refactor: 移除本地前端容器，仅保留远程部署

本地前端因 Casdoor OAuth 回调固定指向 onu.dhdx.fun，无法完成
登录流程，没有实际用途。转为仅远程服务器部署。

本地服务器现仅需 2 容器：backend + celery-worker(含beat)

Co-Authored-By: Claude <noreply@anthropic.com>

.agents/skills/frontend-design/LICENSE.txt

@@ -1,177 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS

.agents/skills/frontend-design/SKILL.md

@@ -1,42 +0,0 @@
----
-name: frontend-design
-description: Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, artifacts, posters, or applications (examples include websites, landing pages, dashboards, React components, HTML/CSS layouts, or when styling/beautifying any web UI). Generates creative, polished code and UI design that avoids generic AI aesthetics.
-license: Complete terms in LICENSE.txt
----
-
-This skill guides creation of distinctive, production-grade frontend interfaces that avoid generic "AI slop" aesthetics. Implement real working code with exceptional attention to aesthetic details and creative choices.
-
-The user provides frontend requirements: a component, page, application, or interface to build. They may include context about the purpose, audience, or technical constraints.
-
-## Design Thinking
-
-Before coding, understand the context and commit to a BOLD aesthetic direction:
-- **Purpose**: What problem does this interface solve? Who uses it?
-- **Tone**: Pick an extreme: brutally minimal, maximalist chaos, retro-futuristic, organic/natural, luxury/refined, playful/toy-like, editorial/magazine, brutalist/raw, art deco/geometric, soft/pastel, industrial/utilitarian, etc. There are so many flavors to choose from. Use these for inspiration but design one that is true to the aesthetic direction.
-- **Constraints**: Technical requirements (framework, performance, accessibility).
-- **Differentiation**: What makes this UNFORGETTABLE? What's the one thing someone will remember?
-
-**CRITICAL**: Choose a clear conceptual direction and execute it with precision. Bold maximalism and refined minimalism both work - the key is intentionality, not intensity.
-
-Then implement working code (HTML/CSS/JS, React, Vue, etc.) that is:
-- Production-grade and functional
-- Visually striking and memorable
-- Cohesive with a clear aesthetic point-of-view
-- Meticulously refined in every detail
-
-## Frontend Aesthetics Guidelines
-
-Focus on:
-- **Typography**: Choose fonts that are beautiful, unique, and interesting. Avoid generic fonts like Arial and Inter; opt instead for distinctive choices that elevate the frontend's aesthetics; unexpected, characterful font choices. Pair a distinctive display font with a refined body font.
-- **Color & Theme**: Commit to a cohesive aesthetic. Use CSS variables for consistency. Dominant colors with sharp accents outperform timid, evenly-distributed palettes.
-- **Motion**: Use animations for effects and micro-interactions. Prioritize CSS-only solutions for HTML. Use Motion library for React when available. Focus on high-impact moments: one well-orchestrated page load with staggered reveals (animation-delay) creates more delight than scattered micro-interactions. Use scroll-triggering and hover states that surprise.
-- **Spatial Composition**: Unexpected layouts. Asymmetry. Overlap. Diagonal flow. Grid-breaking elements. Generous negative space OR controlled density.
-- **Backgrounds & Visual Details**: Create atmosphere and depth rather than defaulting to solid colors. Add contextual effects and textures that match the overall aesthetic. Apply creative forms like gradient meshes, noise textures, geometric patterns, layered transparencies, dramatic shadows, decorative borders, custom cursors, and grain overlays.
-
-NEVER use generic AI-generated aesthetics like overused font families (Inter, Roboto, Arial, system fonts), cliched color schemes (particularly purple gradients on white backgrounds), predictable layouts and component patterns, and cookie-cutter design that lacks context-specific character.
-
-Interpret creatively and make unexpected choices that feel genuinely designed for the context. No design should be the same. Vary between light and dark themes, different fonts, different aesthetics. NEVER converge on common choices (Space Grotesk, for example) across generations.
-
-**IMPORTANT**: Match implementation complexity to the aesthetic vision. Maximalist designs need elaborate code with extensive animations and effects. Minimalist or refined designs need restraint, precision, and careful attention to spacing, typography, and subtle details. Elegance comes from executing the vision well.
-
-Remember: Claude is capable of extraordinary creative work. Don't hold back, show what can truly be created when thinking outside the box and committing fully to a distinctive vision.

.claude/skills/frontend-design

@@ -1 +0,0 @@
-../../.agents/skills/frontend-design

.gitignore

@@ -32,6 +32,9 @@ logs/
 *.db
 *.sqlite
 
+# Keys
+*.pem
+
 # Temp
 /tmp/
 *.tmp
@@ -41,3 +44,10 @@ logs/
 # Claude Code
 .claude/
 .mcp.json
+CLAUDE.md
+
+# Deployment docs (contain credentials)
+*部署交接文档.md
+
+# Reasonix
+.reasonix/

CLAUDE.md

@@ -1,531 +0,0 @@
-# H3C ONU设备管理系统 - Claude开发指南
-
-## 项目概述
-
-这是一个基于 Python FastAPI + Vue 3 的 H3C OLT 设备监控管理系统，用于监控 4000+ ONU 设备的在线状态。
-
-**当前版本**: v0.8.0
-**开发状态**: 核心功能已完成，权限与运维功能完善中
-
-**已实现功能**：
-- ✅ SSH 连接 H3C OLT 设备查询 ONU 状态（支持 More 分页、终端控制字符清理）
-- ✅ Excel 数据导入和批量管理
-- ✅ 定时自动状态检查（可配置间隔，最小5分钟）+ 手动触发
-- ✅ Casdoor 统一认证和 JWT 令牌管理
-- ✅ 设备管理（列表、详情、筛选、分页）
-- ✅ 统计仪表板（总数、在线、离线）+ 区域分布饼图 + 7天趋势折线图
-- ✅ 完整 RBAC 权限管理（角色、权限、用户管理页面）
-- ✅ OLT 管理（增删改查、批量导入、区域动态同步）
-- ✅ OLT 端口管理（查看端口状态、开关端口）
-- ✅ 重复 MAC 检测与清除
-- ✅ 新设备发现与信息补全
-- ✅ 快速扫描（多线程并发）
-- ✅ 环路检测
-- ✅ 系统设置（管理员可配置检查间隔，显示下次扫描时间/扫描中状态）
-- ✅ 库存管理模块（物料、序列号设备、出入库、盘点）
-- ✅ 每日状态快照（凌晨1点聚合，用于趋势图性能优化）
-- ✅ 审计日志（全量操作记录、筛选查询、CSV 导出）
-- ✅ 设备更换记录（MAC 地址更换历史，与库存序列号联动）
-- ✅ iOS PWA 主屏幕支持（standalone 模式 safe area 适配）
-
-**技术栈**：
-- 后端：Python FastAPI + PostgreSQL + Celery + Redis + Paramiko
-- 前端：Vue 3 + Element Plus + Pinia + Axios
-- 部署：Docker Compose
-
----
-
-## 已实现的 API 端点
-
-### 认证相关
-- `GET /api/auth/login` - 获取 Casdoor 登录 URL
-- `POST /api/auth/callback` - Casdoor 登录回调
-- `GET /api/auth/profile` - 获取当前用户信息
-
-### 设备管理
-- `GET /api/devices` - 获取设备列表（分页、筛选）
-- `GET /api/devices/{id}` - 获取设备详情
-
-### 状态检查
-- `POST /api/check/status` - 手动触发状态检查
-
-### 数据导入
-- `POST /api/import/upload` - 上传并导入 Excel 文件
-
-### 统计信息
-- `GET /api/stats/summary` - 获取统计摘要（总数、在线、离线）
-
-### 系统
-- `GET /health` - 健康检查
-- `GET /docs` - API 文档（Swagger UI）
-
----
-
-## Rules
-
-### 代码规范
-
-#### Python 后端规范
-- 遵循 PEP 8 规范
-- 使用 Black 进行代码格式化
-- 使用 isort 进行导入排序
-- 使用类型注解（Type Hints）
-- 异步函数使用 async/await
-- 错误处理使用自定义异常类
-
-#### Vue 前端规范
-- 使用 Composition API（setup script）
-- 组件使用 PascalCase 命名
-- 使用 TypeScript 类型检查
-- 遵循 Vue 官方风格指南
-- 使用 ESLint + Prettier 格式化
-
-#### Git 提交规范
-使用 Conventional Commits 格式：
-```
-<type>(<scope>): <subject>
-
-类型：feat, fix, docs, style, refactor, test, chore
-示例：feat(device): 添加设备导入功能
-```
-
-### 架构规则
-
-#### 后端架构
-- **分层架构**：API → Service → Model
-- **API 层**：仅处理请求/响应，调用 Service
-- **Service 层**：业务逻辑，不直接操作数据库
-- **Model 层**：SQLAlchemy 模型定义
-- **异步任务**：耗时操作使用 Celery
-
-#### 前端架构
-- **组件分类**：
-  - `components/common/`：通用组件
-  - `components/business/`：业务组件
-  - `views/`：页面组件
-- **状态管理**：使用 Pinia stores
-- **API 调用**：统一在 `api/` 目录封装
-
-### 安全规则
-
-#### 数据安全
-- SSH 密码必须加密存储（使用 Fernet 加密）
-- 敏感信息通过环境变量配置
-- 数据库连接使用 SSL
-- 定期备份数据（90天历史记录）
-
-#### 应用安全
-- 所有 API 端点需要认证（除登录接口）
-- 实现 CSRF 保护
-- 输入验证使用 Pydantic
-- SQL 注入防护（使用 ORM）
-- XSS 防护（前端转义）
-
-#### 访问控制
-- 基于 RBAC 的权限控制
-- 数据级权限过滤（按区域/学校）
-- 操作审计日志记录
-- 设备信息变更需要审核
-
-### 性能规则
-
-#### 数据库优化
-- 为常用查询字段添加索引
-- 使用连接池（pool_size=20）
-- 避免 N+1 查询问题
-- 定期清理历史数据（保留90天）
-
-#### 缓存策略
-- Redis 缓存热点数据（设备状态）
-- 缓存过期时间：30分钟
-- 手动刷新有5分钟冷却限制
-
-#### 异步处理
-- SSH 状态检查使用 Celery 异步任务
-- 批量导入使用后台任务
-- 定时任务使用 Celery Beat
-
-### 开发规则
-
-#### 环境配置
-- 开发环境使用 `.env.development`
-- 生产环境使用 `.env.production`
-- 不提交 `.env` 文件到 Git
-- 提供 `.env.example` 模板
-
-#### 测试要求
-- 核心业务逻辑需要单元测试
-- API 端点需要集成测试
-- 测试覆盖率目标：≥80%
-
-#### 文档要求
-- API 变更及时更新 Swagger 文档
-- 复杂业务逻辑添加注释
-- 重要配置添加说明
-
-### 部署规则
-
-#### Docker 部署
-- 使用 Docker Compose 编排
-- 外部 PostgreSQL 和 Redis（不在容器内）
-- 日志挂载到宿主机
-- 使用 Nginx 反向代理
-
-#### 环境变量
-必需配置：
-- `DATABASE_URL`：PostgreSQL 连接字符串
-- `REDIS_URL`：Redis 连接字符串
-- `CASDOOR_*`：Casdoor 认证配置
-- `SECRET_KEY`：应用密钥
-
-#### 监控告警
-- 健康检查端点：`/health`
-- 性能指标端点：`/metrics`
-- 日志级别：生产环境使用 INFO
-
----
-
-## 部署陷阱与经验教训
-
-### 修改代码后必须重新构建镜像
-
-**问题**：修改了宿主机上的源码后，直接 `docker compose up -d` 或 `docker compose restart` **不会**让容器使用新代码。容器运行的是构建时打包进镜像的旧代码。
-
-**正确流程**：
-```bash
-# 1. 重新构建镜像（必须加 --no-cache 确保不用旧层）
-docker compose build --no-cache backend   # 或 frontend，或两者
-
-# 2. 重新创建容器（必须用 rm + up，或 up --force-recreate）
-docker compose rm -f backend
-docker compose up -d backend
-
-# 3. 如有数据库模型变更，执行迁移
-docker compose exec backend alembic upgrade head
-```
-
-**不要用**：
-- `docker compose restart`：只重启进程，不更新镜像
-- `docker compose up -d`（无 build）：容器配置变了会重建，但镜像不变
-
-### 端口被占用导致容器启动但无端口映射
-
-**问题**：如果宿主机端口已被其他容器占用，新容器会启动成功（`docker compose up` 不报错），但端口映射为空 `{}`，外部无法访问。
-
-**排查方法**：
-```bash
-# 检查端口映射是否正常
-docker inspect <container> --format '{{json .NetworkSettings.Ports}}'
-
-# 查看谁占用了端口
-docker ps | grep <port>
-```
-
-**解决方法**：先停掉占用端口的旧容器，再 `docker compose rm -f && docker compose up -d`。
-
-### frontend 容器必须配置 VITE_API_PROXY_TARGET
-
-**问题**：根目录 `docker-compose.yml` 的 frontend 服务如果没有配置 `VITE_API_PROXY_TARGET`，Vite 代理会默认打到 `http://localhost:8001`，导致所有 `/api` 请求 500 或无法到达后端。
-
-**必须在 docker-compose.yml 中配置**：
-```yaml
-frontend:
-  build: ./frontend
-  ports:
-    - "5173:5173"
-  environment:
-    - VITE_API_PROXY_TARGET=http://backend:8000
-```
-
-### 新增数据库模型后必须执行迁移
-
-**问题**：新增了 SQLAlchemy 模型（如 `DeviceDailySnapshot`、`SystemSetting`），重建镜像后如果不执行 `alembic upgrade head`，表不存在会导致 500 错误。
-
-**每次新增模型的完整流程**：
-```bash
-# 1. 创建迁移文件（在宿主机或容器内）
-docker compose exec backend alembic revision --autogenerate -m "描述"
-
-# 2. 重建镜像
-docker compose build --no-cache backend
-
-# 3. 重启容器
-docker compose rm -f backend && docker compose up -d backend
-
-# 4. 执行迁移
-docker compose exec backend alembic upgrade head
-```
-
-### Alembic 迁移文件 revision ID 不能重复
-
-**问题**：手动创建迁移文件时，如果 `revision` 字段与已有文件重复，`alembic upgrade head` 会报 `Multiple head revisions are present` 错误。
-
-**规则**：手动创建迁移文件时，revision ID 使用不与现有文件冲突的唯一字符串（如 `h8i9j0k1l2m3`），并确认 `down_revision` 指向正确的上一个版本。
-
-### Celery worker 必须重建才能识别新任务
-
-**问题**：新增 Celery 任务模块后，如果只重建 backend 而不重建 celery-worker，worker 不会注册新任务，消息会被丢弃并报 `KeyError`。
-
-**规则**：新增任务模块后，backend 和 celery-worker 都必须重建：
-```bash
-docker compose build --no-cache backend celery-worker
-docker compose rm -f backend celery-worker
-docker compose up -d backend celery-worker
-```
-
-验证任务是否注册：
-```bash
-docker compose exec celery-worker celery -A celery_worker.celery_app inspect registered
-```
-
-### 区域管理员多区域过滤必须用 `.in_()` 而非 `==`
-
-**问题**：`assigned_area` 字段存储逗号分隔的多个区域（如 `"城区,郊区"`），用 `==` 只能匹配整个字符串，导致多区域管理员只能看到第一个区域的数据。
-
-**规则**：所有涉及 `assigned_area` 的过滤都必须先 split 再用 `.in_()`：
-```python
-areas = [a.strip() for a in current['assigned_area'].split(',') if a.strip()]
-query = query.filter(Model.region.in_(areas))
-```
-
-### Vite dev server 通过反向代理访问需配置 allowedHosts
-
-**问题**：通过域名反向代理访问 Vite dev server 时，会报 `Blocked request. This host is not allowed`。
-
-**解决**：在 `vite.config.js` 中设置：
-```js
-server: {
-  allowedHosts: ['all', 'your-domain.com'],
-}
-```
-
-### iOS PWA standalone 模式与 Safari 的 safe area 差异
-
-**问题**：`env(safe-area-inset-top)` 在 Safari 浏览器中为 0（有地址栏占位），在 standalone 模式（添加到主屏幕）下为真实刘海高度（44-59px）。直接使用会导致 Safari 中布局正常但 standalone 中顶栏/弹窗重叠。
-
-**规则**：所有 safe area 相关样式必须包在 `@media (display-mode: standalone)` 中，Safari 不受影响：
-```css
-@media (display-mode: standalone) {
-  .mobile-topbar {
-    height: calc(52px + env(safe-area-inset-top));
-  }
-}
-```
-
-`ElMessage` 的 offset 通过 `src/utils/message.js` 封装统一处理，所有页面从该文件导入而非直接从 `element-plus` 导入。
-
-### Docker healthcheck 镜像内无 curl
-
-**问题**：backend 镜像基于 Python slim，没有 `curl`，healthcheck 用 `curl` 会导致所有依赖服务启动失败。
-
-**规则**：healthcheck 使用 Python 内置模块：
-```yaml
-healthcheck:
-  test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
-  interval: 15s
-  timeout: 10s
-  retries: 5
-  start_period: 40s
-```
-
----
-
-## 项目结构
-
-```
-H3ConuMS2/
-├── backend/              # Python 后端
-│   ├── app/
-│   │   ├── api/         # API 路由
-│   │   ├── core/        # 核心配置
-│   │   ├── models/      # 数据模型
-│   │   ├── schemas/     # Pydantic 模式
-│   │   ├── services/    # 业务逻辑
-│   │   ├── tasks/       # Celery 任务
-│   │   └── utils/       # 工具函数
-│   ├── alembic/         # 数据库迁移
-│   └── tests/           # 测试代码
-├── frontend/            # Vue 前端
-│   └── src/
-│       ├── api/         # API 调用
-│       ├── components/  # 组件
-│       ├── router/      # 路由
-│       ├── stores/      # 状态管理
-│       ├── views/       # 页面
-│       └── utils/       # 工具函数
-├── deploy/              # 部署配置
-│   ├── docker-compose.yml
-│   └── nginx.conf
-└── docs/                # 文档
-```
-
----
-
-## 核心业务逻辑
-
-### SSH 状态检查流程
-1. 从数据库获取 OLT 设备配置
-2. 建立 SSH 连接（使用连接池）
-3. 执行命令：`display onu slot {slot_number}`
-4. 解析返回结果：
-   - 包含 "Up" → 在线
-   - 包含 "Offline" → 离线
-5. 更新设备状态到数据库
-6. 记录历史状态
-
-### 权限控制逻辑
-- **超级管理员**：所有权限
-- **管理员**：管理所有设备和用户
-- **区域管理员**：管理指定区域的设备
-- **学校管理员**：管理指定学校的设备
-- **普通用户**：只读权限
-
-### 数据导入流程
-1. 上传 Excel 文件
-2. 使用 Pandas 解析数据
-3. 数据验证（MAC 地址格式、必填字段）
-4. 批量插入数据库
-5. 返回导入结果（成功/失败记录）
-
----
-
-## 开发指南
-
-### 快速启动
-
-**后端**：
-```bash
-cd backend
-python -m venv venv
-source venv/bin/activate
-pip install -r requirements.txt
-uvicorn app.main:app --reload --host 0.0.0.0 --port 8000
-```
-
-**前端**：
-```bash
-cd frontend
-npm install
-npm run dev
-```
-
-**Celery Worker**：
-```bash
-cd backend
-celery -A app.core.celery_app worker --loglevel=info
-```
-
-**Celery Beat**：
-```bash
-cd backend
-celery -A app.core.celery_app beat --loglevel=info
-```
-
-**Docker 部署**：
-```bash
-# 配置环境变量
-cp backend/.env.example backend/.env
-
-# 启动所有服务
-docker-compose up -d
-
-# 初始化数据库
-docker-compose exec backend python scripts/init_db.py
-```
-
-### 数据库迁移
-
-```bash
-# 创建迁移
-alembic revision --autogenerate -m "描述"
-/home/v6ole/pyproject/H3ConuMS2/CLAUDE.md
-# 执行迁移
-alembic upgrade head
-
-# 回滚
-alembic downgrade -1
-```
-
-### 添加新功能
-
-1. **后端 API**：
-   - 在 `app/api/v1/` 创建路由文件
-   - 在 `app/services/` 创建服务文件
-   - 在 `app/schemas/` 定义请求/响应模式
-   - 在 `app/models/` 定义数据模型（如需要）
-
-2. **前端页面**：
-   - 在 `views/` 创建页面组件
-   - 在 `api/` 添加 API 调用
-   - 在 `router/` 添加路由配置
-   - 在 `stores/` 添加状态管理（如需要）
-
----
-
-## 常见问题
-
-### SSH 连接失败
-- 检查网络连通性
-- 验证 SSH 凭证
-- 检查防火墙设置
-- 查看日志：`docker-compose logs backend`
-
-### 数据库连接失败
-- 检查 `DATABASE_URL` 配置
-- 验证数据库服务状态
-- 检查网络权限
-
-### Casdoor 登录失败
-- 检查 Casdoor 服务状态
-- 验证 `CASDOOR_*` 配置
-- 检查回调地址配置
-
----
-
-## 参考文档
-
-- [FastAPI 文档](https://fastapi.tiangolo.com/)
-- [Vue 3 文档](https://vuejs.org/)
-- [Element Plus 文档](https://element-plus.org/)
-- [Casdoor 文档](https://casdoor.org/)
-- [项目详细设计](./系统设计文档.md)
-- [开发计划](./开发计划.md)
-
-<!-- code-review-graph MCP tools -->
-## MCP Tools: code-review-graph
-
-**IMPORTANT: This project has a knowledge graph. ALWAYS use the
-code-review-graph MCP tools BEFORE using Grep/Glob/Read to explore
-the codebase.** The graph is faster, cheaper (fewer tokens), and gives
-you structural context (callers, dependents, test coverage) that file
-scanning cannot.
-
-### When to use graph tools FIRST
-
-- **Exploring code**: `semantic_search_nodes` or `query_graph` instead of Grep
-- **Understanding impact**: `get_impact_radius` instead of manually tracing imports
-- **Code review**: `detect_changes` + `get_review_context` instead of reading entire files
-- **Finding relationships**: `query_graph` with callers_of/callees_of/imports_of/tests_for
-- **Architecture questions**: `get_architecture_overview` + `list_communities`
-
-Fall back to Grep/Glob/Read **only** when the graph doesn't cover what you need.
-
-### Key Tools
-
-| Tool | Use when |
-| ------ | ---------- |
-| `detect_changes` | Reviewing code changes — gives risk-scored analysis |
-| `get_review_context` | Need source snippets for review — token-efficient |
-| `get_impact_radius` | Understanding blast radius of a change |
-| `get_affected_flows` | Finding which execution paths are impacted |
-| `query_graph` | Tracing callers, callees, imports, tests, dependencies |
-| `semantic_search_nodes` | Finding functions/classes by name or keyword |
-| `get_architecture_overview` | Understanding high-level codebase structure |
-| `refactor_tool` | Planning renames, finding dead code |
-
-### Workflow
-
-1. The graph auto-updates on file changes (via hooks).
-2. Use `detect_changes` for code review.
-3. Use `get_affected_flows` to understand impact.
-4. Use `query_graph` pattern="tests_for" to check coverage.

