSelect domains={domains} value={domainId} onChange={setDomainId} /><div className="grid grid-cols-2 gap-3"><Field name="localPart" label="邮箱前缀" placeholder="alice" /><Field name="displayName" label="显示名" placeholder="Alice" /></div><SelectField label="归属方式" value={ownerMode} onValueChange={setOwnerMode} items={[['new','新建/按登录名匹配账号'],['existing','追加到已有账号']]} />{ownerMode === "existing" ? <SelectField label="已有账号" value={userId} onValueChange={setUserId} items={users.filter((u) => !u.disabled).map((u) => [u.id, accountLoginName(u)])} /> : <Field name="ownerLoginName" label="归属登录名" placeholder="留空则使用新邮箱地址" required={false} />}<div className="grid grid-cols-2 gap-3"><Field name="password" label="密码" type="password" placeholder="至少 6 位" /><Field name="quotaMb" label="配额 MB" type="number" defaultValue="1024" /></div><SelectField label="身份" value={role} onValueChange={setRole} items={[['user','普通用户'],['admin','管理员']]} /><DialogFooter><Button disabled={mut.isPending || !domainId}>创建</Button></DialogFooter></form></DialogContent></Dialog>
+  const qc = useQueryClient()
+  const { toast } = useToast()
+  const [open, setOpen] = React.useState(false)
+  const [domainId, setDomainId] = React.useState("")
+  const [ownerMode, setOwnerMode] = React.useState("new")
+  const [userId, setUserId] = React.useState("")
+  React.useEffect(() => {
+    if (!domainId && domains[0]) setDomainId(domains[0].id)
+    if (!userId && users[0]) setUserId(users[0].id)
+  }, [domains, domainId, users, userId])
+  const mut = useMutation({
+    mutationFn: (form: FormData) => api.createMailbox({
+      domainId,
+      localPart: String(form.get("localPart")),
+      displayName: String(form.get("displayName")),
+      password: String(form.get("password")),
+      quotaMb: Number(form.get("quotaMb") || 1024),
+      role: "user",
+      ownerEmail: String(form.get("ownerEmail") || ""),
+      userId: ownerMode === "existing" ? userId : "",
+    }),
+    onSuccess: () => { invalidateAdmin(qc); setOpen(false); toast({ title: "邮箱已创建" }) },
+    onError: (e) => toast({ title: "创建失败", description: e.message }),
+  })
+  return (
+    <Dialog open={open} onOpenChange={setOpen}>
+      <DialogTrigger asChild><Button><Plus className="h-4 w-4" />邮箱</Button></DialogTrigger>
+      <DialogContent>
+        <DialogHeader><DialogTitle>创建邮箱</DialogTitle></DialogHeader>
+        <form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)) }}>
+          <DomainSelect domains={domains} value={domainId} onChange={setDomainId} />
+          <div className="grid grid-cols-2 gap-3">
+            <Field name="localPart" label="邮箱前缀" placeholder="alice" />
+            <Field name="displayName" label="显示名" placeholder="Alice" />
+          </div>
+          <SelectField label="归属方式" value={ownerMode} onValueChange={setOwnerMode} items={[["new", "新建/按主登录邮箱匹配账号"], ["existing", "追加到已有账号"]]} />
+          {ownerMode === "existing" ? (
+            <SelectField label="已有账号" value={userId} onValueChange={setUserId} items={users.filter((u) => !u.disabled).map((u) => [u.id, accountPrimaryEmail(u)])} />
+          ) : (
+            <Field name="ownerEmail" label="主登录邮箱" placeholder="留空则使用新邮箱地址" required={false} />
+          )}
+          <div className="grid grid-cols-2 gap-3">
+            <Field name="password" label="密码" type="password" placeholder="至少 6 位" />
+            <Field name="quotaMb" label="配额 MB" type="number" defaultValue="1024" />
+          </div>
+          <DialogFooter><Button disabled={mut.isPending || !domainId}>创建</Button></DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  )
 }
 
