增加用户名

manual_trading_hub/static/app.js

@@ -264,8 +264,8 @@
       const el = document.getElementById("settings-meta-line");
       if (!el) return;
       const parts = [];
-      if (m.password_required) parts.push("已启用 HUB_PASSWORD 登录保护");
-      else parts.push("未设 HUB_PASSWORD（反代公网暴露时建议设置）");
+      if (m.password_required) parts.push("已启用用户名+密码登录");
+      else parts.push("未设 HUB_PASSWORD（反代公网暴露时建议设置 HUB_USERNAME + HUB_PASSWORD）");
       if (m.hub_bridge_token_set) parts.push("中控已配置 HUB_BRIDGE_TOKEN");
       else parts.push("中控未设 HUB_BRIDGE_TOKEN（实例需 APP_AUTH_DISABLED 或同令牌）");
       if (m.public_origin) parts.push("浏览器外链基址: " + m.public_origin);

manual_trading_hub/static/index.html

@@ -66,7 +66,7 @@
         <div class="hint-body">
           保存后写入 <code>hub_settings.json</code>。Flask / Agent 填本机地址即可；复盘链接可留空（由 Flask 地址自动生成）。<br />
           <code>HUB_DISABLED_IDS</code> 可强制关闭账户；<code>HUB_BRIDGE_TOKEN</code> 与实例一致，或实例 <code>APP_AUTH_DISABLED=true</code>。<br />
-          公网反代请在 hub <code>.env</code> 设置 <code>HUB_PASSWORD</code>；HTTPS 反代建议 <code>HUB_COOKIE_SECURE=true</code>。
+          公网反代请在 hub <code>.env</code> 设置 <code>HUB_USERNAME</code> 与 <code>HUB_PASSWORD</code>；HTTPS 反代建议 <code>HUB_COOKIE_SECURE=true</code>。
         </div>
       </details>
       <p id="settings-meta-line" class="settings-meta-line"></p>

manual_trading_hub/static/login.html

@@ -21,50 +21,57 @@
     </div>
     <form id="login-form" class="login-form" autocomplete="on">
       <label class="field">
-        <span>访问密码</span>
-        <input type="password" name="password" id="login-password" required autofocus placeholder="HUB_PASSWORD" />
+        <span>用户名</span>
+        <input type="text" name="username" id="login-username" required autocomplete="username" placeholder="HUB_USERNAME" />
+      </label>
+      <label class="field">
+        <span>密码</span>
+        <input type="password" name="password" id="login-password" required autocomplete="current-password" placeholder="HUB_PASSWORD" />
       </label>
       <button type="submit" class="primary login-submit">进入系统</button>
       <p id="login-err" class="login-err" hidden></p>
     </form>
-    <p class="login-foot">反代暴露公网时请在 hub <code>.env</code> 设置 <code>HUB_PASSWORD</code></p>
+    <p class="login-foot">在 hub <code>.env</code> 设置 <code>HUB_USERNAME</code> 与 <code>HUB_PASSWORD</code>（未设用户名时默认为 <code>admin</code>）</p>
   </div>
   <script>
     (function () {
       const form = document.getElementById("login-form");
       const err = document.getElementById("login-err");
+      const userInput = document.getElementById("login-username");
       const params = new URLSearchParams(location.search);
       const next = params.get("next") || "/monitor";
 
+      fetch("/api/auth/status")
+        .then((r) => r.json())
+        .then((s) => {
+          if (!s.required || s.logged_in) location.href = next;
+          if (s.username_hint && !userInput.value) userInput.value = s.username_hint;
+        })
+        .catch(() => {});
+
       form.onsubmit = async (e) => {
         e.preventDefault();
         err.hidden = true;
-        const pwd = document.getElementById("login-password").value;
+        const username = userInput.value.trim();
+        const password = document.getElementById("login-password").value;
         try {
           const r = await fetch("/api/auth/login", {
             method: "POST",
             headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ password: pwd }),
+            body: JSON.stringify({ username, password }),
           });
-          const j = await r.json();
-          if (j.ok) {
+          const j = await r.json().catch(() => ({}));
+          if (r.ok && j.ok) {
             location.href = next.startsWith("/") ? next : "/monitor";
             return;
           }
-          err.textContent = j.detail || j.msg || "密码错误";
+          err.textContent = j.detail || j.msg || "用户名或密码错误";
           err.hidden = false;
         } catch (ex) {
           err.textContent = String(ex);
           err.hidden = false;
         }
       };
-
-      fetch("/api/auth/status")
-        .then((r) => r.json())
-        .then((s) => {
-          if (!s.required || s.logged_in) location.href = next;
-        })
-        .catch(() => {});
     })();
   </script>
 </body>