修复

onchain_scout_gate/app/web.py

@@ -186,18 +186,19 @@ def create_app(settings: Settings) -> FastAPI:
         _root = _Path(__file__).resolve().parent.parent.parent
         if str(_root) not in sys.path:
             sys.path.insert(0, str(_root))
-        from nav_embed import install_nav_embed
+        from nav_embed import install_nav_embed, nav_session_middleware_kwargs
 
         install_nav_embed(app)
+        _sess_kw = nav_session_middleware_kwargs()
     except Exception:
-        pass
+        _sess_kw = {"same_site": "lax", "https_only": False}
     app.add_middleware(GZipMiddleware, minimum_size=800)
     app.add_middleware(
         SessionMiddleware,
         secret_key=settings.app.session_secret,
         max_age=60 * 60 * 24 * 7,
-        same_site="lax",
-        https_only=False,
+        same_site=_sess_kw.get("same_site", "lax"),
+        https_only=bool(_sess_kw.get("https_only", False)),
     )
     root_dir = Path(__file__).resolve().parent.parent
     templates = Jinja2Templates(directory=str(root_dir / "templates"))
@@ -318,6 +319,24 @@ def create_app(settings: Settings) -> FastAPI:
             return RedirectResponse("/dashboard", status_code=302)
         return templates.TemplateResponse("login.html", {"request": request, "error": "用户名或密码错误"})
 
+    @app.post("/api/auth/login")
+    async def api_auth_login(request: Request) -> JSONResponse:
+        if not settings.auth.enabled:
+            return JSONResponse({"ok": True, "redirect": "/dashboard"})
+        try:
+            body = await request.json()
+        except Exception:
+            return JSONResponse({"ok": False, "detail": "请求格式错误"}, status_code=400)
+        username = str(body.get("username") or "").strip()
+        password = str(body.get("password") or "")
+        ok_user = username == app.state.auth_user
+        ok_pass = _hash_password(password) == app.state.auth_password_hash
+        if ok_user and ok_pass:
+            request.session["logged_in"] = True
+            request.session["username"] = username
+            return JSONResponse({"ok": True, "redirect": "/dashboard"})
+        return JSONResponse({"ok": False, "detail": "用户名或密码错误"}, status_code=401)
+
     @app.get("/logout")
     async def logout(request: Request) -> RedirectResponse:
         request.session.clear()

onchain_scout_gate/deploy/ecosystem.config.cjs

@@ -34,6 +34,7 @@ module.exports = {
         // 本地导航 iframe 嵌入（勿写进 config.yaml，须在此或 pm2 ecosystem）
         // NAV_ALLOW_EMBED: "true",
         // NAV_EMBED_ORIGINS: "http://192.168.8.6:5070",
+        // NAV_EMBED_SESSION: "1",
       },
     },
   ],

onchain_scout_gate/templates/login.html

@@ -24,14 +24,57 @@
         <div class="matrix-login-badge">SECURE CHANNEL</div>
         <div class="matrix-login-glitch" data-text="&gt; AUTHENTICATE">&gt; AUTHENTICATE</div>
         <p class="matrix-login-sub">MATRIX // GATE USDT PERP FUNNEL · 未授权区域禁止访问</p>
-        <form method="post" action="/login" class="matrix-login-form">
+        <form id="matrixLoginForm" method="post" action="/login" class="matrix-login-form">
             <label class="matrix-label">操作员 ID</label>
             <input class="matrix-input" type="text" name="username" required autocomplete="username" />
             <label class="matrix-label">密钥</label>
             <input class="matrix-input" type="password" name="password" required autocomplete="current-password" />
             <button type="submit" class="matrix-btn matrix-btn-full matrix-btn-pulse">建立会话</button>
         </form>
-        <div class="matrix-error">{{ error }}</div>
+        <div class="matrix-error" id="matrixLoginError">{{ error }}</div>
     </div>
+    <script>
+      (function () {
+        var form = document.getElementById("matrixLoginForm");
+        var errEl = document.getElementById("matrixLoginError");
+        if (!form) return;
+        form.addEventListener("submit", function (e) {
+          e.preventDefault();
+          if (errEl) errEl.textContent = "";
+          var fd = new FormData(form);
+          var btn = form.querySelector('button[type="submit"]');
+          if (btn) btn.disabled = true;
+          fetch("/api/auth/login", {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Accept: "application/json" },
+            credentials: "same-origin",
+            body: JSON.stringify({
+              username: fd.get("username"),
+              password: fd.get("password"),
+            }),
+          })
+            .then(function (r) {
+              return r.json().then(function (j) {
+                return { ok: r.ok, body: j };
+              });
+            })
+            .then(function (x) {
+              if (x.ok && x.body && x.body.redirect) {
+                window.location.href = x.body.redirect;
+                return;
+              }
+              if (errEl) {
+                errEl.textContent = (x.body && x.body.detail) || "登录失败";
+              }
+            })
+            .catch(function () {
+              if (errEl) errEl.textContent = "网络错误或会话 Cookie 被拦截（iframe 嵌入须 HTTPS + NAV_EMBED_ORIGINS）";
+            })
+            .finally(function () {
+              if (btn) btn.disabled = false;
+            });
+        });
+      })();
+    </script>
 </body>
 </html>