 function CreateAliasDialog({ domains }: { domains: Domain[] }) {

apps/web/src/pages/login.tsx

@@ -21,7 +21,7 @@ export function LoginPage() {
   const login = useMutation({
     mutationFn: (form: FormData) => challengeToken
       ? api.login({ challengeToken, twoFactorCode: String(form.get("twoFactorCode") || "") })
-      : api.login({ loginName: String(form.get("loginName") || ""), password: String(form.get("password") || ""), turnstileToken }),
+      : api.login({ email: String(form.get("email") || ""), password: String(form.get("password") || ""), turnstileToken }),
     onSuccess: async (data) => {
       if (data.twoFactorRequired && data.challengeToken) {
         setChallengeToken(data.challengeToken)
@@ -49,8 +49,8 @@ export function LoginPage() {
             {!challengeToken ? (
               <>
                 <div className="space-y-2">
-                  <Label htmlFor="loginName" className="text-sm font-medium">登录名</Label>
-                  <Input id="loginName" name="loginName" type="text" autoComplete="username" required className="h-11 text-base" />
+                  <Label htmlFor="email" className="text-sm font-medium">邮箱地址</Label>
+                  <Input id="email" name="email" type="email" autoComplete="username" required className="h-11 text-base" />
                 </div>
                 <div className="space-y-2">
                   <Label htmlFor="password" className="text-sm font-medium">密码</Label>
@@ -59,8 +59,8 @@ export function LoginPage() {
               </>
             ) : (
               <div className="space-y-2">
-                <Label htmlFor="twoFactorCode" className="text-sm font-medium">双因素验证码</Label>
-                <Input id="twoFactorCode" name="twoFactorCode" inputMode="numeric" autoComplete="one-time-code" minLength={6} maxLength={6} required className="h-11 text-center text-lg tracking-[0.35em]" />
+                <Label htmlFor="twoFactorCode" className="text-sm font-medium">双因素验证码或恢复码</Label>
+                <Input id="twoFactorCode" name="twoFactorCode" autoComplete="one-time-code" minLength={6} required className="h-11 text-center text-lg" />
               </div>
             )}
             {!challengeToken && turnstileRequired && (

apps/web/src/pages/mail.tsx

@@ -737,6 +737,8 @@ export function MailPage() {
   async function runConfirmedBulkAction(action: BulkAction, ids: string[]) {
     setBulkPending(true)
     try {
+      let completionTitle = `已处理 ${ids.length} 封邮件`
+      let completionDescription: string | undefined
       if (action === "read" || action === "unread") {
         const read = action === "read"
         await Promise.all(ids.map((id) => api.markRead(id, read)))
@@ -747,13 +749,15 @@ export function MailPage() {
         await Promise.all(ids.map((id) => api.delete(id)))
       } else {
         const target = action === "archive" ? "Archive" : action === "inbox" ? "Inbox" : action === "trash" ? "Trash" : "Spam"
-        await Promise.all(ids.map((id) => api.move(id, target)))
+        const result = await api.bulkMove(ids, target)
+        completionTitle = result.ok ? result.message : "批量移动部分失败"
+        completionDescription = result.ok ? undefined : result.message
       }
       if (selectedId && ids.includes(selectedId)) setSelectedId(null)
       setCompactSelectedIds([])
       setPendingConfirm(null)
       await refreshMailData()
-      toast({ title: `已处理 ${ids.length} 封邮件` })
+      toast({ title: completionTitle, description: completionDescription })
     } catch (error) {
       toast({ title: "批量操作失败", description: error instanceof Error ? error.message : "请稍后重试" })
     } finally {
@@ -766,11 +770,11 @@ export function MailPage() {
     if (ids.length === 0) return
     setBulkPending(true)
     try {
-      await Promise.all(ids.map((id) => api.move(id, folderName)))
+      const result = await api.bulkMove(ids, folderName)
       if (selectedId && ids.includes(selectedId)) setSelectedId(null)
       setCompactSelectedIds([])
       await refreshMailData()
-      toast({ title: folderName === "Inbox" ? `已将 ${ids.length} 封邮件移回收件箱` : `已移动 ${ids.length} 封邮件` })
+      toast({ title: result.ok ? (folderName === "Inbox" ? `已将 ${result.moved} 封邮件移回收件箱` : `已移动 ${result.moved} 封邮件`) : "批量移动部分失败", description: result.ok ? undefined : result.message })
     } catch (error) {
       toast({ title: "批量移动失败", description: error instanceof Error ? error.message : "请稍后重试" })
     } finally {
@@ -1219,7 +1223,7 @@ export function MailPage() {
           onLanguageChange={setLanguage}
           onSettings={openSettings}
         />
-        <div className={cn("mt-2 gap-1.5", sidebarCollapsed ? "flex justify-center" : showMailboxCopy ? "grid grid-cols-[minmax(0,1fr)_2rem]" : "grid grid-cols-1")}>
+        <div className={cn("mt-2 gap-1.5", sidebarCollapsed ? "flex justify-center" : "grid grid-cols-[minmax(0,1fr)_2rem]")}>
           <MailboxSwitcher
             collapsed={sidebarCollapsed}
             mailboxes={mailboxList.data?.items || []}
@@ -1229,12 +1233,12 @@ export function MailPage() {
             unreadCount={mailboxUnreadCount}
             onSelect={switchMailbox}
           />
-          {!sidebarCollapsed && showMailboxCopy && (
+          {!sidebarCollapsed && (
             <Button
               type="button"
               variant="outline"
               size="icon"
-              className="h-8 w-8 shrink-0 rounded-md bg-background shadow-none hover:bg-background"
+              className={cn("h-8 w-8 shrink-0 rounded-md bg-background shadow-none hover:bg-background", !showMailboxCopy && "pointer-events-none invisible")}
               onClick={copyCurrentMailbox}
               disabled={!selectedMailbox}
               aria-label="复制邮箱地址"
@@ -3287,7 +3291,7 @@ function MailboxSwitcher({ collapsed, mailboxes, loading, selectedMailboxId, sel
         align="start"
         className={cn(
           "max-w-[calc(100vw-32px)] p-1",
-          collapsed ? "w-[204px]" : "w-[var(--radix-dropdown-menu-trigger-width)] min-w-[var(--radix-dropdown-menu-trigger-width)]"
+          collapsed ? "w-[204px]" : "w-[21rem] min-w-[var(--radix-dropdown-menu-trigger-width)]"
         )}
       >
         {mailboxes.length > 0 && (

