提交登录修改

app/.env

@@ -15,6 +15,9 @@ client_name=ShuFuAI
 java_api_base=http://127.0.0.1:18080
 # java_api_base=http://121.196.149.225:18080
 
+# 与 Java 后端共享的 JWT 签名密钥，必须与 backend-java 的 AIIMAGE_JWT_SECRET 完全一致
+AIIMAGE_JWT_SECRET=please-change-this-secret-please-rotate-at-least-32-bytes
+
 
 
 

app/.env.example

@@ -15,4 +15,9 @@ java_api_base=http://47.111.163.154:18080
 # java_api_base=http://127.0.0.1:18080
 # java_api_base=http://47.111.163.154:18080
 
+# 与 Java 后端共享的 JWT 签名密钥，必须与 backend-java 的 AIIMAGE_JWT_SECRET 完全一致
+AIIMAGE_JWT_SECRET=please-change-this-secret-please-rotate-at-least-32-bytes
+# JWT cookie 名称，默认 aiimage_token；改动需与 Java 端 aiimage.auth.cookie-name 保持一致
+# AIIMAGE_AUTH_COOKIE_NAME=aiimage_token
+
 

app/app.py

@@ -3,9 +3,8 @@
 按功能拆分为蓝图：认证(auth)、主页面(main)、管理员(admin)、图片(image)、品牌(brand)
 """
 import os
-import secrets
 import logging
-from datetime import timedelta, datetime
+from datetime import datetime
 from logging.handlers import RotatingFileHandler
 
 from flask import Flask
@@ -73,12 +72,6 @@ def create_app():
         supports_credentials=True,
         resources={r"/api/*": {"origins": cors_origins}, r"/login": {"origins": cors_origins}},
     )
-    # 生产环境必须通过环境变量注入固定 SECRET_KEY；否则服务重启会使旧会话失效。
-    app.secret_key = os.environ.get('SECRET_KEY', 'dev-secret-key-change-me')
-    app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(days=7)
-    app.config['SESSION_COOKIE_HTTPONLY'] = True
-    app.config['SESSION_COOKIE_SAMESITE'] = os.environ.get('SESSION_COOKIE_SAMESITE', 'Lax')
-    app.config['SESSION_COOKIE_SECURE'] = os.environ.get('SESSION_COOKIE_SECURE', '0') == '1'
 
     # 注册蓝图（不设 url_prefix，保持原有 URL 路径不变，前端无需改动）
     app.register_blueprint(auth_bp)

app/app_common.py

@@ -1,5 +1,5 @@
 """
-公共模块：数据库连接、初始化、会话校验、装饰器、模板渲染
+公共模块：数据库连接、初始化、JWT 鉴权装饰器、模板渲染
 供各蓝图复用
 """
 import os
@@ -8,18 +8,19 @@ from datetime import timedelta
 from functools import wraps
 
 import pymysql
-from flask import request, redirect, url_for, session, jsonify, render_template, render_template_string
+from flask import request, redirect, url_for, jsonify, render_template, render_template_string, g
 
 from config import mysql_host, mysql_user, mysql_password, mysql_database
+from jwt_util import parse_token, get_token_from_request
 
-BASE_DIR = os.path.dirname(os.path.abspath(__file__))
-STATIC_DIR = os.path.join(BASE_DIR, 'static')
-ASSETS_DIR = os.path.join(BASE_DIR, 'assets')
-WEB_SOURCE_DIR = os.path.join(BASE_DIR, 'web_source')
-TEMPLATE_FALLBACK_DIRS = (
-    WEB_SOURCE_DIR,
-    os.path.join(WEB_SOURCE_DIR, 'templates_backup'),
-)
+BASE_DIR = os.path.dirname(os.path.abspath(__file__))
+STATIC_DIR = os.path.join(BASE_DIR, 'static')
+ASSETS_DIR = os.path.join(BASE_DIR, 'assets')
+WEB_SOURCE_DIR = os.path.join(BASE_DIR, 'web_source')
+TEMPLATE_FALLBACK_DIRS = (
+    WEB_SOURCE_DIR,
+    os.path.join(WEB_SOURCE_DIR, 'templates_backup'),
+)
 
 
 def get_db():
@@ -35,13 +36,13 @@ def get_db():
 
 def _render_html(template_name: str, **context):
     """读取 HTML 模板：若为加密文件则先解密，再渲染。未加密或解密失败时按明文渲染。"""
-    path = next(
-        (candidate for candidate in (os.path.join(base_path, template_name) for base_path in TEMPLATE_FALLBACK_DIRS)
-         if os.path.isfile(candidate)),
-        None,
-    )
-    if path is None:
-        return render_template(template_name, **context)
+    path = next(
+        (candidate for candidate in (os.path.join(base_path, template_name) for base_path in TEMPLATE_FALLBACK_DIRS)
+         if os.path.isfile(candidate)),
+        None,
+    )
+    if path is None:
+        return render_template(template_name, **context)
     with open(path, "rb") as f:
         raw = f.read()
     try:
@@ -54,13 +55,13 @@ def _render_html(template_name: str, **context):
 
 def _render_html_new(template_name: str, **context):
     """读取 HTML 模板：若为加密文件则先解密，再渲染。未加密或解密失败时按明文渲染。"""
-    path = next(
-        (candidate for candidate in (os.path.join(base_path, template_name) for base_path in TEMPLATE_FALLBACK_DIRS)
-         if os.path.isfile(candidate)),
-        None,
-    )
-    if path is None:
-        return render_template(template_name, **context)
+    path = next(
+        (candidate for candidate in (os.path.join(base_path, template_name) for base_path in TEMPLATE_FALLBACK_DIRS)
+         if os.path.isfile(candidate)),
+        None,
+    )
+    if path is None:
+        return render_template(template_name, **context)
     with open(path, "rb") as f:
         raw = f.read()
     try:
@@ -72,9 +73,36 @@ def _render_html_new(template_name: str, **context):
 
 
 
+def _resolve_jwt_user():
+    """从 Authorization/cookie 解析 JWT，命中后写入 flask.g 缓存。无效返回 None。"""
+    cached = getattr(g, "_aiimage_user", None)
+    if cached is not None:
+        return cached or None
+    token = get_token_from_request()
+    payload = parse_token(token) if token else None
+    if not payload:
+        g._aiimage_user = False
+        return None
+    g._aiimage_user = payload
+    g.aiimage_user_id = payload.get("user_id")
+    g.aiimage_username = payload.get("username") or ""
+    g.aiimage_device_id = payload.get("device_id") or ""
+    return payload
+
+
+def current_user_id():
+    user = _resolve_jwt_user()
+    return user.get("user_id") if user else None
+
+
+def current_username():
+    user = _resolve_jwt_user()
+    return user.get("username") if user else ""
+
+
 def _is_session_user_valid():
-    """校验 session 中的 user_id 是否在数据库中仍存在；不存在则清除 session 并返回 False"""
-    uid = session.get('user_id')
+    """兼容旧调用：判断当前 JWT 用户是否仍存在于数据库。"""
+    uid = current_user_id()
     if not uid:
         return False
     try:
@@ -83,23 +111,22 @@ def _is_session_user_valid():
             cur.execute("SELECT id FROM users WHERE id = %s", (uid,))
             row = cur.fetchone()
         conn.close()
-        if not row:
-            session.clear()
-            return False
-        return True
+        return bool(row)
     except Exception:
-        session.clear()
         return False
 
 
 def _get_current_admin_role():
     """获取当前登录用户的管理角色：super_admin / admin / None（非管理员）"""
+    uid = current_user_id()
+    if not uid:
+        return None, None
     try:
         conn = get_db()
         with conn.cursor() as cur:
             cur.execute(
                 "SELECT id, username, is_admin, role, created_by_id FROM users WHERE id = %s",
-                (session['user_id'],)
+                (uid,)
             )
             row = cur.fetchone()
         conn.close()
@@ -110,13 +137,19 @@ def _get_current_admin_role():
         return None, None
 
 
+def _unauthorized_response():
+    if request.headers.get('X-Requested-With') == 'XMLHttpRequest' \
+            or request.path.startswith('/api/') \
+            or 'application/json' in (request.headers.get('Accept') or ''):
+        return jsonify({'success': False, 'error': '未登录'}), 401
+    return redirect(url_for('auth.login'))
+
+
 def login_required(f):
     @wraps(f)
     def decorated(*args, **kwargs):
-        if not session.get('user_id') or not _is_session_user_valid():
-            if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
-                return jsonify({'success': False, 'error': '未登录'}), 401
-            return redirect(url_for('auth.login'))
+        if not current_user_id():
+            return _unauthorized_response()
         return f(*args, **kwargs)
     return decorated
 
@@ -124,22 +157,24 @@ def login_required(f):
 def admin_required(f):
     @wraps(f)
     def decorated(*args, **kwargs):
-        if not session.get('user_id'):
-            if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
-                return jsonify({'success': False, 'error': '未登录'}), 401
-            return redirect(url_for('auth.login'))
+        uid = current_user_id()
+        if not uid:
+            return _unauthorized_response()
         try:
             conn = get_db()
             with conn.cursor() as cur:
-                cur.execute("SELECT is_admin, role FROM users WHERE id = %s", (session['user_id'],))
+                cur.execute("SELECT is_admin, role FROM users WHERE id = %s", (uid,))
                 row = cur.fetchone()
             conn.close()
             if not row or not row.get('is_admin'):
-                if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
+                if request.headers.get('X-Requested-With') == 'XMLHttpRequest' \
+                        or request.path.startswith('/api/') \
+                        or 'application/json' in (request.headers.get('Accept') or ''):
                     return jsonify({'success': False, 'error': '需要管理员权限'}), 403
                 return redirect(url_for('main.home'))
         except Exception as e:
-            if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
+            if request.headers.get('X-Requested-With') == 'XMLHttpRequest' \
+                    or request.path.startswith('/api/'):
                 return jsonify({'success': False, 'error': str(e)}), 500
             return redirect(url_for('main.home'))
         return f(*args, **kwargs)

