diff --git a/bms-back/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysUserController.java b/bms-back/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysUserController.java
index c4bf05e9..5dfbefed 100644
--- a/bms-back/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysUserController.java
+++ b/bms-back/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysUserController.java
@@ -1,6 +1,8 @@
 package com.ruoyi.web.controller.system;
 
+import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.stream.Collectors;
 import jakarta.servlet.http.HttpServletResponse;
 import org.apache.commons.lang3.ArrayUtils;
@@ -65,6 +67,27 @@ public class SysUserController extends BaseController
         return getDataTable(list);
     }
 
+    /**
+     * 获取用户下拉选项（业务员/客服/采购员等选择用）。
+     * 不加 @PreAuthorize：登录即可访问，只返回 id/账号/姓名/部门等展示字段，
+     * 避免给业务角色额外开放 system:user:list（含手机号/邮箱等完整信息）。
+     */
+    @GetMapping("/optionselect")
+    public AjaxResult optionselect()
+    {
+        List<Map<String, Object>> options = userService.selectUserOptions().stream().map(u -> {
+            Map<String, Object> m = new LinkedHashMap<>();
+            m.put("userId", u.getUserId());
+            m.put("userName", u.getUserName());
+            m.put("nickName", u.getNickName());
+            m.put("deptId", u.getDeptId());
+            m.put("deptName", u.getDept() == null ? null : u.getDept().getDeptName());
+            m.put("status", u.getStatus());
+            return m;
+        }).collect(Collectors.toList());
+        return AjaxResult.success(options);
+    }
+
     @Log(title = "用户管理", businessType = BusinessType.EXPORT)
     @PreAuthorize("@ss.hasPermi('system:user:export')")
     @PostMapping("/export")
diff --git a/bms-back/ruoyi-system/src/main/java/com/ruoyi/customer/customerinfo/service/impl/BmsCustomerServiceImpl.java b/bms-back/ruoyi-system/src/main/java/com/ruoyi/customer/customerinfo/service/impl/BmsCustomerServiceImpl.java
index 57525228..bfe15d17 100644
--- a/bms-back/ruoyi-system/src/main/java/com/ruoyi/customer/customerinfo/service/impl/BmsCustomerServiceImpl.java
+++ b/bms-back/ruoyi-system/src/main/java/com/ruoyi/customer/customerinfo/service/impl/BmsCustomerServiceImpl.java
@@ -2,6 +2,7 @@ package com.ruoyi.customer.customerinfo.service.impl;
 
 import java.util.List;
 
+import com.ruoyi.common.annotation.DataScope;
 import com.ruoyi.common.core.domain.entity.SysUser;
 import com.ruoyi.common.utils.DateUtils;
 import com.ruoyi.common.utils.SecurityUtils;
@@ -64,6 +65,7 @@ public class BmsCustomerServiceImpl implements IBmsCustomerService
      * @return 客户主
      */
     @Override
+    @DataScope(deptAlias = "su", deptField = "dept_id", userAlias = "c", userField = "sales_user_id")
     public List<BmsCustomer> selectBmsCustomerList(BmsCustomer bmsCustomer)
     {
         return bmsCustomerMapper.selectBmsCustomerList(bmsCustomer);
diff --git a/bms-back/ruoyi-system/src/main/java/com/ruoyi/customer/supplierinfo/service/impl/BmsSupplierServiceImpl.java b/bms-back/ruoyi-system/src/main/java/com/ruoyi/customer/supplierinfo/service/impl/BmsSupplierServiceImpl.java
index b5685e37..fe3dae45 100644
--- a/bms-back/ruoyi-system/src/main/java/com/ruoyi/customer/supplierinfo/service/impl/BmsSupplierServiceImpl.java
+++ b/bms-back/ruoyi-system/src/main/java/com/ruoyi/customer/supplierinfo/service/impl/BmsSupplierServiceImpl.java
@@ -2,6 +2,7 @@ package com.ruoyi.customer.supplierinfo.service.impl;
 
 import java.util.List;
 
+import com.ruoyi.common.annotation.DataScope;
 import com.ruoyi.common.core.domain.entity.SysUser;
 import com.ruoyi.common.utils.DateUtils;
 import com.ruoyi.common.utils.SecurityUtils;
@@ -47,6 +48,7 @@ public class BmsSupplierServiceImpl implements IBmsSupplierService
     }
 
