修复中控内嵌：跨站 Cookie 被拦时用 embed_sso 维持登录。

SSO 写入 sessionStorage，fetch 自动带 X-Hub-Embed-SSO，避免期权链 API 401。

Co-authored-by: Cursor <cursoragent@cursor.com>

app.py

@@ -240,6 +240,16 @@ except Exception:
     _SESSION_DAYS = 7
 app.config["PERMANENT_SESSION_LIFETIME"] = timedelta(days=_SESSION_DAYS)
 app.config["SESSION_REFRESH_EACH_REQUEST"] = True
+# 中控跨站 iframe 嵌入:默认 SameSite=None;Secure,否则仅首屏有会话、后续 API 全 401
+_samesite = (os.getenv("SESSION_COOKIE_SAMESITE") or "None").strip() or "None"
+app.config["SESSION_COOKIE_SAMESITE"] = _samesite
+_secure_raw = (os.getenv("SESSION_COOKIE_SECURE") or "").strip().lower()
+if _secure_raw in ("1", "true", "yes", "on"):
+    app.config["SESSION_COOKIE_SECURE"] = True
+elif _secure_raw in ("0", "false", "no", "off"):
+    app.config["SESSION_COOKIE_SECURE"] = False
+elif _samesite.lower() == "none":
+    app.config["SESSION_COOKIE_SECURE"] = True
 from lib.instance.instance_embed_lib import attach_embed_templates, redirect_to_embed_shell_if_enabled
 from lib.instance.instance_static_lib import install_common_static
 
@@ -5157,6 +5167,17 @@ def login_required(f):
     def decorated(*args, **kwargs):
         if AUTH_DISABLED or bool(session.get("logged_in")):
             return f(*args, **kwargs)
+        # 中控 iframe:Cookie 可能被拦,改认 embed_sso
+        try:
+            from lib.hub.hub_bridge_auth import hub_embed_sso_ok
+
+            if hub_embed_sso_ok(request):
+                session["logged_in"] = True
+                session.permanent = True
+                session.modified = True
+                return f(*args, **kwargs)
+        except Exception:
+            pass
         # API 必须返回 JSON,否则前端 r.json() 会报 Unexpected token...
         path = request.path or ""
         wants_json = (
@@ -5165,7 +5186,7 @@ def login_required(f):
             or "application/json" in (request.headers.get("Accept") or "")
         )
         if wants_json:
-            return jsonify({"ok": False, "msg": "未登录或会话过期,请重新登录"}), 401
+            return jsonify({"ok": False, "msg": "未登录或会话过期,请从中控重新打开工作台"}), 401
         return redirect("/login")
     return decorated