app/blueprints/admin.py

@@ -1,379 +1,17 @@
-"""
-管理员蓝图：用户管理（列表/创建/更新/删除）、生成历史、管理页
-"""
-import json
-import pymysql
-from flask import Blueprint, request, jsonify
-from werkzeug.security import generate_password_hash
-
-from app_common import get_db, _render_html, _get_current_admin_role, admin_required, login_required
-from flask import session
-
-admin_bp = Blueprint('admin', __name__)
-
-
-def _parse_json(val, default=None):
-    if val is None:
-        return default if default is not None else []
-    if isinstance(val, (list, dict)):
-        return val
-    try:
-        return json.loads(val)
-    except Exception:
-        return default if default is not None else []
-
-
-@admin_bp.route('/admin')
-@login_required
-@admin_required
-def admin_page():
-    return _render_html('admin.html')
-
-
-@admin_bp.route('/api/admin/users')
-@admin_required
-def admin_list_users():
-    """分页获取用户列表；支持用户名模糊搜索、指定管理员所属普通用户筛选"""
-    role, current_row = _get_current_admin_role()
-    if not role:
-        return jsonify({'success': False, 'error': '需要管理员权限'}), 403
-    page = max(1, int(request.args.get('page', 1)))
-    page_size = min(50, max(5, int(request.args.get('page_size', 15))))
-    offset = (page - 1) * page_size
-    search_username = (request.args.get('username') or request.args.get('search') or '').strip()
-    created_by_id_arg = request.args.get('created_by_id') or request.args.get('admin_id')
-    created_by_id = int(created_by_id_arg) if created_by_id_arg and str(created_by_id_arg).isdigit() else None
-    if role != 'super_admin':
-        created_by_id = None
-    try:
-        conn = get_db()
-        with conn.cursor() as cur:
-            if role == 'super_admin':
-                where_parts = ["1=1"]
-                params = []
-                if search_username:
-                    where_parts.append("u.username LIKE %s")
-                    params.append("%" + search_username + "%")
-                if created_by_id is not None:
-                    where_parts.append("u.created_by_id = %s")
-                    params.append(created_by_id)
-                where_sql = " AND ".join(where_parts)
-                cur.execute(
-                    """SELECT u.id, u.username, u.is_admin, u.role, u.created_at, u.created_by_id,
-                          creator.username AS creator_username
-                   FROM users u
-                   LEFT JOIN users creator ON creator.id = u.created_by_id
-                   WHERE """ + where_sql + """ ORDER BY u.id LIMIT %s OFFSET %s""",
-                    tuple(params) + (page_size, offset),
-                )
-                rows = cur.fetchall()
-                cur.execute("SELECT COUNT(*) as total FROM users u WHERE " + where_sql, tuple(params))
-                total = cur.fetchone()['total']
-                cur.execute("SELECT id, username FROM users WHERE role = 'admin' ORDER BY id")
-                admins = [{'id': r['id'], 'username': r['username']} for r in cur.fetchall()]
-            else:
-                admin_id = current_row['id']
-                where_parts = ["(u.id = %s OR (u.role = 'normal' AND u.created_by_id = %s))"]
-                params = [admin_id, admin_id]
-                if search_username:
-                    where_parts.append("u.username LIKE %s")
-                    params.append("%" + search_username + "%")
-                where_sql = " AND ".join(where_parts)
-                cur.execute(
-                    """SELECT u.id, u.username, u.is_admin, u.role, u.created_at, u.created_by_id,
-                          creator.username AS creator_username
-                   FROM users u
-                   LEFT JOIN users creator ON creator.id = u.created_by_id
-                   WHERE """ + where_sql + """ ORDER BY u.id LIMIT %s OFFSET %s""",
-                    tuple(params) + (page_size, offset),
-                )
-                rows = cur.fetchall()
-                cur.execute(
-                    "SELECT COUNT(*) as total FROM users u WHERE " + where_sql,
-                    tuple(params),
-                )
-                total = cur.fetchone()['total']
-                admins = []
-            items = [
-                {
-                    'id': r['id'],
-                    'username': r['username'],
-                    'is_admin': bool(r.get('is_admin')),
-                    'role': r.get('role') or 'normal',
-                    'created_by_id': r.get('created_by_id'),
-                    'creator_username': r.get('creator_username') or '',
-                    'created_at': r['created_at'].strftime('%Y-%m-%d %H:%M') if r.get('created_at') else '',
-                }
-                for r in rows
-            ]
-        conn.close()
-        payload = {
-            'success': True,
-            'items': items,
-            'total': total,
-            'page': page,
-            'page_size': page_size,
-            'current_user_role': role,
-            'admins': admins,
-        }
-        return jsonify(payload)
-    except Exception as e:
-        return jsonify({'success': False, 'error': str(e)})
-
-
-@admin_bp.route('/api/admin/user', methods=['POST'])
-@admin_required
-def admin_create_user():
-    data = request.get_json() or {}
-    username = (data.get('username') or '').strip()
-    password = data.get('password') or ''
-    role, current_row = _get_current_admin_role()
-    if not role:
-        return jsonify({'success': False, 'error': '需要管理员权限'}), 403
-    want_role = (data.get('role') or 'normal').strip() or 'normal'
-    if want_role not in ('admin', 'normal'):
-        want_role = 'normal'
-    if role == 'admin' and want_role == 'admin':
-        return jsonify({'success': False, 'error': '仅超级管理员可创建管理员'})
-    if want_role == 'admin':
-        want_created_by = current_row['id']
-    elif role == 'super_admin':
-        want_created_by = data.get('created_by_id')
-    else:
-        want_created_by = current_row['id']
-    if not username or not password:
-        return jsonify({'success': False, 'error': '用户名和密码不能为空'})
-    if len(username) < 2:
-        return jsonify({'success': False, 'error': '用户名至少2个字符'})
-    if len(password) < 6:
-        return jsonify({'success': False, 'error': '密码至少6个字符'})
-    if want_role == 'normal' and role == 'super_admin' and want_created_by is None:
-        try:
-            conn = get_db()
-            with conn.cursor() as cur:
-                cur.execute("SELECT id FROM users WHERE role = 'admin' ORDER BY id LIMIT 1")
-                r = cur.fetchone()
-            conn.close()
-            want_created_by = r['id'] if r else current_row['id']
-        except Exception:
-            want_created_by = current_row['id']
-    if want_role == 'normal' and want_created_by is None:
-        want_created_by = current_row['id']
-    is_admin = 1 if want_role in ('super_admin', 'admin') else 0
-    pwd_hash = generate_password_hash(password, method='pbkdf2:sha256')
-    try:
-        conn = get_db()
-        with conn.cursor() as cur:
-            cur.execute(
-                "INSERT INTO users (username, password_hash, is_admin, role, created_by_id) VALUES (%s, %s, %s, %s, %s)",
-                (username, pwd_hash, is_admin, want_role, want_created_by),
-            )
-        conn.commit()
-        conn.close()
-        return jsonify({'success': True, 'msg': '用户创建成功'})
-    except pymysql.IntegrityError:
-        return jsonify({'success': False, 'error': '用户名已存在'})
-    except Exception as e:
-        return jsonify({'success': False, 'error': str(e)})
-
-
-@admin_bp.route('/api/admin/user/<int:uid>', methods=['PUT'])
-@admin_required
-def admin_update_user(uid):
-    data = request.get_json() or {}
-    password = data.get('password')
-    want_role = (data.get('role') or '').strip() or data.get('role')
-    role, current_row = _get_current_admin_role()
-    if not role:
-        return jsonify({'success': False, 'error': '需要管理员权限'}), 403
-    if want_role is None and not password:
-        return jsonify({'success': False, 'error': '请提供要修改的内容'})
-    try:
-        conn = get_db()
-        with conn.cursor() as cur:
-            cur.execute("SELECT id, role, created_by_id FROM users WHERE id = %s", (uid,))
-            target = cur.fetchone()
-            if not target:
-                conn.close()
-                return jsonify({'success': False, 'error': '用户不存在'})
-            if role == 'admin':
-                if target['role'] != 'normal' or target.get('created_by_id') != current_row['id']:
-                    conn.close()
-                    return jsonify({'success': False, 'error': '只能编辑自己创建的普通用户'}), 403
-                want_role = None
-            else:
-                if target.get('role') == 'super_admin':
-                    conn.close()
-                    return jsonify({'success': False, 'error': '不能修改超级管理员'})
-                if want_role == 'super_admin':
-                    return jsonify({'success': False, 'error': '不能将用户设为超级管理员'})
-                if want_role not in ('admin', 'normal', None, ''):
-                    want_role = None
-            if password:
-                if len(password) < 6:
-                    conn.close()
-                    return jsonify({'success': False, 'error': '密码至少6个字符'})
-                pwd_hash = generate_password_hash(password, method='pbkdf2:sha256')
-                cur.execute("UPDATE users SET password_hash = %s WHERE id = %s", (pwd_hash, uid))
-            if want_role is not None and want_role != '':
-                is_admin = 1 if want_role == 'admin' else 0
-                cur.execute(
-                    "UPDATE users SET is_admin = %s, role = %s WHERE id = %s",
-                    (is_admin, want_role, uid),
-                )
-        conn.commit()
-        conn.close()
-        return jsonify({'success': True, 'msg': '更新成功'})
-    except Exception as e:
-        return jsonify({'success': False, 'error': str(e)})
-
-
-@admin_bp.route('/api/admin/user/<int:uid>', methods=['DELETE'])
-@admin_required
-def admin_delete_user(uid):
-    from flask import session
-    if session.get('user_id') == uid:
-        return jsonify({'success': False, 'error': '不能删除当前登录账号'})
-    role, current_row = _get_current_admin_role()
-    if not role:
-        return jsonify({'success': False, 'error': '需要管理员权限'}), 403
-    try:
-        conn = get_db()
-        with conn.cursor() as cur:
-            cur.execute("SELECT id, role, created_by_id FROM users WHERE id = %s", (uid,))
-            target = cur.fetchone()
-            if not target:
-                conn.close()
-                return jsonify({'success': False, 'error': '用户不存在'})
-            if target.get('role') == 'super_admin':
-                conn.close()
-                return jsonify({'success': False, 'error': '不能删除超级管理员'})
-            if role == 'admin':
-                if target.get('role') != 'normal' or target.get('created_by_id') != current_row['id']:
-                    conn.close()
-                    return jsonify({'success': False, 'error': '只能删除自己创建的普通用户'}), 403
-            cur.execute("DELETE FROM users WHERE id = %s", (uid,))
-            affected = cur.rowcount
-        conn.commit()
-        conn.close()
-        if affected == 0:
-            return jsonify({'success': False, 'error': '用户不存在'})
-        return jsonify({'success': True, 'msg': '删除成功'})
-    except Exception as e:
-        return jsonify({'success': False, 'error': str(e)})
-
-
-@admin_bp.route('/api/admin/user/<int:uid>/column-permissions')
-@login_required
-def admin_user_column_permissions(uid):
-    """获取指定用户的栏目权限列表：当前用户只能查自己，管理员可查任意用户。超级管理员返回全部栏目。"""
-    current_uid = session.get('user_id')
-    menu_type = (request.args.get('menu_type') or '').strip().lower()
-    if current_uid != uid:
-        role, _ = _get_current_admin_role()
-        if not role:
-            return jsonify({'success': False, 'error': '无权查看该用户的栏目权限'}), 403
-    try:
-        conn = get_db()
-        with conn.cursor() as cur:
-            cur.execute("SELECT role FROM users WHERE id = %s", (uid,))
-            user_row = cur.fetchone()
-            valid_menu_type = menu_type if menu_type in ('app', 'admin') else ''
-            if user_row and (user_row.get('role') or '').strip() == 'super_admin':
-                sql = """
-                    SELECT id, name, column_key, menu_type, route_path, sort_order, created_at
-                    FROM columns
-                """
-                params = []
-                if valid_menu_type:
-                    sql += " WHERE menu_type = %s"
-                    params.append(valid_menu_type)
-                sql += " ORDER BY sort_order ASC, id ASC"
-                cur.execute(sql, tuple(params))
-                rows = cur.fetchall()
-            else:
-                sql = """
-                    SELECT c.id, c.name, c.column_key, c.menu_type, c.route_path, c.sort_order, c.created_at
-                    FROM columns c
-                    INNER JOIN user_column_permission ucp ON ucp.column_id = c.id
-                    WHERE ucp.user_id = %s
-                """
-                params = [uid]
-                if valid_menu_type:
-                    sql += " AND c.menu_type = %s"
-                    params.append(valid_menu_type)
-                sql += " ORDER BY c.sort_order ASC, c.id ASC"
-                cur.execute(sql, tuple(params))
-                rows = cur.fetchall()
-        conn.close()
-        items = [
-            {
-                'id': r['id'],
-                'name': r['name'],
-                'column_key': r['column_key'],
-                'menu_type': r.get('menu_type') or 'app',
-                'route_path': r.get('route_path') or '',
-                'sort_order': r.get('sort_order') or 0,
-                'created_at': r['created_at'].strftime('%Y-%m-%d %H:%M') if r.get('created_at') else '',
-            }
-            for r in rows
-        ]
-        return jsonify({'success': True, 'items': items})
-    except Exception as e:
-        return jsonify({'success': False, 'error': str(e)})
-
-
-@admin_bp.route('/api/admin/history')
-@admin_required
-def admin_history():
-    """管理员分页获取所有生成记录，支持按用户和时间筛选"""
-    page = max(1, int(request.args.get('page', 1)))
-    page_size = min(50, max(10, int(request.args.get('page_size', 15))))
-    offset = (page - 1) * page_size
-    user_id = request.args.get('user_id', type=int)
-    time_start = (request.args.get('time_start') or '').strip()
-    time_end = (request.args.get('time_end') or '').strip()
-    conditions, params = [], []
-    if user_id:
-        conditions.append("h.user_id = %s")
-        params.append(user_id)
-    if time_start:
-        conditions.append("h.created_at >= %s")
-        params.append(time_start)
-    if time_end:
-        conditions.append("h.created_at <= %s")
-        params.append(time_end + ' 23:59:59' if len(time_end) <= 10 else time_end)
-    where_clause = " AND ".join(conditions) if conditions else "1=1"
-    params_count = params[:]
-    params.extend([page_size, offset])
-    try:
-        conn = get_db()
-        with conn.cursor() as cur:
-            cur.execute(
-                """SELECT h.id, h.user_id, h.created_at, h.panel_type, h.original_urls, h.params, h.result_urls,
-                          h.long_image_url, u.username
-                   FROM image_history h
-                   LEFT JOIN users u ON h.user_id = u.id
-                   WHERE """ + where_clause + """ ORDER BY h.created_at DESC LIMIT %s OFFSET %s""",
-                params,
-            )
-            rows = cur.fetchall()
-            cur.execute("SELECT COUNT(*) as total FROM image_history h WHERE " + where_clause, params_count)
-            total = cur.fetchone()['total']
-        conn.close()
-        items = []
-        for r in rows:
-            items.append({
-                'id': r['id'],
-                'user_id': r['user_id'],
-                'username': r.get('username') or '-',
-                'created_at': r['created_at'].strftime('%Y-%m-%d %H:%M') if r['created_at'] else '',
-                'panel_type': r['panel_type'] or '',
-                'original_urls': _parse_json(r['original_urls'], []),
-                'params': _parse_json(r['params'], {}),
-                'result_urls': _parse_json(r['result_urls'], []),
-                'long_image_url': (r.get('long_image_url') or '').strip() or None,
-            })
-        return jsonify({'success': True, 'items': items, 'total': total, 'page': page, 'page_size': page_size})
-    except Exception as e:
-        return jsonify({'success': False, 'error': str(e)})
+"""
+管理员蓝图：仅保留 /admin 页面渲染。
+用户管理、栏目权限、生成历史等接口已全部迁移至 Java 端。
+"""
+from flask import Blueprint
+
+from app_common import _render_html, admin_required, login_required
+from config import JAVA_API_BASE
+
+admin_bp = Blueprint('admin', __name__)
+
+
+@admin_bp.route('/admin')
+@login_required
+@admin_required
+def admin_page():
+    return _render_html('admin.html', java_api_base=JAVA_API_BASE)