     @Override
+    @DataScope(deptAlias = "su", deptField = "dept_id", userAlias = "s", userField = "purchaser_user_id")
     public List<BmsSupplier> selectBmsSupplierList(BmsSupplier bmsSupplier)
     {
         return bmsSupplierMapper.selectBmsSupplierList(bmsSupplier);
diff --git a/bms-back/ruoyi-system/src/main/java/com/ruoyi/system/mapper/SysUserMapper.java b/bms-back/ruoyi-system/src/main/java/com/ruoyi/system/mapper/SysUserMapper.java
index 543c59cb..98d9f7b2 100644
--- a/bms-back/ruoyi-system/src/main/java/com/ruoyi/system/mapper/SysUserMapper.java
+++ b/bms-back/ruoyi-system/src/main/java/com/ruoyi/system/mapper/SysUserMapper.java
@@ -20,6 +20,13 @@ public interface SysUserMapper
      */
     public List<SysUser> selectUserList(SysUser sysUser);
 
+    /**
+     * 查询全部未删除用户（下拉选项用，不带数据权限过滤）
+     *
+     * @return 用户信息集合
+     */
+    public List<SysUser> selectUserOptions();
+
     /**
      * 根据条件分页查询已配用户角色列表
      * 
diff --git a/bms-back/ruoyi-system/src/main/java/com/ruoyi/system/service/ISysUserService.java b/bms-back/ruoyi-system/src/main/java/com/ruoyi/system/service/ISysUserService.java
index 067245bd..75301e5c 100644
--- a/bms-back/ruoyi-system/src/main/java/com/ruoyi/system/service/ISysUserService.java
+++ b/bms-back/ruoyi-system/src/main/java/com/ruoyi/system/service/ISysUserService.java
@@ -19,6 +19,13 @@ public interface ISysUserService
      */
     public List<SysUser> selectUserList(SysUser user);
 
+    /**
+     * 查询全部未删除用户（下拉选项用，不带数据权限过滤）
+     *
+     * @return 用户信息集合
+     */
+    public List<SysUser> selectUserOptions();
+
     /**
      * 根据条件分页查询已分配用户角色列表
      * 
diff --git a/bms-back/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java b/bms-back/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java
index b0196b8f..dad79a14 100644
--- a/bms-back/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java
+++ b/bms-back/ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java
@@ -79,6 +79,15 @@ public class SysUserServiceImpl implements ISysUserService
         return userMapper.selectUserList(user);
     }
 
+    /**
+     * 下拉选项专用：故意不加 @DataScope，任何角色都能拿到完整用户名单用于人员选择/回显
+     */
+    @Override
+    public List<SysUser> selectUserOptions()
+    {
+        return userMapper.selectUserOptions();
+    }
+
     /**
      * 根据条件分页查询已分配用户角色列表
      * 
diff --git a/bms-back/ruoyi-system/src/main/resources/mapper/customer/BmsCustomerMapper.xml b/bms-back/ruoyi-system/src/main/resources/mapper/customer/BmsCustomerMapper.xml
index c4cf81b2..b116013b 100644
--- a/bms-back/ruoyi-system/src/main/resources/mapper/customer/BmsCustomerMapper.xml
+++ b/bms-back/ruoyi-system/src/main/resources/mapper/customer/BmsCustomerMapper.xml
@@ -54,6 +54,9 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
                c.product_ids, c.remark,
                c.create_by, c.create_time, c.update_by, c.update_time, c.del_flag
         from bms_customer c
+        <!-- 数据权限：销售（仅本人 c.sales_user_id）/销售经理（本部门 su.dept_id）；
+             历史迁移数据 sales_user_id 为非数字工号，+0 后不匹配任何 sys_user，仅管理员可见 -->
+        left join sys_user su on su.user_id = c.sales_user_id + 0
     </sql>
 
     <select id="selectBmsCustomerList" parameterType="BmsCustomer" resultMap="BmsCustomerResult">
@@ -80,6 +83,8 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="throwRatio != null "> and c.throw_ratio = #{throwRatio}</if>
             <if test="creditEd != null "> and c.credit_ed = #{creditEd}</if>
             <if test="productIds != null  and productIds != ''"> and c.product_ids = #{productIds}</if>
+            <!-- 数据权限过滤（@DataScope 生成：仅本人= c.sales_user_id=当前用户；本部门= su.dept_id=当前用户部门） -->
+            ${params.dataScope}
         </where>
         order by c.customer_id desc
     </select>
diff --git a/bms-back/ruoyi-system/src/main/resources/mapper/customer/BmsSupplierMapper.xml b/bms-back/ruoyi-system/src/main/resources/mapper/customer/BmsSupplierMapper.xml
index 2a4fd951..1995e6f7 100644
--- a/bms-back/ruoyi-system/src/main/resources/mapper/customer/BmsSupplierMapper.xml
+++ b/bms-back/ruoyi-system/src/main/resources/mapper/customer/BmsSupplierMapper.xml
@@ -39,31 +39,43 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
     </resultMap>
 
