修复中控内嵌：跨站 Cookie 被拦时用 embed_sso 维持登录。

SSO 写入 sessionStorage，fetch 自动带 X-Hub-Embed-SSO，避免期权链 API 401。

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/instance/instance_settings_register.py

@@ -44,6 +44,17 @@ def _api_login_required(hub_token_write_allowed: bool = False):
 
             # crypto_okx 可无 lib.hub;鉴权与中控 request_allowed 对齐
             allowed = bool(auth_disabled or logged_in)
+            if not allowed:
+                try:
+                    from lib.hub.hub_bridge_auth import hub_embed_sso_ok
+
+                    if hub_embed_sso_ok(request):
+                        session["logged_in"] = True
+                        session.permanent = True
+                        session.modified = True
+                        allowed = True
+                except Exception:
+                    pass
             if not allowed and hub_hdr and bridge and hub_hdr == bridge:
                 allowed = True
             if not allowed:

lib/instance/instance_static_lib.py

@@ -28,6 +28,7 @@ _COMMON_STATIC_ASSETS: dict[str, str] = {
     "journal_form_save.js": "application/javascript; charset=utf-8",
     "instance_page.css": "text/css; charset=utf-8",
     "instance_embed.js": "application/javascript; charset=utf-8",
+    "hub_embed_auth.js": "application/javascript; charset=utf-8",
     "instance_mobile_nav.js": "application/javascript; charset=utf-8",
     "instance_stats.js": "application/javascript; charset=utf-8",
     "instance_live.js": "application/javascript; charset=utf-8",

lib/instance/templates/embed_shell.html

@@ -3,6 +3,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+    <script src="/static/hub_embed_auth.js?v=1"></script>
     <script src="/static/instance_theme.js?v=51"></script>
     <script src="/static/autofill_guard.js?v=1"></script>
     <link rel="stylesheet" href="/static/instance_theme_early.css?v=4">