app/blueprints/auth.py

@@ -1,107 +1,55 @@
-"""
-认证蓝图：登录、登出、登录状态校验
-"""
-from flask import Blueprint, request, redirect, url_for, session, jsonify
-from werkzeug.security import check_password_hash
-
-from app_common import (
-    get_db,
-    _render_html,
-    _is_session_user_valid,
-    login_required,
-    BASE_DIR,
-)
-from tool.devices import DeviceIDGenerator
-
-auth_bp = Blueprint('auth', __name__)
-
-
-@auth_bp.route('/login', methods=['GET', 'POST'])
-def login():
-    if session.get('user_id') and _is_session_user_valid():
-        return redirect(url_for('main.home'))
-    if request.method == 'POST':
-        data = request.get_json() if request.is_json else request.form
-        username = (data.get('username') or '').strip()
-        password = data.get('password') or ''
-        if not username or not password:
-            if request.is_json:
-                return jsonify({'success': False, 'error': '请输入用户名和密码'})
-            return _render_html('login.html', error='请输入用户名和密码')
-        try:
-            conn = get_db()
-            with conn.cursor() as cur:
-                cur.execute(
-                    "SELECT id, password_hash, machine, is_admin FROM users WHERE username = %s",
-                    (username,)
-                )
-                row = cur.fetchone()
-            if row and check_password_hash(row['password_hash'], password):
-                current_machine = DeviceIDGenerator().get_device_id()
-                stored_machine = (row.get('machine') or '').strip()
-                if not stored_machine:
-                    with conn.cursor() as cur:
-                        cur.execute("UPDATE users SET machine = %s WHERE id = %s", (current_machine, row['id']))
-                    conn.commit()
-                    conn.close()
-                    session.permanent = True
-                    session['user_id'] = row['id']
-                    session['username'] = username
-                    if request.is_json:
-                        return jsonify({'success': True, 'redirect': url_for('main.home')})
-                    return redirect(url_for('main.home'))
-                print("验证设备",stored_machine)
-                print("当前设备",current_machine)
-                if stored_machine != current_machine and row.get("is_admin") != 1:
-                    conn.close()
-                    err_msg = '当前设备与首次登录设备不一致，请在原设备上登录'
-                    if request.is_json:
-                        return jsonify({'success': False, 'error': err_msg})
-                    return _render_html('login.html', error=err_msg)
-                conn.close()
-                session.permanent = True
-                session['user_id'] = row['id']
-                session['username'] = username
-                if request.is_json:
-                    return jsonify({'success': True, 'redirect': url_for('main.home')})
-                return redirect(url_for('main.home'))
-            conn.close()
-        except Exception as e:
-            if request.is_json:
-                return jsonify({'success': False, 'error': str(e)})
-            return _render_html('login.html', error='登录失败，请稍后重试')
-        if request.is_json:
-            return jsonify({'success': False, 'error': '用户名或密码错误'})
-        return _render_html('login.html', error='用户名或密码错误')
-    return _render_html('login.html')
-
-
-@auth_bp.route('/api/auth/check')
-@login_required
-def api_auth_check():
-    """校验登录状态，用于页面加载时判断是否已登录；同时校验机器码是否与首次登录设备一致"""
-    if not session.get('user_id'):
-        return jsonify({'logged_in': False})
-    try:
-        conn = get_db()
-        with conn.cursor() as cur:
-            cur.execute("SELECT machine, is_admin FROM users WHERE id = %s", (session['user_id'],))
-            row = cur.fetchone()
-        conn.close()
-        if not row:
-            return jsonify({'logged_in': False})
-        stored_machine = (row.get('machine') or '').strip()
-        if stored_machine:
-            current_machine = DeviceIDGenerator().get_device_id()
-            if stored_machine != current_machine and row.get("is_admin") != 1:
-                session.clear()
-                return jsonify({'logged_in': False, 'error': '当前设备与首次登录设备不一致'})
-    except Exception:
-        return jsonify({'logged_in': False})
-    return jsonify({'logged_in': True, 'redirect': url_for('main.home')})
-
-
-@auth_bp.route('/logout')
-def logout():
-    session.clear()
-    return redirect(url_for('auth.login'))
+"""
+认证蓝图：登录页（仅 GET 渲染模板）+ 登出（清 JWT cookie）+ token 同步
+登录表单提交已经直连 Java 后端 /login，Python 这边只负责：
+1. 渲染登录页模板
+2. 把 Java 签发的 JWT 从前端写到 Python 同源 cookie，供后续页面跳转携带
+3. 登出：清 cookie 跳回登录页
+"""
+import sys
+
+from flask import Blueprint, redirect, url_for, make_response, request, jsonify
+
+from app_common import _render_html, current_user_id
+from config import JAVA_API_BASE
+from jwt_util import COOKIE_NAME, parse_token_with_reason
+
+auth_bp = Blueprint('auth', __name__)
+
+
+@auth_bp.route('/login', methods=['GET'])
+def login():
+    if current_user_id():
+        return redirect(url_for('main.home'))
+    return _render_html('login.html', java_api_base=JAVA_API_BASE)
+
+
+@auth_bp.route('/api/auth/sync', methods=['POST'])
+def api_auth_sync():
+    """前端拿到 Java 返回的 JWT 后调用，把 token 写进 Python 同源 cookie。"""
+    data = request.get_json(silent=True) or {}
+    token = (data.get('token') or '').strip()
+    if not token:
+        return jsonify({'success': False, 'error': '缺少 token'}), 400
+    payload, reason = parse_token_with_reason(token)
+    if not payload:
+        # 把根因打到服务端日志，并回传给前端，便于现场排查
+        print(f"[auth] /api/auth/sync 校验失败: {reason}", file=sys.stderr)
+        return jsonify({'success': False, 'error': f'token 无效: {reason}'}), 401
+    resp = make_response(jsonify({'success': True}))
+    resp.set_cookie(
+        COOKIE_NAME,
+        token,
+        max_age=7 * 24 * 3600,
+        path='/',
+        httponly=True,
+        samesite='Lax',
+    )
+    return resp
+
+
+@auth_bp.route('/logout')
+def logout():
+    resp = make_response(redirect(url_for('auth.login')))
+    resp.delete_cookie(COOKIE_NAME, path='/')
+    return resp
+

app/blueprints/brand.py

@@ -13,9 +13,9 @@ from queue import Queue, Empty
 from concurrent.futures import ThreadPoolExecutor, as_completed
 from urllib.parse import urlparse
 
-from flask import Blueprint, request, jsonify, session, send_file, redirect, Response
+from flask import Blueprint, request, jsonify, send_file, redirect, Response
 
-from app_common import get_db, login_required, BASE_DIR
+from app_common import get_db, login_required, current_user_id, BASE_DIR
 from config import bucket_path,JAVA_API_BASE
 from brand_spider.main import single_file_handle, TaskCancelledError
 
@@ -70,12 +70,12 @@ def _get_uid_from_request_headers():
 
 def _resolve_user_id():
     """
-    优先使用请求头 uid；没有请求头 uid 时回退到 session['user_id']。
+    优先使用请求头 uid；没有请求头 uid 时回退到 JWT 解析的当前用户。
     若二者同时存在但不一致，则视为无效请求并返回 None。
     """
     req_uid = _get_uid_from_request_headers()
     if req_uid is not None:
-        sess_uid = session.get('user_id')
+        sess_uid = current_user_id()
         if sess_uid is not None:
             try:
                 if int(sess_uid) != int(req_uid):
@@ -84,7 +84,7 @@ def _resolve_user_id():
                 if str(sess_uid) != str(req_uid):
                     return None
         return req_uid
-    return session.get('user_id')
+    return current_user_id()
 
 
 def _get_user_id_or_error():