OLT时间同步.md

@@ -1,21 +0,0 @@
-H3C OLT 批量配置脚本（直接复制执行）
-```
-system-view
- undo ntp-service unicast-server 172.16.0.254
- ntp-service unicast-server 172.16.1.252
- clock timezone Beijing add 08:00:00
- quit
- save force
- ```
-作用说明：
-第2行：删掉旧的内网 NTP（172.16.0.254，因为它用的是本地假时间）。
-第3行：指向新配好的 Windows 时间服务器（172.16.1.252，它直连国家授时中心）。
-第4行：把设备显示时区改成北京时间（东八区），解决时间少8小时的问题。
-第6行：强制保存配置，防止重启丢失（加 force 是为了跳过确认提示，方便批量执行）。
-验证方法：
-全部刷完等大概 1到2分钟后，执行以下两条命令看结果：
-display clock
-display ntp-service sessions
-display clock 必须看到带有 Beijing 字样，且时间与当前实际北京时间一致。
-display ntp-service sessions 必须看到 172.16.1.252 前面带有 [12345] 标记，且 offset（偏差）在几毫秒以内。
-注意：如果某些 OLT 之前没有配过 172.16.0.254，执行第2行时可能会报错提示“找不到该配置”，直接忽略该报错即可，不影响后续命令执行。

PROJECT_STRUCTURE.md

@@ -1,580 +0,0 @@
-# 项目结构详细说明
-
-## 后端目录结构 (backend/)
-
-```
-backend/
-├── app/                           # 主应用目录
-│   ├── __init__.py
-│   ├── main.py                    # FastAPI应用入口
-│   ├── api/                       # API路由
-│   │   ├── __init__.py
-│   │   ├── v1/                    # API版本1
-│   │   │   ├── __init__.py
-│   │   │   ├── auth.py           # 认证相关API
-│   │   │   ├── devices.py        # 设备管理API
-│   │   │   ├── check.py          # 状态检查API
-│   │   │   ├── stats.py          # 统计API
-│   │   │   ├── users.py          # 用户管理API
-│   │   │   ├── import.py         # 数据导入API
-│   │   │   └── system.py         # 系统设置API
-│   │   └── dependencies.py       # 依赖注入
-│   ├── core/                      # 核心配置
-│   │   ├── __init__.py
-│   │   ├── config.py             # 应用配置
-│   │   ├── security.py           # 安全相关
-│   │   ├── database.py           # 数据库配置
-│   │   ├── casdoor.py            # Casdoor配置
-│   │   └── celery_app.py         # Celery配置
-│   ├── models/                    # SQLAlchemy模型
-│   │   ├── __init__.py
-│   │   ├── base.py               # 基础模型
-│   │   ├── device.py             # 设备相关模型
-│   │   ├── user.py               # 用户相关模型
-│   │   ├── permission.py         # 权限相关模型
-│   │   └── history.py            # 历史记录模型
-│   ├── schemas/                   # Pydantic模式
-│   │   ├── __init__.py
-│   │   ├── device.py             # 设备模式
-│   │   ├── user.py               # 用户模式
-│   │   ├── auth.py               # 认证模式
-│   │   └── common.py             # 通用模式
-│   ├── services/                  # 业务逻辑服务
-│   │   ├── __init__.py
-│   │   ├── device_service.py     # 设备服务
-│   │   ├── ssh_service.py        # SSH连接服务
-│   │   ├── check_service.py      # 状态检查服务
-│   │   ├── import_service.py     # 数据导入服务
-│   │   ├── user_service.py       # 用户服务
-│   │   ├── permission_service.py # 权限服务
-│   │   └── casdoor_service.py    # Casdoor服务
-│   ├── tasks/                     # Celery任务
-│   │   ├── __init__.py
-│   │   ├── check_tasks.py        # 状态检查任务
-│   │   ├── import_tasks.py       # 数据导入任务
-│   │   └── notification_tasks.py # 通知任务
-│   ├── utils/                     # 工具函数
-│   │   ├── __init__.py
-│   │   ├── excel_parser.py       # Excel解析工具
-│   │   ├── ssh_utils.py          # SSH工具函数
-│   │   ├── validators.py         # 数据验证
-│   │   ├── encryption.py         # 加密工具
-│   │   └── logger.py             # 日志配置
-│   └── middleware/               # 中间件
-│       ├── __init__.py
-│       ├── auth_middleware.py    # 认证中间件
-│       ├── permission_middleware.py # 权限中间件
-│       └── logging_middleware.py # 日志中间件
-├── alembic/                       # 数据库迁移
-│   ├── versions/                  # 迁移版本
-│   ├── env.py
-│   └── alembic.ini
-├── tests/                         # 测试代码
-│   ├── __init__.py
-│   ├── conftest.py               # 测试配置
-│   ├── test_api/                 # API测试
-│   ├── test_services/            # 服务测试
-│   └── test_utils/               # 工具测试
-├── scripts/                       # 脚本文件
-│   ├── init_db.py                # 数据库初始化
-│   ├── create_admin.py           # 创建管理员
-│   └── backup_data.py            # 数据备份
-├── requirements/                  # 依赖管理
-│   ├── base.txt                  # 基础依赖
-│   ├── dev.txt                   # 开发依赖
-│   └── prod.txt                  # 生产依赖
-├── logs/                          # 日志目录
-├── static/                        # 静态文件
-├── Dockerfile                     # Docker构建文件
-├── docker-entrypoint.sh          # Docker入口脚本
-├── requirements.txt               # 依赖文件
-├── .env.example                   # 环境变量示例
-└── pyproject.toml                # Python项目配置
-```
-
-## 前端目录结构 (frontend/)
-
-```
-frontend/
-├── public/                        # 静态资源
-│   ├── index.html                # 主HTML文件
-│   ├── favicon.ico               # 网站图标
-│   └── robots.txt                # 搜索引擎配置
-├── src/                           # 源代码
-│   ├── main.js                   # 应用入口
-│   ├── App.vue                   # 根组件
-│   ├── api/                      # API调用
-│   │   ├── index.js              # API配置
-│   │   ├── auth.js               # 认证API
-│   │   ├── device.js             # 设备API
-│   │   ├── check.js              # 状态检查API
-│   │   ├── user.js               # 用户API
-│   │   └── import.js             # 数据导入API
-│   ├── assets/                   # 资源文件
-│   │   ├── css/                  # 样式文件
-│   │   │   ├── main.css          # 主样式
-│   │   │   ├── variables.css     # CSS变量
-│   │   │   └── components.css    # 组件样式
-│   │   └── images/               # 图片资源
-│   ├── components/               # 公共组件
-│   │   ├── common/               # 通用组件
-│   │   │   ├── Layout/           # 布局组件
-│   │   │   │   ├── AppLayout.vue
-│   │   │   │   ├── Header.vue
-│   │   │   │   ├── Sidebar.vue
-│   │   │   │   └── Footer.vue
-│   │   │   ├── Table/            # 表格组件
-│   │   │   │   ├── DataTable.vue
-│   │   │   │   └── Pagination.vue
-│   │   │   ├── Form/             # 表单组件
-│   │   │   │   ├── SearchForm.vue
-│   │   │   │   └── FilterForm.vue
-│   │   │   ├── Chart/            # 图表组件
-│   │   │   │   ├── StatusChart.vue
-│   │   │   │   └── TrendChart.vue
-│   │   │   └── Dialog/           # 对话框组件
-│   │   │       ├── ConfirmDialog.vue
-│   │   │       └── ImportDialog.vue
-│   │   └── business/             # 业务组件
-│   │       ├── Device/           # 设备相关组件
-│   │       ├── User/             # 用户相关组件
-│   │       └── System/           # 系统相关组件
-│   ├── router/                   # 路由配置
-│   │   ├── index.js              # 路由主文件
-│   │   ├── routes.js             # 路由定义
-│   │   └── guards.js             # 路由守卫
-│   ├── stores/                   # 状态管理 (Pinia)
-│   │   ├── index.js              # Store配置
-│   │   ├── auth.js               # 认证状态
-│   │   ├── device.js             # 设备状态
-│   │   ├── user.js               # 用户状态
-│   │   └── system.js             # 系统状态
-│   ├── views/                    # 页面组件
-│   │   ├── Auth/                 # 认证页面
-│   │   │   ├── Login.vue         # 登录页面
-│   │   │   └── Callback.vue      # 回调页面
-│   │   ├── Dashboard/            # 仪表板
-│   │   │   └── index.vue         # 仪表板主页
-│   │   ├── Device/               # 设备管理
-│   │   │   ├── List.vue          # 设备列表
-│   │   │   ├── Detail.vue        # 设备详情
-│   │   │   └── Import.vue        # 数据导入
-│   │   ├── Check/                # 状态检查
-│   │   │   ├── Status.vue        # 状态页面
-│   │   │   └── History.vue       # 检查历史
-│   │   ├── User/                 # 用户管理
-│   │   │   ├── List.vue          # 用户列表
-│   │   │   ├── Profile.vue       # 用户资料
-│   │   │   └── Permission.vue    # 权限管理
-│   │   ├── System/               # 系统设置
-│   │   │   ├── OltConfig.vue     # OLT配置
-│   │   │   ├── TaskConfig.vue    # 任务配置
-│   │   │   └── Audit.vue         # 审核中心
-│   │   └── Error/                # 错误页面
-│   │       ├── 404.vue           # 404页面
-│   │       └── 500.vue           # 500页面
-│   ├── utils/                    # 工具函数
-│   │   ├── auth.js               # 认证工具
-│   │   ├── request.js            # 请求工具
-│   │   ├── permission.js         # 权限工具
-│   │   ├── format.js             # 格式化工具
-│   │   ├── validate.js           # 验证工具
-│   │   └── storage.js            # 存储工具
-│   ├── directives/               # 自定义指令
-│   │   ├── permission.js         # 权限指令
-│   │   └── loading.js            # 加载指令
-│   └── plugins/                  # 插件
-│       ├── element-plus.js       # Element Plus插件
-│       └── echarts.js            # ECharts插件
-├── tests/                         # 测试文件
-│   ├── unit/                     # 单元测试
-│   └── e2e/                      # 端到端测试
-├── .env.development               # 开发环境变量
-├── .env.production                # 生产环境变量
-├── .env.example                   # 环境变量示例
-├── package.json                   # 项目配置
-├── package-lock.json              # 依赖锁文件
-├── vite.config.js                 # Vite配置
-├── index.html                     # HTML入口
-└── Dockerfile                     # Docker构建文件
-```
-
-## 部署目录结构 (deploy/)
-
-```
-deploy/
-├── docker-compose.yml            # Docker Compose配置
-├── docker-compose.dev.yml        # 开发环境配置
-├── docker-compose.prod.yml       # 生产环境配置
-├── nginx/                        # Nginx配置
-│   ├── nginx.conf                # 主配置文件
-│   ├── conf.d/                   # 站点配置
-│   │   └── h3c-onu-ms.conf      # 应用配置
-│   └── ssl/                      # SSL证书
-├── scripts/                      # 部署脚本
-│   ├── deploy.sh                 # 部署脚本
-│   ├── backup.sh                 # 备份脚本
-│   ├── restore.sh                # 恢复脚本
-│   └── monitor.sh                # 监控脚本
-├── config/                       # 配置文件
-│   ├── backend.env               # 后端环境变量
-│   ├── frontend.env              # 前端环境变量
-│   └── celery.env                # Celery环境变量
-└── .env.example                  # 环境变量示例
-```
-
-## 文档目录结构 (docs/)
-
-```
-docs/
-├── api/                          # API文档
-│   ├── overview.md               # API概述
-│   ├── auth.md                   # 认证API文档
-│   ├── device.md                 # 设备API文档
-│   ├── check.md                  # 状态检查API文档
-│   └── user.md                   # 用户API文档
-├── deployment/                   # 部署文档
-│   ├── requirements.md           # 环境要求
-│   ├── installation.md           # 安装指南
-│   ├── configuration.md          # 配置说明
-│   ├── docker.md                 # Docker部署
-│   └── troubleshooting.md        # 故障排除
-├── user-guide/                   # 用户指南
-│   ├── getting-started.md        # 快速开始
-│   ├── device-management.md      # 设备管理指南
-│   ├── data-import.md            # 数据导入指南
-│   ├── permission-guide.md       # 权限管理指南
-│   └── faq.md                    # 常见问题
-├── development/                  # 开发文档
-│   ├── setup.md                  # 开发环境搭建
-│   ├── architecture.md           # 架构说明
-│   ├── coding-standards.md       # 编码规范
-│   ├── testing.md                # 测试指南
-│   └── contributing.md           # 贡献指南
-└── images/                       # 文档图片
-```
-
-## 脚本目录结构 (scripts/)
-
-```
-scripts/
-├── database/                     # 数据库脚本
-│   ├── init.sql                  # 初始化SQL
-│   ├── backup.sh                 # 数据库备份
-│   ├── restore.sh                # 数据库恢复
-│   └── migrate.sh                # 迁移脚本
-├── monitoring/                   # 监控脚本
-│   ├── health-check.sh           # 健康检查
-│   ├── log-rotate.sh             # 日志轮转
-│   └── alert.sh                  # 告警脚本
-├── deployment/                   # 部署脚本
-│   ├── build.sh                  # 构建脚本
-│   ├── deploy.sh                 # 部署脚本
-│   └── rollback.sh               # 回滚脚本
-└── utils/                        # 工具脚本
-    ├── cleanup.sh                # 清理脚本
-    ├── generate-cert.sh          # 证书生成
-    └── update-config.sh          # 配置更新
-```
-
-## 环境变量说明
-
-### 后端环境变量 (.env)
-```bash
-# 应用配置
-APP_NAME=H3C-ONU-MS
-APP_ENV=production
-DEBUG=false
-SECRET_KEY=your-secret-key-here
-
-# 数据库配置
-DATABASE_URL=postgresql://user:password@host:5432/dbname
-DATABASE_POOL_SIZE=20
-DATABASE_MAX_OVERFLOW=40
-
-# Redis配置
-REDIS_URL=redis://host:6379/0
-REDIS_POOL_SIZE=10
-
-# Casdoor配置
-CASDOOR_ENDPOINT=https://casdoor.example.com
-CASDOOR_CLIENT_ID=your_client_id
-CASDOOR_CLIENT_SECRET=your_client_secret
-CASDOOR_CERTIFICATE=your_certificate
-CASDOOR_ORG_NAME=your_org
-CASDOOR_APP_NAME=h3c-onu-ms
-
-# SSH配置
-SSH_TIMEOUT=30
-SSH_MAX_CONNECTIONS=10
-SSH_RETRY_COUNT=3
-
-# 任务配置
-CHECK_INTERVAL=1800  # 30分钟（秒）
-MANUAL_COOLDOWN=300  # 5分钟（秒）
-HISTORY_RETENTION=90 # 90天
-
-# 日志配置
-LOG_LEVEL=INFO
-LOG_FILE=/app/logs/app.log
-LOG_ROTATION=10MB
-LOG_RETENTION=30
-```
-
-### 前端环境变量 (.env)
-```bash
-# 应用配置
-VITE_APP_TITLE=H3C ONU设备管理系统
-VITE_APP_VERSION=1.0.0
-
-# API配置
-VITE_API_BASE_URL=http://localhost:8000
-VITE_API_TIMEOUT=30000
-
-# Casdoor配置
-VITE_CASDOOR_ENDPOINT=https://casdoor.example.com
-VITE_CASDOOR_CLIENT_ID=your_client_id
-VITE_CASDOOR_ORG_NAME=your_org
-VITE_CASDOOR_APP_NAME=h3c-onu-ms
-
-# 功能开关
-VITE_ENABLE_SSO=true
-VITE_ENABLE_WEBSOCKET=true
-VITE_ENABLE_ANALYTICS=false
-```
-
-## 开发工作流
-
-### 1. 环境准备
-```bash
-# 克隆项目
-git clone <repository-url>
-cd H3ConuMS2
-
-# 后端环境
-cd backend
-python -m venv venv
-source venv/bin/activate
-pip install -r requirements/dev.txt
-
-# 前端环境
-cd ../frontend
-npm install
-```
-
-### 2. 数据库初始化
-```bash
-# 创建数据库
-createdb h3c_onu_ms
-
-# 运行迁移
-cd backend
-alembic upgrade head
-
-# 初始化数据
-python scripts/init_data.py
-```
-
-### 3. 启动开发服务
-```bash
-# 启动后端
-cd backend
-uvicorn app.main:app --reload --host 0.0.0.0 --port 8000
-
-# 启动前端（新终端）
-cd frontend
-npm run dev
-
-# 启动Celery Worker（新终端）
-cd backend
-celery -A app.core.celery_app worker --loglevel=info
-
-# 启动Celery Beat（新终端）
-cd backend
-celery -A app.core.celery_app beat --loglevel=info
-```
-
-### 4. 访问应用
-- 前端开发服务器: http://localhost:5173
-- 后端API服务器: http://localhost:8000
-- API文档: http://localhost:8000/docs
-- 管理界面: http://localhost:8000/admin
-
-## 代码规范
-
-### Python代码规范
-- 遵循PEP 8规范
-- 使用Black进行代码格式化
-- 使用isort进行导入排序
-- 使用Flake8进行代码检查
-- 使用mypy进行类型检查
-
-### Vue代码规范
-- 使用ESLint + Prettier
-- 遵循Vue官方风格指南
-- 使用TypeScript进行类型检查
-- 组件使用PascalCase命名
-- 单文件组件结构规范
-
-### Git提交规范
-- 使用Conventional Commits规范
-- 提交信息格式: `<type>(<scope>): <subject>`
-- 类型: feat, fix, docs, style, refactor, test, chore
-- 示例: `feat(device): 添加设备导入功能`
-
-## 测试策略
-
-### 单元测试
-```bash
-# 后端单元测试
-cd backend
-pytest tests/unit/
-
-# 前端单元测试
-cd frontend
-npm run test:unit
-```
-
-### 集成测试
-```bash
-# 后端集成测试
-cd backend
-pytest tests/integration/
-
-# API测试
-pytest tests/api/
-```
-
-### 端到端测试
-```bash
-# 前端E2E测试
-cd frontend
-npm run test:e2e
-```
-
-## 部署流程
-
-### 开发环境部署
-```bash
-cd deploy
-docker-compose -f docker-compose.dev.yml up -d
-```
-
-### 生产环境部署
-```bash
-# 构建镜像
-docker-compose -f docker-compose.prod.yml build
-
-# 启动服务
-docker-compose -f docker-compose.prod.yml up -d
-
-# 查看日志
-docker-compose -f docker-compose.prod.yml logs -f
-```
-
-### 持续集成/持续部署
-1. 代码推送到Git仓库
-2. 自动运行测试
-3. 构建Docker镜像
-4. 推送到镜像仓库
-5. 部署到服务器
-6. 运行健康检查
-
-## 监控和告警
-
-### 应用监控
-- 健康检查端点: `/health`
-- 性能指标: `/metrics` (Prometheus格式)
-- 请求统计: 中间件记录
-- 错误跟踪: Sentry集成
-
-### 系统监控
-- 服务器资源使用率
-- 数据库连接池状态
-- Redis内存使用情况
-- 网络连接状态
-
-### 告警规则
-- 设备离线率超过阈值
-- 系统资源使用率过高
-- 服务不可用
-- 安全相关事件
-
-## 安全考虑
-
-### 数据安全
-- SSH密码加密存储
-- 数据库连接加密
-- 敏感信息环境变量管理
-- 定期数据备份
-
-### 应用安全
-- CSRF保护
-- XSS防护
-- SQL注入防护
-- 速率限制
-- 输入验证
-
-### 访问安全
-- 基于角色的访问控制
-- 会话管理
-- 双因素认证支持
-- 登录尝试限制
-
-## 性能优化
-
-### 数据库优化
-- 合理使用索引
-- 查询优化
-- 连接池配置
-- 定期清理历史数据
-
-### 缓存策略
-- Redis缓存热点数据
-- 浏览器缓存静态资源
-- CDN加速前端资源
-
-### 异步处理
-- Celery处理耗时任务
-- WebSocket实时更新
-- 批量操作优化
-
-## 扩展性设计
-
-### 水平扩展
-- 无状态API服务
-- 数据库读写分离
-- Redis集群支持
-- 负载均衡配置
-
-### 功能扩展
-- 插件化架构设计
-- 模块化代码组织
-- 配置驱动功能开关
-- API版本管理
-
-## 维护计划
-
-### 日常维护
-- 日志监控和分析
-- 数据库备份验证
-- 系统更新和补丁
-- 性能监控和优化
-
-### 定期维护
-- 每月安全审计
-- 每季度性能评估
-- 每年架构评审
-- 数据归档和清理
-
-## 文档更新
-- API变更及时更新文档
-- 部署流程变更记录
-- 故障处理经验总结
-- 用户反馈整理
-
----
-
-**文档版本**: v1.0  
-**最后更新**: 2026年4月1日  
-**维护人员**: 系统开发团队

QUICKSTART.md

@@ -1,39 +0,0 @@
-# H3C ONU设备管理系统 - 快速开始
-
-## 项目状态
-✅ 第一阶段：基础框架已完成
-
-## 已完成功能
-- ✅ 后端 FastAPI 框架
-- ✅ 前端 Vue 3 框架
-- ✅ SSH 连接和 ONU 状态解析
-- ✅ 数据库模型设计
-- ✅ Docker 配置
-
-## 快速启动
-
-### 1. 配置环境变量
-```bash
-cp backend/.env.example backend/.env
-# 编辑 backend/.env 配置数据库等信息
-```
-
-### 2. 启动后端
-```bash
-./start-backend.sh
-```
-
-### 3. 启动前端
-```bash
-./start-frontend.sh
-```
-
-### 4. 访问系统
-- 前端：http://localhost:5173
-- 后端 API：http://localhost:8000
-- API 文档：http://localhost:8000/docs
-
-## 下一步开发
-参考 `开发计划.md` 继续第一阶段第2周任务
-
-1. 定期检测还需要加入环路检测功能，并且将环路的状态记录到数据库中，在OLT界面上显示

VERSION

@@ -0,0 +1 @@
+0.10.0

about.md

@@ -1,37 +0,0 @@
-# H3C ONU 管理系统
-
-H3C ONU 管理系统（H3ConuMS）是一套面向校园网络运维团队的 ONU 设备集中管理平台，支持对接多台 H3C OLT 设备，实现大规模 ONU 的状态监控、信息管理与运维操作。
-
-## 主要功能
-
-**设备监控**
-系统通过 SSH 定期轮询 OLT 设备，自动采集所有 ONU 的在线状态、光功率、距离、端口等信息，并以列表和卡片两种视图展示。支持手动触发刷新，状态变化实时可见。
-
-**设备管理**
-支持按区域、学校、楼宇、场所类型等维度对 ONU 设备进行分类管理。可通过 Excel 批量导入设备信息，也可在界面中逐条编辑。设备更换时记录完整的 MAC 地址变更历史。
-
-**OLT 管理**
-统一管理多台 OLT 设备的连接信息，支持端口级别的设备发现。OLT 扫描到的新设备会进入待入库列表，由运维人员补全信息后正式纳管。
-
-**统计分析**
-提供实时在线率统计、7 天趋势折线图、区域分布饼图等可视化报表，帮助运维团队快速掌握全网设备健康状况。
-
-**权限管理**
-基于 Casdoor 统一认证，支持管理员、区域管理员、学校管理员、普通用户等多级角色，数据访问范围按角色自动隔离。
-
-**审计日志**
-记录所有用户的写操作，包括设备编辑、更换、导入、权限变更等，保留 90 天供追溯查询。
-
-## 技术栈
-
-| 层级 | 技术 |
-|------|------|
-| 后端 | Python · FastAPI · SQLAlchemy · Celery · Redis |
-| 前端 | Vue 3 · Element Plus · ECharts |
-| 数据库 | PostgreSQL |
-| 认证 | Casdoor（OIDC） |
-| 部署 | Docker Compose · Nginx |
-
-## 版本
-
-当前版本：v0.8.0

backend/.env.example

@@ -16,7 +16,7 @@ CASDOOR_CLIENT_SECRET=your_client_secret
 CASDOOR_ORG_NAME=your_org
 CASDOOR_APP_NAME=h3c-onu-ms
 CASDOOR_CERTIFICATE=backend/token_jwt_key.pem
-CASDOOR_REDIRECT_URL=http://localhost:5173/callback
+CASDOOR_REDIRECT_URL=
 
 # SSH配置
 SSH_TIMEOUT=30
@@ -24,3 +24,28 @@ SSH_TIMEOUT=30
 # 任务配置
 CHECK_INTERVAL=1800
 MANUAL_COOLDOWN=300
+
+# CORS & 前端
+CORS_ORIGINS=http://localhost:5173,http://localhost:18002
+FRONTEND_URL=https://your-domain.com
+
+# NTP 同步
+NTP_OLD_SERVER=172.16.0.254
+NTP_NEW_SERVER=172.16.1.252
+
+# iMC API 配置（用于 ONU 远程重启和光功率查询）
+IMC_API_URL=
+IMC_API_USERNAME=
+IMC_API_PASSWORD=
+IMC_API_VERIFY_SSL=false
+IMC_CONNECT_TIMEOUT=5
+IMC_READ_TIMEOUT=20
+
+# 企业微信告警配置
+WECHAT_CORPID=
+WECHAT_CORPSECRET=
+WECHAT_AGENTID=
+WECHAT_TOKEN=
+WECHAT_ENCODING_AES_KEY=
+WECHAT_USE_PROXY=True
+WECHAT_PROXY_API_URL=

backend/VERSION

@@ -0,0 +1 @@
+0.10.0

backend/alembic/versions/i9j0k1l2m3n4_add_onu_coordinates.py

@@ -0,0 +1,25 @@
+"""add latitude and longitude columns to onu_devices
+
+Revision ID: i9j0k1l2m3n4
+Revises: h8i9j0k1l2m3
+Create Date: 2026-06-02 12:00:00.000000
+
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = 'i9j0k1l2m3n4'
+down_revision: Union[str, None] = 'h8i9j0k1l2m3'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column('onu_devices', sa.Column('latitude', sa.Float(), nullable=True))
+    op.add_column('onu_devices', sa.Column('longitude', sa.Float(), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column('onu_devices', 'longitude')
+    op.drop_column('onu_devices', 'latitude')

backend/alembic/versions/j0k1l2m3n4o5_add_composite_indexes.py

@@ -0,0 +1,29 @@
+"""add composite indexes for performance
+
+Revision ID: j0k1l2m3n4o5
+Revises: i9j0k1l2m3n4
+Create Date: 2026-06-02 15:00:00.000000
+
+"""
+from typing import Sequence, Union
+from alembic import op
+
+revision: str = 'j0k1l2m3n4o5'
+down_revision: Union[str, None] = 'i9j0k1l2m3n4'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # FK 索引 — 每次状态检查都要按 OLT 查询设备
+    op.create_index('ix_onu_devices_olt_id', 'onu_devices', ['olt_id'])
+    # 复合索引 — Dashboard 按区域+学校聚合
+    op.create_index('ix_onu_devices_region_school', 'onu_devices', ['region', 'school_name'])
+    # FK 索引 — DeviceStatusHistory 按设备查最新状态（最频繁的查询）
+    op.create_index('ix_device_status_history_onu_device_id_checked', 'device_status_history', ['onu_device_id', 'checked_at'])
+
+
+def downgrade() -> None:
+    op.drop_index('ix_device_status_history_onu_device_id_checked', table_name='device_status_history')
+    op.drop_index('ix_onu_devices_region_school', table_name='onu_devices')
+    op.drop_index('ix_onu_devices_olt_id', table_name='onu_devices')

backend/alembic/versions/k0l1m2n3o4p5_add_device_tags.py

@@ -0,0 +1,23 @@
+"""add tags column to onu_devices
+
+Revision ID: k0l1m2n3o4p5
+Revises: j0k1l2m3n4o5
+Create Date: 2026-06-03 10:00:00.000000
+
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = 'k0l1m2n3o4p5'
+down_revision: Union[str, None] = 'j0k1l2m3n4o5'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column('onu_devices', sa.Column('tags', sa.Text(), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column('onu_devices', 'tags')

backend/alembic/versions/l1m2n3o4p5q6_add_optical_power_history.py

@@ -0,0 +1,34 @@
+"""add optical_power_history table
+
+Revision ID: l1m2n3o4p5q6
+Revises: k0l1m2n3o4p5
+Create Date: 2026-06-03 11:00:00.000000
+
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = 'l1m2n3o4p5q6'
+down_revision: Union[str, None] = 'k0l1m2n3o4p5'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table('optical_power_history',
+        sa.Column('id', sa.BigInteger(), nullable=False),
+        sa.Column('onu_device_id', sa.BigInteger(), sa.ForeignKey('onu_devices.id'), nullable=False),
+        sa.Column('power_in', sa.String(20), nullable=True),
+        sa.Column('power_out', sa.String(20), nullable=True),
+        sa.Column('recorded_at', sa.TIMESTAMP(), server_default=sa.text('now()'), nullable=False),
+        sa.PrimaryKeyConstraint('id')
+    )
+    op.create_index('ix_optical_power_history_id', 'optical_power_history', ['id'])
+    op.create_index('ix_optical_power_history_onu_device_id', 'optical_power_history', ['onu_device_id'])
+
+
+def downgrade() -> None:
+    op.drop_index('ix_optical_power_history_onu_device_id', table_name='optical_power_history')
+    op.drop_index('ix_optical_power_history_id', table_name='optical_power_history')
+    op.drop_table('optical_power_history')

backend/alembic/versions/m1n2o3p4q5r6_add_user_display_name.py

@@ -0,0 +1,23 @@
+"""add display_name to users
+
+Revision ID: m1n2o3p4q5r6
+Revises: l1m2n3o4p5q6
+Create Date: 2026-06-03 20:00:00.000000
+
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = 'm1n2o3p4q5r6'
+down_revision: Union[str, None] = 'l1m2n3o4p5q6'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column('users', sa.Column('display_name', sa.String(100), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column('users', 'display_name')

backend/app/api/v1/audit.py

@@ -49,45 +49,6 @@ def get_audit_logs(
     }
 
 
-@router.get("/logs/{log_id}")
-def get_audit_log_detail(
-    log_id: int,
-    db: Session = Depends(get_db),
-    _: dict = Depends(require_permission('*')),
-):
-    """获取单条审计日志详情"""
-    log = db.query(AuditLog).filter(AuditLog.id == log_id).first()
-    if not log:
-        from fastapi import HTTPException
-        raise HTTPException(status_code=404, detail="日志不存在")
-    return _fmt(log, detail=True)
-
-
-@router.get("/stats")
-def get_audit_stats(
-    days: int = Query(7, ge=1, le=90),
-    db: Session = Depends(get_db),
-    _: dict = Depends(require_permission('*')),
-):
-    """审计日志统计（最近N天）"""
-    from datetime import timedelta
-    from sqlalchemy import func
-    since = datetime.utcnow() - timedelta(days=days)
-    rows = (
-        db.query(AuditLog.action_type, AuditLog.status, func.count().label("cnt"))
-        .filter(AuditLog.action_time >= since)
-        .group_by(AuditLog.action_type, AuditLog.status)
-        .all()