     <sql id="selectBmsSupplierVo">
-        select supplier_id, supplier_code, supplier_name, supplier_code_dw, credit_code, supplier_type, is_enable, purchaser_user_id, purchaser_user, settlement_user_id, settlement_user, service_user_id, service_user, ed, zq, settlement_type, temp_ed, account_balance, foreign_currency_balance, credit_ed, weight_threshold, throw_ratio, cooperation_start_date, cooperation_status, channel_ids, remark, create_by, create_time, update_by, update_time, del_flag from bms_supplier
+        select s.supplier_id, s.supplier_code, s.supplier_name, s.supplier_code_dw, s.credit_code, s.supplier_type,
+               s.is_enable, s.purchaser_user_id, s.purchaser_user, s.settlement_user_id, s.settlement_user,
+               s.service_user_id, s.service_user, s.ed, s.zq, s.settlement_type, s.temp_ed, s.account_balance,
+               s.foreign_currency_balance, s.credit_ed, s.weight_threshold, s.throw_ratio, s.cooperation_start_date,
+               s.cooperation_status, s.channel_ids, s.remark, s.create_by, s.create_time, s.update_by, s.update_time, s.del_flag
+        from bms_supplier s
+        <!-- 数据权限：采购/销售（仅本人 s.purchaser_user_id）/部门经理（本部门 su.dept_id）；
+             非数字历史工号 +0 后不匹配任何 sys_user，仅管理员可见 -->
+        left join sys_user su on su.user_id = s.purchaser_user_id + 0
     </sql>
 
     <select id="selectBmsSupplierList" parameterType="BmsSupplier" resultMap="BmsSupplierResult">
         <include refid="selectBmsSupplierVo"/>
         <where>
-            <if test="supplierCode != null and supplierCode != ''"> and supplier_code = #{supplierCode}</if>
-            <if test="supplierName != null and supplierName != ''"> and supplier_name like concat('%', #{supplierName}, '%')</if>
-            <if test="supplierCodeDw != null and supplierCodeDw != ''"> and supplier_code_dw = #{supplierCodeDw}</if>
-            <if test="creditCode != null and creditCode != ''"> and credit_code = #{creditCode}</if>
-            <if test="supplierType != null and supplierType != ''"> and supplier_type = #{supplierType}</if>
-            <if test="isEnable != null and isEnable != ''"> and is_enable = #{isEnable}</if>
-            <if test="purchaserUserId != null and purchaserUserId != ''"> and purchaser_user_id = #{purchaserUserId}</if>
-            <if test="purchaserUser != null and purchaserUser != ''"> and purchaser_user = #{purchaserUser}</if>
-            <if test="settlementUserId != null and settlementUserId != ''"> and settlement_user_id = #{settlementUserId}</if>
-            <if test="settlementUser != null and settlementUser != ''"> and settlement_user = #{settlementUser}</if>
-            <if test="serviceUserId != null and serviceUserId != ''"> and service_user_id = #{serviceUserId}</if>
-            <if test="serviceUser != null and serviceUser != ''"> and service_user = #{serviceUser}</if>
-            <if test="cooperationStatus != null and cooperationStatus != ''"> and cooperation_status = #{cooperationStatus}</if>
+            s.del_flag = '0'
+            <if test="supplierCode != null and supplierCode != ''"> and s.supplier_code = #{supplierCode}</if>
+            <if test="supplierName != null and supplierName != ''"> and s.supplier_name like concat('%', #{supplierName}, '%')</if>
+            <if test="supplierCodeDw != null and supplierCodeDw != ''"> and s.supplier_code_dw = #{supplierCodeDw}</if>
+            <if test="creditCode != null and creditCode != ''"> and s.credit_code = #{creditCode}</if>
+            <if test="supplierType != null and supplierType != ''"> and s.supplier_type = #{supplierType}</if>
+            <if test="isEnable != null and isEnable != ''"> and s.is_enable = #{isEnable}</if>
+            <if test="purchaserUserId != null and purchaserUserId != ''"> and s.purchaser_user_id = #{purchaserUserId}</if>
+            <if test="purchaserUser != null and purchaserUser != ''"> and s.purchaser_user = #{purchaserUser}</if>
+            <if test="settlementUserId != null and settlementUserId != ''"> and s.settlement_user_id = #{settlementUserId}</if>
+            <if test="settlementUser != null and settlementUser != ''"> and s.settlement_user = #{settlementUser}</if>
+            <if test="serviceUserId != null and serviceUserId != ''"> and s.service_user_id = #{serviceUserId}</if>
+            <if test="serviceUser != null and serviceUser != ''"> and s.service_user = #{serviceUser}</if>
+            <if test="cooperationStatus != null and cooperationStatus != ''"> and s.cooperation_status = #{cooperationStatus}</if>
+            <!-- 数据权限过滤（@DataScope 生成：仅本人= s.purchaser_user_id=当前用户；本部门= su.dept_id=当前用户部门） -->
+            ${params.dataScope}
         </where>
+        order by s.supplier_id desc
     </select>
 