app/blueprints/brand_备份.py

@@ -1,726 +0,0 @@
-"""
-品牌爬虫蓝图：展开文件夹、运行任务、任务列表/详情、下载结果
-"""
-import os
-import json
-import threading
-import traceback
-import zipfile
-import io
-import time
-import requests
-from queue import Queue, Empty
-from concurrent.futures import ThreadPoolExecutor, as_completed
-from urllib.parse import urlparse
-
-from flask import Blueprint, request, jsonify, session, send_file, redirect, Response
-
-from app_common import get_db, login_required, BASE_DIR
-from config import bucket_path,JAVA_API_BASE
-from brand_spider.main import single_file_handle, TaskCancelledError
-
-brand_bp = Blueprint('brand', __name__)
-BRAND_OUTPUT_DIR = os.path.join(BASE_DIR, 'brand_output')
-OSS_PREFIX = "brand_results"
-
-# 任务完成时推送给前端的 SSE 队列：task_id -> [Queue, ...]
-_task_event_queues = {}
-_task_event_lock = threading.Lock()
-
-# 任务行级进度（当前处理文件的行数/总行数），仅存内存，不落库：
-# task_id -> {
-#   'file_index': int,      # 当前处理第几个文件
-#   'file_total': int,      # 总文件数
-#   'file_path': str,       # 当前文件路径
-#   'current_line': int,    # 当前行号（或当前品牌序号）
-#   'total_lines': int,     # 总行数（或总品牌数）
-# }
-_task_line_progress = {}
-_task_line_progress_lock = threading.Lock()
-_cancelled_brand_tasks = set()
-_cancelled_brand_tasks_lock = threading.Lock()
-
-
-def _mark_task_cancelled(task_id):
-    with _cancelled_brand_tasks_lock:
-        _cancelled_brand_tasks.add(task_id)
-
-
-def _is_task_cancelled(task_id):
-    with _cancelled_brand_tasks_lock:
-        return task_id in _cancelled_brand_tasks
-
-
-def _get_uid_from_request_headers():
-    """
-    从请求头读取 uid。
-    前端会在 headers 里携带 uid，用于确定本次请求的归属用户。
-    """
-    uid = request.headers.get('uid')
-    if uid is None:
-        return None
-    uid = str(uid).strip()
-    if not uid:
-        return None
-    try:
-        return int(uid)
-    except Exception:
-        return None
-
-
-def _resolve_user_id():
-    """
-    优先使用请求头 uid；没有请求头 uid 时回退到 session['user_id']。
-    若二者同时存在但不一致，则视为无效请求并返回 None。
-    """
-    req_uid = _get_uid_from_request_headers()
-    if req_uid is not None:
-        sess_uid = session.get('user_id')
-        if sess_uid is not None:
-            try:
-                if int(sess_uid) != int(req_uid):
-                    return None
-            except Exception:
-                if str(sess_uid) != str(req_uid):
-                    return None
-        return req_uid
-    return session.get('user_id')
-
-
-def _get_user_id_or_error():
-    user_id = _resolve_user_id()
-    if not user_id:
-        return None, (jsonify({'success': False, 'error': '未登录或缺少uid'}), 401)
-    try:
-        return int(user_id), None
-    except Exception:
-        return None, (jsonify({'success': False, 'error': 'uid无效'}), 400)
-
-
-def _push_task_event(task_id, event):
-    """向订阅了该任务的所有 SSE 连接推送事件，并移除该任务的队列列表。
-    同时清理内存中的行级进度，不通过数据库中转行级进度。"""
-    with _task_event_lock:
-        queues = _task_event_queues.pop(task_id, [])
-    for q in queues:
-        try:
-            q.put_nowait(event)
-        except Exception:
-            pass
-    # 任务进入终态时，顺便清理行级进度缓存
-    with _task_line_progress_lock:
-        _task_line_progress.pop(task_id, None)
-    status = (event or {}).get('status') if isinstance(event, dict) else None
-    if status in ('success', 'failed', 'cancelled'):
-        with _cancelled_brand_tasks_lock:
-            _cancelled_brand_tasks.discard(task_id)
-
-
-def _expand_folder_xlsx(folder_path):
-    """返回文件夹下所有 .xlsx 文件的绝对路径列表"""
-    if not folder_path or not os.path.isdir(folder_path):
-        return []
-    paths = []
-    for name in os.listdir(folder_path):
-        if name.endswith('.xlsx') or name.endswith('.XLSX'):
-            paths.append(os.path.normpath(os.path.join(folder_path, name)))
-    return paths
-
-
-def _upload_local_xlsx_to_oss(local_path, user_id):
-    """将本地 xlsx 文件上传到 OSS，返回 (url, None) 或 (None, error_message)。"""
-    if not local_path or not os.path.isfile(local_path):
-        return None, "文件不存在"
-    try:
-        from ali_oss import upload_file as oss_upload_file
-    except ImportError:
-        return None, "OSS 模块未配置"
-    base = os.path.basename(local_path)
-    safe_base = "".join(c if c.isalnum() or c in '-_.' else '_' for c in base)
-    if not safe_base.endswith('.xlsx'):
-        safe_base = safe_base + '.xlsx'
-    key = f"{bucket_path}brand_input/{user_id}/{int(time.time() * 1000)}/{safe_base}"
-    try:
-        with open(local_path, "rb") as f:
-            content = f.read()
-        url = oss_upload_file(content, key)
-        return url, None
-    except Exception as e:
-        return None, str(e)
-
-
-def _run_brand_single(taskid,brand_ls, fileUrl,strategy,totalLines,chunkTotal,chunkIndex):
-    """"""
-    invalidBrands = [] # 不符合品牌的数据
-    queryFailedBrands = [] # 查询失败的数据
-    keptRows = []
-    for brand in brand_ls:
-        if _is_task_cancelled(taskid):
-            raise TaskCancelledError("任务已取消")
-        faild_data,query_faild_data = single_file_handle(brand,strategy)
-        invalidBrands.extend(faild_data)
-        queryFailedBrands.extend(query_faild_data)
-        if len(faild_data) == 0 and len(query_faild_data) == 0:
-            keptRows.append(brand)
-
-    data = { "strategy": strategy ,
-                          "files": [
-                            {
-                              "fileUrl": fileUrl,
-                              "originalFilename": "",
-                              "relativePath": "",
-                              "mainSheetName": "",
-                              "chunkIndex": chunkIndex,
-                              "chunkTotal": chunkTotal,
-                              "totalLines": totalLines,
-                              "keptRows": keptRows,
-                              "invalidBrands": invalidBrands,
-                              "queryFailedBrands": queryFailedBrands
-                            }
-                          ]
-                        }
-    resp = requests.post(f"{JAVA_API_BASE}/api/brand/tasks/{taskid}/result",headers={"accept":"application/json"},
-                         # json={ "strategy": strategy ,
-                         #  "files": [
-                         #    {  "fileUrl": fileUrl,"originalFilename": "","relativePath": "",
-                         #      "mainSheetName": "","columns": [],"keptRows": [],
-                         #      "invalidBrands": invalidBrands,"queryFailedBrands": queryFailedBrands
-                         #    }]})
-                         json=data)
-    # print(data)
-    # print(taskid,brand_ls, fileUrl)
-    print("提交结果",data,"\n-->",resp.text)
-    return True
-
-
-
-def _background_brand_task(task_id,data):
-    """
-        后台执行爬虫任务
-        参数示例：
-            data : {
-            "taskId": 348,
-            "strategy": "Terms",
-            "files": [
-              {
-                "fileIndex": 1,
-                "fileUrl": "ab8cce4878754bfd89b4cd3ed20e1395",
-                "originalFilename": "品牌样例.xlsx",
-                "relativePath": "店铺A/品牌样例.xlsx",
-                "sheetName": "Sheet1",
-                "columns": [
-                  "品牌",
-                  "ASIH",
-                  "状态",
-                  "时间"
-                ],
-                "rows": [
-                  {
-                    "品牌": "YQAUTEC",
-                    "ASIH": "B0F28NZ752",
-                    "状态": "",
-                    "时间": "",
-                    "__rowIndex": 2
-                  }
-                ],
-                "uniqueBrands": [
-                  "YQAUTEC"
-                ]
-              }
-            ]
-          }
-    """
-    try:
-        file_ls = data.get("files")
-        strategy = data.get("strategy")
-        if not isinstance(file_ls, list):
-            file_ls = []
-        tasks = []
-        for file_data in file_ls:
-            rows = file_data.get("rows") or []
-            brand_ls = [i.get("品牌") for i in rows if i.get("品牌")]
-            fileUrl = file_data.get("fileUrl")
-            if not brand_ls:
-                continue
-            for i in range(0, len(brand_ls), 5):
-                chunk = brand_ls[i:i + 5]
-                tasks.append((chunk, fileUrl))
-
-        if tasks:
-            max_workers = min(8, len(tasks))
-            with ThreadPoolExecutor(max_workers=max_workers) as executor:
-                if _is_task_cancelled(task_id):
-                    _push_task_event(task_id, {'status': 'cancelled'})
-                    return
-                futures = [
-                    executor.submit(_run_brand_single, task_id, chunk, file_url, strategy,len(brand_ls),len(tasks),chunkIndex+1)
-                    for chunkIndex,(chunk, file_url) in enumerate(tasks)
-                ]
-                for future in as_completed(futures):
-                    if _is_task_cancelled(task_id):
-                        for f in futures:
-                            f.cancel()
-                        _push_task_event(task_id, {'status': 'cancelled'})
-                        return
-                    future.result()
-        _push_task_event(task_id, {'status': 'success'})
-    except Exception as e:
-        print("执行出错",traceback.format_exc())
-        _push_task_event(task_id, {'status': 'failed', 'error_message': str(e)})
-    print("执行完成")
-
-
-def _parse_json(val, default=None):
-    if val is None:
-        return default if default is not None else []
-    if isinstance(val, (list, dict)):
-        return val
-    try:
-        return json.loads(val)
-    except Exception:
-        return default if default is not None else []
-
-
-def _is_url(s):
-    if not isinstance(s, str) or not s.strip():
-        return False
-    return s.strip().startswith('http://') or s.strip().startswith('https://')
-
-
-def _normalize_result_paths(raw):
-    """
-    将 result_paths 规范化为 (url_list, zip_url)。
-    支持旧格式 list 或新格式 dict {"urls": [...], "zip_url": "..."}。
-    """
-    if not raw:
-        return [], None
-    if isinstance(raw, dict):
-        urls = raw.get('urls') or []
-        if not isinstance(urls, list):
-            urls = []
-        zip_url = raw.get('zip_url')
-        if zip_url and not isinstance(zip_url, str):
-            zip_url = None
-        return urls, zip_url
-    if isinstance(raw, list):
-        return raw, None
-    return [], None
-
-
-@brand_bp.route('/api/brand/expand-folder', methods=['POST'])
-@login_required
-def api_brand_expand_folder():
-    """展开文件夹，返回其下所有 .xlsx 文件路径列表"""
-    try:
-        _, err = _get_user_id_or_error()
-        if err:
-            return err
-        data = request.get_json() or {}
-        folder = (data.get('folder') or '').strip()
-        if not folder:
-            return jsonify({'success': False, 'error': '请提供 folder 路径'}), 400
-        paths = _expand_folder_xlsx(folder)
-        return jsonify({'success': True, 'paths': paths})
-    except Exception as e:
-        return jsonify({'success': False, 'error': str(e)}), 500
-
-def _expand_folder_xlsx_recursive_items(folder_path):
-    """返回文件夹下所有 .xlsx 文件的绝对路径和相对路径列表（递归）"""
-    if not folder_path or not os.path.isdir(folder_path):
-        return []
-    items = []
-    root = os.path.normpath(folder_path)
-    for current_root, _, filenames in os.walk(root):
-        for name in filenames:
-            if not (name.endswith('.xlsx') or name.endswith('.XLSX')):
-                continue
-            absolute_path = os.path.normpath(os.path.join(current_root, name))
-            relative_path = os.path.relpath(absolute_path, root).replace('\\', '/')
-            items.append({
-                'absolutePath': absolute_path,
-                'relativePath': relative_path,
-            })
-    items.sort(key=lambda item: item['relativePath'])
-    return items
-
-@brand_bp.route('/api/brand/expand-folder-recursive', methods=['POST'])
-@login_required
-def api_brand_expand_folder_recursive():
-    """递归展开文件夹，返回 .xlsx 文件绝对路径及相对路径列表"""
-    try:
-        _, err = _get_user_id_or_error()
-        if err:
-            return err
-        data = request.get_json() or {}
-        folder = (data.get('folder') or '').strip()
-        if not folder:
-            return jsonify({'success': False, 'error': '请提供 folder 路径'}), 400
-        items = _expand_folder_xlsx_recursive_items(folder)
-        return jsonify({'success': True, 'items': items})
-    except Exception as e:
-        return jsonify({'success': False, 'error': str(e)}), 500
-
-
-@brand_bp.route('/api/brand/run', methods=['POST'])
-# @login_required
-def api_brand_run():
-    """立即运行：创建任务并后台执行，立即返回 task_id，前端可轮询进度与取消"""
-    try:
-        data = request.get_json() or {}
-        paths = data.get('paths') or []
-        # task_type: 1=立即执行，2=添加任务；此接口默认 1
-        try:
-            task_type = int(data.get('task_type') or 1)
-        except Exception:
-            task_type = 1
-        if task_type not in (1, 2):
-            task_type = 1
-        strategy = (data.get('strategy') or 'Terms').strip()
-        if strategy not in ('Terms', 'Simple'):
-            strategy = 'Terms'
-        if not isinstance(paths, list):
-            paths = []
-        paths = [p.strip() for p in paths if p and isinstance(p, str) and os.path.isfile(p.strip())]
-        if not paths:
-            return jsonify({'success': False, 'error': '没有有效的 xlsx 文件路径'}), 400
-        # 先上传到 OSS，获取链接再入库
-        user_id, err = _get_user_id_or_error()
-        if err:
-            return err
-        urls = []
-        for p in paths:
-            url, err = _upload_local_xlsx_to_oss(p, user_id)
-            if err:
-                return jsonify({'success': False, 'error': f'上传文件失败: {os.path.basename(p)} - {err}'}), 500
-            base_name = os.path.basename(p)
-            urls.append({"fileUrl": url,"originalFilename": base_name,"relativePath": p })
-
-        # 请求提交
-        resp = requests.post(f"{JAVA_API_BASE}/api/brand/tasks?userId={user_id}",headers={
-            "content-type":"application/json",
-        },data=json.dumps({ "files": urls, "strategy": strategy,"taskType": 1,"archiveName": ""}))
-        print({ "files": urls, "strategy": strategy,"taskType": 1,"archiveName": ""})
-        print(f"{JAVA_API_BASE}/api/brand/tasks?userId={user_id}")
-        resp_data = resp.json()
-        # print(f"{JAVA_API_BASE}/api/brand/tasks?userId={user_id} 返回：",resp_data,"状态：",resp.status_code)
-        if resp_data.get("success"):
-            task_id = resp_data.get("data").get("taskId")
-            data = resp_data.get("data")
-            threading.Thread(target=_background_brand_task, args=(task_id,data), daemon=True).start()
-            return jsonify({'success': True, 'task_id': task_id})
-        else:
-            print(resp_data)
-            return jsonify({'success': False, 'error': "请求接口失败"}), 500
-
-    except Exception as e:
-        traceback.print_exc()
-        return jsonify({'success': False, 'error': str(e)}), 500
-
-
-@brand_bp.route('/api/brand/tasks', methods=['GET', 'POST'])
-# @login_required
-def api_brand_tasks():
-    """GET: 获取当前用户的任务列表；POST: 添加任务（后台执行）"""
-    if request.method == 'GET':
-        try:
-            user_id, err = _get_user_id_or_error()
-            if err:
-                return err
-            resp = requests.get(f"{JAVA_API_BASE}/api/brand/tasks", params={
-                "userId": user_id
-            })
-            resp_data = resp.json()
-            print("获取列表",resp.text)
-            if resp_data.get("success"):
-                items = resp_data.get("data").get("items")
-                return jsonify({'success': True, 'items': items})
-            return jsonify({'success': True, 'items': []})
-        except Exception as e:
-            traceback.print_exc()
-            print("获取列表失败",e)
-            return jsonify({'success': False, 'error': str(e)}), 500
-    # POST
-    try:
-        data = request.get_json() or {}
-        paths = data.get('paths') or []
-        # task_type: 1=立即执行，2=添加任务；此接口默认 2
-        try:
-            task_type = int(data.get('task_type') or 2)
-        except Exception:
-            task_type = 2
-        if task_type not in (1, 2):
-            task_type = 2
-        strategy = (data.get('strategy') or 'Terms').strip()
-        if strategy not in ('Terms', 'Simple'):
-            strategy = 'Terms'
-        if not isinstance(paths, list):
-            paths = []
-        paths = [p.strip() for p in paths if p and isinstance(p, str)]
-        if not paths:
-            return jsonify({'success': False, 'error': '请提供至少一个文件路径或链接'}), 400
-        user_id, err = _get_user_id_or_error()
-        if err:
-            return err
-        urls = []
-        for p in paths:
-            url, err = _upload_local_xlsx_to_oss(p, user_id)
-            if err:
-                return jsonify({'success': False, 'error': f'上传文件失败: {os.path.basename(p)} - {err}'}), 500
-            base_name = os.path.basename(p)
-            urls.append({"fileUrl": url, "originalFilename": base_name, "relativePath": p})
-        params = {
-            "userId": user_id
-        }
-        # resp = requests.post(f"{JAVA_API_BASE}/api/brand/tasks?userId={user_id}",headers={
-        #     "content-type":"application/json",
-        # },data=json.dumps({ "files": urls, "strategy": strategy,"taskType": 1,"archiveName": ""}))
-        req_data = {"files": urls, "strategy": strategy, "taskType": 2, "archiveName": ""}
-        resp = requests.post(f"{JAVA_API_BASE}/api/brand/tasks?userId={user_id}", headers={"content-type": "application/json"},
-                             data=json.dumps(req_data))
-        print(req_data)
-        # print(f"{JAVA_API_BASE}/api/brand/tasks?userId={user_id}，返回", resp.text)
-        resp_data = resp.json()
-        if resp_data.get("success"):
-            task_id = resp_data.get("data").get("taskId")
-            data = resp_data.get("data")
-            return jsonify({'success': True, 'task_id': task_id})
-        return jsonify({'success': False, 'task_id': "请求异常"})
-    except Exception as e:
-        return jsonify({'success': False, 'error': str(e)}), 500
-
-
-@brand_bp.route('/api/brand/tasks/<int:task_id>')
-# @login_required
-def api_brand_task_detail(task_id):
-    """获取单个任务详情（用于轮询状态）"""
-    try:
-        resp = requests.get(f"{JAVA_API_BASE}/api/brand/tasks/{task_id}")
-        resp_data = resp.json()
-        if resp_data.get("success"):
-            task = resp_data["data"]["task"]
-            return jsonify({
-                'success': True,
-                'task': task
-            })
-    except Exception as e:
-        return jsonify({'success': False, 'error': str(e)}), 500
-
-
-@brand_bp.route('/api/brand/tasks/<int:task_id>/line-progress')
-# @login_required
-def api_brand_task_line_progress(task_id):
-    """
-    获取任务的“当前文件行级进度”（当前行数/总行数）。
-    该信息仅存放在内存字典 _task_line_progress 中，不写入数据库。
-    """
-    try:
-        resp = requests.get(f"{JAVA_API_BASE}/api/brand/tasks/{task_id}")
-        resp_data = resp.json()
-        if resp_data.get("success"):
-            if resp_data["data"]["line_progress"]["has_progress"]:
-                info = resp_data["data"]["line_progress"]["info"]
-                resp = {
-                    'file_index': int(info.get('file_index') or 0),
-                    'file_total': int(info.get('file_total') or 0),
-                    'file_name': info.get("file_name",""),
-                    'current_line': int(info.get('current_line') or 0),
-                    'total_lines': int(info.get('total_lines') or 0),
-                }
-                return jsonify({'success': True, 'has_progress': True, 'info': resp})
-        raise RuntimeError("获取进度失败")
-    except Exception as e:
-        return jsonify({'success': False, 'error': str(e)}), 500
-
-
-@brand_bp.route('/api/brand/tasks/<int:task_id>/events')
-# @login_required
-def api_brand_task_events(task_id):
-    """SSE：任务完成时后端主动推送事件，前端监听后隐藏进度条与取消按钮"""
-    user_id, err = _get_user_id_or_error()
-    if err:
-        return err
-
-    def _task_status_event():
-        conn = get_db()
-        try:
-            with conn.cursor() as cur:
-                cur.execute(
-                    "SELECT status, error_message FROM brand_crawl_tasks WHERE id = %s AND user_id = %s",
-                    (task_id, user_id)
-                )
-                row = cur.fetchone()
-        finally:
-            conn.close()
-        if not row:
-            return None
-        st = (row.get('status') or '').lower()
-        if st in ('success', 'failed', 'cancelled'):
-            return {'status': st, 'error_message': (row.get('error_message') or '').strip() or None}
-        return None
-
-    # 若任务已处于终态，直接返回一条事件后结束
-    ev = _task_status_event()
-    if ev is not None:
-        def _one_shot():
-            yield "data: " + json.dumps(ev, ensure_ascii=False) + "\n\n"
-        return Response(
-            _one_shot(),
-            mimetype='text/event-stream',
-            headers={'Cache-Control': 'no-cache', 'X-Accel-Buffering': 'no'}
-        )
-
-    # 否则注册队列，等待后台任务完成时推送
-    q = Queue()
-    with _task_event_lock:
-        _task_event_queues.setdefault(task_id, []).append(q)
-
-    def _stream():
-        try:
-            while True:
-                try:
-                    event = q.get(timeout=20)
-                    yield "data: " + json.dumps(event, ensure_ascii=False) + "\n\n"
-                    return
-                except Empty:
-                    yield ": keepalive\n\n"
-        finally:
-            with _task_event_lock:
-                lst = _task_event_queues.get(task_id, [])
-                if q in lst:
-                    lst.remove(q)
-                if not lst:
-                    _task_event_queues.pop(task_id, None)
-
-    return Response(
-        _stream(),
-        mimetype='text/event-stream',
-        headers={'Cache-Control': 'no-cache', 'X-Accel-Buffering': 'no'}
-    )
-
-
-@brand_bp.route('/api/brand/tasks/<int:task_id>/cancel', methods=['POST'])
-# @login_required
-def api_brand_task_cancel(task_id):
-    """取消正在执行或等待中的任务（pending/running 均可取消）"""
-    try:
-        user_id, err = _get_user_id_or_error()
-        if err:
-            return err
-
-
-        resp = requests.post(
-            f"{JAVA_API_BASE}/api/brand/tasks/{task_id}/cancel",
-            headers={"accept": "application/json"},
-            timeout=20
-        )
-        try:
-            resp_data = resp.json()
-        except Exception:
-            return jsonify({'success': False, 'error': '取消接口返回非 JSON'}), 500
-        if not resp_data.get('success'):
-            return jsonify({'success': False, 'error': '第三方取消任务失败'}), 400
-
-        _mark_task_cancelled(task_id)
-        _push_task_event(task_id, {'status': 'cancelled'})
-        return jsonify({'success': True})
-    except Exception as e:
-        return jsonify({'success': False, 'error': str(e)}), 500
-
-
-@brand_bp.route('/api/brand/tasks/<int:task_id>', methods=['DELETE'])
-@login_required
-def api_brand_task_delete(task_id):
-    """删除任务（仅限非 running 状态）"""
-    try:
-        user_id, err = _get_user_id_or_error()
-        if err:
-            return err
-
-        resp = requests.delete(
-            f"{JAVA_API_BASE}/api/brand/tasks/{task_id}",
-            headers={"accept": "application/json"},
-            timeout=20
-        )
-        try:
-            resp_data = resp.json()
-        except Exception:
-            return jsonify({'success': False, 'error': '取消接口返回非 JSON'}), 500
-        if not resp_data.get('success'):
-            return jsonify({'success': False, 'error': '第三方取消任务失败'}), 400
-        return jsonify({'success': True})
-    except Exception as e:
-        return jsonify({'success': False, 'error': str(e)}), 500
-
-
-@brand_bp.route('/api/brand/download/<int:task_id>')
-@login_required
-def api_brand_download(task_id):
-    """下载任务结果：优先使用 OSS zip_url 重定向；否则本地/单链接/多链接按原逻辑处理"""
-    try:
-        user_id, err = _get_user_id_or_error()
-        if err:
-            return err
-
-        conn = get_db()
-        with conn.cursor() as cur:
-            cur.execute(
-                "SELECT result_paths FROM brand_crawl_tasks WHERE id = %s AND user_id = %s",
-                (task_id, user_id)
-            )
-            row = cur.fetchone()
-        conn.close()
-        if not row or not row.get('result_paths'):
-            return jsonify({'success': False, 'error': '无结果可下载'}), 404
-        raw = row['result_paths']
-        if isinstance(raw, str):
-            raw = _parse_json(raw)
-        url_list, zip_url = _normalize_result_paths(raw)
-        # 新格式：有 zip_url 直接重定向到 OSS
-        if zip_url and _is_url(zip_url):
-            return redirect(zip_url, code=302)
-
-        # 兼容旧格式：result_paths 可能为 list（本地路径或 url）
-        if not url_list and isinstance(raw, list):
-            url_list = raw
-        local_paths = [p for p in url_list if isinstance(p, str) and not _is_url(p) and os.path.isfile(p)]
-        url_paths = [p.strip() for p in url_list if isinstance(p, str) and _is_url(p)]
-
-        if len(url_paths) == 1 and not local_paths:
-            return redirect(url_paths[0], code=302)
-
-        if len(local_paths) == 1 and not url_paths:
-            return send_file(
-                local_paths[0],
-                as_attachment=True,
-                download_name=os.path.basename(local_paths[0])
-            )
-
-        if local_paths or url_paths:
-            buf = io.BytesIO()
-            with zipfile.ZipFile(buf, 'w', zipfile.ZIP_DEFLATED) as zf:
-                for p in local_paths:
-                    zf.write(p, os.path.basename(p))
-                for url in url_paths:
-                    try:
-                        import requests as req
-                        r = req.get(url, timeout=30, stream=True)
-                        r.raise_for_status()
-                        name = os.path.basename(urlparse(url).path) or ('file_%s' % (url_paths.index(url)))
-                        if not name or name == 'file_%s' % url_paths.index(url):
-                            name = 'download_%s' % url_paths.index(url)
-                        zf.writestr(name, r.content)
-                    except Exception:
-                        pass
-            buf.seek(0)
-            return send_file(
-                buf,
-                mimetype='application/zip',
-                as_attachment=True,
-                download_name='brand_task_%s.zip' % task_id
-            )
-
-        return jsonify({'success': False, 'error': '结果文件不存在或链接不可用'}), 404
-    except Exception as e:
-        return jsonify({'success': False, 'error': str(e)}), 500
-
-