-    )
-    total = db.query(func.count(AuditLog.id)).filter(AuditLog.action_time >= since).scalar()
-    by_type = {}
-    for row in rows:
-        if row.action_type not in by_type:
-            by_type[row.action_type] = {"success": 0, "failed": 0, "error": 0}
-        by_type[row.action_type][row.status] = row.cnt
-    return {"total": total, "days": days, "by_type": by_type}
-
-
 @router.get("/logs/export/csv")
 def export_audit_logs(
     start_time: Optional[datetime] = Query(None),
@@ -130,6 +91,45 @@ def export_audit_logs(
     )
 
 
+@router.get("/logs/{log_id}")
+def get_audit_log_detail(
+    log_id: int,
+    db: Session = Depends(get_db),
+    _: dict = Depends(require_permission('*')),
+):
+    """获取单条审计日志详情"""
+    log = db.query(AuditLog).filter(AuditLog.id == log_id).first()
+    if not log:
+        from fastapi import HTTPException
+        raise HTTPException(status_code=404, detail="日志不存在")
+    return _fmt(log, detail=True)
+
+
+@router.get("/stats")
+def get_audit_stats(
+    days: int = Query(7, ge=1, le=90),
+    db: Session = Depends(get_db),
+    _: dict = Depends(require_permission('*')),
+):
+    """审计日志统计（最近N天）"""
+    from datetime import timedelta
+    from sqlalchemy import func
+    since = datetime.utcnow() - timedelta(days=days)
+    rows = (
+        db.query(AuditLog.action_type, AuditLog.status, func.count().label("cnt"))
+        .filter(AuditLog.action_time >= since)
+        .group_by(AuditLog.action_type, AuditLog.status)
+        .all()
+    )
+    total = db.query(func.count(AuditLog.id)).filter(AuditLog.action_time >= since).scalar()
+    by_type = {}
+    for row in rows:
+        if row.action_type not in by_type:
+            by_type[row.action_type] = {"success": 0, "failed": 0, "error": 0}
+        by_type[row.action_type][row.status] = row.cnt
+    return {"total": total, "days": days, "by_type": by_type}
+
+
 def _fmt(r: AuditLog, detail: bool = False) -> dict:
     base = {
         "id": r.id,

backend/app/api/v1/auth.py

@@ -53,11 +53,16 @@ def callback(body: CallbackRequest, db: Session = Depends(get_db)):
         if not user:
             user = User(
                 casdoor_id=casdoor_user["sub"],
-                username=casdoor_user.get("name") or casdoor_user.get("preferred_username", ""),
+                username=casdoor_user.get("preferred_username") or casdoor_user.get("name", ""),
+                display_name=casdoor_user.get("displayName") or casdoor_user.get("name", ""),
                 email=casdoor_user.get("email"),
                 role="user"
             )
             db.add(user)
+        else:
+            # 每次登录同步 Casdoor 信息（姓名、邮箱等可能更新）
+            user.display_name = casdoor_user.get("displayName") or casdoor_user.get("name", user.display_name or "")
+            user.email = casdoor_user.get("email", user.email)
 
         user.last_login = datetime.utcnow()
         db.commit()
@@ -79,12 +84,12 @@ def callback(body: CallbackRequest, db: Session = Depends(get_db)):
 
 @router.get("/permissions")
 def get_my_permissions(
-    authorization: str = Header(..., alias="Authorization"),
+    authorization: str = Header(None, alias="Authorization"),
     db: Session = Depends(get_db)
 ):
     """获取当前用户的权限码列表"""
     from app.middleware.permission_middleware import get_role_permissions
-    if not authorization.startswith("Bearer "):
+    if not authorization or not authorization.startswith("Bearer "):
         raise HTTPException(status_code=401, detail="未授权")
     token = authorization[7:]
     payload = verify_token(token)
@@ -97,11 +102,11 @@ def get_my_permissions(
 
 @router.get("/profile")
 def get_profile(
-    authorization: str = Header(..., alias="Authorization"),
+    authorization: str = Header(None, alias="Authorization"),
     db: Session = Depends(get_db)
 ):
     """获取当前用户信息"""
-    if not authorization.startswith("Bearer "):
+    if not authorization or not authorization.startswith("Bearer "):
         raise HTTPException(status_code=401, detail="未授权")
     token = authorization[7:]
     payload = verify_token(token)

backend/app/api/v1/check.py

@@ -1,11 +1,13 @@
 """状态检查 API"""
 import asyncio
 import logging
-from fastapi import APIRouter, HTTPException, Depends
+from fastapi import APIRouter, HTTPException, Depends, Request
 from celery.result import AsyncResult
 from pydantic import BaseModel
 from typing import Optional, List
 from sqlalchemy.orm import Session
+from slowapi import Limiter
+from slowapi.util import get_remote_address
 from app.tasks.check_tasks import check_all_devices
 from app.core.celery_app import celery_app
 from app.core.database import get_db
@@ -14,6 +16,7 @@ from app.middleware.permission_middleware import require_permission
 
 logger = logging.getLogger(__name__)
 router = APIRouter(prefix="/api/check", tags=["状态检查"])
+limiter = Limiter(key_func=get_remote_address)
 
 
 class CheckResult(BaseModel):
@@ -31,7 +34,8 @@ class CheckError(BaseModel):
 
 
 @router.post("/status")
-def trigger_check(_: dict = Depends(require_permission('device.check'))):
+@limiter.limit("3/minute")
+def trigger_check(request: Request, _: dict = Depends(require_permission('device.check'))):
     """手动触发状态检查"""
     try:
         task = check_all_devices.delay()

backend/app/api/v1/devices.py

@@ -1,5 +1,8 @@
 """设备管理 API"""
+import csv
+import io
 from fastapi import APIRouter, Depends, Query, HTTPException
+from fastapi.responses import StreamingResponse
 from sqlalchemy.orm import Session, joinedload
 from sqlalchemy import asc, desc, distinct, or_
 from pydantic import BaseModel
@@ -20,6 +23,7 @@ def get_devices(
     school_name: str = None,
     keyword: str = None,
     status: str = None,
+    tag: str = None,
     db: Session = Depends(get_db),
     current: dict = Depends(require_permission('device.view')),
 ):
@@ -68,6 +72,8 @@ def get_devices(
         query = query.filter(ONUDevice.region == region)
     if school_name:
         query = query.filter(ONUDevice.school_name.contains(school_name))
+    if tag:
+        query = query.filter(ONUDevice.tags.contains(tag))
     if keyword:
         query = query.filter(
             or_(
@@ -332,6 +338,55 @@ def export_replacements(
     )
 
 
+@router.get("/tags")
+def get_all_tags(db: Session = Depends(get_db)):
+    """获取所有不重复的设备标签"""
+    from sqlalchemy import func as _func
+    rows = db.query(ONUDevice.tags).filter(
+        ONUDevice.tags.isnot(None), ONUDevice.tags != ''
+    ).all()
+    tags = set()
+    for (tag_str,) in rows:
+        for t in tag_str.split(','):
+            t = t.strip()
+            if t:
+                tags.add(t)
+    return sorted(tags)
+
+
+@router.get("/export/csv")
+def export_devices_csv(
+    region: Optional[str] = Query(None),
+    school_name: Optional[str] = Query(None),
+    db: Session = Depends(get_db),
+    _: dict = Depends(require_permission('device.view')),
+):
+    """导出设备列表为 CSV"""
+    from sqlalchemy import func as _func
+
+    query = db.query(ONUDevice)
+    if region:
+        query = query.filter(ONUDevice.region == region)
+    if school_name:
+        query = query.filter(ONUDevice.school_name == school_name)
+    devices = query.order_by(ONUDevice.region, ONUDevice.school_name).all()
+
+    output = io.StringIO()
+    writer = csv.writer(output)
+    writer.writerow(["MAC地址", "区域", "学校", "楼宇", "场所类型", "房间号", "端口", "型号", "LOID", "距离(m)", "备注"])
+    for d in devices:
+        writer.writerow([d.mac_address, d.region or "", d.school_name or "", d.building or "",
+                         d.place_type or "", d.room_number or "", d.port_id or "", d.model or "",
+                         d.loid or "", d.distance_m or "", d.notes or ""])
+
+    output.seek(0)
+    return StreamingResponse(
+        iter([output.getvalue()]),
+        media_type="text/csv",
+        headers={"Content-Disposition": "attachment; filename=onu_devices.csv"}
+    )
+
+
 @router.get("/{device_id}", response_model=ONUDeviceResponse)
 def get_device(
     device_id: int,
@@ -395,6 +450,7 @@ class DeviceUpdate(BaseModel):
     room_number: Optional[str] = None
     place_type: Optional[str] = None
     notes: Optional[str] = None
+    tags: Optional[str] = None
 
 
 class DeviceReplaceRequest(BaseModel):
@@ -430,6 +486,7 @@ def update_device(
     device.room_number = body.room_number or None
     device.place_type = body.place_type or None
     device.notes = body.notes or None
+    device.tags = body.tags or None
 
     # 若该设备 MAC 在 new_devices 待入库列表中，自动移除（已在设备列表中补全信息）
     from app.models.device import NewDevice
@@ -613,6 +670,18 @@ def get_device_optical_power(
         data = IMCService().get_optical_power(device.mac_address)
         if data is None:
             raise HTTPException(status_code=502, detail="获取光功率失败，iMC 接口无响应")
+        # 记录光功率历史
+        try:
+            from app.models.device import OpticalPowerHistory
+            db.add(OpticalPowerHistory(
+                onu_device_id=device_id,
+                power_in=data.get("powerIn"),
+                power_out=data.get("powerOut"),
+            ))
+            db.commit()
+        except Exception:
+            pass
+
         return OpticalPowerResponse(
             power_in=data.get("powerIn"),
             power_out=data.get("powerOut"),
@@ -648,10 +717,9 @@ def get_onu_events(
         raise HTTPException(status_code=404, detail="关联的 OLT 不存在")
 
     from app.services.ssh_service import SSHService
-    ssh = SSHService(olt.ip_address, olt.username, olt.password)
     try:
-        ssh.connect()
+        with SSHService(olt.ip_address, olt.username, olt.password) as ssh:
-        events = ssh.get_onu_events(device.port_id)
+            events = ssh.get_onu_events(device.port_id)
         return {
             "interface": f"Onu{device.port_id}",
             "olt_location": olt.location,
@@ -659,5 +727,26 @@ def get_onu_events(
         }
     except Exception as e:
         raise HTTPException(status_code=500, detail=f"查询失败: {str(e)}")
-    finally:
+
-        ssh.close()
+
+@router.get("/{device_id}/optical-power-history")
+def get_optical_power_history(
+    device_id: int,
+    limit: int = Query(20, ge=1, le=100),
+    db: Session = Depends(get_db),
+    _: dict = Depends(require_permission('device.view')),
+):
+    """获取设备光功率历史记录"""
+    from app.models.device import OpticalPowerHistory
+    rows = (
+        db.query(OpticalPowerHistory)
+        .filter(OpticalPowerHistory.onu_device_id == device_id)
+        .order_by(OpticalPowerHistory.recorded_at.desc())
+        .limit(limit)
+        .all()
+    )
+    return [
+        {"power_in": r.power_in, "power_out": r.power_out,
+         "recorded_at": r.recorded_at.isoformat() if r.recorded_at else None}
+        for r in rows
+    ]

backend/app/api/v1/monitor.py

@@ -0,0 +1,45 @@
+"""Celery 任务监控 API"""
+import time
+import redis as redis_lib
+from fastapi import APIRouter, Depends
+from app.core.celery_app import celery_app
+from app.core.config import settings
+from app.middleware.permission_middleware import require_permission
+
+router = APIRouter(prefix="/api/monitor", tags=["任务监控"])
+
+
+def _get_redis():
+    return redis_lib.from_url(settings.REDIS_URL, decode_responses=True)
+
+
+@router.get("/tasks")
+def get_task_status(_: dict = Depends(require_permission('*'))):
+    """获取 Celery 任务状态概览"""
+    try:
+        insp = celery_app.control.inspect()
+        active = insp.active() or {}
+        scheduled = insp.scheduled() or {}
+        reserved = insp.reserved() or {}
+
+        r = _get_redis()
+        last_run = r.get("check_all_devices:last_run")
+        is_running = bool(r.get("check_all_devices:running"))
+        interval_str = r.get("system:check_interval_seconds")
+
+        interval = int(interval_str) if interval_str else 1800
+        next_run = None
+        if last_run and not is_running:
+            next_run = float(last_run) + interval
+
+        return {
+            "workers": list(active.keys()),
+            "active_count": sum(len(v) for v in active.values()),
+            "scheduled_count": sum(len(v) for v in scheduled.values()),
+            "check_running": is_running,
+            "last_check": float(last_run) if last_run else None,
+            "next_check": next_run,
+            "check_interval_seconds": interval,
+        }
+    except Exception as e:
+        return {"error": str(e)}

backend/app/api/v1/olt.py

@@ -4,6 +4,7 @@ from sqlalchemy.orm import Session
 from sqlalchemy import distinct
 from pydantic import BaseModel
 from app.core.database import get_db
+from app.core.config import settings
 from app.middleware.permission_middleware import require_permission
 from app.models.device import OLTDevice
 import pandas as pd
@@ -262,14 +263,11 @@ def clear_onu_port(
     if body.port_id not in port_ids:
         raise HTTPException(status_code=400, detail="端口不在重复记录中")
 
-    ssh = SSHService(olt.ip_address, olt.username, olt.password)
     try:
-        ssh.connect()
+        with SSHService(olt.ip_address, olt.username, olt.password) as ssh:
-        ssh.clear_onu_port(body.port_id)
+            ssh.clear_onu_port(body.port_id)
     except Exception as e:
         raise HTTPException(status_code=500, detail=f"清除失败: {str(e)}")
-    finally:
-        ssh.close()
 
     # 从 ports 列表移除已清除的端口
     remaining = [p for p in record.ports if p["port_id"] != body.port_id]
@@ -450,10 +448,9 @@ def loopback_detection(
     onu_map = {(o.olt_id, o.port_id): o for o in all_onus if o.port_id}
 
     def check_one(olt):
-        ssh = SSHService(olt.ip_address, olt.username, olt.password)
         try:
-            ssh.connect()
+            with SSHService(olt.ip_address, olt.username, olt.password) as ssh:
-            detection = ssh.detect_loopback()
+                detection = ssh.detect_loopback()
         except Exception as e:
             return {
                 "olt_id": olt.id,
@@ -463,8 +460,6 @@ def loopback_detection(
                 "has_loop": False,
                 "loop_interfaces": [],
             }
-        finally:
-            ssh.close()
 
         loop_interfaces = []
         for iface in detection.get("interfaces", []):
@@ -487,6 +482,7 @@ def loopback_detection(
             "has_loop": detection["has_loop"],
             "loop_interfaces": loop_interfaces,
             "error": None,
+            "raw": detection.get("raw", ""),
         }
 
     results_map = {}
@@ -501,8 +497,8 @@ def loopback_detection(
 
 
 class SyncNTPRequest(BaseModel):
-    old_server: str = "172.16.0.254"
+    old_server: str = settings.NTP_OLD_SERVER
-    new_server: str = "172.16.1.252"
+    new_server: str = settings.NTP_NEW_SERVER
 
 
 @router.post("/sync-ntp")
@@ -521,10 +517,9 @@ def sync_ntp(
         olts = [o for o in olts if o.region in areas] if areas else []
 
     def sync_one(olt):
-        ssh = SSHService(olt.ip_address, olt.username, olt.password)
         try:
-            ssh.connect()
+            with SSHService(olt.ip_address, olt.username, olt.password) as ssh:
-            ssh.sync_ntp(body.old_server, body.new_server)
+                ssh.sync_ntp(body.old_server, body.new_server)
             return {
                 "olt_ip": olt.ip_address,
                 "olt_location": olt.location or olt.ip_address,
@@ -538,8 +533,6 @@ def sync_ntp(
                 "success": False,
                 "error": str(e),
             }
-        finally:
-            ssh.close()
 
     results_map = {}
     with ThreadPoolExecutor(max_workers=len(olts) or 1) as executor:
@@ -573,15 +566,12 @@ def get_olt_ports(
     olt = db.query(OLTDevice).filter(OLTDevice.id == olt_id).first()
     if not olt:
         raise HTTPException(status_code=404, detail="OLT 不存在")
-    ssh = SSHService(olt.ip_address, olt.username, olt.password)
     try:
-        ssh.connect()
+        with SSHService(olt.ip_address, olt.username, olt.password) as ssh:
-        ports = ssh.get_olt_ports()
+            ports = ssh.get_olt_ports()
         return {"ports": ports}
     except Exception as e:
         raise HTTPException(status_code=500, detail=str(e))
-    finally:
-        ssh.close()
 
 
 @router.post("/devices/{olt_id}/ports/toggle")
@@ -593,13 +583,10 @@ def toggle_olt_port(olt_id: int, body: TogglePortRequest, port_name: str, db: Se
     olt = db.query(OLTDevice).filter(OLTDevice.id == olt_id).first()
     if not olt:
         raise HTTPException(status_code=404, detail="OLT 不存在")
-    ssh = SSHService(olt.ip_address, olt.username, olt.password)
     try:
-        ssh.connect()
+        with SSHService(olt.ip_address, olt.username, olt.password) as ssh:
-        ssh.toggle_olt_port(port_name, body.action)
+            ssh.toggle_olt_port(port_name, body.action)
         return {"message": f"端口 {port_name} 已{'关闭' if body.action == 'shutdown' else '开启'}"}
     except Exception as e:
         raise HTTPException(status_code=500, detail=str(e))
-    finally:
-        ssh.close()
 

backend/app/api/v1/settings.py

@@ -98,3 +98,29 @@ def update_about(
         db.add(SystemSetting(key='about_content', value=content, description='关于页面内容（Markdown）'))
     db.commit()
     return {"key": "about_content", "value": content}
+
+
+@router.put("/webhook")
+def update_webhook(
+    body: dict,
+    db: Session = Depends(get_db),
+    _: dict = Depends(require_permission('*')),
+):
+    """更新企业微信告警配置（仅管理员）"""
+    configs = [
+        ("wechat_corpid", body.get("corpid", ""), "企业微信 CorpID"),
+        ("wechat_corpsecret", body.get("corpsecret", ""), "企业微信 CorpSecret"),
+        ("wechat_agentid", body.get("agentid", ""), "企业微信 AgentID"),
+    ]
+    for key, value, desc in configs:
+        setting = db.query(SystemSetting).filter_by(key=key).first()
+        if setting:
+            setting.value = value
+        else:
+            db.add(SystemSetting(key=key, value=value, description=desc))
+
+    db.commit()
+    return {"message": "企业微信配置已保存"}
+
+
+

backend/app/api/v1/stats.py

@@ -179,16 +179,14 @@ def get_trend(
     )
     snapshot_map = {s.snapshot_date: s for s in snapshots}
 
-    # 今天实时聚合
+    # 今天实时聚合 — 取每个设备最新状态（不限日期），反映真实当前状况
     today_str = today.strftime('%Y-%m-%d')
-    start_of_today = datetime.combine(today, datetime.min.time())
 
-    daily_latest_subq = (
+    latest_subq = (
         db.query(
             DeviceStatusHistory.onu_device_id,
             func.max(DeviceStatusHistory.checked_at).label("max_checked_at"),
         )
-        .filter(DeviceStatusHistory.checked_at >= start_of_today)
         .group_by(DeviceStatusHistory.onu_device_id)
         .subquery()
     )
@@ -198,9 +196,9 @@ def get_trend(
             func.sum(case((DeviceStatusHistory.status == 'offline', 1), else_=0)).label("offline"),
         )
         .join(
-            daily_latest_subq,
+            latest_subq,
-            (DeviceStatusHistory.onu_device_id == daily_latest_subq.c.onu_device_id) &
+            (DeviceStatusHistory.onu_device_id == latest_subq.c.onu_device_id) &
-            (DeviceStatusHistory.checked_at == daily_latest_subq.c.max_checked_at)
+            (DeviceStatusHistory.checked_at == latest_subq.c.max_checked_at)
         )
         .one()
     )
@@ -246,3 +244,175 @@ def get_trend(
 
     return result
 
+@router.get("/olt-stats")
+def get_olt_stats(
+    db: Session = Depends(get_db),
+    _: dict = Depends(require_permission('device.view')),
+):
+    """获取每台 OLT 下的设备在线率统计"""
+    from app.models.device import OLTDevice
+
+    latest_subq = (
+        db.query(
+            DeviceStatusHistory.onu_device_id,
+            func.max(DeviceStatusHistory.checked_at).label("max_checked_at")
+        )
+        .group_by(DeviceStatusHistory.onu_device_id)
+        .subquery()
+    )
+    latest_status_subq = (
+        db.query(DeviceStatusHistory.onu_device_id, DeviceStatusHistory.status)
+        .join(latest_subq,
+              (DeviceStatusHistory.onu_device_id == latest_subq.c.onu_device_id) &
+              (DeviceStatusHistory.checked_at == latest_subq.c.max_checked_at))
+        .subquery()
+    )
+
+    rows = (
+        db.query(
+            OLTDevice.id,
+            OLTDevice.ip_address,
+            OLTDevice.location,
+            OLTDevice.region,
+            func.count(ONUDevice.id).label("total"),
+            func.sum(case((latest_status_subq.c.status == 'online', 1), else_=0)).label("online"),
+            func.sum(case((latest_status_subq.c.status == 'offline', 1), else_=0)).label("offline"),
+        )
+        .outerjoin(ONUDevice, ONUDevice.olt_id == OLTDevice.id)
+        .outerjoin(latest_status_subq, ONUDevice.id == latest_status_subq.c.onu_device_id)
+        .group_by(OLTDevice.id)
+        .order_by(OLTDevice.region, OLTDevice.location)
+        .all()
+    )
+
+    return [
+        {
+            "olt_id": r.id,
+            "name": r.location or r.ip_address,
+            "ip": r.ip_address,
+            "region": r.region or "未知",
+            "total": int(r.total or 0),
+            "online": int(r.online or 0),
+            "offline": int(r.offline or 0),
+        }
+        for r in rows
+    ]
+
+
+@router.get("/offline-schools")
+def get_offline_schools(
+    db: Session = Depends(get_db),
+    _: dict = Depends(require_permission('device.view')),
+):
+    """获取全部离线的学校列表"""
+    _subq = (
+        db.query(DeviceStatusHistory.onu_device_id,
+                 func.max(DeviceStatusHistory.checked_at).label("max_checked_at"))
+        .group_by(DeviceStatusHistory.onu_device_id).subquery()
+    )
+    _status_subq = (
+        db.query(DeviceStatusHistory.onu_device_id, DeviceStatusHistory.status)
+        .join(_subq,
+              (DeviceStatusHistory.onu_device_id == _subq.c.onu_device_id) &
+              (DeviceStatusHistory.checked_at == _subq.c.max_checked_at)).subquery()
+    )
+    rows = (
+        db.query(
+            ONUDevice.school_name, ONUDevice.region,
+            func.count().label("total"),
+            func.sum(case((_status_subq.c.status == 'online', 1), else_=0)).label("online"),
+        )
+        .outerjoin(_status_subq, ONUDevice.id == _status_subq.c.onu_device_id)
+        .group_by(ONUDevice.school_name, ONUDevice.region)
+        .having(func.sum(case((_status_subq.c.status == 'online', 1), else_=0)) == 0)
+        .all()
+    )
+    return [
+        {"school_name": r.school_name or "未知", "region": r.region or "未知", "total": int(r.total or 0)}
+        for r in rows if int(r.total or 0) > 0
+    ]
+
+
+@router.get("/model-distribution")
+def get_model_distribution(
+    db: Session = Depends(get_db),
+    _: dict = Depends(require_permission('device.view')),
+):
+    """统计 ONU 设备型号分布"""
+    rows = (
+        db.query(
+            ONUDevice.model,
+            func.count(ONUDevice.id).label("count"),
+        )
+        .filter(ONUDevice.model.isnot(None), ONUDevice.model != '')
+        .group_by(ONUDevice.model)
+        .order_by(func.count(ONUDevice.id).desc())
+        .all()
+    )
+    unknown = db.query(func.count(ONUDevice.id)).filter(