     <select id="selectBmsSupplierBySupplierId" parameterType="Long" resultMap="BmsSupplierResult">
         <include refid="selectBmsSupplierVo"/>
-        where supplier_id = #{supplierId}
+        where s.supplier_id = #{supplierId} and s.del_flag = '0'
     </select>
 
     <insert id="insertBmsSupplier" parameterType="BmsSupplier" useGeneratedKeys="true" keyProperty="supplierId">
diff --git a/bms-back/ruoyi-system/src/main/resources/mapper/system/SysUserMapper.xml b/bms-back/ruoyi-system/src/main/resources/mapper/system/SysUserMapper.xml
index b12cc870..0ebf9763 100644
--- a/bms-back/ruoyi-system/src/main/resources/mapper/system/SysUserMapper.xml
+++ b/bms-back/ruoyi-system/src/main/resources/mapper/system/SysUserMapper.xml
@@ -85,6 +85,15 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
 		<!-- 数据范围过滤 -->
 		${params.dataScope}
 	</select>
+
+	<!-- 下拉选项专用：不带数据权限，仅返回展示所需字段 -->
+	<select id="selectUserOptions" resultMap="SysUserResult">
+		select u.user_id, u.dept_id, u.nick_name, u.user_name, u.status, d.dept_name
+		from sys_user u
+		left join sys_dept d on u.dept_id = d.dept_id
+		where u.del_flag = '0'
+		order by u.dept_id, u.user_id
+	</select>
 	
 	<select id="selectAllocatedList" parameterType="SysUser" resultMap="SysUserResult">
 	    select distinct u.user_id, u.dept_id, u.user_name, u.nick_name, u.email, u.phonenumber, u.status, u.create_time
diff --git a/bms-back/sql/customer+supplier/datascope_sales_roles.sql b/bms-back/sql/customer+supplier/datascope_sales_roles.sql
new file mode 100644
index 00000000..9fe97cf1
--- /dev/null
+++ b/bms-back/sql/customer+supplier/datascope_sales_roles.sql
@@ -0,0 +1,37 @@
+-- =============================================================
+-- 客户/供应商数据权限角色：
+--   销售(sales)       data_scope=5 仅本人：只看 sales_user_id/purchaser_user_id=自己 的数据
+--   销售经理(sales_mgr) data_scope=3 本部门：看所属部门人员的客户/供应商
+-- 超级管理员(admin) data_scope=1 全部数据，不受限。
+-- 菜单授权：客户/供应商管理目录 + 客户管理 + 供应商管理 + 客户余额管理 + 查询/新增/修改/导出按钮
+-- 幂等：角色已存在则只更新 data_scope，菜单授权重复执行无副作用
+-- 2026-09-21
+-- =============================================================
+SET NAMES utf8mb4;
+
+INSERT INTO `sys_role`
+  (`role_name`, `role_key`, `role_sort`, `data_scope`, `menu_check_strictly`, `dept_check_strictly`,
+   `status`, `del_flag`, `create_by`, `create_time`, `remark`)
+SELECT '销售', 'sales', 10, '5', 1, 1, '0', '0', 'admin', NOW(), '仅本人数据：只能看自己负责的客户/供应商'
+FROM DUAL
+WHERE NOT EXISTS (SELECT 1 FROM `sys_role` WHERE `role_key` = 'sales' AND `del_flag` = '0');
+
+INSERT INTO `sys_role`
+  (`role_name`, `role_key`, `role_sort`, `data_scope`, `menu_check_strictly`, `dept_check_strictly`,
+   `status`, `del_flag`, `create_by`, `create_time`, `remark`)
+SELECT '销售经理', 'sales_mgr', 11, '3', 1, 1, '0', '0', 'admin', NOW(), '本部门数据：可查看本部门销售负责的客户/供应商'
+FROM DUAL
+WHERE NOT EXISTS (SELECT 1 FROM `sys_role` WHERE `role_key` = 'sales_mgr' AND `del_flag` = '0');
+
+-- 角色数据范围以本文件为准（重复执行可纠偏）
+UPDATE `sys_role` SET `data_scope` = '5' WHERE `role_key` = 'sales'     AND `del_flag` = '0';
+UPDATE `sys_role` SET `data_scope` = '3' WHERE `role_key` = 'sales_mgr' AND `del_flag` = '0';
+
+-- 菜单授权（2309 目录 / 2313 客户管理 / 2314 供应商管理 / 2422 客户余额管理 / 2424~2433 操作按钮）
+INSERT INTO `sys_role_menu` (`role_id`, `menu_id`)
+SELECT r.role_id, m.menu_id
+FROM `sys_role` r
+JOIN `sys_menu` m ON m.menu_id IN (2309, 2313, 2314, 2422, 2424, 2425, 2426, 2428, 2429, 2430, 2431, 2433)
+WHERE r.`role_key` IN ('sales', 'sales_mgr')
+  AND r.`del_flag` = '0'
+  AND NOT EXISTS (SELECT 1 FROM `sys_role_menu` rm WHERE rm.role_id = r.role_id AND rm.menu_id = m.menu_id);
diff --git a/bms-front/src/api/system/user.js b/bms-front/src/api/system/user.js
index b5e3edd8..afc58b32 100644
--- a/bms-front/src/api/system/user.js
+++ b/bms-front/src/api/system/user.js
@@ -10,6 +10,14 @@ export function listUser(query) {
   })
 }
 