app/blueprints/image.py

@@ -13,10 +13,10 @@ import subprocess
 import requests
 from urllib.parse import urlparse, quote
 
-from flask import Blueprint, request, jsonify, Response, session, send_file
+from flask import Blueprint, request, jsonify, Response, send_file
 from PIL import Image
 
-from app_common import get_db, login_required, BASE_DIR
+from app_common import get_db, login_required, current_user_id, BASE_DIR
 from config import STITCH_WORKFLOW_ID,client_name
 
 image_bp = Blueprint('image', __name__)
@@ -146,11 +146,12 @@ def api_generate():
                     except (TypeError, ValueError):
                         hid = None
                 conn = get_db()
+                _uid = current_user_id()
                 with conn.cursor() as cur:
                     if hid is not None and hid > 0:
                         cur.execute(
                             "SELECT result_urls FROM image_history WHERE id=%s AND user_id=%s",
-                            (hid, session['user_id']),
+                            (hid, _uid),
                         )
                         row = cur.fetchone()
                         existing_urls = []
@@ -182,7 +183,7 @@ def api_generate():
                                 _json.dumps(_sanitize_params_for_history(params)),
                                 _json.dumps(merged_result_urls),
                                 hid,
-                                session['user_id'],
+                                _uid,
                             ),
                         )
                         if cur.rowcount > 0:
@@ -192,7 +193,7 @@ def api_generate():
                             """INSERT INTO image_history (user_id, panel_type, original_urls, params, result_urls, long_image_url)
                                VALUES (%s, %s, %s, %s, %s, %s)""",
                             (
-                                session['user_id'],
+                                _uid,
                                 params.get('panel_type', ''),
                                 _json.dumps(result.get('original_urls') or []),
                                 _json.dumps(_sanitize_params_for_history(params)),
@@ -366,7 +367,7 @@ def api_history():
         conn = get_db()
         with conn.cursor() as cur:
             where_user = "user_id = %s"
-            params_where = [session['user_id']]
+            params_where = [current_user_id()]
             if panel_type:
                 where_user += " AND panel_type = %s"
                 params_where.append(panel_type)

