fix: stabilize rule config and cross-review backend

fastapi_modules/fastapi_leaudit/services/impl/authServiceImpl.py

@@ -27,6 +27,8 @@ class AuthServiceImpl(IAuthService):
         """账密登录。
 
         现阶段仍兼容旧库明文密码，后续应迁移到哈希校验。
+        登录标识同时兼容旧系统常见的 `sub` 与 `username`，
+        避免前端展示用户名为 `admin`、实际登录只能输入 `000`。
         """
         async with GetAsyncSession() as session:
             from sqlalchemy import text
@@ -36,14 +38,17 @@ class AuthServiceImpl(IAuthService):
                     "SELECT id, sub, username, nick_name, phone_number, email, "
                     "ou_id, ou_name, is_leader, password, status, deleted_at, "
                     "try_count, try_login_time, area, tenant_name, dep_name, dep_short_name "
-                    "FROM sso_users WHERE sub = :sub"
+                    "FROM sso_users "
+                    "WHERE deleted_at IS NULL AND (sub = :identifier OR username = :identifier) "
+                    "ORDER BY CASE WHEN sub = :identifier THEN 0 ELSE 1 END, id ASC "
+                    "LIMIT 1"
                 ),
-                {"sub": Sub},
+                {"identifier": Sub},
             )
             row = result.fetchone()
 
             if not row:
-                logger.warning("登录失败: 用户不存在 - sub=%s", Sub)
+                logger.warning("登录失败: 用户不存在 - identifier=%s", Sub)
                 raise LeauditException(StatusCodeEnum.HTTP_401_UNAUTHORIZED, "账号或密码错误")
 
             user = dict(row._mapping)