+// 查询用户下拉选项（登录即可访问，仅含 id/账号/姓名/部门等展示字段）
+export function optionUserList() {
+  return request({
+    url: '/system/user/optionselect',
+    method: 'get'
+  })
+}
+
 // 查询用户详细
 export function getUser(userId) {
   return request({
diff --git a/bms-front/src/components/UserSelect/index.vue b/bms-front/src/components/UserSelect/index.vue
index 02869e0a..e3ef17c7 100644
--- a/bms-front/src/components/UserSelect/index.vue
+++ b/bms-front/src/components/UserSelect/index.vue
@@ -8,17 +8,17 @@
     :loading="loading"
     :size="size"
     :multiple="false"
-    value-on-clear="null"
     style="width: 100%;"
     @change="handleChange"
   >
     <el-option
       v-for="item in options"
       :key="item.userId"
-      :label="item.nickName || item.userName"
+      :label="formatLabel(item)"
       :value="String(item.userId)"
+      :disabled="item.status === '1'"
     >
-      <span>{{ item.nickName || item.userName }}</span>
+      <span>{{ item.nickName || item.userName }}<template v-if="item.status === '1'">（停用）</template></span>
       <span
         v-if="showCode && item.userName"
         class="user-select-sub"
@@ -83,6 +83,12 @@ const options = computed(() => {
   return list
 })
 
+/** 选项文本：停用用户追加（停用）标记，便于编辑历史数据时识别 */
+function formatLabel(item) {
+  const name = item.nickName || item.userName
+  return item.status === '1' ? `${name}（停用）` : name
+}
+
 function handleChange(val) {
   const value = val === '' ? null : val
   emit('update:modelValue', value)
diff --git a/bms-front/src/components/UserSelect/useUsers.js b/bms-front/src/components/UserSelect/useUsers.js
index 48b45b69..8264a13d 100644
--- a/bms-front/src/components/UserSelect/useUsers.js
+++ b/bms-front/src/components/UserSelect/useUsers.js
@@ -1,20 +1,26 @@
 import { ref } from 'vue'
-import { listUser } from '@/api/system/user'
+import { optionUserList } from '@/api/system/user'
 
 /**
  * 用户列表模块级共享缓存：整个应用只拉取一次，UserSelect / UserName 共用
+ * 走 /system/user/optionselect（登录即可），不依赖 system:user:list 权限，
+ * 避免销售等业务角色页面出现403提示、下拉无数据。
  */
 const userList = ref([])
 let loadingPromise = null
 
 export function useUsers() {
-  /** 确保用户列表已加载（force=true 强制刷新） */
+  /** 确保用户列表已加载（force=true 强制刷新）；失败时返回空数组，避免未捕获的 Promise 异常 */
   function ensureUsers(force = false) {
     if (!force && loadingPromise) return loadingPromise
     if (!force && userList.value.length) return Promise.resolve(userList.value)
-    loadingPromise = listUser({ pageNum: 1, pageSize: 1000 })
+    loadingPromise = optionUserList()
       .then(res => {
-        userList.value = res.rows || []
+        userList.value = res.data || []
+        return userList.value
+      })
+      .catch(() => {
+        userList.value = []
         return userList.value
       })
       .finally(() => {