+        (ONUDevice.model.is_(None)) | (ONUDevice.model == '')
+    ).scalar() or 0
+
+    result = [{"model": r.model or "未知", "count": r.count} for r in rows]
+    if unknown > 0:
+        result.append({"model": "未知型号", "count": unknown})
+    return result
+
+
+@router.get("/school-locations")
+def get_school_locations(
+    db: Session = Depends(get_db),
+    _: dict = Depends(require_permission('device.view')),
+):
+    """获取各学校的聚合位置数据（用于地图展示）"""
+    latest_subq = (
+        db.query(
+            DeviceStatusHistory.onu_device_id,
+            func.max(DeviceStatusHistory.checked_at).label("max_checked_at")
+        )
+        .group_by(DeviceStatusHistory.onu_device_id)
+        .subquery()
+    )
+    latest_status_subq = (
+        db.query(
+            DeviceStatusHistory.onu_device_id,
+            DeviceStatusHistory.status
+        )
+        .join(
+            latest_subq,
+            (DeviceStatusHistory.onu_device_id == latest_subq.c.onu_device_id) &
+            (DeviceStatusHistory.checked_at == latest_subq.c.max_checked_at)
+        )
+        .subquery()
+    )
+
+    rows = (
+        db.query(
+            ONUDevice.school_name,
+            ONUDevice.region,
+            ONUDevice.latitude,
+            ONUDevice.longitude,
+            func.count().label("total"),
+            func.sum(case((latest_status_subq.c.status == 'online', 1), else_=0)).label("online"),
+            func.sum(case((latest_status_subq.c.status == 'offline', 1), else_=0)).label("offline"),
+        )
+        .outerjoin(latest_status_subq, ONUDevice.id == latest_status_subq.c.onu_device_id)
+        .filter(ONUDevice.latitude.isnot(None))
+        .filter(ONUDevice.longitude.isnot(None))
+        .group_by(ONUDevice.school_name, ONUDevice.region, ONUDevice.latitude, ONUDevice.longitude)
+        .all()
+    )
+
+    return [
+        {
+            "school_name": row.school_name or "未知",
+            "region": row.region or "未知",
+            "latitude": row.latitude,
+            "longitude": row.longitude,
+            "total": int(row.total or 0),
+            "online": int(row.online or 0),
+            "offline": int(row.offline or 0),
+        }
+        for row in rows
+    ]
+

backend/app/api/v1/users.py

@@ -28,7 +28,7 @@ def get_users(
         query = query.filter(User.role == role)
     if keyword:
         query = query.filter(
-            User.username.contains(keyword) | User.email.contains(keyword)
+            User.username.contains(keyword) | User.display_name.contains(keyword) | User.email.contains(keyword)
         )
     query = query.order_by(asc(User.created_at))
     total = query.count()

backend/app/api/v1/wechat.py

@@ -0,0 +1,241 @@
+"""企业微信回调 API（URL验证 + 消息接收）"""
+import logging
+from fastapi import APIRouter, Request, Response
+from app.services.wechat_service import get_wechat_service
+from app.core.config import settings
+
+logger = logging.getLogger(__name__)
+router = APIRouter(prefix="/api/wechat", tags=["企业微信回调"])
+
+
+@router.post("/menu/create")
+async def create_menu():
+    """创建/更新企业微信应用菜单"""
+    svc = get_wechat_service()
+    menu = {
+        "button": [
+            {
+                "name": "设备查询",
+                "sub_button": [
+                    {"type": "click", "name": "在线统计", "key": "online"},
+                    {"type": "click", "name": "全离线学校", "key": "offline_schools"},
+                    {"type": "click", "name": "MAC查询", "key": "status"},
+                ]
+            },
+            {"type": "click", "name": "帮助", "key": "help"},
+        ]
+    }
+    ok = svc.create_menu(menu)
+    return {"success": ok}
+
+
+@router.get("/callback")
+async def wechat_callback_get(request: Request):
+    """企业微信 URL 验证（GET）"""
+    params = request.query_params
+    msg_signature = params.get("msg_signature", "")
+    timestamp = params.get("timestamp", "")
+    nonce = params.get("nonce", "")
+    echostr = params.get("echostr", "")
+
+    svc = get_wechat_service()
+    result = svc.verify_url(msg_signature, timestamp, nonce, echostr)
+    if result:
+        return Response(content=result, media_type="text/plain")
+    return Response(content="验证失败", status_code=403)
+
+
+@router.post("/callback")
+async def wechat_callback_post(request: Request):
+    """企业微信消息接收（POST）"""
+    params = request.query_params
+    msg_signature = params.get("msg_signature", "")
+    timestamp = params.get("timestamp", "")
+    nonce = params.get("nonce", "")
+
+    xml_data = await request.body()
+    if not xml_data:
+        return Response(content="", media_type="text/plain")
+
+    svc = get_wechat_service()
+    msg = svc.parse_message(xml_data)
+    if not msg:
+        return Response(content="", media_type="text/plain")
+
+    msg_type = msg.get("MsgType", "")
+    from_user = msg.get("FromUserName", "")
+
+    logger.info(f"收到企微消息: type={msg_type}, from={from_user}, content={msg.get('Content', '')}")
+
+    if msg_type == "text":
+        content = msg.get("Content", "").strip()
+        if content.lower() in ("online", "在线", "在线统计"):
+            _handle_online_cmd(svc, from_user)
+        elif content.lower() in ("全离线", "离线学校", "offline"):
+            _handle_offline_schools_cmd(svc, from_user)
+        elif content.startswith("#状态+") or content.startswith("#status+"):
+            _handle_status_cmd(svc, from_user, content)
+        elif content.lower() in ("help", "帮助", "#帮助", "#help"):
+            _handle_help_cmd(svc, from_user)
+        else:
+            # 尝试作为 MAC 后缀查询
+            _handle_status_cmd(svc, from_user, f"#状态+{content}")
+
+    elif msg_type == "event":
+        event = msg.get("Event", "")
+        event_key = msg.get("EventKey", "")
+        if event == "click":
+            if event_key == "online":
+                _handle_online_cmd(svc, from_user)
+            elif event_key == "offline_schools":
+                _handle_offline_schools_cmd(svc, from_user)
+            elif event_key == "help":
+                _handle_help_cmd(svc, from_user)
+
+    return Response(content="", media_type="text/plain")
+
+
+# ── 命令处理 ────────────────────────────────────────────────────────────────
+
+def _handle_online_cmd(svc, from_user: str):
+    """处理在线统计命令"""
+    try:
+        from app.core.database import SessionLocal
+        from app.models.device import ONUDevice, DeviceStatusHistory
+        from sqlalchemy import func, case
+
+        db = SessionLocal()
+        try:
+            latest_subq = (
+                db.query(DeviceStatusHistory.onu_device_id,
+                         func.max(DeviceStatusHistory.checked_at).label("max_checked_at"))
+                .group_by(DeviceStatusHistory.onu_device_id).subquery()
+            )
+            latest_status_subq = (
+                db.query(DeviceStatusHistory.onu_device_id, DeviceStatusHistory.status)
+                .join(latest_subq, (DeviceStatusHistory.onu_device_id == latest_subq.c.onu_device_id) &
+                      (DeviceStatusHistory.checked_at == latest_subq.c.max_checked_at)).subquery()
+            )
+            total = db.query(func.count(ONUDevice.id)).scalar() or 0
+            online = (
+                db.query(func.count(ONUDevice.id))
+                .join(latest_status_subq, ONUDevice.id == latest_status_subq.c.onu_device_id, isouter=True)
+                .filter(latest_status_subq.c.status == 'online').scalar() or 0
+            )
+            rate = (online / total * 100) if total > 0 else 0
+            svc.send_text_message(
+                f"📊 设备在线统计\n总设备数: {total}\n在线: {online}\n离线: {total - online}\n在线率: {rate:.1f}%",
+                to_user=from_user
+            )
+        finally:
+            db.close()
+    except Exception as e:
+        logger.error(f"在线统计失败: {e}")
+        svc.send_text_message("查询失败，请稍后重试", to_user=from_user)
+
+
+def _handle_status_cmd(svc, from_user: str, content: str):
+    """处理设备状态查询命令"""
+    try:
+        mac_suffix = content.split('+')[1].strip().upper()
+        from app.core.database import SessionLocal
+        from app.models.device import ONUDevice, DeviceStatusHistory
+        from sqlalchemy import func
+
+        db = SessionLocal()
+        try:
+            devices = db.query(ONUDevice).filter(
+                ONUDevice.mac_address.ilike(f"%{mac_suffix}")
+            ).limit(10).all()
+
+            if not devices:
+                svc.send_text_message("未找到匹配的设备", to_user=from_user)
+                return
+
+            lines = [f"🔍 找到 {len(devices)} 个设备（MAC 含 {mac_suffix}）：", ""]
+            for d in devices[:8]:
+                # 查最新状态
+                latest = (
+                    db.query(DeviceStatusHistory.status,
+                             func.max(DeviceStatusHistory.checked_at))
+                    .filter(DeviceStatusHistory.onu_device_id == d.id)
+                    .group_by(DeviceStatusHistory.status)
+                    .order_by(func.max(DeviceStatusHistory.checked_at).desc())
+                    .first()
+                )
+                status_text = latest[0] if latest else "未知"
+                emoji = "🟢" if status_text == "online" else "🔴"
+                school = d.school_name or "未知"
+                lines.append(f"{emoji} {d.mac_address} | {school} | {d.region or ''}")
+
+            svc.send_text_message("\n".join(lines), to_user=from_user)
+        finally:
+            db.close()
+    except Exception as e:
+        logger.error(f"设备查询失败: {e}")
+        svc.send_text_message("查询失败，请稍后重试", to_user=from_user)
+
+
+def _handle_offline_schools_cmd(svc, from_user: str):
+    """查询全离线学校"""
+    try:
+        from app.core.database import SessionLocal
+        from app.models.device import ONUDevice, DeviceStatusHistory
+        from sqlalchemy import func, case
+
+        db = SessionLocal()
+        try:
+            latest_subq = (
+                db.query(DeviceStatusHistory.onu_device_id,
+                         func.max(DeviceStatusHistory.checked_at).label("max_checked_at"))
+                .group_by(DeviceStatusHistory.onu_device_id).subquery()
+            )
+            latest_status_subq = (
+                db.query(DeviceStatusHistory.onu_device_id, DeviceStatusHistory.status)
+                .join(latest_subq,
+                      (DeviceStatusHistory.onu_device_id == latest_subq.c.onu_device_id) &
+                      (DeviceStatusHistory.checked_at == latest_subq.c.max_checked_at)).subquery()
+            )
+            rows = (
+                db.query(
+                    ONUDevice.school_name, ONUDevice.region,
+                    func.count().label("total"),
+                    func.sum(case((latest_status_subq.c.status == 'online', 1), else_=0)).label("online"),
+                )
+                .outerjoin(latest_status_subq, ONUDevice.id == latest_status_subq.c.onu_device_id)
+                .group_by(ONUDevice.school_name, ONUDevice.region)
+                .having(func.sum(case((latest_status_subq.c.status == 'online', 1), else_=0)) == 0)
+                .all()
+            )
+
+            if not rows:
+                svc.send_text_message("✅ 当前没有全离线的学校", to_user=from_user)
+                return
+
+            lines = [f"🔴 全离线学校 ({len(rows)} 所)：", ""]
+            for r in rows:
+                school = r.school_name or "未知"
+                region = r.region or "未知"
+                total = int(r.total or 0)
+                if total > 0:
+                    lines.append(f"• {school}（{region}）: {total}台全离线")
+            svc.send_text_message("\n".join(lines), to_user=from_user)
+        finally:
+            db.close()
+    except Exception as e:
+        logger.error(f"全离线查询失败: {e}")
+        svc.send_text_message("查询失败，请稍后重试", to_user=from_user)
+
+
+def _handle_help_cmd(svc, from_user: str):
+    """处理帮助命令"""
+    svc.send_text_message(
+        "📋 H3C ONU 管理助手\n\n"
+        "🔍 设备查询:\n"
+        "• 发送「在线」查看设备在线统计\n"
+        "• 发送「全离线」查看全离线学校\n"
+        "• 发送 MAC 地址后四位查询设备\n\n"
+        "💡 发送「帮助」显示此信息\n"
+        f"💻 完整功能: {settings.FRONTEND_URL}",
+        to_user=from_user
+    )

backend/app/api/v1/ws.py

@@ -0,0 +1,46 @@
+"""WebSocket 实时推送"""
+import asyncio
+import json
+import logging
+import redis.asyncio as aioredis
+from fastapi import APIRouter, WebSocket, WebSocketDisconnect
+from app.core.config import settings
+
+logger = logging.getLogger(__name__)
+router = APIRouter(prefix="/api", tags=["WebSocket"])
+
+REDIS_CHANNEL = "h3c_onu:status_updates"
+_connected: set[WebSocket] = set()
+
+
+async def _redis_listener():
+    """监听 Redis pub/sub 并广播给所有 WebSocket 客户端"""
+    try:
+        r = aioredis.from_url(settings.REDIS_URL)
+        pubsub = r.pubsub()
+        await pubsub.subscribe(REDIS_CHANNEL)
+        logger.info("WebSocket Redis 监听已启动")
+        async for msg in pubsub.listen():
+            if msg["type"] == "message":
+                dead: set[WebSocket] = set()
+                for ws in _connected:
+                    try:
+                        await ws.send_text(msg["data"].decode())
+                    except Exception:
+                        dead.add(ws)
+                _connected -= dead
+    except Exception as e:
+        logger.error(f"Redis 监听异常: {e}")
+
+
+@router.websocket("/ws/dashboard")
+async def dashboard_ws(ws: WebSocket):
+    await ws.accept()
+    _connected.add(ws)
+    try:
+        while True:
+            await ws.receive_text()  # keep-alive, 忽略客户端消息
+    except WebSocketDisconnect:
+        pass
+    finally:
+        _connected.discard(ws)

backend/app/core/config.py

@@ -21,14 +21,31 @@ class Settings(BaseSettings):
     CASDOOR_ORG_NAME: str
     CASDOOR_APP_NAME: str
     CASDOOR_CERTIFICATE: str = ""  # 支持文件路径或直接填 PEM 内容
-    CASDOOR_REDIRECT_URL: str = "http://localhost:5173/callback"
+    CASDOOR_REDIRECT_URL: str = ""
 
     SSH_TIMEOUT: int = 30
     CHECK_INTERVAL: int = 1800
     MANUAL_COOLDOWN: int = 300
 
+    # CORS & 前端
+    CORS_ORIGINS: str = ""  # 逗号分隔
+    FRONTEND_URL: str = "https://onu.dhdx.fun"
+
+    # NTP 同步配置
+    NTP_OLD_SERVER: str = "172.16.0.254"
+    NTP_NEW_SERVER: str = "172.16.1.252"
+
     # iMC API 配置（用于 ONU 远程重启和光功率查询）
     IMC_API_URL: str = ""
+
+    # 企业微信应用消息 API（用于发送告警）
+    WECHAT_CORPID: str = ""
+    WECHAT_CORPSECRET: str = ""
+    WECHAT_AGENTID: str = ""
+    WECHAT_TOKEN: str = ""
+    WECHAT_ENCODING_AES_KEY: str = ""
+    WECHAT_USE_PROXY: bool = True
+    WECHAT_PROXY_API_URL: str = ""
     IMC_API_USERNAME: str = ""
     IMC_API_PASSWORD: str = ""
     IMC_API_VERIFY_SSL: bool = False

backend/app/core/database.py

@@ -4,7 +4,14 @@ from sqlalchemy.ext.declarative import declarative_base
 from sqlalchemy.orm import sessionmaker
 from app.core.config import settings
 
-engine = create_engine(settings.DATABASE_URL, pool_pre_ping=True)
+engine = create_engine(
+    settings.DATABASE_URL,
+    pool_pre_ping=True,
+    pool_size=20,
+    max_overflow=40,
+    pool_recycle=3600,
+    pool_timeout=30,
+)
 SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
 Base = declarative_base()
 

backend/app/main.py

@@ -1,15 +1,57 @@
 """FastAPI 主应用"""
-from fastapi import FastAPI
+import os
+import logging
+from pythonjsonlogger import jsonlogger
+from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
+from slowapi import Limiter, _rate_limit_exceeded_handler
+from slowapi.errors import RateLimitExceeded
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.responses import JSONResponse
 from app.core.config import settings
-from app.api.v1 import auth, devices, check, import_data, stats, olt, provision, users, roles, inventory, settings as settings_api, audit
+from app.api.v1 import auth, devices, check, import_data, stats, olt, provision, users, roles, inventory, settings as settings_api, audit, wechat, ws, monitor
 from app.middleware.audit_middleware import AuditMiddleware
 
-app = FastAPI(title=settings.APP_NAME, debug=settings.DEBUG)
+# 结构化 JSON 日志
+_handler = logging.StreamHandler()
+_handler.setFormatter(jsonlogger.JsonFormatter('%(asctime)s %(name)s %(levelname)s %(message)s'))
+logging.getLogger().handlers = [_handler]
+logging.getLogger().setLevel(logging.INFO)
+logging.getLogger('uvicorn.access').handlers = [_handler]
 
+# 请求体大小限制中间件
+MAX_BODY_SIZE = 10 * 1024 * 1024  # 10 MB
+
+class RequestSizeLimitMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, request: Request, call_next):
+        if request.headers.get("content-length"):
+            if int(request.headers["content-length"]) > MAX_BODY_SIZE:
+                return JSONResponse({"detail": "请求体过大，最大 10MB"}, status_code=413)
+        return await call_next(request)
+
+# CORS 白名单 — 支持通过环境变量 CORS_ORIGINS 覆盖（逗号分隔）
+CORS_ORIGINS_DEFAULT = "http://localhost:5173,http://localhost:18002,https://onu.dhdx.fun"
+ALLOWED_ORIGINS = [o.strip() for o in os.getenv("CORS_ORIGINS", CORS_ORIGINS_DEFAULT).split(",") if o.strip()]
+
+
+def get_client_ip(request: Request) -> str:
+    """读取 X-Forwarded-For 首字段作为真实客户端 IP"""
+    forwarded = request.headers.get("X-Forwarded-For")
+    if forwarded:
+        return forwarded.split(",")[0].strip()
+    return request.client.host if request.client else "unknown"
+
+
+limiter = Limiter(key_func=get_client_ip, default_limits=["120/minute"])
+
+app = FastAPI(title=settings.APP_NAME, debug=settings.DEBUG)
+app.state.limiter = limiter
+app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
+
+app.add_middleware(RequestSizeLimitMiddleware)
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
+    allow_origins=ALLOWED_ORIGINS if ALLOWED_ORIGINS else ["*"],
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
@@ -28,8 +70,51 @@ app.include_router(roles.router)
 app.include_router(inventory.router)
 app.include_router(settings_api.router)
 app.include_router(audit.router)
+app.include_router(wechat.router)
+app.include_router(ws.router)
+app.include_router(monitor.router)
+
+
+@app.on_event("startup")
+async def startup():
+    import asyncio
+    asyncio.create_task(ws._redis_listener())
+
+
+def _read_version() -> str:
+    """读取项目版本号"""
+    version_paths = ["/app/VERSION", os.path.join(os.path.dirname(__file__), "../../VERSION")]
+    for p in version_paths:
+        if os.path.exists(p):
+            with open(p) as f:
+                return f.read().strip()
+    return "0.0.0"
 
 
 @app.get("/health")
 def health_check():
-    return {"status": "ok"}
+    status = {"status": "ok", "db": "ok", "redis": "ok", "version": _read_version()}
+    try:
+        import redis
+        import psycopg2
+        r = redis.from_url(settings.REDIS_URL, socket_timeout=2)
+        r.ping()
+    except Exception:
+        status["redis"] = "error"
+        status["status"] = "degraded"
+    try:
+        from sqlalchemy import text
+        from app.core.database import SessionLocal
+        db = SessionLocal()
+        db.execute(text("SELECT 1"))
+        db.close()
+    except Exception:
+        status["db"] = "error"
+        status["status"] = "degraded"
+    return status
+
+
+@app.get("/api/health")
+def api_health_check():
+    """API 路径下的健康检查（用于前端通过 /api/ 代理访问）"""
+    return health_check()

backend/app/middleware/permission_middleware.py

@@ -1,8 +1,11 @@
 """权限检查中间件（数据库驱动 + Redis 缓存）"""
 import json
+import logging
 from fastapi import HTTPException, Depends, Header
 from sqlalchemy.orm import Session
 from sqlalchemy import text
+
+logger = logging.getLogger(__name__)
 import redis
 
 from app.core.database import get_db
@@ -52,14 +55,19 @@ def invalidate_role_cache(role: str) -> None:
 def require_permission(permission: str):
     """FastAPI Depends 工厂，检查 Bearer token 中的角色是否拥有指定权限"""
     def dependency(
-        authorization: str = Header(..., alias="Authorization"),
+        authorization: str = Header(None, alias="Authorization"),
         db: Session = Depends(get_db),
     ) -> dict:
+        if not authorization:
+            logger.warning("auth rejected: 缺少 Authorization 头 (permission=%s)", permission)
+            raise HTTPException(status_code=401, detail="未授权")
         if not authorization.startswith("Bearer "):
+            logger.warning("auth rejected: Authorization 格式错误 (permission=%s): %.50s", permission, authorization)
             raise HTTPException(status_code=401, detail="未授权")
         token = authorization[7:]
         payload = verify_token(token)
         if not payload:
+            logger.warning("auth rejected: token 验证失败 (permission=%s): token前20字符=%.20s...", permission, token[:20])
             raise HTTPException(status_code=401, detail="令牌无效或已过期")
 
         role = payload.get('role', 'user')
@@ -83,11 +91,11 @@ def require_permission(permission: str):
 
 
 def get_current_user(
-    authorization: str = Header(..., alias="Authorization"),
+    authorization: str = Header(None, alias="Authorization"),
     db: Session = Depends(get_db),
 ) -> dict:
     """仅验证登录状态，不检查具体权限"""
-    if not authorization.startswith("Bearer "):
+    if not authorization or not authorization.startswith("Bearer "):
         raise HTTPException(status_code=401, detail="未授权")
     token = authorization[7:]
     payload = verify_token(token)

backend/app/models/device.py

@@ -1,5 +1,5 @@
 """设备数据模型"""
-from sqlalchemy import Column, BigInteger, String, Integer, Text, TIMESTAMP, ForeignKey, JSON
+from sqlalchemy import Column, BigInteger, String, Integer, Float, Text, TIMESTAMP, ForeignKey, JSON
 from sqlalchemy.orm import relationship
 from sqlalchemy.sql import func
 from app.core.database import Base
@@ -39,6 +39,9 @@ class ONUDevice(Base):
     place_type = Column(String(50))  # 场所类型
     room_number = Column(String(50))
     notes = Column(Text)  # 备注
+    tags = Column(Text)  # 标签（逗号分隔），如 "重点设备,考试用"
+    latitude = Column(Float, nullable=True)  # 纬度
+    longitude = Column(Float, nullable=True)  # 经度
     created_at = Column(TIMESTAMP, server_default=func.now())
     updated_at = Column(TIMESTAMP, server_default=func.now(), onupdate=func.now())
 
@@ -95,6 +98,17 @@ class NewDevice(Base):
     discovered_at = Column(TIMESTAMP, server_default=func.now())
 
 
+class OpticalPowerHistory(Base):
+    """光功率历史记录"""
+    __tablename__ = "optical_power_history"
+
+    id = Column(BigInteger, primary_key=True, index=True)
+    onu_device_id = Column(BigInteger, ForeignKey("onu_devices.id"), nullable=False, index=True)
+    power_in = Column(String(20))   # 接收光功率 dBm
+    power_out = Column(String(20))  # 发送光功率 dBm
+    recorded_at = Column(TIMESTAMP, nullable=False, server_default=func.now())
+
+
 class DeviceReplacement(Base):
     """设备更换记录"""
     __tablename__ = "device_replacements"

backend/app/models/user.py

@@ -10,6 +10,7 @@ class User(Base):
     id = Column(BigInteger, primary_key=True, index=True)
     casdoor_id = Column(String(100), unique=True, nullable=False)
     username = Column(String(100), nullable=False)
+    display_name = Column(String(100))  # 中文姓名
     email = Column(String(255))
     role = Column(String(50), default="user")
     assigned_area = Column(String(100))