apps/web/src/pages/profile.tsx

@@ -67,6 +67,7 @@ export function ProfilePage() {
   const [ruleDialogOpen, setRuleDialogOpen] = React.useState(false)
   const [mobileSidebarOpen, setMobileSidebarOpen] = React.useState(false)
   const [externalRunAccountId, setExternalRunAccountId] = React.useState("")
+  const [twoFactorRecoveryCodes, setTwoFactorRecoveryCodes] = React.useState<string[]>([])
   const isMobile = useIsMobile()
   const themeMountedRef = React.useRef(false)
 
@@ -142,17 +143,17 @@ export function ProfilePage() {
   })
   const setupTwoFactor = useMutation({
     mutationFn: api.setupTwoFactor,
-    onSuccess: () => toast({ title: "双因素密钥已生成" }),
+    onSuccess: () => { setTwoFactorRecoveryCodes([]); toast({ title: "双因素密钥已生成" }) },
     onError: (error) => toast({ title: "生成失败", description: error.message }),
   })
   const enableTwoFactor = useMutation({
     mutationFn: (form: FormData) => api.enableTwoFactor(String(form.get("code") || "")),
-    onSuccess: (data) => { qc.setQueryData(["me"], data); setupTwoFactor.reset(); twoFactorFormRef.current?.reset(); toast({ title: "双因素认证已启用" }) },
+    onSuccess: (data) => { qc.setQueryData(["me"], { user: data.user }); setTwoFactorRecoveryCodes(data.recoveryCodes || []); setupTwoFactor.reset(); twoFactorFormRef.current?.reset(); toast({ title: "双因素认证已启用" }) },
     onError: (error) => toast({ title: "启用失败", description: error.message }),
   })
   const disableTwoFactor = useMutation({
     mutationFn: (form: FormData) => api.disableTwoFactor(String(form.get("code") || "")),
-    onSuccess: (data) => { qc.setQueryData(["me"], data); twoFactorFormRef.current?.reset(); toast({ title: "双因素认证已关闭" }) },
+    onSuccess: (data) => { qc.setQueryData(["me"], data); setTwoFactorRecoveryCodes([]); twoFactorFormRef.current?.reset(); toast({ title: "双因素认证已关闭" }) },
     onError: (error) => toast({ title: "关闭失败", description: error.message }),
   })
   const createApiToken = useMutation({
@@ -339,9 +340,9 @@ export function ProfilePage() {
   if (me.isError || !user) return <div className="grid h-svh place-items-center text-muted-foreground">登录状态已失效</div>
 
