feat(userMgr): add user removal functionality

- Implement RemoveUser function in database.go to delete users
- Add RemoveUserHandler to handle HTTP requests for user removal
- Update API documentation with new /userMgr/remove endpoint
- Add route for user removal in router.go

database.go

@@ -4,6 +4,7 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
+	"strconv"
 	"strings"
 	"time"
 
@@ -84,6 +85,28 @@ func AddUser(username, passwd, userType string) (int, error) { // New user regis
 	return int(lastID), nil
 }
 
+func RemoveUser (userID int) error {
+	if !isValidInput(strconv.Itoa(userID)) {
+		return errors.New("invalid input: contains illegal characters")
+	}
+
+	result, err := db.Exec("DELETE FROM userLogin WHERE userID = ?", userID)
+	if err != nil {
+		return fmt.Errorf("failed to delete user: %w", err)
+	}
+
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to get rows affected: %w", err)
+	}
+
+	if rowsAffected == 0 {
+		return errors.New("user not found")
+	}
+
+	return nil
+}
+
 func GetUserByUsername(username string) (*User, error) {
 	if !isValidInput(username) {
 		return nil, errors.New("invalid input: contains illegal characters")

docs/api.md

@@ -173,7 +173,7 @@ X-Timestamp: 1704067200000
 ```json
 {
   "success": true,
-  "message": "user created successfully",
+  "message": "User created successfully",
   "data": {
     "userID": 2,
     "username": "new_user",
@@ -184,6 +184,37 @@ X-Timestamp: 1704067200000
 
 ---
 
+## Remove User
+
+**Endpoint**: `/userMgr/remove`  
+**Method**: POST  
+**Content-Type**: application/json  
+**Auth Required**: Yes (token)  
+**Permission Level**: Superuser
+
+**Request Headers**:
+```
+X-Token: your_token
+X-Timestamp: 1704067200000
+```
+
+**Request Body**:
+```json
+{
+  "targetUserID": 2
+}
+```
+
+**Response**:
+```json
+{
+  "success": true,
+  "message": "User removed successfully"
+}
+```
+
+---
+
 ## Create frpc Instance
 
 **Endpoint:** `/frpcAct/instanceMgr/create`  

router.go

@@ -13,6 +13,7 @@ func setupRoutes() {
 	http.HandleFunc("/logout", LogoutHandler)
 
 	http.HandleFunc("/userMgr/create", CreateUserHandler)
+	http.HandleFunc("/userMgr/remove", RemoveUserHandler)
 
 	http.HandleFunc("/frpcAct/instanceMgr/create", CreateInstanceHandler)
 	http.HandleFunc("/frpcAct/instanceMgr/list", ListInstancesHandler)

userAct.go

@@ -24,6 +24,10 @@ type CreateUserRequest struct {
 	Type     string `json:"type"`
 }
 
+type RemoveUserRequest struct {
+	TargetUserID int `json:"targetUserID"`
+}
+
 func RegisterHandler(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
@@ -271,3 +275,59 @@ func CreateUserHandler(w http.ResponseWriter, r *http.Request) {
 		"type":     user.Type,
 	})
 }
+
+func RemoveUserHandler(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+		postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Invalid request method: %s", r.Method))
+		return
+	}
+
+	if !ValidateTimeStamp(r.Header) {
+		SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
+		return
+	}
+	userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
+	if err != nil {
+		SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
+		postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Invalid or missing token: %v", err))
+		return
+	}
+	user, err := GetUserByID(userID)
+	if err != nil {
+		SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user info")
+		postLog.Error(fmt.Sprintf("[RemoveUserHandler] Failed to get user info for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
+		return
+	}
+	if user.Type != "superuser" {
+		SendErrorResponse(w, http.StatusForbidden, "Permission denied")
+		postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Permission denied: non-superuser token for user [%d]%s", userID, GetUsernameByID(userID)))
+		return
+	}
+	
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		SendErrorResponse(w, http.StatusBadRequest, "Failed to read request body")
+		postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Failed to read request body: %v", err))
+		return
+	}
+	defer r.Body.Close()
+
+	var req RemoveUserRequest
+	if err := json.Unmarshal(body, &req); err != nil {
+		SendErrorResponse(w, http.StatusBadRequest, "Invalid request format")
+		postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Invalid request format: %v", err))
+		return
+	}
+	if req.TargetUserID == 0 {
+		SendErrorResponse(w, http.StatusBadRequest, "TargetUserID is required")
+		postLog.Warning("[RemoveUserHandler] RemoveUser failed: TargetUserID is empty")
+		return
+	}
+	if err := RemoveUser(req.TargetUserID); err != nil {
+		SendErrorResponse(w, http.StatusInternalServerError, err.Error())
+		postLog.Error(fmt.Sprintf("[RemoveUserHandler] Failed to remove user [%d]: %v", req.TargetUserID, err))
+		return
+	}
+	SendSuccessResponse(w, "User removed successfully", nil)
+}