diff --git a/internal/handler/user.go b/internal/handler/user.go
new file mode 100644
index 0000000..23e5f2e
--- /dev/null
+++ b/internal/handler/user.go
@@ -0,0 +1,149 @@
+package handler
+
+import (
+	"strconv"
+
+	"gotest/internal/middleware"
+	"gotest/internal/service"
+
+	"github.com/gin-gonic/gin"
+)
+
+// UserHandler 用户处理器
+type UserHandler struct {
+	userService *service.UserService
+}
+
+// NewUserHandler 创建用户处理器
+func NewUserHandler(userService *service.UserService) *UserHandler {
+	return &UserHandler{userService: userService}
+}
+
+// GetProfile 获取当前用户资料 GET /api/v1/user/profile
+func (h *UserHandler) GetProfile(c *gin.Context) {
+	userID := middleware.GetUserID(c)
+	user, err := h.userService.GetProfile(userID)
+	if err != nil {
+		FailInternal(c, "获取用户信息失败")
+		return
+	}
+	Success(c, user)
+}
+
+// UpdateProfile 更新当前用户资料 PUT /api/v1/user/profile
+func (h *UserHandler) UpdateProfile(c *gin.Context) {
+	userID := middleware.GetUserID(c)
+	var req struct {
+		Avatar string `json:"avatar"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		FailBadRequest(c, "参数错误")
+		return
+	}
+	if err := h.userService.UpdateProfile(userID, req.Avatar); err != nil {
+		FailInternal(c, "更新失败")
+		return
+	}
+	SuccessMsg(c, "更新成功")
+}
+
+// ChangePassword 修改密码 PUT /api/v1/user/password
+func (h *UserHandler) ChangePassword(c *gin.Context) {
+	userID := middleware.GetUserID(c)
+	var req struct {
+		OldPassword string `json:"old_password" binding:"required"`
+		NewPassword string `json:"new_password" binding:"required"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		FailBadRequest(c, "原密码和新密码不能为空")
+		return
+	}
+	if err := h.userService.ChangePassword(userID, req.OldPassword, req.NewPassword); err != nil {
+		FailBadRequest(c, err.Error())
+		return
+	}
+	SuccessMsg(c, "密码修改成功")
+}
+
+// ListUsers 用户列表（管理端） GET /api/v1/admin/users
+func (h *UserHandler) ListUsers(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "10"))
+	if page < 1 {
+		page = 1
+	}
+	if pageSize < 1 || pageSize > 100 {
+		pageSize = 10
+	}
+
+	users, total, err := h.userService.ListUsers(page, pageSize)
+	if err != nil {
+		FailInternal(c, "查询失败")
+		return
+	}
+	Success(c, gin.H{
+		"list":      users,
+		"total":     total,
+		"page":      page,
+		"page_size": pageSize,
+	})
+}
+
+// CreateUser 创建用户（管理端） POST /api/v1/admin/users
+func (h *UserHandler) CreateUser(c *gin.Context) {
+	var req struct {
+		Username string `json:"username" binding:"required"`
+		Password string `json:"password" binding:"required"`
+		Phone    string `json:"phone"`
+		Role     string `json:"role"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		FailBadRequest(c, "用户名和密码不能为空")
+		return
+	}
+	if req.Role == "" {
+		req.Role = "user"
+	}
+	if err := h.userService.CreateUser(req.Username, req.Password, req.Phone, req.Role); err != nil {
+		FailBadRequest(c, err.Error())
+		return
+	}
+	SuccessMsg(c, "创建成功")
+}
+
+// UpdateUser 更新用户（管理端） PUT /api/v1/admin/users/:id
+func (h *UserHandler) UpdateUser(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		FailBadRequest(c, "无效的用户 ID")
+		return
+	}
+	var req struct {
+		Phone  string `json:"phone"`
+		Role   string `json:"role"`
+		Status int    `json:"status"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		FailBadRequest(c, "参数错误")
+		return
+	}
+	if err := h.userService.UpdateUser(uint(id), req.Phone, req.Role, req.Status); err != nil {
+		FailInternal(c, "更新失败")
+		return
+	}
+	SuccessMsg(c, "更新成功")
+}
+
+// DeleteUser 删除用户（管理端） DELETE /api/v1/admin/users/:id
+func (h *UserHandler) DeleteUser(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		FailBadRequest(c, "无效的用户 ID")
+		return
+	}
+	if err := h.userService.DeleteUser(uint(id)); err != nil {
+		FailInternal(c, "删除失败")
+		return
+	}
+	SuccessMsg(c, "删除成功")
+}