app/blueprints/main.py

@@ -1,23 +1,24 @@
-"""
-主页面蓝图：首页、home、图片工作台、品牌页、静态文件、Logo
-"""
+"""
+主页面蓝图：首页、home、图片工作台、品牌页、静态文件、Logo
+"""
 import os
 from flask import Blueprint, send_file, render_template_string
-
-from app_common import (
-    get_db,
-    _render_html,
-    _is_session_user_valid,
-    login_required,
-    admin_required,
-    STATIC_DIR,
-    BASE_DIR,
-    ASSETS_DIR
-)
-from flask import redirect, url_for, session
-from flask import Flask, request, Response, stream_with_context
-import requests
-
+
+from app_common import (
+    get_db,
+    _render_html,
+    login_required,
+    admin_required,
+    current_user_id,
+    current_username,
+    STATIC_DIR,
+    BASE_DIR,
+    ASSETS_DIR
+)
+from flask import redirect, url_for
+from flask import Flask, request, Response, stream_with_context
+import requests
+
 from config import base_url,version,JAVA_API_BASE
 
 main_bp = Blueprint('main', __name__)
@@ -63,35 +64,36 @@ def _resolve_asset_filename(filename):
             return matches[0]
 
     return safe_name
-
-
-@main_bp.route('/')
-def index():
-    if session.get('user_id') and _is_session_user_valid():
-        return redirect(url_for('main.home'))
-    return redirect(url_for('auth.login'))
-
-
-@main_bp.route('/home')
-@login_required
-def home():
-    try:
-        conn = get_db()
-        with conn.cursor() as cur:
-            cur.execute("SELECT username, is_admin FROM users WHERE id = %s", (session['user_id'],))
-            row = cur.fetchone()
-        conn.close()
-        return _render_html('home.html', username=row.get('username', ''), is_admin=bool(row.get('is_admin')), user_id=session.get('user_id'),baseUrl=base_url,version=version)
-    except Exception:
-        return _render_html('home.html', username=session.get('username', ''), is_admin=False, user_id=session.get('user_id'),baseUrl=base_url,version=version)
-
-
-@main_bp.route('/image')
-@login_required
-def wb():
-    return _render_html('index.html')
-
-
+
+
+@main_bp.route('/')
+def index():
+    if current_user_id():
+        return redirect(url_for('main.home'))
+    return redirect(url_for('auth.login'))
+
+
+@main_bp.route('/home')
+@login_required
+def home():
+    uid = current_user_id()
+    try:
+        conn = get_db()
+        with conn.cursor() as cur:
+            cur.execute("SELECT username, is_admin FROM users WHERE id = %s", (uid,))
+            row = cur.fetchone()
+        conn.close()
+        return _render_html('home.html', username=row.get('username', ''), is_admin=bool(row.get('is_admin')), user_id=uid, baseUrl=base_url, version=version, java_api_base=JAVA_API_BASE)
+    except Exception:
+        return _render_html('home.html', username=current_username(), is_admin=False, user_id=uid, baseUrl=base_url, version=version, java_api_base=JAVA_API_BASE)
+
+
+@main_bp.route('/image')
+@login_required
+def wb():
+    return _render_html('index.html')
+
+
 @main_bp.route('/brand')
 @login_required
 def brand_page():
@@ -112,41 +114,41 @@ def brand_page():
                 if raw[:7] == b'gAAAAAB':
                     raise
                 content = raw.decode('utf-8', errors='replace')
-            return render_template_string(content, user_id=session.get('user_id'))
+            return render_template_string(content, user_id=current_user_id(), java_api_base=JAVA_API_BASE)
         except Exception:
             continue
-    return _render_html('brand.html', user_id=session.get('user_id'))
-
-
-@main_bp.route('/brand/legacy')
-@login_required
-def brand_page_legacy():
-    legacy_path = os.path.join(BASE_DIR, 'web_source', 'templates_backup', 'brand.html')
-    if not os.path.isfile(legacy_path):
-        return '', 404
-    with open(legacy_path, 'rb') as f:
-        content = f.read().decode('utf-8', errors='replace')
-    content = content.replace(
-        '<header class="top-bar">',
-        '<header class="top-bar" style="display:none !important;">',
-        1,
+    return _render_html('brand.html', user_id=current_user_id(), java_api_base=JAVA_API_BASE)
+
+
+@main_bp.route('/brand/legacy')
+@login_required
+def brand_page_legacy():
+    legacy_path = os.path.join(BASE_DIR, 'web_source', 'templates_backup', 'brand.html')
+    if not os.path.isfile(legacy_path):
+        return '', 404
+    with open(legacy_path, 'rb') as f:
+        content = f.read().decode('utf-8', errors='replace')
+    content = content.replace(
+        '<header class="top-bar">',
+        '<header class="top-bar" style="display:none !important;">',
+        1,
     )
     content = content.replace('height: calc(100vh - 56px);', 'height: 100vh;', 1)
-    return render_template_string(content, user_id=session.get('user_id'))
-
-
-
-
-@main_bp.route('/static/<path:filename>')
-def serve_static(filename):
-    """提供 static 目录及子目录下的静态文件访问。"""
-    filepath = os.path.normpath(os.path.join(STATIC_DIR, filename))
-    static_abs = os.path.abspath(STATIC_DIR)
-    file_abs = os.path.abspath(filepath)
-    if not file_abs.startswith(static_abs) or not os.path.isfile(file_abs):
-        return '', 404
-    return send_file(file_abs, as_attachment=False)
-
+    return render_template_string(content, user_id=current_user_id())
+
+
+
+
+@main_bp.route('/static/<path:filename>')
+def serve_static(filename):
+    """提供 static 目录及子目录下的静态文件访问。"""
+    filepath = os.path.normpath(os.path.join(STATIC_DIR, filename))
+    static_abs = os.path.abspath(STATIC_DIR)
+    file_abs = os.path.abspath(filepath)
+    if not file_abs.startswith(static_abs) or not os.path.isfile(file_abs):
+        return '', 404
+    return send_file(file_abs, as_attachment=False)
+
 
 @main_bp.route('/assets/<path:filename>')
 def serve_assets(filename):
@@ -165,8 +167,8 @@ def serve_assets(filename):
         if os.path.isfile(file_abs):
             return send_file(file_abs, as_attachment=False)
     return '', 404
-
-
+
+
 @main_bp.route('/new_web_source/<path:filename>')
 @login_required
 def serve_new_web_source(filename):
@@ -179,7 +181,7 @@ def serve_new_web_source(filename):
     if filename.lower().endswith('.html'):
         with open(file_abs, 'rb') as f:
             content = f.read().decode('utf-8', errors='replace')
-        raw_uid = session.get('user_id')
+        raw_uid = current_user_id()
         uid_value = str(int(raw_uid)) if str(raw_uid or '').isdigit() else '""'
         uid_script = (
             "\n<script>"
@@ -195,22 +197,22 @@ def serve_new_web_source(filename):
 
 @main_bp.route('/logo.jpg', methods=['GET'])
 def get_logo_image():
-    return send_file(os.path.join(BASE_DIR, "logo.jpg"), mimetype='image/jpeg')
-
-
-@main_bp.route('/newApi/<path:path>', methods=['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'])
-def proxy(path):
-    target_url = f"{JAVA_API_BASE}/{path}"
-
-    # 复制请求参数
-    params = request.args.to_dict()
-
-    # 处理请求头
-    headers = {}
-    for key, value in request.headers:
-        if key.lower() in ['host', 'content-length', 'connection']:
-            continue
-        headers[key] = value
+    return send_file(os.path.join(BASE_DIR, "logo.jpg"), mimetype='image/jpeg')
+
+
+@main_bp.route('/newApi/<path:path>', methods=['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'])
+def proxy(path):
+    target_url = f"{JAVA_API_BASE}/{path}"
+
+    # 复制请求参数
+    params = request.args.to_dict()
+
+    # 处理请求头
+    headers = {}
+    for key, value in request.headers:
+        if key.lower() in ['host', 'content-length', 'connection']:
+            continue
+        headers[key] = value
     ignore_url = [f"{JAVA_API_BASE}/api/delete-brand/tasks/batch",
                   f"{JAVA_API_BASE}/api/delete-brand/tasks/progress/batch",
                   f"{JAVA_API_BASE}/api/delete-brand/history",
@@ -229,36 +231,36 @@ def proxy(path):
             print("=============================")
         except Exception as e:
             print("打印失败", e)
-
-    try:
-        # 使用流式请求
-        req = requests.request(
-            method=request.method,
-            url=target_url,
-            params=params,
-            headers=headers,
-            data=request.get_data() if request.get_data() else None,
-            cookies=request.cookies,
-            stream=True,  # 启用流式传输
+
+    try:
+        # 使用流式请求
+        req = requests.request(
+            method=request.method,
+            url=target_url,
+            params=params,
+            headers=headers,
+            data=request.get_data() if request.get_data() else None,
+            cookies=request.cookies,
+            stream=True,  # 启用流式传输
             timeout=proxy_timeout
-        )
-
-        # 流式响应
-        def generate():
-            for chunk in req.iter_content(chunk_size=8192):
-                if chunk:
-                    yield chunk
-
-        # 构建响应
-        response = Response(stream_with_context(generate()), status=req.status_code)
-
-        # 复制响应头
-        for key, value in req.headers.items():
-            if key.lower() not in ['content-encoding', 'content-length', 'transfer-encoding', 'connection']:
-                response.headers[key] = value
-
-        return response
-
+        )
+
+        # 流式响应
+        def generate():
+            for chunk in req.iter_content(chunk_size=8192):
+                if chunk:
+                    yield chunk
+
+        # 构建响应
+        response = Response(stream_with_context(generate()), status=req.status_code)
+
+        # 复制响应头
+        for key, value in req.headers.items():
+            if key.lower() not in ['content-encoding', 'content-length', 'transfer-encoding', 'connection']:
+                response.headers[key] = value
+
+        return response
+
     except requests.exceptions.Timeout:
         print(f"后端服务超时：target_url={target_url}, timeout={proxy_timeout}")
         return Response("后端服务超时", status=504)

app/config.py

@@ -50,7 +50,6 @@ file_url_pre = f"https://{bucket}.oss-cn-hangzhou.aliyuncs.com/"
 
 os.environ['OSS_ACCESS_KEY_ID'] = accessKeyId
 os.environ['OSS_ACCESS_KEY_SECRET'] = accessKeySecret
-os.environ['SECRET_KEY'] = "ddffc7c1d02121d9554d7b080b2511b6"
 
 
 debug = True

app/jwt_util.py

@@ -0,0 +1,83 @@
+"""
+JWT 工具：解析 Java 端签发的 token、从请求中提取 token。
+与 Java 端 JwtService 共用同一个 HS256 密钥（AIIMAGE_JWT_SECRET）。
+"""
+import os
+import sys
+from typing import Optional, Tuple
+
+from flask import request
+
+try:
+    import jwt as pyjwt
+    _PYJWT_IMPORT_ERROR = None
+except ImportError as _e:
+    pyjwt = None
+    _PYJWT_IMPORT_ERROR = _e
+    # 启动时立刻给出醒目提示，避免上线后才发现一直 401
+    print(
+        "[auth] WARNING: PyJWT 未安装，所有依赖 JWT 的接口都会返回 401。"
+        " 请执行 `pip install PyJWT==2.10.1` 或 `pip install -r requirements.txt`。",
+        file=sys.stderr,
+    )
+
+
+_DEFAULT_SECRET = "please-change-this-secret-please-rotate-at-least-32-bytes"
+COOKIE_NAME = os.getenv("AIIMAGE_AUTH_COOKIE_NAME", "aiimage_token")
+
+
+def _signing_key() -> bytes:
+    """与 Java JwtService.signingKey 保持一致：UTF-8 字节，不足 32 字节右侧补 0。"""
+    secret = os.getenv("AIIMAGE_JWT_SECRET", _DEFAULT_SECRET)
+    key_bytes = secret.encode("utf-8")
+    if len(key_bytes) < 32:
+        key_bytes = key_bytes + b"\x00" * (32 - len(key_bytes))
+    return key_bytes
+
+
+def parse_token_with_reason(token: str) -> Tuple[Optional[dict], Optional[str]]:
+    """解析 JWT，返回 (payload, error_reason)。
+    payload 命中时 error_reason 为 None；失败时 payload 为 None，error_reason 描述根因。"""
+    if not token:
+        return None, "token 为空"
+    if pyjwt is None:
+        return None, f"PyJWT 未安装（{_PYJWT_IMPORT_ERROR}）"
+    # 打印 token 头，便于发现 alg 不是 HS256 等情况（不验签，仅 base64 解码 header）
+    try:
+        header = pyjwt.get_unverified_header(token)
+    except Exception as e:
+        return None, f"无法解析 token header: {type(e).__name__}: {e}"
+    alg = header.get("alg") or "?"
+    try:
+        payload = pyjwt.decode(token, _signing_key(), algorithms=["HS256", "HS384", "HS512"])
+    except Exception as e:
+        # 常见：ExpiredSignatureError / InvalidSignatureError / DecodeError / InvalidAlgorithmError
+        return None, f"{type(e).__name__}: {e} (token alg={alg})"
+    sub = payload.get("sub")
+    try:
+        user_id = int(sub) if sub is not None else None
+    except (TypeError, ValueError):
+        return None, f"sub 字段非法: {sub!r}"
+    if user_id is None:
+        return None, "payload 缺少 sub 字段"
+    return {
+        "user_id": user_id,
+        "username": payload.get("username") or "",
+        "device_id": payload.get("deviceId") or "",
+    }, None
+
+
+def parse_token(token: str) -> Optional[dict]:
+    """解析 JWT，返回 {user_id, username, device_id}；失败返回 None。"""
+    payload, _ = parse_token_with_reason(token)
+    return payload
+
+
+def get_token_from_request() -> str:
+    """优先从 Authorization: Bearer 取，其次从 cookie 取。"""
+    auth = request.headers.get("Authorization", "")
+    if auth.startswith("Bearer "):
+        token = auth[len("Bearer "):].strip()
+        if token:
+            return token
+    return (request.cookies.get(COOKIE_NAME) or "").strip()

app/main.py

@@ -20,6 +20,7 @@ import subprocess
 from amazon.del_brand import kill_process
 from app import run_app
 from generate_api import generate
+from tool.devices import DeviceIDGenerator
 
 
 with open("version.txt","w",encoding="utf-8") as file:
@@ -347,6 +348,13 @@ class WindowAPI:
         except Exception as e:
             return {'success': False, 'error': str(e)}
 