   const sidebarContent = (
-    <div className="flex h-full w-[256px] shrink-0 flex-col border-r border-border bg-card">
+    <div className="flex h-full w-[var(--app-sidebar-width)] shrink-0 flex-col border-r border-border bg-card">
       <div className="h-[64px] border-b">
-        <AccountHeader name={user.displayName || selectedMailbox?.address || "NewSzxcn"} email={user.loginName || user.email || selectedMailbox?.address} darkMode={darkMode} onToggleTheme={() => setDarkMode((v) => !v)} onBack={() => navigate("/")} />
+        <AccountHeader name={user.displayName || selectedMailbox?.address || "NewSzxcn"} email={user.email || selectedMailbox?.address} darkMode={darkMode} onToggleTheme={() => setDarkMode((v) => !v)} onBack={() => navigate("/")} />
       </div>
       <nav className="min-h-0 flex-1 overflow-y-auto p-2">
         <div className="px-2 pb-2 pt-2 text-xs font-semibold text-muted-foreground">管理</div>
@@ -445,6 +446,7 @@ export function ProfilePage() {
         setupTwoFactor={setupTwoFactor}
         enableTwoFactor={enableTwoFactor}
         disableTwoFactor={disableTwoFactor}
+        twoFactorRecoveryCodes={twoFactorRecoveryCodes}
         mailboxes={mailboxes.data?.items || []}
         selectedMailboxId={mailboxId}
         selectedMailbox={selectedMailbox}
@@ -582,6 +584,7 @@ type AccountSettingsSectionProps = {
   setupTwoFactor: { data?: { secret: string; otpauthUrl: string }; mutate: () => void; reset: () => void; isPending: boolean }
   enableTwoFactor: { mutate: (form: FormData) => void; isPending: boolean }
   disableTwoFactor: { mutate: (form: FormData) => void; isPending: boolean }
+  twoFactorRecoveryCodes: string[]
   onCopy: (text: string) => void
   mailboxes: Mailbox[]
   selectedMailboxId: string
@@ -637,6 +640,7 @@ function AccountSettingsSection(props: AccountSettingsSectionProps) {
         setupTwoFactor={props.setupTwoFactor}
         enableTwoFactor={props.enableTwoFactor}
         disableTwoFactor={props.disableTwoFactor}
+        recoveryCodes={props.twoFactorRecoveryCodes}
         onCopy={props.onCopy}
       />
     )
@@ -672,7 +676,7 @@ function SettingsCard({ title, subtitle, action, children, className, contentCla
 }
 
 function AccountTabSection({ user, stats, selectedMailbox, mailboxes, onOpenCleanup }: { user: AccountSettingsSectionProps["user"]; profile: AccountSettingsSectionProps["profile"]; stats?: MailStats; showStats: boolean; displayMode: DisplayMode; onDisplayModeChange: (mode: DisplayMode) => void; selectedMailbox?: Mailbox; mailboxes: Mailbox[]; onOpenCleanup: () => void }) {
-  const accountName = user.loginName || user.email
+  const accountName = user.email
   const quotaBytes = stats?.quotaBytes || (selectedMailbox?.quotaMb ? selectedMailbox.quotaMb * 1024 * 1024 : 0)
   const storageBytes = stats?.storageBytes || 0
   const quotaPct = quotaBytes > 0 ? Math.min(100, Math.round((storageBytes / quotaBytes) * 100)) : 0
@@ -680,7 +684,7 @@ function AccountTabSection({ user, stats, selectedMailbox, mailboxes, onOpenClea
     <div className="space-y-6">
       <SettingsCard title="账号信息">
         <div className="space-y-5">
-          <InfoLine label="用户名" value={accountName} />
+          <InfoLine label="主登录邮箱" value={accountName} />
           <div className="grid gap-2 sm:grid-cols-[10rem_minmax(0,1fr)] sm:items-center">
             <Label className="text-base font-normal text-muted-foreground">时区</Label>
             <Select defaultValue="Asia/Shanghai">
@@ -909,14 +913,14 @@ function EditSignatureForm({ item, mailboxes, pending, onCancel, onSubmit }: { i
   )
 }
 