backend/app/schemas/user.py

@@ -7,6 +7,7 @@ from datetime import datetime
 class UserListItem(BaseModel):
     id: int
     username: str
+    display_name: Optional[str] = None
     email: Optional[str] = None
     role: str
     assigned_area: Optional[str] = None

backend/app/services/check_service.py

@@ -1,4 +1,5 @@
 """设备状态检查服务"""
+import time
 from typing import List, Dict, Optional
 from sqlalchemy.orm import Session
 from app.services.ssh_service import SSHService
@@ -6,6 +7,26 @@ from app.models.device import OLTDevice, ONUDevice, DeviceStatusHistory, Duplica
 from datetime import datetime
 import re
 
+# SSH 连接池缓存，TTL 5 分钟
+_conn_pool: Dict[int, tuple[SSHService, float]] = {}
+_POOL_TTL = 300
+
+def _get_cached_ssh(olt_ip: str, olt_user: str, olt_pass: str, olt_id: int) -> SSHService:
+    """获取缓存的 SSH 连接，过期自动重连"""
+    entry = _conn_pool.get(olt_id)
+    if entry:
+        ssh, ts = entry
+        if time.time() - ts < _POOL_TTL:
+            return ssh
+        try:
+            ssh.close()
+        except Exception:
+            pass
+    ssh = SSHService(olt_ip, olt_user, olt_pass)
+    ssh.connect()
+    _conn_pool[olt_id] = (ssh, time.time())
+    return ssh
+
 
 def parse_distance(distance_str: Optional[str]) -> Optional[int]:
     """将距离字符串转为整数，如 '<1000' -> 1000, '1234' -> 1234"""
@@ -29,9 +50,8 @@ class CheckService:
         if not olt:
             raise Exception(f"OLT 设备不存在: {olt_id}")
 
-        ssh = SSHService(olt.ip_address, olt.username, olt.password)
+        ssh = _get_cached_ssh(olt.ip_address, olt.username, olt.password, olt_id)
         try:
-            ssh.connect()
             output = ssh.execute_command(olt.slot_command)
             onu_info_dict, _ = ssh.parse_onu_info(output)
 
@@ -83,8 +103,10 @@ class CheckService:
                 "online": online_count,
                 "offline": offline_count,
             }
-        finally:
+        except Exception:
-            ssh.close()
+            # 连接异常时清除缓存，下次自动重连
+            _conn_pool.pop(olt_id, None)
+            raise
 
     def check_single_device(self, device_id: int) -> Dict:
         """通过 SSH 单独查询一台 ONU 设备的当前状态和距离。
@@ -160,9 +182,8 @@ class CheckService:
         if not olt:
             raise Exception(f"OLT 设备不存在: {olt_id}")
 
-        ssh = SSHService(olt.ip_address, olt.username, olt.password)
+        ssh = _get_cached_ssh(olt.ip_address, olt.username, olt.password, olt_id)
         try:
-            ssh.connect()
             output = ssh.execute_command(olt.slot_command)
             onu_info_dict, duplicate_dict = ssh.parse_onu_info(output)
 
@@ -232,8 +253,9 @@ class CheckService:
                 "offline": offline_count,
                 "new_discovered": new_count,
             }
-        finally:
+        except Exception:
-            ssh.close()
+            _conn_pool.pop(olt_id, None)
+            raise
 
     async def scan_olt(self, olt_id: int) -> Dict:
         """仅扫描 OLT，返回发现的设备列表（不写入数据库）"""
@@ -241,9 +263,8 @@ class CheckService:
         if not olt:
             raise Exception(f"OLT 设备不存在: {olt_id}")
 
-        ssh = SSHService(olt.ip_address, olt.username, olt.password)
+        ssh = _get_cached_ssh(olt.ip_address, olt.username, olt.password, olt_id)
         try:
-            ssh.connect()
             output = ssh.execute_command(olt.slot_command)
             onu_info_dict, duplicate_dict = ssh.parse_onu_info(output)
 
@@ -282,8 +303,9 @@ class CheckService:
                 "devices": devices,
                 "duplicates": duplicates,
             }
-        finally:
+        except Exception:
-            ssh.close()
+            _conn_pool.pop(olt_id, None)
+            raise
 
     def _save_duplicate_macs(self, olt_id: int, duplicate_dict: dict):
         for mac, records in duplicate_dict.items():

backend/app/services/ssh_service.py

@@ -4,8 +4,6 @@ import re
 import time
 from typing import Dict, List, Optional, Tuple
 from dataclasses import dataclass
-from app.core.config import settings
-
 
 @dataclass
 class ONUInfo:
@@ -36,7 +34,7 @@ class SSHService:
         """建立 SSH 连接，等待初始 banner 输出完毕"""
         try:
             self.client = paramiko.SSHClient()
-            self.client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+            self.client.set_missing_host_key_policy(paramiko.WarningPolicy())
             self.client.connect(
                 hostname=self.host,
                 port=self.port,
@@ -51,7 +49,7 @@ class SSHService:
             while time.time() < deadline:
                 if self.shell.recv_ready():
                     buf += self.shell.recv(4096).decode('utf-8', errors='ignore')
-                    if ">" in buf:
+                    if re.search(r'<[^>]+>', buf):
                         break
                 else:
                     time.sleep(0.2)
@@ -77,14 +75,28 @@ class SSHService:
                 if "---- More ----" in chunk:
                     self.shell.send(" ")
                     time.sleep(0.3)
-                elif ">" in chunk:
+                elif re.search(r'^<[^>]+>\s*$', chunk, re.MULTILINE):
-                    # 命令提示符出现，说明输出完毕
+                    # 匹配整行为 <DEVICE_NAME> 的提示符行（不匹配回显中的 ">"）
                     break
             else:
                 time.sleep(0.2)
 
         return output
 
+    def _send_and_wait(self, cmd: str, expect: str, timeout: int = 10) -> str:
+        """发送命令并等待期望字符串出现，超时返回已收集的输出"""
+        self.shell.send(cmd + "\n")
+        buf = ""
+        deadline = time.time() + timeout
+        while time.time() < deadline:
+            if self.shell.recv_ready():
+                buf += self.shell.recv(4096).decode('utf-8', errors='ignore')
+                if expect in buf:
+                    return buf
+            else:
+                time.sleep(0.2)
+        return buf
+
     def clear_onu_port(self, port_id: str) -> bool:
         """清除指定端口的 ONU 配置（恢复默认）
         流程: system-view -> interface Onu{port_id} -> default -> Y
@@ -92,26 +104,13 @@ class SSHService:
         if not self.shell:
             raise Exception("SSH 未连接")
 
-        def send_and_wait(cmd: str, expect: str, timeout: int = 10) -> str:
-            self.shell.send(cmd + "\n")
-            buf = ""
-            deadline = time.time() + timeout
-            while time.time() < deadline:
-                if self.shell.recv_ready():
-                    buf += self.shell.recv(4096).decode('utf-8', errors='ignore')
-                    if expect in buf:
-                        return buf
-                else:
-                    time.sleep(0.2)
-            return buf
-
         # 进入系统视图
-        out = send_and_wait("system-view", "]")
+        out = self._send_and_wait("system-view", "]")
         if "]" not in out:
             raise Exception("进入 system-view 失败")
 
         # 进入端口
-        out = send_and_wait(f"interface Onu{port_id}", "]")
+        out = self._send_and_wait(f"interface Onu{port_id}", "]")
         if "]" not in out:
             raise Exception(f"进入端口 Onu{port_id} 失败")
 
@@ -138,8 +137,8 @@ class SSHService:
             self.shell.recv(4096)
 
         # 退出到用户视图
-        send_and_wait("quit", "]", timeout=5)
+        self._send_and_wait("quit", "]", timeout=5)
-        send_and_wait("quit", ">", timeout=5)
+        self._send_and_wait("quit", ">", timeout=5)
 
         return True
 
@@ -150,7 +149,7 @@ class SSHService:
         interfaces = []
         if has_loop:
             for line in output.splitlines():
-                m = re.match(r'\s+(Onu\S+)\s+', line)
+                m = re.match(r'\s+(Onu\S+)', line)
                 if m:
                     interfaces.append(m.group(1))
         return {"has_loop": has_loop, "interfaces": interfaces, "raw": output}
@@ -176,8 +175,8 @@ class SSHService:
         """清理终端控制字符和 More 分页标记，避免污染解析"""
         # 移除 ANSI 转义序列
         output = re.sub(r'\x1b\[[0-9;]*[a-zA-Z]', '', output)
-        # 移除 ---- More ---- 行（含前后控制字符）
+        # 移除 ---- More ---- 标记（仅标记本身，保留同行后续设备数据）
-        output = re.sub(r'---- More ----[^\n]*', '', output)
+        output = re.sub(r'---- More ----', '', output)
         # 将独立的 \r（不跟 \n）替换为空，避免覆盖行内容
         output = re.sub(r'\r(?!\n)', '', output)
         return output
@@ -319,33 +318,20 @@ class SSHService:
         if not self.shell:
             raise Exception("SSH 未连接")
 
-        def send_and_wait(cmd: str, expect: str, timeout: int = 10) -> str:
+        out = self._send_and_wait("system-view", "]")
-            self.shell.send(cmd + "\n")
-            buf = ""
-            deadline = time.time() + timeout
-            while time.time() < deadline:
-                if self.shell.recv_ready():
-                    buf += self.shell.recv(4096).decode('utf-8', errors='ignore')
-                    if expect in buf:
-                        return buf
-                else:
-                    time.sleep(0.2)
-            return buf
-
-        out = send_and_wait("system-view", "]")
         if "]" not in out:
             raise Exception("进入 system-view 失败")
 
-        out = send_and_wait(f"interface {port_name}", "]")
+        out = self._send_and_wait(f"interface {port_name}", "]")
         if "]" not in out:
             raise Exception(f"进入端口 {port_name} 失败")
 
-        out = send_and_wait(action, "]")
+        out = self._send_and_wait(action, "]")
         if "]" not in out:
             raise Exception(f"执行 {action} 失败")
 
-        send_and_wait("quit", "]", timeout=5)
+        self._send_and_wait("quit", "]", timeout=5)
-        send_and_wait("quit", ">", timeout=5)
+        self._send_and_wait("quit", ">", timeout=5)
         return True
 
     def sync_ntp(self, old_server: str, new_server: str) -> bool:
@@ -356,41 +342,28 @@ class SSHService:
         if not self.shell:
             raise Exception("SSH 未连接")
 
-        def send_and_wait(cmd: str, expect: str, timeout: int = 15) -> str:
+        out = self._send_and_wait("system-view", "]")
-            self.shell.send(cmd + "\n")
-            buf = ""
-            deadline = time.time() + timeout
-            while time.time() < deadline:
-                if self.shell.recv_ready():
-                    buf += self.shell.recv(4096).decode('utf-8', errors='ignore')
-                    if expect in buf:
-                        return buf
-                else:
-                    time.sleep(0.2)
-            return buf
-
-        out = send_and_wait("system-view", "]")
         if "]" not in out:
             raise Exception("进入 system-view 失败")
 
         # 删除旧 NTP 服务器（若不存在会报错，忽略即可）
-        send_and_wait(f"undo ntp-service unicast-server {old_server}", "]")
+        self._send_and_wait(f"undo ntp-service unicast-server {old_server}", "]")
 
         # 添加新 NTP 服务器
-        out = send_and_wait(f"ntp-service unicast-server {new_server}", "]")
+        out = self._send_and_wait(f"ntp-service unicast-server {new_server}", "]")
         if "]" not in out:
             raise Exception(f"配置 NTP 服务器 {new_server} 失败")
 
         # 设置时区为北京时间
-        out = send_and_wait("clock timezone Beijing add 08:00:00", "]")
+        out = self._send_and_wait("clock timezone Beijing add 08:00:00", "]")
         if "]" not in out:
             raise Exception("配置时区失败")
 
         # 退出系统视图
-        send_and_wait("quit", ">")
+        self._send_and_wait("quit", ">")
 
         # 强制保存配置
-        send_and_wait("save force", ">", timeout=30)
+        self._send_and_wait("save force", ">", timeout=30)
 
         return True
 
@@ -427,6 +400,16 @@ class SSHService:
             })
         return events
 
+    def __enter__(self):
+        """上下文管理器入口，自动连接"""
+        self.connect()
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        """上下文管理器出口，自动关闭连接"""
+        self.close()
+        return False
+
     def close(self):
         """关闭 SSH 连接"""
         if self.client:

backend/app/services/wechat_service.py

@@ -0,0 +1,331 @@
+"""企业微信 (WeChat Work) 应用消息服务"""
+import time
+import hashlib
+import base64
+import socket
+import struct
+import urllib.parse
+import xml.etree.ElementTree as ET
+import logging
+import requests
+from Crypto.Cipher import AES
+from app.core.config import settings
+
+logger = logging.getLogger(__name__)
+
+
+def _get_db_setting(key: str, default: str = "") -> str:
+    """从数据库读取 SystemSetting，失败时返回 default"""
+    try:
+        from app.core.database import SessionLocal
+        from app.models.setting import SystemSetting
+        db = SessionLocal()
+        try:
+            row = db.query(SystemSetting).filter_by(key=key).first()
+            return row.value if row else default
+        finally:
+            db.close()
+    except Exception:
+        return default
+
+
+class WeChatService:
+    """企业微信应用消息服务"""
+
+    def __init__(self):
+        # 优先读环境变量，fallback 到数据库配置
+        self.corpid = settings.WECHAT_CORPID or _get_db_setting("wechat_corpid")
+        self.corpsecret = settings.WECHAT_CORPSECRET or _get_db_setting("wechat_corpsecret")
+        self.agentid = settings.WECHAT_AGENTID or _get_db_setting("wechat_agentid")
+        self.token = settings.WECHAT_TOKEN
+        self.encoding_aes_key = settings.WECHAT_ENCODING_AES_KEY
+        self.use_proxy = settings.WECHAT_USE_PROXY
+        self.proxy_api_url = settings.WECHAT_PROXY_API_URL
+        self._access_token = None
+        self._token_expires_at = 0
+
+    # ── access_token 管理 ───────────────────────────────────────────────────
+
+    def get_access_token(self) -> str | None:
+        """获取企业微信 access_token，自动缓存和续期"""
+        now = time.time()
+        if self._access_token and now < self._token_expires_at:
+            return self._access_token
+
+        if not self.corpid or not self.corpsecret:
+            logger.warning("WECHAT_CORPID 或 WECHAT_CORPSECRET 未配置")
+            return None
+
+        try:
+            if self.use_proxy:
+                url = f"{self.proxy_api_url}/cgi-bin/gettoken?corpid={self.corpid}&corpsecret={self.corpsecret}"
+            else:
+                url = f"https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid={self.corpid}&corpsecret={self.corpsecret}"
+
+            resp = requests.get(url, timeout=10)
+            result = resp.json()
+
+            if result.get("errcode") == 0:
+                self._access_token = result.get("access_token")
+                expires_in = result.get("expires_in", 7200) - 300  # 提前5分钟过期
+                self._token_expires_at = now + expires_in
+                logger.info(f"企业微信 access_token 获取成功，过期时间: {time.strftime('%H:%M:%S', time.localtime(self._token_expires_at))}")
+                return self._access_token
+            elif result.get("errcode") == 60020 and not self.use_proxy:
+                logger.info("IP受限，尝试使用代理获取 access_token")
+                self.use_proxy = True
+                return self.get_access_token()
+            else:
+                logger.error(f"获取 access_token 失败: {result}")
+                return None
+        except Exception as e:
+            logger.error(f"获取 access_token 异常: {e}")
+            return None
+
+    # ── 消息分条 ────────────────────────────────────────────────────────────
+
+    @staticmethod
+    def _split_long_message(content: str, max_chars: int = 1800) -> list[str]:
+        """将长消息按换行边界拆分为多条，避免企微截断"""
+        if len(content) <= max_chars:
+            return [content]
+        chunks = []
+        lines = content.split('\n')
+        current = ''
+        for line in lines:
+            if len(current) + len(line) + 1 > max_chars and current:
+                chunks.append(current.strip())
+                current = line
+            else:
+                current += ('\n' + line) if current else line
+        if current.strip():
+            chunks.append(current.strip())
+        return chunks
+
+    # ── 发送消息 ────────────────────────────────────────────────────────────
+
+    def _send_markdown_single(self, content: str, to_user: str) -> bool:
+        """发送单条 Markdown 消息（内部方法）"""
+        access_token = self.get_access_token()
+        if not access_token:
+            return False
+
+        data = {
+            "touser": to_user, "toparty": "", "totag": "",
+            "msgtype": "markdown",
+            "agentid": int(self.agentid),
+            "markdown": {"content": content}
+        }
+
+        if self.use_proxy:
+            url = f"{self.proxy_api_url}/cgi-bin/message/send?access_token={access_token}"
+        else:
+            url = f"https://qyapi.weixin.qq.com/cgi-bin/message/send?access_token={access_token}"
+
+        resp = requests.post(url, json=data, timeout=15)
+        result = resp.json()
+        errcode = result.get("errcode", -1)
+        if errcode == 0:
+            return True
+        elif errcode == 40014:
+            self._access_token = None
+            self._token_expires_at = 0
+            raise Exception("token_expired")
+        elif errcode == 60020 and not self.use_proxy:
+            self.use_proxy = True
+            raise Exception("ip_restricted")
+        else:
+            logger.warning(f"企业微信消息发送失败: {result.get('errmsg')} (errcode={errcode})")
+            return False
+
+    def send_markdown(self, content: str, to_user: str = "@all") -> bool:
+        """发送 Markdown 消息，自动分条"""
+        if not self.corpid or not self.corpsecret or not self.agentid:
+            logger.warning("企业微信未配置，跳过发送")
+            return False
+
+        chunks = self._split_long_message(content)
+        success = True
+        for i, chunk in enumerate(chunks):
+            prefix = f"({i+1}/{len(chunks)})\n" if len(chunks) > 1 else ""
+            for attempt in range(3):
+                try:
+                    ok = self._send_markdown_single(prefix + chunk, to_user)
+                    if ok:
+                        break
+                    if attempt < 2:
+                        time.sleep(1)
+                except Exception as e:
+                    logger.warning(f"发送分片 {i+1}/{len(chunks)} 异常: {e}")
+                    if attempt < 2:
+                        time.sleep(1)
+                        continue
+                    success = False
+            if i < len(chunks) - 1:
+                time.sleep(0.5)  # 避免频率限制
+        return success
+
+
+    # ── 发送文本消息 ────────────────────────────────────────────────────────
+
+    def send_text_message(self, content: str, to_user: str = "@all") -> bool:
+        """通过应用消息 API 发送文本消息，自动分条"""
+        if not self.corpid or not self.corpsecret or not self.agentid:
+            return False
+
+        chunks = self._split_long_message(content, max_chars=1800)
+        success = True
+        for i, chunk in enumerate(chunks):
+            prefix = f"({i+1}/{len(chunks)})\n" if len(chunks) > 1 else ""
+            try:
+                access_token = self.get_access_token()
+                if not access_token:
+                    return False
+                data = {
+                    "touser": to_user, "toparty": "", "totag": "",
+                    "msgtype": "text",
+                    "agentid": int(self.agentid),
+                    "text": {"content": prefix + chunk}
+                }
+                url = f"{self.proxy_api_url}/cgi-bin/message/send?access_token={access_token}" if self.use_proxy else f"https://qyapi.weixin.qq.com/cgi-bin/message/send?access_token={access_token}"
+                resp = requests.post(url, json=data, timeout=15)
+                if resp.json().get("errcode") != 0:
+                    success = False
+            except Exception as e:
+                logger.error(f"发送文本消息分片 {i+1}/{len(chunks)} 失败: {e}")
+                success = False
+            if i < len(chunks) - 1:
+                time.sleep(0.5)
+        return success
+
+    # ── 菜单管理 ────────────────────────────────────────────────────────────
+
+    def create_menu(self, menu_data: dict) -> bool:
+        """创建/更新企业微信应用菜单"""
+        try:
+            access_token = self.get_access_token()
+            if not access_token:
+                return False
+            if self.use_proxy:
+                url = f"{self.proxy_api_url}/cgi-bin/menu/create?access_token={access_token}&agentid={self.agentid}"
+            else:
+                url = f"https://qyapi.weixin.qq.com/cgi-bin/menu/create?access_token={access_token}&agentid={self.agentid}"
+            resp = requests.post(url, json=menu_data, timeout=15)
+            result = resp.json()
+            if result.get("errcode") == 0:
+                logger.info("企业微信菜单创建成功")
+                return True
+            logger.warning(f"创建菜单失败: {result}")
+            return False
+        except Exception as e:
+            logger.error(f"创建菜单异常: {e}")
+            return False
+
+    # ── 获取用户信息 ─────────────────────────────────────────────────────────
+
+    def get_user_info(self, userid: str) -> dict:
+        """获取企业微信用户信息"""
+        try:
+            access_token = self.get_access_token()
+            if not access_token:
+                return {"errcode": -1, "errmsg": "无 access_token"}
+            if self.use_proxy:
+                url = f"{self.proxy_api_url}/cgi-bin/user/get?access_token={access_token}&userid={userid}"
+            else:
+                url = f"https://qyapi.weixin.qq.com/cgi-bin/user/get?access_token={access_token}&userid={userid}"
+            resp = requests.get(url, timeout=10)
+            return resp.json()
+        except Exception as e:
+            logger.error(f"获取用户信息失败: {e}")
+            return {"errcode": -1, "errmsg": str(e)}
+
+    # ── URL 验证（GET 回调）──────────────────────────────────────────────────
+
+    def verify_url(self, msg_signature: str, timestamp: str, nonce: str, echostr: str) -> str | None:
+        """验证企业微信回调 URL"""
+        try:
+            echostr = urllib.parse.unquote(echostr)
+            temp_list = [self.token, timestamp, nonce, echostr]
+            temp_list.sort()
+            temp_str = ''.join(temp_list)
+            hash_str = hashlib.sha1(temp_str.encode('utf-8')).hexdigest()
+
+            if hash_str != msg_signature:
+                logger.error(f"URL验证签名不匹配: expected={msg_signature}, got={hash_str}")
+                return None
+
+            if self.encoding_aes_key:
+                return self._decrypt_echostr(echostr)
+            return echostr
+        except Exception as e:
+            logger.error(f"URL验证异常: {e}")
+            return None
+
+    def _decrypt_echostr(self, echostr: str) -> str | None:
+        """解密 echostr"""
+        try:
+            aes_key = base64.b64decode(self.encoding_aes_key + '=')
+            encrypted = base64.b64decode(echostr)
+            cipher = AES.new(aes_key, AES.MODE_CBC, aes_key[:16])
+            decrypted = cipher.decrypt(encrypted)
+            decrypted = decrypted[:-decrypted[-1]]  # PKCS7 unpad
+            content = decrypted[16:]
+            xml_len = socket.ntohl(struct.unpack("I", content[:4])[0])
+            xml_content = content[4:xml_len + 4]
+            received_id = content[xml_len + 4:].decode('utf-8')