+    def get_device_id(self):
+        """暴露给 HTML 的设备指纹接口：复用桌面端硬件特征生成 64 位 SHA256 ID。"""
+        try:
+            return {'success': True, 'device_id': DeviceIDGenerator().get_device_id()}
+        except Exception as e:
+            return {'success': False, 'error': str(e)}
+
     def get_detail_del(self,task_id):
         """获取正在执行的删除品牌任务详情"""
         task_info = runing_task.get(task_id)
@@ -432,7 +440,7 @@ def main():
     
     api = WindowAPI(window)
     window.expose(api.close, api.minimize, api.maximize, api.toggle_maximize, generate_images, api.save_image, api.save_image_to_folder, api.select_folder, api.select_brand_xlsx_files, api.select_brand_folder,
-                  api.save_file_from_url, api.save_template_xlsx,api.save_template_zip,api.upload_file_to_java,api.open_external_url,api.enqueue_json,api.get_detail_del,api.save_file_from_url_new)
+                  api.save_file_from_url, api.save_template_xlsx,api.save_template_zip,api.upload_file_to_java,api.open_external_url,api.enqueue_json,api.get_detail_del,api.save_file_from_url_new,api.get_device_id)
     webview.start(
         debug=True,
         storage_path=cache_path,

app/requirements.txt

@@ -54,6 +54,7 @@ pyinstaller==6.19.0
 pyinstaller-hooks-contrib==2026.3
 PyMsgBox==2.0.1
 PyMySQL==1.1.2
+PyJWT==2.10.1
 pyperclip==1.11.0
 PyQt5==5.15.11
 PyQt5-Qt5==5.15.2

app/web_source/admin.html

@@ -236,6 +236,29 @@
 
     <script>
         (function() {
+            var JAVA_API_BASE = "{{ java_api_base or '' }}".replace(/\/+$/, '');
+            var AUTH_TOKEN_KEY = 'aiimage_auth_token';
+            function buildJavaUrl(path) { return JAVA_API_BASE + path; }
+            function getAuthToken() {
+                try { return localStorage.getItem(AUTH_TOKEN_KEY) || ''; } catch (e) { return ''; }
+            }
+            function authHeaders(extra) {
+                var headers = extra || {};
+                var token = getAuthToken();
+                if (token) headers['Authorization'] = 'Bearer ' + token;
+                return headers;
+            }
+            function jsonHeaders() {
+                return authHeaders({ 'Content-Type': 'application/json' });
+            }
+            function parseJson(r) { return r.json().catch(function() { return {}; }); }
+            function errMsg(res) {
+                return (res && (res.message || res.error)) || '请求失败';
+            }
+            if (!JAVA_API_BASE) {
+                alert('Java 服务地址未配置，请联系管理员设置 java_api_base');
+            }
+
             // Tab 切换
             document.querySelectorAll('.tab').forEach(function(t) {
                 t.onclick = function() {
@@ -268,17 +291,21 @@
             }
             function loadUsers(page) {
                 userPage = page || 1;
-                fetch('/api/admin/users?' + buildUserListQuery(userPage))
-                    .then(function(r) { return r.json(); })
+                fetch(buildJavaUrl('/api/admin/users?' + buildUserListQuery(userPage)), {
+                    credentials: 'include',
+                    headers: authHeaders()
+                })
+                    .then(parseJson)
                     .then(function(res) {
                         var tbody = document.getElementById('userListBody');
                         if (!res.success) {
-                            tbody.innerHTML = '<tr><td colspan="6" class="empty-tip">加载失败: ' + (res.error || '') + '</td></tr>';
+                            tbody.innerHTML = '<tr><td colspan="6" class="empty-tip">加载失败: ' + errMsg(res) + '</td></tr>';
                             return;
                         }
-                        currentUserRole = res.current_user_role || 'admin';
-                        adminsList = res.admins || [];
-                        var items = res.items || [];
+                        var data = res.data || {};
+                        currentUserRole = data.current_user_role || 'admin';
+                        adminsList = data.admins || [];
+                        var items = data.items || [];
                         if (items.length === 0) {
                             tbody.innerHTML = '<tr><td colspan="6" class="empty-tip">暂无用户</td></tr>';
                         } else {
@@ -290,7 +317,7 @@
                                     '</td></tr>';
                             }).join('');
                         }
-                        renderPagination('userPagination', res.total, res.page, res.page_size, loadUsers);
+                        renderPagination('userPagination', data.total, data.page, data.page_size, loadUsers);
                         bindUserActions();
                         updateCreateFormByRole();
                         updateUserFilterByRole();
@@ -362,11 +389,15 @@
                 document.querySelectorAll('[data-delete]').forEach(function(btn) {
                     btn.onclick = function() {
                         if (!confirm('确定删除用户 "' + (btn.dataset.name || '') + '" 吗？')) return;
-                        fetch('/api/admin/user/' + btn.dataset.delete, { method: 'DELETE' })
-                            .then(function(r) { return r.json(); })
+                        fetch(buildJavaUrl('/api/admin/user/' + btn.dataset.delete), {
+                            method: 'DELETE',
+                            credentials: 'include',
+                            headers: authHeaders()
+                        })
+                            .then(parseJson)
                             .then(function(res) {
                                 if (res.success) { loadUsers(userPage); }
-                                else { alert(res.error || '删除失败'); }
+                                else { alert(errMsg(res)); }
                             });
                     };
                 });
@@ -393,22 +424,23 @@
                     return;
                 }
                 var body = { username: username, password: password, role: role };
-                if (role === 'normal' && currentUserRole === 'super_admin' && createdById) body.created_by_id = createdById;
-                fetch('/api/admin/user', {
+                if (role === 'normal' && currentUserRole === 'super_admin' && createdById) body.createdById = createdById;
+                fetch(buildJavaUrl('/api/admin/user'), {
                     method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
+                    credentials: 'include',
+                    headers: jsonHeaders(),
                     body: JSON.stringify(body)
                 })
-                .then(function(r) { return r.json(); })
+                .then(parseJson)
                 .then(function(res) {
                     if (res.success) {
-                        msgEl.textContent = res.msg || '创建成功';
+                        msgEl.textContent = res.message || '创建成功';
                         msgEl.classList.add('ok');
                         document.getElementById('username').value = '';
                         document.getElementById('password').value = '';
                         loadUsers(1);
                     } else {
-                        msgEl.textContent = res.error || '创建失败';
+                        msgEl.textContent = errMsg(res);
                         msgEl.classList.add('err');
                     }
                 })
@@ -429,20 +461,21 @@
                 if (password) body.password = password;
                 if (currentUserRole === 'super_admin' && editRoleEl && editRoleEl.offsetParent !== null)
                     body.role = editRoleEl.value || 'normal';
-                fetch('/api/admin/user/' + uid, {
+                fetch(buildJavaUrl('/api/admin/user/' + uid), {
                     method: 'PUT',
-                    headers: { 'Content-Type': 'application/json' },
+                    credentials: 'include',
+                    headers: jsonHeaders(),
                     body: JSON.stringify(body)
                 })
-                .then(function(r) { return r.json(); })
+                .then(parseJson)
                 .then(function(res) {
                     if (res.success) {
-                        msgEl.textContent = res.msg || '保存成功';
+                        msgEl.textContent = res.message || '保存成功';
                         msgEl.classList.add('ok');
                         document.getElementById('editUserModal').classList.remove('show');
                         loadUsers(userPage);
                     } else {
-                        msgEl.textContent = res.error || '保存失败';
+                        msgEl.textContent = errMsg(res);
                         msgEl.classList.add('err');
                     }
                 });
@@ -469,15 +502,19 @@
             }
             function loadHistory(page) {
                 historyPage = page || 1;
-                fetch('/api/admin/history?' + buildHistoryQuery(historyPage))
-                    .then(function(r) { return r.json(); })
+                fetch(buildJavaUrl('/api/admin/history?' + buildHistoryQuery(historyPage)), {
+                    credentials: 'include',
+                    headers: authHeaders()
+                })
+                    .then(parseJson)
                     .then(function(res) {
                         var tbody = document.getElementById('historyListBody');
                         if (!res.success) {
-                            tbody.innerHTML = '<tr><td colspan="5" class="empty-tip">加载失败: ' + (res.error || '') + '</td></tr>';
+                            tbody.innerHTML = '<tr><td colspan="5" class="empty-tip">加载失败: ' + errMsg(res) + '</td></tr>';
                             return;
                         }
-                        var items = res.items || [];
+                        var data = res.data || {};
+                        var items = data.items || [];
                         if (items.length === 0) {
                             tbody.innerHTML = '<tr><td colspan="5" class="empty-tip">暂无记录</td></tr>';
                         } else {
@@ -492,20 +529,24 @@
                                     '<div class="thumb-wrap">' + (thumbs || '-') + '</div></td></tr>';
                             }).join('');
                         }
-                        renderPagination('historyPagination', res.total, res.page, res.page_size, loadHistory);
+                        renderPagination('historyPagination', data.total, data.page, data.page_size, loadHistory);
                     })
                     .catch(function() {
                         document.getElementById('historyListBody').innerHTML = '<tr><td colspan="5" class="empty-tip">请求失败</td></tr>';
                     });
             }
             function loadUserOptions() {
-                fetch('/api/admin/users?page=1&page_size=999')
-                    .then(function(r) { return r.json(); })
+                fetch(buildJavaUrl('/api/admin/users?page=1&page_size=50'), {
+                    credentials: 'include',
+                    headers: authHeaders()
+                })
+                    .then(parseJson)
                     .then(function(res) {
                         var sel = document.getElementById('filterUser');
                         var cur = sel.value;
                         sel.innerHTML = '<option value="">全部用户</option>';
-                        (res.items || []).forEach(function(u) {
+                        var data = res.data || {};
+                        (data.items || []).forEach(function(u) {
                             var opt = document.createElement('option');
                             opt.value = u.id;
                             opt.textContent = u.username + ' (' + roleLabel(u.role || 'normal') + ')';
@@ -520,6 +561,9 @@
             function renderPagination(elId, total, page, pageSize, onPage) {
                 var el = document.getElementById(elId);
                 if (!el) return;
+                total = total || 0;
+                page = page || 1;
+                pageSize = pageSize || 15;
                 var totalPages = Math.max(1, Math.ceil(total / pageSize));
                 el.innerHTML = '<span>共 ' + total + ' 条</span>' +
                     '<button ' + (page <= 1 ? 'disabled' : '') + ' data-p="' + (page - 1) + '">上一页</button>' +

app/web_source/brand.html

@@ -818,6 +818,15 @@
                 return localStorage.getItem('uid') || '';
             }
 