-function SecuritySettingsSection({ user, password, passwordFormRef, twoFactorFormRef, setupTwoFactor, enableTwoFactor, disableTwoFactor, onCopy }: { user: AccountSettingsSectionProps["user"]; password: AccountSettingsSectionProps["password"]; passwordFormRef: React.RefObject<HTMLFormElement>; twoFactorFormRef: React.RefObject<HTMLFormElement>; setupTwoFactor: AccountSettingsSectionProps["setupTwoFactor"]; enableTwoFactor: AccountSettingsSectionProps["enableTwoFactor"]; disableTwoFactor: AccountSettingsSectionProps["disableTwoFactor"]; onCopy: (text: string) => void }) {
+function SecuritySettingsSection({ user, password, passwordFormRef, twoFactorFormRef, setupTwoFactor, enableTwoFactor, disableTwoFactor, recoveryCodes, onCopy }: { user: AccountSettingsSectionProps["user"]; password: AccountSettingsSectionProps["password"]; passwordFormRef: React.RefObject<HTMLFormElement>; twoFactorFormRef: React.RefObject<HTMLFormElement>; setupTwoFactor: AccountSettingsSectionProps["setupTwoFactor"]; enableTwoFactor: AccountSettingsSectionProps["enableTwoFactor"]; disableTwoFactor: AccountSettingsSectionProps["disableTwoFactor"]; recoveryCodes: string[]; onCopy: (text: string) => void }) {
   return (
     <div className="space-y-6">
       <SettingsCard title="当前登录" contentClassName="border-t py-5">
         <div className="flex items-center gap-4">
           <div className="flex size-10 items-center justify-center rounded-full bg-emerald-100 text-emerald-700"><ShieldCheck className="h-5 w-5" /></div>
           <div>
-            <div className="font-semibold">{user.loginName || user.email}</div>
+            <div className="font-semibold">{user.email}</div>
             <div className="text-sm text-muted-foreground">上次登录：刚刚</div>
           </div>
         </div>
@@ -968,12 +972,28 @@ function SecuritySettingsSection({ user, password, passwordFormRef, twoFactorFor
           </form>
         )}
         {user.twoFactorEnabled && (
-          <form ref={twoFactorFormRef} className="space-y-4" onSubmit={(e) => { e.preventDefault(); disableTwoFactor.mutate(new FormData(e.currentTarget)) }}>
-            <Field label="当前验证码"><Input name="code" inputMode="numeric" autoComplete="one-time-code" minLength={6} maxLength={6} required /></Field>
-            <div className="flex justify-end">
-              <Button variant="destructive" disabled={disableTwoFactor.isPending}>{disableTwoFactor.isPending ? "关闭中..." : "关闭两步验证"}</Button>
-            </div>
-          </form>
+          <div className="space-y-4">
+            {recoveryCodes.length > 0 && (
+              <div className="rounded-lg border bg-muted/30 p-4">
+                <div className="mb-3 flex items-center justify-between gap-3">
+                  <div>
+                    <div className="text-sm font-semibold">恢复码</div>
+                    <div className="text-xs text-muted-foreground">每个恢复码只能使用一次。</div>
+                  </div>
+                  <Button type="button" variant="outline" size="sm" onClick={() => onCopy(recoveryCodes.join("\n"))}><Copy className="h-4 w-4" />复制</Button>
+                </div>
+                <div className="grid gap-2 sm:grid-cols-2">
+                  {recoveryCodes.map((code) => <code key={code} className="rounded-md bg-background px-3 py-2 text-sm font-semibold">{code}</code>)}
+                </div>
+              </div>
+            )}
+            <form ref={twoFactorFormRef} className="space-y-4" onSubmit={(e) => { e.preventDefault(); disableTwoFactor.mutate(new FormData(e.currentTarget)) }}>
+              <Field label="当前验证码或恢复码"><Input name="code" autoComplete="one-time-code" minLength={6} required /></Field>
+              <div className="flex justify-end">
+                <Button variant="destructive" disabled={disableTwoFactor.isPending}>{disableTwoFactor.isPending ? "关闭中..." : "关闭两步验证"}</Button>
+              </div>
+            </form>
+          </div>
         )}
       </SettingsCard>
 