+            if received_id != self.corpid:
+                logger.error(f"企业ID验证失败: {received_id} != {self.corpid}")
+                return None
+            return xml_content.decode('utf-8')
+        except Exception as e:
+            logger.error(f"解密echostr失败: {e}")
+            return None
+
+    # ── 消息解密（POST 回调）─────────────────────────────────────────────────
+
+    def parse_message(self, xml_data: bytes) -> dict | None:
+        """解析企业微信回调的加密 XML 消息"""
+        try:
+            root = ET.fromstring(xml_data)
+            msg = {child.tag: child.text for child in root}
+
+            if 'Encrypt' in msg:
+                decrypted = self._decrypt_message(msg['Encrypt'])
+                decrypted_root = ET.fromstring(decrypted)
+                msg = {child.tag: child.text for child in decrypted_root}
+
+            return msg
+        except Exception as e:
+            logger.error(f"解析消息失败: {e}")
+            return None
+
+    def _decrypt_message(self, encrypted_msg: str) -> str:
+        """解密企业微信推送的消息"""
+        aes_key = base64.b64decode(self.encoding_aes_key + '=')
+        encrypted = base64.b64decode(encrypted_msg)
+        cipher = AES.new(aes_key, AES.MODE_CBC, aes_key[:16])
+        decrypted = cipher.decrypt(encrypted)
+        decrypted = decrypted[:-decrypted[-1]]  # PKCS7 unpad
+        content = decrypted[16:]
+        xml_len = socket.ntohl(struct.unpack("I", content[:4])[0])
+        xml_content = content[4:xml_len + 4]
+        received_id = content[xml_len + 4:].decode('utf-8')
+        if received_id != self.corpid:
+            raise Exception(f"企业ID验证失败: {received_id} != {self.corpid}")
+        return xml_content.decode('utf-8')
+
+
+# 模块级单例和便捷函数
+_service: WeChatService | None = None
+
+
+def get_wechat_service() -> WeChatService:
+    global _service
+    if _service is None:
+        _service = WeChatService()
+    return _service
+
+
+def send_wechat_markdown(content: str) -> bool:
+    """便捷函数：发送企业微信 Markdown 消息"""
+    return get_wechat_service().send_markdown(content)

backend/app/tasks/alert_tasks.py

@@ -0,0 +1,82 @@
+"""告警相关 Celery 任务"""
+import traceback
+from datetime import datetime
+from sqlalchemy import func, case
+from app.core.celery_app import celery_app
+from app.core.database import SessionLocal
+
+
+@celery_app.task(queue='h3c_onu_ms', ignore_result=True)
+def check_school_offline_alerts():
+    """
+    检查是否有学校全部离线（在线率为 0%），如有则发送企业微信告警。
+    该任务在每次全量状态检查完成后异步调用。
+    """
+    from app.models.device import ONUDevice, DeviceStatusHistory
+    from app.services.wechat_service import send_wechat_markdown
+
+    db = SessionLocal()
+    try:
+        # 每台设备最新状态的子查询
+        latest_subq = (
+            db.query(
+                DeviceStatusHistory.onu_device_id,
+                func.max(DeviceStatusHistory.checked_at).label("max_checked_at")
+            )
+            .group_by(DeviceStatusHistory.onu_device_id)
+            .subquery()
+        )
+        latest_status_subq = (
+            db.query(
+                DeviceStatusHistory.onu_device_id,
+                DeviceStatusHistory.status
+            )
+            .join(
+                latest_subq,
+                (DeviceStatusHistory.onu_device_id == latest_subq.c.onu_device_id) &
+                (DeviceStatusHistory.checked_at == latest_subq.c.max_checked_at)
+            )
+            .subquery()
+        )
+
+        # 按学校聚合在线率，只查询在线数为 0 的学校
+        rows = (
+            db.query(
+                ONUDevice.school_name,
+                ONUDevice.region,
+                func.count().label("total"),
+                func.sum(case((latest_status_subq.c.status == 'online', 1), else_=0)).label("online"),
+            )
+            .outerjoin(latest_status_subq, ONUDevice.id == latest_status_subq.c.onu_device_id)
+            .group_by(ONUDevice.school_name, ONUDevice.region)
+            .having(
+                func.sum(case((latest_status_subq.c.status == 'online', 1), else_=0)) == 0
+            )
+            .all()
+        )
+
+        if not rows:
+            return {"alerted": False, "reason": "没有全离线的学校"}
+
+        # 构造告警消息
+        now_str = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+        lines = [
+            "## <font color=\"warning\">[告警] 学校全部离线</font>",
+            f"> 检查时间：{now_str}",
+            "> 以下学校所有设备均处于离线状态：",
+            "",
+        ]
+        for row in rows:
+            school = row.school_name or "未知"
+            region = row.region or "未知"
+            total = int(row.total or 0)
+            if total > 0:
+                lines.append(f"- **{school}**（{region}）: {total} 台设备全离线")
+
+        content = "\n".join(lines)
+        send_wechat_markdown(content)
+        return {"alerted": True, "schools": len(rows)}
+    except Exception as e:
+        return {"alerted": False, "error": str(e), "traceback": traceback.format_exc()}
+    finally:
+        db.close()

backend/app/tasks/check_tasks.py

@@ -97,6 +97,16 @@ def check_all_devices(self):
 
         self.update_state(state='PROGRESS', meta={'current': total, 'total': total, 'status': '检查完成'})
 
+        # 通知 WebSocket 客户端状态已更新
+        try:
+            import json as _json
+            r.publish("h3c_onu:status_updates", _json.dumps({
+                "type": "check_complete", "total_online": total_online,
+                "total_offline": total_offline, "total_olts": total
+            }))
+        except Exception:
+            pass
+
         return {
             'success': True,
             'total_olts': total,

backend/celery_worker.py

@@ -2,5 +2,6 @@
 from app.core.celery_app import celery_app
 from app.tasks import check_tasks   # noqa: F401 - 导入以注册任务
 from app.tasks import audit_tasks   # noqa: F401 - 导入以注册任务
+from app.tasks import alert_tasks   # noqa: F401 - 导入以注册任务
 
 __all__ = ['celery_app']

backend/requirements.txt

@@ -14,6 +14,11 @@ paramiko==3.4.0
 pandas==2.1.4
 openpyxl==3.1.2
 cryptography==42.0.0
+pycryptodome==3.20.0
+slowapi==0.1.9
+python-json-logger==2.0.7
+pytest==8.3.4
+pytest-asyncio==0.25.0
 casdoor==1.18.0
 aiohttp>=3.9.0
 PyJWT>=2.8.0

backend/test_parser.py

@@ -1,30 +0,0 @@
-"""测试 ONU 状态解析"""
-import re
-
-def parse_onu_status(output: str):
-    """解析 ONU 状态"""
-    devices = {}
-    lines = output.split('\n')
-
-    for line in lines:
-        mac_match = re.search(r'([0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4})', line, re.IGNORECASE)
-        if mac_match:
-            mac = mac_match.group(1).lower()
-            if 'Up' in line:
-                devices[mac] = 'online'
-            elif 'Offline' in line:
-                devices[mac] = 'offline'
-
-    return devices
-
-# 测试数据
-test_output = """
-1484-7790-5200                            12      <1000    Onu1/0/1:1       WA6520H-EGPON/A  106/       Up        N/A
-1484-7790-4e20                            13      <1000    Onu1/0/1:2       WA6520H-EGPON/A  106/       Up        N/A
-1484-7790-3900                            N/A     N/A      Onu1/0/1:3       N/A             N/A        Offline   N/A
-"""
-
-result = parse_onu_status(test_output)
-print("解析结果:")
-for mac, status in result.items():
-    print(f"  {mac}: {status}")

backend/tests/conftest.py

@@ -0,0 +1,18 @@
+"""pytest fixtures"""
+import pytest
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker
+from app.core.database import Base
+
+TEST_DB_URL = "sqlite:///:memory:"
+
+
+@pytest.fixture
+def db_session():
+    engine = create_engine(TEST_DB_URL, connect_args={"check_same_thread": False})
+    Base.metadata.create_all(bind=engine)
+    Session = sessionmaker(bind=engine)
+    session = Session()
+    yield session
+    session.close()
+    Base.metadata.drop_all(bind=engine)

backend/tests/test_import_service.py

@@ -0,0 +1,42 @@
+"""数据导入服务测试"""
+import io
+import pytest
+from app.services.import_service import ImportService
+
+
+class TestImportService:
+    def test_validate_mac(self, db_session):
+        svc = ImportService(db_session)
+        valid = [{"mac_address": "1484-778f-aa60", "region": "城区", "school_name": "测试学校"}]
+        result = svc.validate_data(valid)
+        assert len(result["valid"]) == 1
+        assert len(result["invalid"]) == 0
+
+    def test_invalid_mac_rejected(self, db_session):
+        svc = ImportService(db_session)
+        data = [{"mac_address": "invalid", "region": "城区", "school_name": "测试学校"}]
+        result = svc.validate_data(data)
+        assert len(result["invalid"]) > 0
+
+    def test_missing_required_fields(self, db_session):
+        svc = ImportService(db_session)
+        # MAC format valid but empty region/school may or may not be rejected
+        # depending on validation rules — just verify it doesn't crash
+        data = [{"mac_address": "1484-778f-aa60", "region": "", "school_name": ""}]
+        result = svc.validate_data(data)
+        assert "valid" in result or "invalid" in result
+
+
+class TestCleanValue:
+    def test_strips_whitespace(self):
+        from app.services.import_service import clean_value
+        assert clean_value("  test  ") == "test"
+
+    def test_none_returns_empty(self):
+        from app.services.import_service import clean_value
+        assert clean_value(None) == ''
+
+    def test_nan_returns_empty(self):
+        from app.services.import_service import clean_value
+        import math
+        assert clean_value(float('nan')) == ''

backend/tests/test_ssh_parser.py

@@ -0,0 +1,162 @@
+"""SSH 输出解析测试"""
+import re
+import pytest
+from app.services.ssh_service import SSHService
+
+
+def _make_svc():
+    return SSHService("10.0.0.1", "admin", "pass")
+
+
+class TestParseOnuInfo:
+    def test_single_online(self):
+        svc = _make_svc()
+        output = """
+ Flags: S-Switched  L-Loopback  N-Not exist  U-Up    D-Down
+ Port   MAC            Status  OAM State  LOID           Model           Distance
+0/0/1  1484-778f-aa60  Up      OAM_Up     test_loid      H3C_ET704       1234m
+"""
+        onu_dict, unknown = svc.parse_onu_info(output)
+        assert len(onu_dict) == 1
+        assert "1484-778f-aa60" in onu_dict
+        assert onu_dict["1484-778f-aa60"].status == "online"
+
+    def test_mixed_online_offline(self):
+        svc = _make_svc()
+        output = """
+ Flags: S-Switched  L-Loopback  N-Not exist  U-Up    D-Down
+ Port   MAC            Status  OAM State  LOID           Model           Distance
+0/0/1  1484-778f-aa60  Up      OAM_Up     loid_a         H3C_ET704       500m
+0/0/2  1484-778f-bb70  Down    OAM_Down   loid_b         Unknown         <1000m
+"""
+        onu_dict, unknown = svc.parse_onu_info(output)
+        mac_a = "1484-778f-aa60"
+        mac_b = "1484-778f-bb70"
+        assert onu_dict[mac_a].status == "online"
+        assert onu_dict[mac_b].status == "offline"
+
+    def test_more_marker_removal(self):
+        svc = _make_svc()
+        output = """
+ Flags: S-Switched  L-Loopback  N-Not exist  U-Up    D-Down
+ Port   MAC            Status  OAM State  LOID           Model           Distance
+---- More ----
+0/0/1  1484-778f-aa60  Up      OAM_Up     loid           H3C_ET704       500m
+---- More ----
+0/0/2  1484-778f-bb70  Up      OAM_Up     loid2          H3C_ET704       800m
+"""
+        onu_dict, _ = svc.parse_onu_info(output)
+        assert len(onu_dict) == 2
+
+    def test_more_inline_with_device_line(self):
+        """More 标记与下一条设备数据同行时，不应丢弃该行"""
+        svc = _make_svc()
+        output = """
+---- More ----       1484-778f-aa60  Up      OAM_Up     loid           H3C_ET704       500m
+"""
+        onu_dict, _ = svc.parse_onu_info(output)
+        mac = "1484-778f-aa60"
+        assert mac in onu_dict
+
+    def test_empty_output(self):
+        svc = _make_svc()
+        onu_dict, unknown = svc.parse_onu_info("")
+        assert len(onu_dict) == 0
+
+    def test_header_only(self):
+        svc = _make_svc()
+        output = " Flags: S-Switched  L-Loopback  N-Not exist  U-Up    D-Down\n Port   MAC            Status"
+        onu_dict, _ = svc.parse_onu_info(output)
+        assert len(onu_dict) == 0
+
+
+class TestCleanOutput:
+    def test_strips_ansi_codes(self):
+        svc = _make_svc()
+        cleaned = svc._clean_output("\x1b[37D\x1b[K  1484-778f-aa60  Up")
+        assert "\x1b[37D" not in cleaned
+        assert "\x1b[K" not in cleaned
+        assert "1484-778f-aa60" in cleaned
+
+    def test_removes_more_marker(self):
+        svc = _make_svc()
+        output = "---- More ----\n1484-778f-aa60  Up"
+        cleaned = svc._clean_output(output)
+        assert "---- More ----" not in cleaned
+        assert "1484-778f-aa60" in cleaned
+
+    def test_preserves_device_line_after_more(self):
+        """More 标记同行后续设备数据不应被删除"""
+        svc = _make_svc()
+        output = "---- More ----\r\r 1484-778f-aa60  Up"
+        cleaned = svc._clean_output(output)
+        assert "1484-778f-aa60" in cleaned
+        assert "---- More ----" not in cleaned
+
+
+class TestDetectLoopback:
+    """环路检测输出解析测试"""
+
+    def _parse(self, output: str):
+        """模拟 detect_loopback 中的解析逻辑"""
+        has_loop = "Loop is detected on following interfaces" in output
+        interfaces = []
+        if has_loop:
+            for line in output.splitlines():
+                m = re.match(r'\s+(Onu\S+)', line)
+                if m:
+                    interfaces.append(m.group(1))
+        return has_loop, interfaces
+
+    def test_no_loop(self):
+        output = """
+Loopback detection is enabled.
+Loopback detection interval is 30 second(s).
+No loopback is detected.
+"""
+        has_loop, interfaces = self._parse(output)
+        assert not has_loop
+        assert interfaces == []
+
+    def test_has_loop_single(self):
+        output = """
+Loopback detection is enabled.
+Loopback detection interval is 30 second(s).
+Loop is detected on following interfaces:
+        Onu1/0/1:1
+"""
+        has_loop, interfaces = self._parse(output)
+        assert has_loop
+        assert interfaces == ["Onu1/0/1:1"]
+
+    def test_has_loop_multiple(self):
+        output = """
+Loop is detected on following interfaces:
+        Onu1/0/1:1
+        Onu1/0/2:3
+        Onu2/0/5:10
+"""
+        has_loop, interfaces = self._parse(output)
+        assert has_loop
+        assert interfaces == ["Onu1/0/1:1", "Onu1/0/2:3", "Onu2/0/5:10"]
+
+    def test_has_loop_with_extra_whitespace(self):
+        """接口行有多余空白字符"""
+        output = """
+Loop is detected on following interfaces:
+            Onu1/0/1:1
+"""
+        has_loop, interfaces = self._parse(output)
+        assert has_loop
+        assert interfaces == ["Onu1/0/1:1"]
+
+    def test_no_false_positive_on_prompt(self):
+        """确保设备提示符不被误识别为接口"""
+        output = """
+Loop is detected on following interfaces:
+        Onu1/0/1:1
+<H3C_Device>
+"""
+        has_loop, interfaces = self._parse(output)
+        assert has_loop
+        assert interfaces == ["Onu1/0/1:1"]

backend/token_jwt_key.pem

@@ -1,28 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIE2TCCAsGgAwIBAgIDAeJAMA0GCSqGSIb3DQEBCwUAMCYxDjAMBgNVBAoTBWFk
-bWluMRQwEgYDVQQDDAtjZXJ0X3drMWVlZjAeFw0yNTEyMTAxMDAzMzVaFw00NTEy
-MTAxMDAzMzVaMCYxDjAMBgNVBAoTBWFkbWluMRQwEgYDVQQDDAtjZXJ0X3drMWVl
-ZjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK78ajnNnwnutdZ48l92
-hmqa2c8lP1IcpyB7CYVTKurQxSz5iQorYOVhR1UzluSpU8yiPPeFyTRD0pH+DzqG
-otc+Alvxnka5DfP1z/P0asogkALJXouRR+YtUY6i1oo5tKlDbIGJNO2aQcOOak9b
-YoqSRd9y/pq/bPjte7oww29hGQc03LgbNXmIb9n5NGznWCte1c88NUrTz9Dlpn2H
-r3ncOmHpqpzg5NtXughnHsF4YCF+pPIgWlC0C6MtKk0fuJysCY5wpuA620pGL4zO
-6QFv920MiWsdVWxcNo0aNQkXKGjEcy3LraXux2k/sH+E0e3GRXGhWYnkrK7i8kg+
-V+Nm1YFgyGbY7V3yZ0mXPxb+iMlIvz885ViGsRnKqlR0pN1v8NbmzXPu9EkAO3wi
-T/L4fxnETW1hd/ph+AdQ0jEpeyAMRjcl3kMjauOBqfU/THl7L6aUMXB3d05+JK0Y
-uTc1nrZ0Qjh/5EG5XyvRSuKNVxpCB1XcAlAaBTuE5art6jQkCJINvFoOjoHZB65K
-HJVvfMtMuVr7dLSbYOPHH6YJB2fUijNKoXnclAbxldX3fEALsC/SW7zMFF+3FThg
-Seq3OEpNdbkRlQp5sORHeTkWtMO9A60GHvTqDamIqppC4fk71zIRpmEPlfGsOno5
-gNhH8+NKH5Cvmfj4s7/S98D/AgMBAAGjEDAOMAwGA1UdEwEB/wQCMAAwDQYJKoZI
-hvcNAQELBQADggIBAJLW6zjDKZdkfq00r88lM1IxaxRWmUEPQjINOa0GZH/DyAtd
-fgYf35AN+NDEiIiDnJQTR3N8jbX1JySDClEOzv3wLXRiKhWcX8z4HOoieNmMu9lZ
-6pf1lEaMX8WNxB475nfOueEEyHegbsbfpmYM/aVAiSxaKb87if7uDnxJeGqK2Ba0
-c3LJnQ+H87gcAb84G78KXn/XwjRtwaf+Gy06EzycEnckEeN0vni0pRdw8coSudcX
-726Kb+kZ4961G/XxQx4fKX+E4lXkx1CdxPBAws/uOjfciLnuVdT4yp6URXJKRw+/
-R+flPtfvHXNDXB8BHj9ul4UJ4oSHGppx0BR80CmWWNDVdaoO+o0WieFOXG2U2PB+
-p2pleJzckTDuOh5wIe2GFj9WKZTIn4S7ZA6hS5j5ea4bOX5m6cxXVaS5FPHHfHcN
-FyUOEE4f61tv9omsFyl23YD/gmQzotFY+5YPS8DTb1soSzydKQODCq7SobyK8QFo
-3FnOw1cnKuWDZbqkZS6TYHFc3doNaH77bBxgSgIBPlJewd98eZZCv+m8/mCOXCbo
-+7HOgmOHJ1cOEtweCtgrCc2VNvV0w6RSwcZ+WmUAZMajvyEqikVVQzR2LtOOhOyr
-REkkNRAX3PX69GDQLM9QSgGLv0f6nA5uTX9SFj71Iik6YAuUsvIK6uPpn/2B
------END CERTIFICATE-----

deploy/.env.example

@@ -65,6 +65,9 @@ CASDOOR_ORG_NAME=your_organization
 # 应用名称
 CASDOOR_APP_NAME=h3c-onu-ms
 
+# Casdoor 回调地址（部署后改为实际域名）
+CASDOOR_REDIRECT_URL=
+
 # ============================================
 # SSH连接配置
 # ============================================
@@ -98,20 +101,35 @@ HISTORY_RETENTION=90
 BATCH_CHECK_SIZE=100
 
 # ============================================
-# 前端配置
+# 前端 & CORS 配置
 # ============================================
 
-# API基础URL (前端访问后端地址)
+# 前端访问地址
-VITE_API_BASE_URL=http://localhost:8000
+FRONTEND_URL=https://your-domain.com
 
-# Casdoor前端配置
+# CORS允许的域名 (逗号分隔)
-VITE_CASDOOR_ENDPOINT=https://casdoor.example.com
+CORS_ORIGINS=http://localhost:8080,http://localhost:5173
-VITE_CASDOOR_CLIENT_ID=your_casdoor_client_id
-VITE_CASDOOR_ORG_NAME=your_organization
-VITE_CASDOOR_APP_NAME=h3c-onu-ms
 
-# 应用标题
+# ============================================
-VITE_APP_TITLE=H3C ONU设备管理系统
+# NTP 同步配置
+# ============================================
+
+# NTP 旧服务器 IP
+NTP_OLD_SERVER=172.16.0.254
+# NTP 新服务器 IP
+NTP_NEW_SERVER=172.16.1.252
+
+# ============================================
+# iMC 网管 API 配置（ONU 远程重启/光功率查询）
+# ============================================
+
+IMC_API_URL=
+IMC_API_USERNAME=
+IMC_API_PASSWORD=
+# 本地认证不需要 SSL 验证
+IMC_API_VERIFY_SSL=false
+IMC_CONNECT_TIMEOUT=5
+IMC_READ_TIMEOUT=20
 
 # ============================================
 # 日志配置
@@ -154,9 +172,6 @@ METRICS_PORT=8000
 # 安全配置
 # ============================================
 
-# CORS允许的域名 (逗号分隔)
-CORS_ORIGINS=http://localhost:8080,http://localhost:5173
-
 # 速率限制配置
 RATE_LIMIT_PER_MINUTE=60
 RATE_LIMIT_PER_HOUR=1000
@@ -168,6 +183,15 @@ RATE_LIMIT_PER_HOUR=1000
 # 数据库备份目录
 BACKUP_DIR=/app/backups
 
+# 企业微信告警配置
+WECHAT_CORPID=
+WECHAT_CORPSECRET=
+WECHAT_AGENTID=
+WECHAT_TOKEN=
+WECHAT_ENCODING_AES_KEY=
+WECHAT_USE_PROXY=True
+WECHAT_PROXY_API_URL=
+
 # 备份保留天数
 BACKUP_RETENTION=30
 

deploy/docker-compose.yml

@@ -16,8 +16,23 @@ services:
       - CASDOOR_CERTIFICATE=${CASDOOR_CERTIFICATE}
       - CASDOOR_ORG_NAME=${CASDOOR_ORG_NAME}
       - CASDOOR_APP_NAME=${CASDOOR_APP_NAME}
+      - CASDOOR_REDIRECT_URL=${CASDOOR_REDIRECT_URL:-}
       - SECRET_KEY=${SECRET_KEY}
       - DEBUG=${DEBUG:-false}
+      - CORS_ORIGINS=${CORS_ORIGINS:-}
+      - FRONTEND_URL=${FRONTEND_URL:-https://onu.dhdx.fun}
+      - NTP_OLD_SERVER=${NTP_OLD_SERVER:-172.16.0.254}
+      - NTP_NEW_SERVER=${NTP_NEW_SERVER:-172.16.1.252}
+      - IMC_API_URL=${IMC_API_URL:-}
+      - IMC_API_USERNAME=${IMC_API_USERNAME:-}
+      - IMC_API_PASSWORD=${IMC_API_PASSWORD:-}
+      - WECHAT_CORPID=${WECHAT_CORPID:-}
+      - WECHAT_CORPSECRET=${WECHAT_CORPSECRET:-}
+      - WECHAT_AGENTID=${WECHAT_AGENTID:-}
+      - WECHAT_TOKEN=${WECHAT_TOKEN:-}
+      - WECHAT_ENCODING_AES_KEY=${WECHAT_ENCODING_AES_KEY:-}
+      - WECHAT_USE_PROXY=${WECHAT_USE_PROXY:-True}
+      - WECHAT_PROXY_API_URL=${WECHAT_PROXY_API_URL:-}
     volumes:
       - ../backend/logs:/app/logs
       - ../backend/static:/app/static
@@ -46,6 +61,13 @@ services:
       - CASDOOR_ORG_NAME=${CASDOOR_ORG_NAME}
       - CASDOOR_APP_NAME=${CASDOOR_APP_NAME}
       - SECRET_KEY=${SECRET_KEY}
+      - WECHAT_CORPID=${WECHAT_CORPID:-}
+      - WECHAT_CORPSECRET=${WECHAT_CORPSECRET:-}
+      - WECHAT_AGENTID=${WECHAT_AGENTID:-}
+      - WECHAT_TOKEN=${WECHAT_TOKEN:-}
+      - WECHAT_ENCODING_AES_KEY=${WECHAT_ENCODING_AES_KEY:-}
+      - WECHAT_USE_PROXY=${WECHAT_USE_PROXY:-True}
+      - WECHAT_PROXY_API_URL=${WECHAT_PROXY_API_URL:-https://api.v6ole.top}
     volumes:
       - ../backend/logs:/app/logs
     depends_on:
@@ -69,32 +91,32 @@ services:
       - CASDOOR_ORG_NAME=${CASDOOR_ORG_NAME}
       - CASDOOR_APP_NAME=${CASDOOR_APP_NAME}
       - SECRET_KEY=${SECRET_KEY}
+      - WECHAT_CORPID=${WECHAT_CORPID:-}
+      - WECHAT_CORPSECRET=${WECHAT_CORPSECRET:-}
+      - WECHAT_AGENTID=${WECHAT_AGENTID:-}
+      - WECHAT_TOKEN=${WECHAT_TOKEN:-}
+      - WECHAT_ENCODING_AES_KEY=${WECHAT_ENCODING_AES_KEY:-}
+      - WECHAT_USE_PROXY=${WECHAT_USE_PROXY:-True}
+      - WECHAT_PROXY_API_URL=${WECHAT_PROXY_API_URL:-https://api.v6ole.top}
     volumes:
       - ../backend/logs:/app/logs
     depends_on:
       - backend
     restart: unless-stopped
 
-  # 前端应用
+  # 前端应用（生产模式：nginx 静态文件服务）
   frontend:
     build:
       context: ../frontend
       dockerfile: Dockerfile
     container_name: h3c-onu-ms-frontend
     ports:
-      - "5173:5173"
+      - "18062:80"
-    environment:
-      - VITE_API_BASE_URL=${VITE_API_BASE_URL:-http://localhost:8001}
-      - VITE_API_PROXY_TARGET=http://backend:8000
-      - VITE_CASDOOR_ENDPOINT=${VITE_CASDOOR_ENDPOINT}
-      - VITE_CASDOOR_CLIENT_ID=${VITE_CASDOOR_CLIENT_ID}
-      - VITE_CASDOOR_ORG_NAME=${VITE_CASDOOR_ORG_NAME}
-      - VITE_CASDOOR_APP_NAME=${VITE_CASDOOR_APP_NAME}
     depends_on:
       - backend
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:5173"]
+      test: ["CMD", "wget", "-qO-", "http://localhost:80/health"]
       interval: 30s
       timeout: 10s
       retries: 3

deploy/openresty/onu.dhdx.fun.conf

@@ -0,0 +1,54 @@
+server {
+    listen 80;
+    listen 443 ssl http2;
+    server_name onu.dhdx.fun;
+    index index.html;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Host $server_name;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $http_connection;
+    access_log /www/sites/onu.dhdx.fun/log/access.log main;
+    error_log /www/sites/onu.dhdx.fun/log/error.log;
+
+    location ^~ /.well-known/acme-challenge {
+        allow all;
+        root /usr/share/nginx/html;
+    }
+
+    if ($scheme = http) {
+        return 301 https://$host$request_uri;
+    }
+
+    ssl_certificate /www/sites/onu.dhdx.fun/ssl/fullchain.pem;
+    ssl_certificate_key /www/sites/onu.dhdx.fun/ssl/privkey.pem;
+    ssl_protocols TLSv1.3 TLSv1.2 TLSv1.1 TLSv1;
+    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DSS:!DES:!RC4:!3DES:!MD5:!PSK:!KRB5:!SRP:!CAMELLIA:!SEED;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+    error_page 497 https://$host$request_uri;
+    proxy_set_header X-Forwarded-Proto https;
+    add_header Strict-Transport-Security "max-age=31536000";
+
+    # 安全头
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    # 前端（生产 nginx 容器，端口 18062）