+            var JAVA_API_BASE = "{{ java_api_base or '' }}".replace(/\/+$/, '');
+            var AUTH_TOKEN_KEY = 'aiimage_auth_token';
+            function buildJavaUrl(path) {
+                return JAVA_API_BASE + path;
+            }
+            function getAuthToken() {
+                try { return localStorage.getItem(AUTH_TOKEN_KEY) || ''; } catch (e) { return ''; }
+            }
+
             function withUidHeaders(headers) {
                 headers = headers || {};
                 headers.uid = getUid();
@@ -871,19 +880,28 @@
                         return;
                     }
                 } catch (e) { }
-                fetch('/api/admin/user/' + uid + '/column-permissions?menu_type=app', { credentials: 'same-origin' })
+                var token = getAuthToken();
+                if (!JAVA_API_BASE || !token) {
+                    showAllNavSections();
+                    finishNavPermissionLoading();
+                    return;
+                }
+                fetch(buildJavaUrl('/api/admin/permission-users/' + uid + '/column-permissions?menuType=app'), {
+                    credentials: 'include',
+                    headers: { 'Authorization': 'Bearer ' + token }
+                })
                     .then(function (r) { return r.json(); })
                     .then(function (res) {
                         showAllNavSections();
-                        if (!res || !res.success || !Array.isArray(res.items)) {
+                        if (!res || !res.success || !Array.isArray(res.data)) {
                             finishNavPermissionLoading();
                             return;
                         }
                         try {
-                            localStorage.setItem(cacheKey, JSON.stringify(res.items));
+                            localStorage.setItem(cacheKey, JSON.stringify(res.data));
                         } catch (e) { }
-                        var allowedKeys = res.items.map(function (item) {
-                            return (item.column_key || '').toLowerCase();
+                        var allowedKeys = res.data.map(function (item) {
+                            return (item.column_key || item.columnKey || '').toLowerCase();
                         });
                         document.querySelectorAll('.nav-section[data-column-key]').forEach(function (section) {
                             var key = (section.getAttribute('data-column-key') || '').toLowerCase();

app/web_source/home.html

@@ -193,7 +193,7 @@
             {% endif %}
             <span>{{ username }}</span>
             <button type="button" class="header-update-btn" id="homeUpdateToggle" title="检测更新">↻</button>
-            <a href="/logout" onclick="handleLogout()">退出</a>
+            <a href="/logout" onclick="return handleLogout(event);">退出</a>
             <div class="header-update-panel" id="homeUpdatePanel">
                 <div class="header-update-title"><span>↻</span> 软件更新</div>
                 <div class="update-block">
@@ -220,22 +220,29 @@
         function getAppPermissionCacheKey(uid) {
             return 'app_column_permissions:' + String(uid || '');
         }
-        // 权限校验：根据 column-permissions 接口按 column_key 显示入口
+        // 权限校验：根据 Java column-permissions 接口按 column_key 显示入口
         (function() {
             localStorage.setItem("uid",{{ user_id }})
             var uid = document.body.getAttribute('data-user-id');
             if (!uid) return;
             var cacheKey = getAppPermissionCacheKey(uid);
-            var baseUrl = window.location.origin;
-            var apiUrl = baseUrl + '/api/admin/user/' + uid + '/column-permissions';
-            fetch(apiUrl, { credentials: 'same-origin' })
+            var AUTH_TOKEN_KEY = 'aiimage_auth_token';
+            var JAVA_API_BASE = "{{ java_api_base or '' }}".replace(/\/+$/, '');
+            var token = '';
+            try { token = localStorage.getItem(AUTH_TOKEN_KEY) || ''; } catch (e) {}
+            if (!JAVA_API_BASE || !token) return;
+            var apiUrl = JAVA_API_BASE + '/api/admin/permission-users/' + uid + '/column-permissions?menuType=app';
+            fetch(apiUrl, {
+                credentials: 'include',
+                headers: { 'Authorization': 'Bearer ' + token }
+            })
                 .then(function(r) { return r.json(); })
                 .then(function(res) {
-                    if (!res || !res.success || !Array.isArray(res.items)) return;
+                    if (!res || !res.success || !Array.isArray(res.data)) return;
                     try {
-                        localStorage.setItem(cacheKey, JSON.stringify(res.items));
+                        localStorage.setItem(cacheKey, JSON.stringify(res.data));
                     } catch (e) {}
-                    var allowedKeys = res.items.map(function(item) { return (item.column_key || '').toLowerCase(); });
+                    var allowedKeys = res.data.map(function(item) { return (item.columnKey || item.column_key || '').toLowerCase(); });
                     document.querySelectorAll('.entrances .entrance-btn[data-column-key]').forEach(function(btn) {
                         var key = (btn.getAttribute('data-column-key') || '').toLowerCase();
                         btn.style.display = allowedKeys.indexOf(key) >= 0 ? '' : 'none';
@@ -255,16 +262,45 @@
             };
         });
 
-        function handleLogout() {
-            try{
-                localStorage.removeItem('maixiang_api_key');
-                var uid = document.body.getAttribute('data-user-id');
-                if (uid) {
-                    localStorage.removeItem(getAppPermissionCacheKey(uid));
-                }
-            }catch (e) {
-                console.log(e)
+        function handleLogout(ev) {
+            if (ev && ev.preventDefault) ev.preventDefault();
+            var AUTH_TOKEN_KEY = 'aiimage_auth_token';
+            var JAVA_API_BASE = "{{ java_api_base or '' }}".replace(/\/+$/, '');
+            var token = '';
+            try { token = localStorage.getItem(AUTH_TOKEN_KEY) || ''; } catch (e) {}
+
+            function cleanLocal() {
+                try {
+                    localStorage.removeItem('maixiang_api_key');
+                    localStorage.removeItem(AUTH_TOKEN_KEY);
+                    var uid = document.body.getAttribute('data-user-id');
+                    if (uid) {
+                        localStorage.removeItem(getAppPermissionCacheKey(uid));
+                    }
+                } catch (e) { console.log(e); }
             }
+
+            function gotoPythonLogout() {
+                cleanLocal();
+                window.location.href = '/logout';
+            }
+
+            if (!JAVA_API_BASE || !token) {
+                gotoPythonLogout();
+                return false;
+            }
+            // 先让 Java 端清 cookie/会话，再走 Python /logout 清 Python cookie
+            var headers = { 'Authorization': 'Bearer ' + token };
+            try {
+                fetch(JAVA_API_BASE + '/logout', {
+                    method: 'POST',
+                    credentials: 'include',
+                    headers: headers
+                }).then(gotoPythonLogout).catch(gotoPythonLogout);
+            } catch (e) {
+                gotoPythonLogout();
+            }
+            return false;
         }
 
         // 软件更新（与 index 设置中逻辑一致）
@@ -346,19 +382,6 @@
             };
             btnDownload.style.display = 'none';
         })();
-        // (function() {
-        //     fetch('/api/auth/check', { credentials: 'same-origin' })
-        //         .then(function(r) { return r.json(); })
-        //         .then(function(res) {
-        //             if (res.logged_in && res.redirect) {
-        //                 window.location.href = res.redirect;
-        //             }else{
-        //                 window.location.href = "/login"
-        //                 // handleLogout()
-        //             }
-        //         })
-        //         .catch(function() {});
-        // })();
     </script>
 </body>
 </html>

app/web_source/login.html

@@ -117,6 +117,10 @@
         </form>
     </div>
     <script>
+        var JAVA_API_BASE = "{{ java_api_base or '' }}";
+        var AUTH_TOKEN_KEY = 'aiimage_auth_token';
+        var DEVICE_ID_KEY = 'aiimage_device_id';
+
         function clearAppPermissionCaches() {
             try {
                 var keysToRemove = [];
@@ -132,55 +136,126 @@
             } catch (e) {}
         }
 
+        function waitForPywebview(timeoutMs) {
+            return new Promise(function(resolve) {
+                if (window.pywebview && window.pywebview.api && window.pywebview.api.get_device_id) {
+                    resolve(window.pywebview.api);
+                    return;
+                }
+                var done = false;
+                var finish = function() {
+                    if (done) return;
+                    done = true;
+                    var api = (window.pywebview && window.pywebview.api) || null;
+                    resolve(api);
+                };
+                window.addEventListener('pywebviewready', finish, { once: true });
+                setTimeout(finish, timeoutMs || 1500);
+            });
+        }
+
+        function fetchDeviceId() {
+            return waitForPywebview(2000).then(function(api) {
+                if (!api || typeof api.get_device_id !== 'function') {
+                    return '';
+                }
+                try {
+                    var ret = api.get_device_id();
+                    return Promise.resolve(ret).then(function(res) {
+                        if (res && res.success && res.device_id) {
+                            try { localStorage.setItem(DEVICE_ID_KEY, res.device_id); } catch (e) {}
+                            return res.device_id;
+                        }
+                        return '';
+                    }).catch(function() { return ''; });
+                } catch (e) {
+                    return '';
+                }
+            });
+        }
+
+        function buildJavaUrl(path) {
+            var base = (JAVA_API_BASE || '').replace(/\/+$/, '');
+            return base + path;
+        }
+
         (function() {
             var params = new URLSearchParams(window.location.search || '');
             if (params.get('logout') === '1' || params.get('switch') === '1') {
-                return;
+                try { localStorage.removeItem(AUTH_TOKEN_KEY); } catch (e) {}
             }
-            fetch('/api/auth/check', { credentials: 'same-origin' })
-                .then(function(r) { return r.json(); })
-                .then(function(res) {
-                    if (res.logged_in && res.redirect) {
-                        window.location.href = res.redirect;
-                    }
-                })
-                .catch(function() {});
         })();
+
         document.getElementById('loginForm').onsubmit = function(e) {
             e.preventDefault();
             var btn = document.getElementById('btnLogin');
             btn.disabled = true;
             btn.textContent = '登录中...';
             var form = e.target;
-            var fd = new FormData(form);
-            fetch(form.action, {
-                method: 'POST',
-                body: fd,
-                headers: { 'X-Requested-With': 'XMLHttpRequest' }
-            })
-            .then(function(r) { return r.json(); })
-            .then(function(res) {
-                if (res.success) {
-<<<<<<<< HEAD:backend/web_source/login.html
-                    window.location.href = res.redirect || '/admin';
-========
-                    clearAppPermissionCaches();
-                    window.location.href = res.redirect || '/home';
->>>>>>>> gitee/master:app/web_source/login.html
-                } else {
-                    var errEl = document.querySelector('.error-msg');
-                    if (!errEl) {
-                        errEl = document.createElement('p');
-                        errEl.className = 'error-msg';
-                        form.insertBefore(errEl, form.firstChild);
-                    }
-                    errEl.textContent = res.error || '登录失败';
-                    btn.disabled = false;
-                    btn.textContent = '登录';
+            var username = (form.username.value || '').trim();
+            var password = form.password.value || '';
+
+            function showError(msg) {
+                var errEl = document.querySelector('.error-msg');
+                if (!errEl) {
+                    errEl = document.createElement('p');
+                    errEl.className = 'error-msg';
+                    form.insertBefore(errEl, form.firstChild);
                 }
-            })
-            .catch(function() {
-                form.submit();
+                errEl.textContent = msg || '登录失败';
+                btn.disabled = false;
+                btn.textContent = '登录';
+            }
+
+            fetchDeviceId().then(function(deviceId) {
+                if (!deviceId) {
+                    showError('未获取到设备ID，请在桌面端打开');
+                    return;
+                }
+                var payload = { username: username, password: password, deviceId: deviceId };
+                return fetch(buildJavaUrl('/login'), {
+                    method: 'POST',
+                    credentials: 'include',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'X-Device-Id': deviceId,
+                        'X-Requested-With': 'XMLHttpRequest'
+                    },
+                    body: JSON.stringify(payload)
+                })
+                .then(function(r) { return r.json(); })
+                .then(function(res) {
+                    if (!res || !res.success) {
+                        showError((res && res.message) || '登录失败');
+                        return;
+                    }
+                    var data = res.data || {};
+                    if (data.token) {
+                        try { localStorage.setItem(AUTH_TOKEN_KEY, data.token); } catch (e) {}
+                    }
+                    // 把 Java 签发的 JWT 同步到 Python 套壳同源 cookie，供后续页面跳转携带
+                    return fetch('/api/auth/sync', {
+                        method: 'POST',
+                        credentials: 'same-origin',
+                        headers: {
+                            'Content-Type': 'application/json',
+                            'X-Requested-With': 'XMLHttpRequest'
+                        },
+                        body: JSON.stringify({ token: data.token })
+                    })
+                    .then(function(r) { return r.json().catch(function() { return {}; }); })
+                    .then(function() {
+                        clearAppPermissionCaches();
+                        window.location.href = '/home';
+                    })
+                    .catch(function() {
+                        clearAppPermissionCaches();
+                        window.location.href = '/home';
+                    });
+                })
+                .catch(function() {
+                    showError('网络异常，请稍后重试');
+                });
             });
         };
     </script>