apps/web/src/pages/register.tsx

@@ -24,32 +24,28 @@ export function RegisterPage() {
   const [domainId, setDomainId] = React.useState("")
   const domains: PublicDomain[] = publicSettings.data?.mailboxDomains || []
   const selectedDomain = domains.find((d) => d.id === domainId)
+  React.useEffect(() => {
+    if (!domainId && domains[0]) setDomainId(domains[0].id)
+    if (domainId && !domains.some((domain) => domain.id === domainId)) setDomainId(domains[0]?.id || "")
+  }, [domainId, domains])
 
   const register = useMutation({
     mutationFn: (form: FormData) => {
       const password = String(form.get("password") || "")
       const confirmPassword = String(form.get("confirmPassword") || "")
       validatePasswordConfirm(password, confirmPassword)
-
-      if (domainId && selectedDomain) {
-        const localPart = String(form.get("localPart") || "").trim()
-        if (!localPart) throw new Error("请输入邮箱前缀")
-        return api.register({
-          email: `${localPart}@${selectedDomain.name}`,
-          displayName: String(form.get("displayName") || ""),
-          password,
-          turnstileToken,
-          domainId,
-          localPart,
-        })
-      }
-
-      // Fallback: no domains available, use email directly
+      const displayName = String(form.get("displayName") || "").trim()
+      if (!displayName) throw new Error("请输入显示名称")
+      const localPart = String(form.get("localPart") || "").trim()
+      if (!localPart) throw new Error("请输入邮箱前缀")
+      if (!domainId || !selectedDomain) throw new Error("请选择邮箱域名")
       return api.register({
-        email: String(form.get("email") || ""),
-        displayName: String(form.get("displayName") || ""),
+        email: `${localPart}@${selectedDomain.name}`,
+        displayName,
         password,
         turnstileToken,
+        domainId,
+        localPart,
       })
     },
     onSuccess: async () => {
@@ -102,14 +98,12 @@ export function RegisterPage() {
                   </div>
                 </div>
               ) : (
-                <div className="space-y-2">
-                  <Label htmlFor="email" className="text-sm font-medium">邮箱</Label>
-                  <Input id="email" name="email" type="email" autoComplete="username" required className="h-11 text-base" />
-                </div>
+                <div className="rounded-md bg-muted/40 px-4 py-3 text-center text-sm text-muted-foreground">当前没有可注册的邮箱域名</div>
               )}
               <div className="space-y-2">
                 <Label htmlFor="displayName" className="text-sm font-medium">显示名称</Label>
-                <Input id="displayName" name="displayName" autoComplete="name" className="h-11 text-base" />
+                <Input id="displayName" name="displayName" autoComplete="name" required className="h-11 text-base" />
+                <p className="text-xs leading-5 text-muted-foreground">显示名称注册后不可自行修改，如需更换请联系管理员。</p>
               </div>
               <div className="space-y-2">
                 <Label htmlFor="password" className="text-sm font-medium">密码</Label>
@@ -120,7 +114,7 @@ export function RegisterPage() {
                 <PasswordInput id="confirmPassword" name="confirmPassword" autoComplete="new-password" minLength={6} required className="h-11 text-base" />
               </div>
               {turnstileRequired && <TurnstileBox siteKey={publicSettings.data?.turnstileSiteKey || ""} onToken={setTurnstileToken} />}
-              <Button className="h-11 w-full text-base" disabled={register.isPending || publicSettings.isLoading}>
+              <Button className="h-11 w-full text-base" disabled={register.isPending || publicSettings.isLoading || domains.length === 0}>
                 {register.isPending ? "注册中..." : "注册"}
                 {!register.isPending && <ArrowRight className="h-4 w-4" />}
               </Button>