+    location / {
+        proxy_pass http://127.0.0.1:18062;
+    }
+
+    # 后端 API（frp 隧道 → 本机后端 /api/ws/dashboard WebSocket）
+    location /api/ {
+        proxy_pass http://127.0.0.1:18060;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+        proxy_connect_timeout 60s;
+    }
+}

deploy/scripts/deploy.sh

@@ -216,12 +216,31 @@ backup_data() {
     echo "环境: $ENV" >> "$BACKUP_DIR/backup.info"
     echo "版本: $(git describe --tags 2>/dev/null || echo '未知')" >> "$BACKUP_DIR/backup.info"
     
+    # 验证数据库备份
+    echo -e "${BLUE}验证数据库备份...${NC}"
+    if [ -f "$BACKUP_DIR/database.sql" ]; then
+        SQL_SIZE=$(wc -c < "$BACKUP_DIR/database.sql")
+        if [ "$SQL_SIZE" -lt 100 ]; then
+            echo -e "${RED}错误: 数据库备份文件过小 ($SQL_SIZE bytes)，可能备份失败${NC}"
+        elif head -1 "$BACKUP_DIR/database.sql" | grep -qiE "^(--|SET|CREATE|COPY|INSERT|ALTER)"; then
+            echo -e "${GREEN}数据库备份验证通过 ($SQL_SIZE bytes)${NC}"
+        else
+            echo -e "${YELLOW}警告: 数据库备份格式异常，请检查${NC}"
+        fi
+    fi
+
     # 压缩备份文件
     echo -e "${BLUE}压缩备份文件...${NC}"
     tar -czf "$BACKUP_DIR.tar.gz" "$BACKUP_DIR"
     rm -rf "$BACKUP_DIR"
-    
+
-    echo -e "${GREEN}备份完成: $BACKUP_DIR.tar.gz${NC}"
+    # 清理旧备份（保留最近 30 天）
+    echo -e "${BLUE}清理旧备份（保留30天）...${NC}"
+    find backups/ -name "*.tar.gz" -mtime +30 -delete 2>/dev/null
+    find backups/ -name "*.tar.gz" -mtime +30 -exec echo "  删除: {}" \; 2>/dev/null
+
+    BACKUP_COUNT=$(find backups/ -name "*.tar.gz" | wc -l)
+    echo -e "${GREEN}备份完成: $BACKUP_DIR.tar.gz (现存 ${BACKUP_COUNT} 个备份)${NC}"
 }
 
 # 函数：恢复数据

docker-compose.yml

@@ -17,7 +17,7 @@ services:
 
   celery-worker:
     build: ./backend
-    command: celery -A celery_worker.celery_app worker --loglevel=info -Q h3c_onu_ms
+    command: celery -A celery_worker.celery_app worker -B --loglevel=info -Q h3c_onu_ms --schedule=/tmp/celerybeat-schedule
     env_file:
       - ./backend/.env
     volumes:
@@ -27,23 +27,5 @@ services:
       backend:
         condition: service_healthy
 
-  celery-beat:
+  # frontend 仅在远程服务器部署，本地通过 docker-compose 不再启动
-    build: ./backend
+  # 部署命令见 .claude/rules/07-remote-operations.md
-    command: celery -A celery_worker.celery_app beat --loglevel=info --schedule=/tmp/celerybeat-schedule
-    env_file:
-      - ./backend/.env
-    restart: unless-stopped
-    depends_on:
-      backend:
-        condition: service_healthy
-
-  frontend:
-    build: ./frontend
-    ports:
-      - "18002:5173"
-    environment:
-      - VITE_API_PROXY_TARGET=http://backend:8000
-    restart: unless-stopped
-    depends_on:
-      backend:
-        condition: service_healthy

frontend/Dockerfile

@@ -1,4 +1,5 @@
-FROM node:18-alpine
+# Stage 1: Build
+FROM node:18-alpine AS build
 
 WORKDIR /app
 
@@ -7,6 +8,21 @@ RUN npm install
 
 COPY . .
 
-EXPOSE 5173
+# Build for production
+RUN npm run build
 
-CMD ["npm", "run", "dev", "--", "--host", "0.0.0.0"]
+# Stage 2: Serve with nginx
+FROM nginx:alpine AS serve
+
+# Remove default nginx config
+RUN rm /etc/nginx/conf.d/default.conf
+
+# Copy custom nginx config
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+
+# Copy built files from build stage
+COPY --from=build /app/dist /usr/share/nginx/html
+
+EXPOSE 80
+
+CMD ["nginx", "-g", "daemon off;"]

frontend/nginx.conf

@@ -0,0 +1,36 @@
+server {
+    listen 80;
+    server_name localhost;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Gzip compression for text-based assets
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_types text/plain text/css text/xml text/javascript
+               application/json application/javascript application/xml+rss
+               image/svg+xml;
+
+    # Cache static assets with content hash names (Vite output)
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+    }
+
+    # SPA fallback - all routes serve index.html
+    location / {
+        try_files $uri $uri/ /index.html;
+        expires -1;
+        add_header Cache-Control "no-store, no-cache, must-revalidate";
+    }
+
+    # Health check endpoint for docker
+    location /health {
+        access_log off;
+        return 200 "healthy\n";
+        add_header Content-Type text/plain;
+    }
+}

frontend/src/api/stats.js

@@ -5,3 +5,11 @@ export const getSummary = () => request.get('/stats/summary')
 export const getTrend = (days = 7) => request.get('/stats/trend', { params: { days } })
 
 export const getByRegion = () => request.get('/stats/by-region')
+
+export const getOltStats = () => request.get('/stats/olt-stats')
+
+export const getModelDistribution = () => request.get('/stats/model-distribution')
+
+export const getOfflineSchools = () => request.get('/stats/offline-schools')
+
+

frontend/src/components/Layout.vue

@@ -74,6 +74,13 @@
       </nav>
 
       <div class="sidebar-footer">
+        <div v-if="authStore.user" class="sidebar-user">
+          <div class="sidebar-user-avatar">{{ (authStore.user.display_name || authStore.user.username || '?')[0] }}</div>
+          <div class="sidebar-user-info">
+            <div class="sidebar-user-name">{{ authStore.user.display_name || authStore.user.username }}</div>
+            <div class="sidebar-user-role">{{ roleLabel }}</div>
+          </div>
+        </div>
         <button class="logout-btn" @click="handleLogout">
           <svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
             <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4"/>
@@ -116,7 +123,7 @@
               <circle cx="12" cy="12" r="10"/>
               <polyline points="12 6 12 12 16 14"/>
             </svg>
-            v0.5.0
+            v{{ appVersion }}
           </div>
         </div>
       </header>
@@ -199,6 +206,7 @@ import { useMobile } from '../composables/useMobile'
 const router = useRouter()
 const route = useRoute()
 const authStore = useAuthStore()
+const appVersion = ref('0.0.0')
 const themeStore = useThemeStore()
 const { isMobile } = useMobile()
 
@@ -210,14 +218,32 @@ const updateTime = () => {
   currentTime.value = now.toLocaleTimeString('zh-CN', { hour12: false })
 }
 let timer = null
+
+// 键盘快捷键
+const shortcuts = { '1': '/dashboard', '2': '/devices', '3': '/charts', '4': '/olt', '5': '/inventory' }
+const onKeydown = (e) => {
+  if (e.ctrlKey && e.key === 'k') { e.preventDefault(); document.querySelector('.search-input input')?.focus() }
+  if (e.ctrlKey && shortcuts[e.key]) { e.preventDefault(); router.push(shortcuts[e.key]) }
+}
+
+const fetchVersion = async () => {
+  try {
+    const res = await fetch('/api/health')
+    const data = await res.json()
+    if (data.version) appVersion.value = data.version
+  } catch { /* 静默 */ }
+}
+
 onMounted(async () => {
   updateTime()
   timer = setInterval(updateTime, 1000)
+  document.addEventListener('keydown', onKeydown)
   if (authStore.token && !authStore.user) {
     await authStore.fetchProfile()
   }
+  fetchVersion()
 })
-onUnmounted(() => clearInterval(timer))
+onUnmounted(() => { clearInterval(timer); document.removeEventListener('keydown', onKeydown) })
 
 const allNavItems = [
   {
@@ -342,6 +368,9 @@ const pageNameMap = {
 }
 const currentPageName = computed(() => pageNameMap[route.path] || '页面')
 
+const roleLabels = { admin: '超级管理员', area_admin: '区域管理员', school_admin: '学校管理员', user: '普通用户' }
+const roleLabel = computed(() => roleLabels[authStore.role] || authStore.role)
+
 const handleLogout = () => {
   authStore.logout()
   router.push('/login')
@@ -501,6 +530,49 @@ const handleLogout = () => {
   border-top: 1px solid var(--border-subtle);
 }
 
+.sidebar-user {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 8px 12px;
+  margin-bottom: 10px;
+  border-radius: var(--radius-md);
+  background: var(--bg-subtle);
+}
+
+.sidebar-user-avatar {
+  width: 34px;
+  height: 34px;
+  border-radius: 50%;
+  background: var(--accent);
+  color: #fff;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 14px;
+  font-weight: 600;
+  flex-shrink: 0;
+}
+
+.sidebar-user-info {
+  overflow: hidden;
+}
+
+.sidebar-user-name {
+  font-size: 13px;
+  font-weight: 500;
+  color: var(--text-primary);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+.sidebar-user-role {
+  font-size: 11px;
+  color: var(--text-muted);
+  margin-top: 1px;
+}
+
 .logout-btn {
   width: 100%;
   display: flex;

frontend/src/components/business/DeviceImportDialog.vue

@@ -0,0 +1,60 @@
+<template>
+  <el-dialog :model-value="visible" @update:model-value="$emit('update:visible', $event)" title="数据导入" width="min(90vw, 560px)" destroy-on-close>
+    <div class="import-hint">请先下载模板，按格式填写后上传。导入只更新设备信息，不会删除已有设备。</div>
+    <div class="import-actions">
+      <el-button size="small" @click="$emit('download-template')">下载导入模板</el-button>
+    </div>
+    <el-upload
+      ref="uploadRef"
+      :auto-upload="false"
+      :show-file-list="true"
+      :limit="1"
+      accept=".xlsx,.xls"
+      :on-change="(f) => $emit('file-change', f)"
+      :on-remove="() => $emit('file-remove')"
+      drag
+      style="margin-top: 16px"
+    >
+      <div class="upload-area">
+        <svg width="32" height="32" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" style="color: var(--text-muted); margin-bottom: 8px">
+          <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/>
+          <polyline points="17 8 12 3 7 8"/><line x1="12" y1="3" x2="12" y2="15"/>
+        </svg>
+        <div style="font-size:13px;color:var(--text-secondary)">拖拽文件到此处，或 <em style="color:var(--accent)">点击选择</em></div>
+        <div style="font-size:11px;color:var(--text-muted);margin-top:4px">支持 .xlsx / .xls 格式</div>
+      </div>
+    </el-upload>
+    <div v-if="result" style="margin-top:16px">
+      <el-alert
+        :type="result.failed?.length ? 'warning' : 'success'"
+        :title="`导入完成：成功 ${result.success} 条${result.failed?.length ? '，失败 ' + result.failed.length + ' 条' : ''}`"
+        :closable="false"
+      />
+      <div v-if="result.failed?.length" style="margin-top:10px;max-height:160px;overflow-y:auto">
+        <div v-for="f in result.failed" :key="f.row" style="font-size:12px;color:var(--danger);padding:2px 0">
+          第 {{ f.row }} 行<template v-if="f.mac">（{{ f.mac }}）</template>：{{ f.reason }}
+        </div>
+      </div>
+    </div>
+    <template #footer>
+      <el-button @click="$emit('update:visible', false); $emit('close')">关闭</el-button>
+      <el-button type="primary" :loading="loading" :disabled="!hasFile" @click="$emit('import')">开始导入</el-button>
+    </template>
+  </el-dialog>
+</template>
+
+<script setup>
+defineProps({
+  visible: { type: Boolean, default: false },
+  loading: { type: Boolean, default: false },
+  hasFile: { type: Boolean, default: false },
+  result: { type: Object, default: null },
+})
+defineEmits(['update:visible', 'download-template', 'file-change', 'file-remove', 'import', 'close'])
+</script>
+
+<style scoped>
+.import-hint { font-size:13px; color:var(--text-muted); margin-bottom:12px; }
+.import-actions { margin-bottom:4px; }
+.upload-area { display:flex; flex-direction:column; align-items:center; padding:20px 0; }
+</style>

frontend/src/stores/theme.js

@@ -1,17 +1,34 @@
 import { defineStore } from 'pinia'
 import { ref, watch } from 'vue'
+import { isAfterSunset, getMsUntilNextSwitch } from '../utils/sunset'
 
 export const useThemeStore = defineStore('theme', () => {
   const STORAGE_KEY = 'onu-theme'
-  const theme = ref(localStorage.getItem(STORAGE_KEY) || 'dark')
+  const savedTheme = localStorage.getItem(STORAGE_KEY)
+  // 无手动偏好时，根据广西日落时间自动选择
+  const theme = ref(savedTheme || (isAfterSunset() ? 'dark' : 'light'))
 
   const applyTheme = (t) => {
     document.documentElement.setAttribute('data-theme', t)
   }
 
+  let switchTimer = null
+
   // 初始化时立即应用
   applyTheme(theme.value)
 
+  // 设置日落/日出自动切换定时器，仅在用户未手动选择时生效
+  const scheduleAutoSwitch = () => {
+    if (switchTimer) clearTimeout(switchTimer)
+    // 始终在日落/日出时自动切换
+    const delay = getMsUntilNextSwitch()
+    switchTimer = setTimeout(() => {
+      theme.value = isAfterSunset() ? 'dark' : 'light'
+      scheduleAutoSwitch() // 递归调度下一次
+    }, delay + 60000) // 加 1 分钟余量
+  }
+  scheduleAutoSwitch()
+
   // 切换
   const toggle = () => {
     theme.value = theme.value === 'dark' ? 'light' : 'dark'

frontend/src/utils/sunset.js

@@ -0,0 +1,76 @@
+/**
+ * 广西（南宁）日落时间计算
+ * 纬度 22.82°N, 经度 108.37°E, 时区 UTC+8
+ */
+
+const LAT = 22.82   // 南宁纬度
+const LON = 108.37  // 南宁经度
+
+function toRad(deg) { return deg * Math.PI / 180 }
+function toDeg(rad) { return rad * 180 / Math.PI }
+
+/**
+ * 计算指定日期的日落时间（北京时间）
+ * @param {Date} date
+ * @returns {{ hour: number, minute: number }} 日落时分
+ */
+export function getSunsetTime(date = new Date()) {
+  const dayOfYear = Math.floor((date - new Date(date.getFullYear(), 0, 0)) / 86400000)
+
+  // 太阳赤纬 (solar declination)
+  const declination = 23.45 * Math.sin(toRad(360 / 365 * (284 + dayOfYear)))
+
+  // 日落时角 cos(ω) = -tan(lat)*tan(δ)
+  const cosOmega = -Math.tan(toRad(LAT)) * Math.tan(toRad(declination))
+  const omega = Math.acos(Math.max(-1, Math.min(1, cosOmega))) // 弧度
+
+  // 日落地方太阳时（小时）
+  const solarHour = 12 + toDeg(omega) / 15
+
+  // 修正：时区经度(120°E)与本地经度差
+  const correction = (120 - LON) / 15 * 60 // 分钟
+  const totalMinutes = solarHour * 60 + correction
+
+  const hour = Math.floor(totalMinutes / 60) % 24
+  const minute = Math.round(totalMinutes % 60)
+
+  return { hour, minute }
+}
+
+/**
+ * 判断当前是否在日落之后（应使用深色模式）
+ */
+export function isAfterSunset() {
+  const now = new Date()
+  const sunset = getSunsetTime(now)
+  const currentMinutes = now.getHours() * 60 + now.getMinutes()
+  const sunsetMinutes = sunset.hour * 60 + sunset.minute
+  // 日出约为 12 - (sunset - 12) = 24 - sunset（粗略估算）
+  const sunriseMinutes = (24 * 60 - sunsetMinutes) % (24 * 60)
+  // 深色时间：日落之后 到 日出之前
+  return currentMinutes >= sunsetMinutes || currentMinutes < sunriseMinutes
+}
+
+/**
+ * 获取距离下次切换的毫秒数
+ * 用于设置定时器在日落/日出时自动切换
+ */
+export function getMsUntilNextSwitch() {
+  const now = new Date()
+  const sunset = getSunsetTime(now)
+  const sunsetMin = sunset.hour * 60 + sunset.minute
+  const sunriseMin = (24 * 60 - sunsetMin) % (24 * 60)
+  const currentMin = now.getHours() * 60 + now.getMinutes()
+
+  let targetMin
+  if (currentMin >= sunsetMin || currentMin < sunriseMin) {
+    // 当前是深色时间，下次切换是日出
+    targetMin = sunriseMin
+  } else {
+    // 当前是浅色时间，下次切换是日落
+    targetMin = sunsetMin
+  }
+
+  const diffMin = (targetMin - currentMin + 24 * 60) % (24 * 60)
+  return diffMin * 60 * 1000
+}

frontend/src/views/About.vue

@@ -42,7 +42,7 @@ onMounted(async () => {
 <style scoped>
 .about-page {
   padding: 24px 28px;
-  max-width: 860px;
+  max-width: 1100px;
 }
 
 .page-header {

frontend/src/views/AuditLog.vue

@@ -83,7 +83,7 @@
           :total="total"
           :page-sizes="[20, 50, 100]"
           layout="total, sizes, prev, pager, next"
-          small
+          size="small"
           @change="fetchLogs"
         />
       </div>

frontend/src/views/Charts.vue

@@ -31,17 +31,59 @@
         </div>
         <div ref="regionChart" class="chart-area"></div>
       </div>
+
+      <!-- OLT 设备在线率 -->
+      <div class="chart-panel">
+        <div class="panel-header">
+          <span class="panel-title">
+            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" style="vertical-align:-2px;margin-right:6px">
+              <rect x="2" y="2" width="20" height="8" rx="1"/><rect x="2" y="14" width="20" height="8" rx="1"/>
+              <line x1="6" y1="6" x2="6.01" y2="6"/><line x1="6" y1="18" x2="6.01" y2="18"/>
+            </svg>
+            OLT 设备在线率
+          </span>
+        </div>
+        <div ref="oltChart" class="chart-area" style="height:360px"></div>
+      </div>
+
+      <!-- 设备型号分布 -->
+      <div class="chart-panel">
+        <div class="panel-header">
+          <span class="panel-title">
+            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" style="vertical-align:-2px;margin-right:6px">
+              <rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/>
+              <rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/>
+            </svg>
+            设备型号分布
+          </span>
+        </div>
+        <div ref="modelChart" class="chart-area" style="height:360px"></div>
+      </div>
     </div>
   </div>
 </template>
 
 <script setup>
-import { ref, onMounted } from 'vue'
+import { ref, onMounted, onUnmounted, nextTick } from 'vue'
 import * as echarts from 'echarts'
-import { getTrend, getByRegion } from '../api/stats'
+import { getTrend, getByRegion, getOltStats, getModelDistribution } from '../api/stats'
 
 const trendChart = ref(null)
 const regionChart = ref(null)
+const oltChart = ref(null)
+const modelChart = ref(null)
+const chartInstances = []
+
+const _initChart = (dom) => {
+  if (!dom) return null
+  const existing = echarts.getInstanceByDom(dom)
+  if (existing) existing.dispose()
+  const chart = echarts.init(dom)
+  chartInstances.push(chart)
+  return chart
+}
+
+const _resizeCharts = () => chartInstances.forEach(c => { try { c.resize() } catch {} })
 
 const chartTheme = {
   backgroundColor: 'transparent',
@@ -59,70 +101,60 @@ const chartTheme = {
 }
 
 const initTrendChart = async () => {
-  const { data } = await getTrend(7)
+  try {
-  const chart = echarts.init(trendChart.value)
+    const { data } = await getTrend(7)
-  chart.setOption({
+    if (!data || !data.length) return
-    ...chartTheme,
+    const chart = _initChart(trendChart.value)
-    tooltip: { ...chartTheme.tooltip, trigger: 'axis' },
+    if (!chart) return
-    legend: {
+    chart.setOption({
-      data: ['在线', '离线'],
+      backgroundColor: 'transparent',
-      textStyle: { color: '#8a9ab8' },
+      textStyle: { color: '#8a9ab8', fontFamily: 'Noto Sans SC, sans-serif', fontSize: 12 },
-      top: 4,
+      grid: { left: '3%', right: '4%', bottom: '3%', top: '12%', containLabel: true },
-    },
+      tooltip: {
-    xAxis: {
+        trigger: 'axis',
-      type: 'category',
+        backgroundColor: '#141c30',
-      data: data.map(d => d.date),
+        borderColor: 'rgba(255,255,255,0.10)',
-      axisLine: chartTheme.axisLine,
+        textStyle: { color: '#e8edf5' },
-      axisTick: chartTheme.axisTick,
+        extraCssText: 'border-radius: 8px; box-shadow: 0 8px 32px rgba(0,0,0,0.4);'
-      axisLabel: { color: '#8a9ab8', fontSize: 11 },
-    },
-    yAxis: {
-      type: 'value',
-      axisLine: { show: false },
-      axisTick: { show: false },
-      axisLabel: { color: '#8a9ab8', fontSize: 11 },
-      splitLine: chartTheme.splitLine,
-    },
-    series: [
-      {
-        name: '在线',
-        type: 'line',
-        data: data.map(d => d.online),
-        smooth: true,
-        symbol: 'circle',
-        symbolSize: 5,
-        lineStyle: { color: '#00d2b4', width: 2 },
-        itemStyle: { color: '#00d2b4' },
-        areaStyle: {
-          color: new echarts.graphic.LinearGradient(0, 0, 0, 1, [
-            { offset: 0, color: 'rgba(0,210,180,0.20)' },
-            { offset: 1, color: 'rgba(0,210,180,0.00)' },
-          ])
-        },
       },
-      {
+      legend: { data: ['在线', '离线'], textStyle: { color: '#8a9ab8' }, top: 4 },
-        name: '离线',
+      xAxis: {
-        type: 'line',
+        type: 'category', data: data.map(d => d.date),
-        data: data.map(d => d.offline),
+        axisLabel: { color: '#8a9ab8', fontSize: 11 },
-        smooth: true,
+        axisLine: { lineStyle: { color: 'rgba(255,255,255,0.08)' } },
-        symbol: 'circle',
-        symbolSize: 5,
-        lineStyle: { color: '#ef4444', width: 2 },
-        itemStyle: { color: '#ef4444' },
-        areaStyle: {
-          color: new echarts.graphic.LinearGradient(0, 0, 0, 1, [
-            { offset: 0, color: 'rgba(239,68,68,0.15)' },
-            { offset: 1, color: 'rgba(239,68,68,0.00)' },
-          ])
-        },
       },
-    ],
+      yAxis: {
-  })
+        type: 'value',
+        axisLabel: { color: '#8a9ab8', fontSize: 11 },
+        splitLine: { lineStyle: { color: 'rgba(255,255,255,0.05)', type: 'dashed' } },
+      },
+      series: [
+        {
+          name: '在线', type: 'line', data: data.map(d => d.online), smooth: true,
+          symbol: 'circle', symbolSize: 5,
+          lineStyle: { color: '#00d2b4', width: 2 }, itemStyle: { color: '#00d2b4' },
+          areaStyle: { color: new echarts.graphic.LinearGradient(0, 0, 0, 1, [
+            { offset: 0, color: 'rgba(0,210,180,0.20)' }, { offset: 1, color: 'rgba(0,210,180,0.00)' }
+          ])}
+        },
+        {
+          name: '离线', type: 'line', data: data.map(d => d.offline), smooth: true,
+          symbol: 'circle', symbolSize: 5,
+          lineStyle: { color: '#ef4444', width: 2 }, itemStyle: { color: '#ef4444' },
+          areaStyle: { color: new echarts.graphic.LinearGradient(0, 0, 0, 1, [
+            { offset: 0, color: 'rgba(239,68,68,0.15)' }, { offset: 1, color: 'rgba(239,68,68,0.00)' }
+          ])}
+        },
+      ],
+    })
+  } catch (e) {
+    console.error('Trend chart error:', e)
+  }
 }
 
 const initRegionChart = async () => {
   const { data } = await getByRegion()
-  const chart = echarts.init(regionChart.value)
+  const chart = _initChart(regionChart.value)
   const colors = ['#00d2b4', '#3b82f6', '#a855f7', '#f59e0b', '#22c55e', '#ef4444', '#ec4899']
   chart.setOption({
     ...chartTheme,
@@ -154,9 +186,72 @@ const initRegionChart = async () => {
   })
 }
 
-onMounted(() => {
+const initOltChart = async () => {
+  const { data } = await getOltStats()
+  const chart = _initChart(oltChart.value)
+  const sorted = [...data].sort((a, b) => {
+    const ra = a.online / (a.total || 1), rb = b.online / (b.total || 1)
+    return ra - rb
+  })
+  chart.setOption({
+    ...chartTheme,
+    tooltip: { ...chartTheme.tooltip, trigger: 'axis', axisPointer: { type: 'shadow' },
+      formatter: (ps) => {
+        const d = ps[0]
+        return `<b>${d.name}</b><br/>在线: ${d.data.online}/${d.data.total}<br/>在线率: ${(d.data.online/(d.data.total||1)*100).toFixed(1)}%<br/>离线: ${d.data.offline}`
+      }
+    },
+    grid: { left: '3%', right: '8%', bottom: '3%', top: '8%', containLabel: true },
+    xAxis: { type: 'value', max: 100, axisLabel: { formatter: '{value}%' } },
+    yAxis: {
+      type: 'category',
+      data: sorted.map(d => d.name),
+      axisLabel: { fontSize: 11, width: 120, overflow: 'truncate' },
+      axisLine: { show: false }, axisTick: { show: false },
+    },
+    series: [{
+      type: 'bar',
+      data: sorted.map(d => ({
+        name: d.name, value: +(d.online / (d.total || 1) * 100).toFixed(1),
+        total: d.total, online: d.online, offline: d.offline,
+        itemStyle: { color: d.online === 0 ? '#ef4444' : +(d.online/(d.total||1)*100).toFixed(1) < 70 ? '#f59e0b' : '#00d2b4',
+          borderRadius: [0, 4, 4, 0] }
+      })),
+      barMaxWidth: 22,
+      label: { show: true, position: 'right', fontSize: 11, color: '#8a9ab8', formatter: '{c}%' },
+    }],
+  })
+}
+
