diff --git a/config/schema.sql b/config/schema.sql
index d30f323..5145d09 100644
--- a/config/schema.sql
+++ b/config/schema.sql
@@ -323,4 +323,9 @@ CREATE TABLE IF NOT EXISTS `ai_cache` (
   `created_at` timestamp DEFAULT CURRENT_TIMESTAMP,
   PRIMARY KEY (`key_hash`),
   KEY `expires_at` (`expires_at`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='AI 响应缓存';
\ No newline at end of file
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='AI 响应缓存';
+
+-- 迁移：order_items.order_id 从 int 改为 varchar(64)，与 orders.id (varchar(50)) 保持一致
+ALTER TABLE `order_items` DROP FOREIGN KEY IF EXISTS `order_items_ibfk_1`;
+ALTER TABLE `order_items` MODIFY COLUMN `order_id` varchar(64) NOT NULL COMMENT '订单ID';
+ALTER TABLE `order_items` ADD CONSTRAINT `order_items_ibfk_1` FOREIGN KEY (`order_id`) REFERENCES `orders` (`id`) ON DELETE CASCADE;
\ No newline at end of file
diff --git a/controllers/users.js b/controllers/users.js
index 124f1a2..b238a48 100644
--- a/controllers/users.js
+++ b/controllers/users.js
@@ -307,9 +307,9 @@ async function getUserInfo(ctx) {
   }
 }
 
-// 获取用户列表（管理员操作）
+// 获取用户列表（店员 / 管理员可操作）
 async function getUsers(ctx) {
-  const operator = await requireAdminAuth(ctx)
+  const operator = await requireStaffAuth(ctx)
   if (!operator) return
 
   let sql = 'SELECT id, phone, name, points, role, status, created_at FROM users WHERE status = 1'