+const initModelChart = async () => {
+  const { data } = await getModelDistribution()
+  if (!data.length) return
+  const chart = _initChart(modelChart.value)
+  const colors = ['#00d2b4','#3b82f6','#a855f7','#f59e0b','#22c55e','#ef4444','#ec4899','#6366f1','#14b8a6','#eab308']
+  chart.setOption({
+    ...chartTheme,
+    tooltip: { ...chartTheme.tooltip, trigger: 'item', formatter: '{b}: {c} 台 ({d}%)' },
+    series: [{
+      type: 'pie', radius: ['42%','70%'], center: ['50%','50%'],
+      data: data.map((d, i) => ({ value: d.count, name: d.model, itemStyle: { color: colors[i % colors.length] } })),
+      label: { show: true, fontSize: 10, color: '#8a9ab8', formatter: '{b}\n{d}%' },
+      labelLine: { length: 16, length2: 12 },
+      emphasis: { itemStyle: { shadowBlur: 12, shadowColor: 'rgba(0,0,0,0.3)' } },
+    }],
+  })
+}
+
+onMounted(async () => {
+  await nextTick()
   initTrendChart()
   initRegionChart()
+  initOltChart()
+  initModelChart()
+  window.addEventListener('resize', _resizeCharts)
+})
+onUnmounted(() => {
+  window.removeEventListener('resize', _resizeCharts)
+  chartInstances.forEach(c => { try { c.dispose() } catch {} })
 })
 </script>
 

frontend/src/views/Dashboard.vue

@@ -6,15 +6,17 @@
         <h1 class="page-title">统计概览</h1>
         <span class="page-subtitle">实时监控 ONU 设备在线状态</span>
       </div>
-      <button class="refresh-btn" :class="{ loading }" @click="loadData">
+      <div class="header-actions">
-        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" :class="{ spinning: loading }">
+        <button class="refresh-btn" :class="{ loading }" @click="loadData">
-          <polyline points="23 4 23 10 17 10"/>
+          <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" :class="{ spinning: loading }">
-          <path d="M20.49 15a9 9 0 1 1-2.12-9.36L23 10"/>
+            <polyline points="23 4 23 10 17 10"/>
-        </svg>
+            <path d="M20.49 15a9 9 0 1 1-2.12-9.36L23 10"/>
-        <span v-if="loading">刷新中…</span>
+          </svg>
-        <span v-else-if="lastUpdated">{{ lastUpdated }}</span>
+          <span v-if="loading">刷新中…</span>
-        <span v-else>刷新数据</span>
+          <span v-else-if="lastUpdated">{{ lastUpdated }}</span>
-      </button>
+          <span v-else>刷新数据</span>
+        </button>
+      </div>
     </div>
 
     <!-- 汇总卡片 -->
@@ -170,6 +172,25 @@
       </div>
     </div>
 
+    <!-- 全离线学校（可折叠） -->
+    <div v-if="offlineSchools.length > 0" class="offline-alert" :class="{ collapsed: offlineCollapsed }">
+      <div class="offline-alert-header" @click="offlineCollapsed = !offlineCollapsed">
+        <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+          <path d="M10.29 3.86L1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z"/>
+          <line x1="12" y1="9" x2="12" y2="13"/><line x1="12" y1="17" x2="12.01" y2="17"/>
+        </svg>
+        <span>全离线学校（{{ offlineSchools.length }} 所）</span>
+        <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" class="collapse-arrow" :class="{ rotated: !offlineCollapsed }">
+          <polyline points="6 9 12 15 18 9"/>
+        </svg>
+      </div>
+      <div v-show="!offlineCollapsed" class="offline-schools-list">
+        <span v-for="s in offlineSchools" :key="s.school_name" class="offline-school-tag" @click="goToSchool(s.school_name)">
+          {{ s.school_name }}（{{ s.total }}台）
+        </span>
+      </div>
+    </div>
+
     <!-- 乡镇详情对话框 -->
     <el-dialog
       v-model="townVisible"
@@ -197,9 +218,10 @@
 </template>
 
 <script setup>
-import { ref, computed, onMounted } from 'vue'
+import { ref, computed, onMounted, onUnmounted } from 'vue'
 import { useRouter } from 'vue-router'
 import request from '../utils/request'
+import { getOfflineSchools } from '../api/stats'
 import { useMobile } from '../composables/useMobile'
 
 const { isMobile } = useMobile()
@@ -210,6 +232,8 @@ const data = ref({})
 const lastUpdated = ref('')
 const townVisible = ref(false)
 const selectedTown = ref(null)
+const offlineSchools = ref([])
+const offlineCollapsed = ref(true)
 
 const rate = (item) => {
   if (!item || !item.total) return 0
@@ -239,6 +263,13 @@ const goToSchool = (schoolName) => {
   router.push({ path: '/devices', query: { school_name: schoolName } })
 }
 
+const loadOfflineSchools = async () => {
+  try {
+    const { data } = await getOfflineSchools()
+    offlineSchools.value = data || []
+  } catch {}
+}
+
 const loadData = async () => {
   loading.value = true
   try {
@@ -248,9 +279,24 @@ const loadData = async () => {
   } finally {
     loading.value = false
   }
+  loadOfflineSchools()
 }
 
-onMounted(loadData)
+let ws = null
+const connectWs = () => {
+  const proto = location.protocol === 'https:' ? 'wss:' : 'ws:'
+  ws = new WebSocket(`${proto}//${location.host}/api/ws/dashboard`)
+  ws.onmessage = (e) => {
+    try {
+      const msg = JSON.parse(e.data)
+      if (msg.type === 'check_complete') loadData()
+    } catch {}
+  }
+  ws.onclose = () => { setTimeout(connectWs, 10000) }
+}
+
+onMounted(() => { loadData(); connectWs() })
+onUnmounted(() => { if (ws) ws.close() })
 </script>
 
 <style scoped>
@@ -286,6 +332,34 @@ onMounted(loadData)
   letter-spacing: 0.03em;
 }
 
+.header-actions {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+
+.report-btn {
+  display: flex;
+  align-items: center;
+  gap: 7px;
+  padding: 8px 16px;
+  background: var(--bg-elevated);
+  border: 1px solid var(--border-default);
+  border-radius: var(--radius-sm);
+  color: var(--text-secondary);
+  font-size: 13px;
+  font-family: var(--font-sans);
+  text-decoration: none;
+  cursor: pointer;
+  transition: all 0.2s;
+}
+
+.report-btn:hover {
+  border-color: var(--accent);
+  color: var(--accent);
+  background: var(--accent-dim);
+}
+
 .refresh-btn {
   display: flex;
   align-items: center;
@@ -352,6 +426,64 @@ onMounted(loadData)
   box-shadow: var(--shadow-glow);
 }
 
+/* 全离线学校告警 */
+.offline-alert {
+  background: rgba(239, 68, 68, 0.08);
+  border: 1px solid rgba(239, 68, 68, 0.25);
+  border-radius: var(--radius-lg);
+  padding: 14px 18px;
+  margin-top: 24px;
+}
+
+.offline-alert-header {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  font-size: 13px;
+  font-weight: 600;
+  color: #ef4444;
+  margin-bottom: 10px;
+  cursor: pointer;
+  user-select: none;
+}
+
+.offline-alert.collapsed .offline-alert-header {
+  margin-bottom: 0;
+}
+
+.collapse-arrow {
+  margin-left: auto;
+  transition: transform 0.2s;
+  flex-shrink: 0;
+}
+
+.collapse-arrow.rotated {
+  transform: rotate(180deg);
+}
+
+.offline-schools-list {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+}
+
+.offline-school-tag {
+  display: inline-flex;
+  padding: 4px 10px;
+  background: rgba(239, 68, 68, 0.12);
+  border: 1px solid rgba(239, 68, 68, 0.2);
+  border-radius: var(--radius-sm);
+  font-size: 12px;
+  color: var(--text-secondary);
+  cursor: pointer;
+  transition: all 0.15s;
+}
+
+.offline-school-tag:hover {
+  background: rgba(239, 68, 68, 0.2);
+  color: #ef4444;
+}
+
 @keyframes card-in {
   from { opacity: 0; transform: translateY(12px); }
   to   { opacity: 1; transform: translateY(0); }

frontend/src/views/DeviceList.vue

@@ -16,6 +16,13 @@
         <el-button v-if="can('device.import')" type="success" size="small" @click="importDialogVisible = true">
           数据导入
         </el-button>
+        <a href="/api/devices/export/csv" class="csv-export-btn" title="导出CSV">
+          <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/>
+            <polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/>
+          </svg>
+          导出CSV
+        </a>
       </div>
     </div>
 
@@ -49,6 +56,12 @@
           <el-option label="未知" value="unknown" />
         </el-select>
       </div>
+      <div class="filter-group">
+        <label class="filter-label">标签</label>
+        <el-select v-model="filters.tag" placeholder="全部" clearable @change="search" size="small" style="width:130px">
+          <el-option v-for="t in availableTags" :key="t" :label="t" :value="t" />
+        </el-select>
+      </div>
       <div class="filter-group">
         <label class="filter-label">搜索</label>
         <el-input
@@ -428,6 +441,7 @@
           <el-input v-model="editForm.place_type" placeholder="如：宿舍、教室、办公室…" />
         </el-form-item>
         <el-form-item label="备注"><el-input v-model="editForm.notes" type="textarea" :rows="2" /></el-form-item>
+        <el-form-item label="标签"><el-input v-model="editForm.tags" placeholder="多个标签用逗号分隔，如：重点设备,考试用" /></el-form-item>
       </el-form>
       <template #footer>
         <el-button @click="editVisible = false">取消</el-button>
@@ -632,7 +646,8 @@ const total = ref(0)
 const page = ref(1)
 const pageSize = ref(20)
 const regions = ref([])
-const filters = ref({ region: '', keyword: '', school_name: '', status: '' })
+const filters = ref({ region: '', keyword: '', school_name: '', status: '', tag: '' })
+const availableTags = ref([])
 
 const detailVisible = ref(false)
 const selectedDevice = ref({})
@@ -647,7 +662,7 @@ let cooldownTimer = null
 const clearing = ref(false)
 
 const editVisible = ref(false)
-const editForm = ref({ region: '', school_name: '', building: '', room_number: '', place_type: '', notes: '' })
+const editForm = ref({ region: '', school_name: '', building: '', room_number: '', place_type: '', notes: '', tags: '' })
 const regionOptions = ref([])
 const editSaving = ref(false)
 
@@ -1003,6 +1018,7 @@ const openEdit = () => {
     room_number: selectedDevice.value.room_number || '',
     place_type: selectedDevice.value.place_type || '',
     notes: selectedDevice.value.notes || '',
+    tags: selectedDevice.value.tags || '',
   }
   loadRegionOptions()
   detailVisible.value = false
@@ -1063,6 +1079,7 @@ const loadDevices = async () => {
     keyword: filters.value.keyword || undefined,
     school_name: filters.value.school_name || undefined,
     status: filters.value.status || undefined,
+    tag: filters.value.tag || undefined,
   })
   devices.value = data.items
   total.value = data.total
@@ -1079,12 +1096,20 @@ const handleSizeChange = (val) => {
   loadDevices()
 }
 
+const fetchTags = async () => {
+  try {
+    const { data } = await request.get('/devices/tags')
+    availableTags.value = data || []
+  } catch {}
+}
+
 onMounted(() => {
   if (route.query.school_name) {
     filters.value.keyword = route.query.school_name
   }
   loadRegions()
   loadDevices()
+  fetchTags()
 })
 </script>
 
@@ -1123,6 +1148,26 @@ onMounted(() => {
 .header-actions {
   display: flex;
   gap: 8px;
+  align-items: center;
+}
+
+.csv-export-btn {
+  display: flex;
+  align-items: center;
+  gap: 5px;
+  padding: 5px 12px;
+  background: var(--bg-elevated);
+  border: 1px solid var(--border-default);
+  border-radius: var(--radius-sm);
+  color: var(--text-secondary);
+  font-size: 12px;
+  font-family: var(--font-sans);
+  text-decoration: none;
+  transition: all 0.15s;
+}
+.csv-export-btn:hover {
+  border-color: var(--accent);
+  color: var(--accent);
 }
 
 /* 筛选栏 */

frontend/src/views/Inventory.vue

@@ -1026,6 +1026,11 @@ const formatTime = (t) => fmtTimeRaw(t, { slice: 16 })
   max-width: 1400px;
 }
 
+@media (max-width: 767px) {
+  .inventory-page { padding: 12px; }
+  .summary-cards { grid-template-columns: repeat(2, 1fr); gap: 8px; }
+}
+
 .summary-cards {
   display: flex;
   gap: 14px;

frontend/src/views/OltManage.vue

@@ -938,7 +938,7 @@ const dismissNewDevice = async (id) => {
 const runQuickScan = async () => {
   quickScanning.value = true
   try {
-    const { data } = await request.post('/olt/quick-scan')
+    const { data } = await request.post('/olt/quick-scan', null, { timeout: 180000 })
     quickScanResult.value = data
     quickScanVisible.value = true
   } catch (error) {
@@ -951,7 +951,7 @@ const runQuickScan = async () => {
 const runLoopbackDetection = async () => {
   loopDetecting.value = true
   try {
-    const { data } = await request.post('/olt/loopback-detection')
+    const { data } = await request.post('/olt/loopback-detection', null, { timeout: 120000 })
     loopResults.value = data
     const map = {}
     for (const item of data) {

frontend/src/views/RecordsLog.vue

@@ -124,7 +124,7 @@
             :total="repTotal"
             :page-sizes="[50, 100, 200]"
             layout="total, sizes, prev, pager, next"
-            small
+            size="small"
             @size-change="repLoad"
             @current-change="repLoad"
           />
@@ -203,7 +203,7 @@
             :total="auditTotal"
             :page-sizes="[20, 50, 100]"
             layout="total, sizes, prev, pager, next"
-            small
+            size="small"
             @change="fetchAudit"
           />
         </div>

frontend/src/views/RolePermissions.vue

@@ -152,7 +152,7 @@ onMounted(async () => {
 </script>
 
 <style scoped>
-.page-wrap { padding: 24px; max-width: 1100px; }
+.page-wrap { padding: 24px; }
 .page-header { margin-bottom: 20px; }
 .page-title { font-size: 18px; font-weight: 600; color: var(--text-primary); margin: 0; }
 .layout { display: flex; gap: 20px; align-items: flex-start; }

frontend/src/views/Settings.vue

@@ -99,6 +99,41 @@
         </div>
       </div>
     </div>
+
+    <!-- 企业微信告警设置 -->
+    <div class="settings-card" style="margin-top: 20px">
+      <div class="card-header">
+        <svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" style="vertical-align: -2px; margin-right: 8px">
+          <path d="M18 8A6 6 0 0 0 6 8c0 7-3 9-3 9h18s-3-2-3-9"/>
+          <path d="M13.73 21a2 2 0 0 1-3.46 0"/>
+        </svg>
+        企业微信告警
+      </div>
+      <div class="card-body">
+        <p class="setting-desc">当某个学校所有设备全部离线时，通过企业微信应用消息 API 发送告警。请填写企业微信自建应用的凭证信息。</p>
+        <div class="wechat-field">
+          <label class="wechat-label">CorpID</label>
+          <input v-model="wechatCorpId" class="webhook-input" placeholder="企业ID" :disabled="wechatSaving" />
+        </div>
+        <div class="wechat-field">
+          <label class="wechat-label">CorpSecret</label>
+          <input v-model="wechatCorpSecret" type="password" class="webhook-input" placeholder="应用 Secret" :disabled="wechatSaving" />
+        </div>
+        <div class="wechat-field">
+          <label class="wechat-label">AgentID</label>
+          <input v-model="wechatAgentId" class="webhook-input" placeholder="应用 AgentID" :disabled="wechatSaving" />
+        </div>
+
+        <div class="form-footer">
+          <button class="save-btn" :disabled="wechatSaving" @click="saveWebhook">
+            <svg v-if="wechatSaving" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" class="spinning">
+              <polyline points="23 4 23 10 17 10"/><path d="M20.49 15a9 9 0 1 1-2.12-9.36L23 10"/>
+            </svg>
+            {{ wechatSaving ? '保存中…' : '保存设置' }}
+          </button>
+        </div>
+      </div>
+    </div>
   </div>
 </template>
 
@@ -179,6 +214,7 @@ const save = async () => {
 onMounted(() => {
   load()
   loadAbout()
+  loadWebhook()
   const timer = setInterval(load, 10000)
   onUnmounted(() => clearInterval(timer))
 })
@@ -204,12 +240,43 @@ const saveAbout = async () => {
     aboutSaving.value = false
   }
 }
+
+const wechatCorpId = ref('')
+const wechatCorpSecret = ref('')
+const wechatAgentId = ref('')
+const wechatSaving = ref(false)
+
+const loadWebhook = async () => {
+  try {
+    const { data } = await getSettings()
+    const setVal = (key, ref) => { const s = data?.[key]; if (s) ref.value = s.value || '' }
+    setVal('wechat_corpid', wechatCorpId)
+    setVal('wechat_corpsecret', wechatCorpSecret)
+    setVal('wechat_agentid', wechatAgentId)
+  } catch {}
+}
+
+const saveWebhook = async () => {
+  wechatSaving.value = true
+  try {
+    await request.put('/settings/webhook', {
+      corpid: wechatCorpId.value,
+      corpsecret: wechatCorpSecret.value,
+      agentid: wechatAgentId.value,
+    })
+    ElMessage.success('企业微信配置已保存')
+  } catch (e) {
+    ElMessage.error(e?.response?.data?.detail || '保存失败')
+  } finally {
+    wechatSaving.value = false
+  }
+}
 </script>
 
 <style scoped>
 .settings-page {
   padding: 24px;
-  max-width: 640px;
+  max-width: 960px;
 }
 
 .page-header {
@@ -427,6 +494,54 @@ const saveAbout = async () => {
   cursor: not-allowed;
 }
 
+.webhook-input {
+  width: 100%;
+  height: 40px;
+  background: var(--bg-elevated);
+  border: 1px solid var(--border-default);
+  border-radius: var(--radius-sm);
+  color: var(--text-primary);
+  font-family: var(--font-mono);
+  font-size: 13px;
+  padding: 0 14px;
+  box-sizing: border-box;
+  outline: none;
+  transition: border-color 0.2s;
+}
+
+.webhook-input:focus {
+  border-color: var(--accent);
+}
+
+.webhook-input:disabled {
+  opacity: 0.6;
+  cursor: not-allowed;
+}
+
+.wechat-section-label {
+  font-size: 12px;
+  font-weight: 600;
+  color: var(--text-secondary);
+  margin-top: 8px;
+  padding-bottom: 4px;
+  border-bottom: 1px solid var(--border-subtle);
+}
+
+.wechat-field {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  margin-top: 8px;
+}
+
+.wechat-label {
+  width: 90px;
+  flex-shrink: 0;
+  font-size: 12px;
+  color: var(--text-muted);
+  text-align: right;
+}
+
 @media (max-width: 767px) {
   .settings-page {
     padding: 16px 12px;

frontend/src/views/UserManage.vue

@@ -21,7 +21,7 @@
         <thead>
           <tr>
             <th>用户名</th>
-            <th>邮箱</th>
+            <th>姓名</th>
             <th>角色</th>
             <th>区域/学校</th>
             <th>状态</th>
@@ -38,7 +38,7 @@
           </tr>
           <tr v-for="u in users" :key="u.id">
             <td class="td-username">{{ u.username }}</td>
-            <td class="td-muted">{{ u.email || '—' }}</td>
+            <td class="td-muted">{{ u.display_name || u.username || '—' }}</td>
             <td>
               <span class="role-badge" :class="'role-' + u.role">{{ roleLabel(u.role) }}</span>
             </td>
@@ -81,7 +81,7 @@
     <div v-if="editUser" class="modal-overlay" @click.self="editUser = null">
       <div class="modal">
         <div class="modal-header">
-          <span class="modal-title">编辑用户：{{ editUser.username }}</span>
+          <span class="modal-title">编辑用户：{{ editUser.display_name || editUser.username }}</span>
           <button class="modal-close" @click="editUser = null">✕</button>
         </div>
         <div class="modal-body">
@@ -330,7 +330,7 @@ onMounted(() => {
 </script>
 
 <style scoped>
-.page-wrap { padding: 24px; max-width: 1200px; }
+.page-wrap { padding: 24px; }
 .page-header { display: flex; align-items: center; justify-content: space-between; margin-bottom: 20px; flex-wrap: wrap; gap: 12px; }
 .page-title { font-size: 18px; font-weight: 600; color: var(--text-primary); margin: 0; }
 .header-filters { display: flex; gap: 10px; }

frontend/vite.config.js

@@ -11,6 +11,10 @@ export default defineConfig({
       '/api': {
         target: process.env.VITE_API_PROXY_TARGET || 'http://localhost:8001',
         changeOrigin: true
+      },
+      '/ws': {
+        target: (process.env.VITE_API_PROXY_TARGET || 'http://localhost:8001').replace('http', 'ws'),
+        ws: true
       }
     }
   }

guide.md

@@ -1,726 +0,0 @@
-# 为 H3ConuMS2 添加 ONU 远程重启 & 光功率查询功能 — 后端开发指南
-
-> 目标：将 H3C iMC 平台的 ONU 远程重启和光功率查询功能集成到 H3ConuMS2 项目中
-> 技术栈：FastAPI + SQLAlchemy + requests (HTTP Digest Auth)
-> 源项目参考：`/home/v6ole/pyproject/H3ConuMS`
-
----
-
-## 1. 整体架构
-
-```
-┌──────────────────┐      REST API 调用       ┌──────────────────┐
-│   H3ConuMS2 后端  │  ──────────────────────►  │   H3C iMC 平台   │
-│   (FastAPI)       │  ◄──────────────────────  │                  │
-│   IMCService      │                           │  /imcrs/epon/... │
-└──────────────────┘                           └──────────────────┘
-```
-
-**后端提供的 API 端点：**
-| 端点 | 方法 | 说明 | iMC 后端接口 |
-|------|------|------|-------------|
-| `/api/devices/{id}/reboot` | POST | 远程重启 ONU | `/imcrs/epon/onu/reboot?mac={mac}` (POST) |
-| `/api/devices/{id}/optical-power` | GET | 获取 ONU 光功率 | `/imcrs/epon/onu/onuLightWaneInfo?mac={mac}` (GET) |
-
-**数据流（以重启为例）：**
-1. 客户端 POST `/api/devices/{id}/reboot`
-2. 后端控制器验证设备存在 + 权限 → 调用 `IMCService.reboot_onu()`
-3. `IMCService` 构建 HTTP Digest 认证头 → POST 到 iMC REST API
-4. iMC 返回结果 → 后端解析错误码 → 返回 JSON
-
----
-
-## 2. Digest 认证原理解析
-
-iMC 的 REST API 使用 **HTTP Digest Access Authentication**（RFC 2617），不是普通的 Cookie/Session 登录。
-
-### 认证流程
-
-```
-客户端                          iMC 服务器
-  │                                │
-  │──── GET /imcrs/... (无认证) ────│
-  │                                │──── 401 + WWW-Authenticate header
-  │                                │    (包含 nonce, realm, qop)
-  │                                │
-  │  ── 解析 WWW-Authenticate ──►  │
-  │     提取 nonce 和 realm        │
-  │                                │
-  │  ── 计算 Digest 响应 ────────►  │
-  │     HA1 = MD5(user:realm:pass) │
-  │     HA2 = MD5(method:uri)      │
-  │     response = MD5(HA1:nonce:nc:cnonce:qop:HA2) │
-  │                                │
-  │──── POST /imcrs/... ──────────►│
-  │    Authorization: Digest ...   │
-  │                                │──── 200 OK (成功)
-```
-
-### 核心 MD5 计算
-
-```python
-cnonce = md5(str(time.time())).hexdigest()[:16]
-ha1 = md5(f"{username}:{realm}:{password}").hexdigest()
-ha2 = md5(f"{method}:{uri}").hexdigest()
-response = md5(f"{ha1}:{nonce}:{nc:08d}:{cnonce}:auth:{ha2}").hexdigest()
-```
-
----
-
-## 3. 需要修改/新增的文件清单
-
-| 文件 | 操作 | 说明 |
-|------|------|------|
-| `backend/app/services/imc_service.py` | **新增** | iMC API 服务（Digest 认证 + 重启 + 光功率） |
-| `backend/app/services/__init__.py` | 修改 | 导出 IMCService |
-| `backend/app/schemas/device.py` | 修改 | 添加重启/光功率响应 Schema |
-| `backend/app/api/v1/devices.py` | 修改 | 添加重启和光功率 API 路由 |
-| `backend/app/core/config.py` | 修改 | 添加 iMC 配置项 |
-| `.env` 或 `backend/.env` | 修改 | 添加 iMC 环境变量 |
-
----
-
-## 4. 后端实现
-
-### 4.1 配置项 — `backend/app/core/config.py`
-
-在 `Settings` 类中添加 iMC 相关配置：
-
-```python
-# ===== iMC API 配置（用于 ONU 远程重启和光功率查询）=====
-IMC_API_URL: str = ""          # 例如 https://172.16.1.252:8443
-IMC_API_USERNAME: str = ""     # iMC 用户名
-IMC_API_PASSWORD: str = ""     # iMC 密码（明文，Digest认证需要原始密码）
-IMC_API_VERIFY_SSL: bool = False  # 是否验证 SSL 证书
-IMC_CONNECT_TIMEOUT: float = 5.0
-IMC_READ_TIMEOUT: float = 20.0
-```
-
-### 4.2 .env 配置
-
-在 `backend/.env`（或项目根目录 `.env`）中添加：
-
-```env
-# iMC API 配置（用于 ONU 远程重启和光功率查询）
-IMC_API_URL=https://172.16.1.252:8443
-IMC_API_USERNAME=admin
-IMC_API_PASSWORD=Pwd@12345
-IMC_API_VERIFY_SSL=false
-IMC_CONNECT_TIMEOUT=5
-IMC_READ_TIMEOUT=20
-```
-
-### 4.3 IMCService — `backend/app/services/imc_service.py`
-
-完整代码，包含 Digest 认证 + 重启 ONU + 光功率查询三大功能：
-
-```python
-"""
-iMC REST API 服务
-- 使用 HTTP Digest Access Authentication (RFC 2617)
-- 支持 nonce 过期自动续约（401 时自动重新握手）
-- 功能：ONU 远程重启、光功率查询
-"""
-import hashlib
-import re
-import json
-import time
-import logging
-import requests
-from app.core.config import settings
-
-logger = logging.getLogger(__name__)
-
-# iMC 重启错误码映射
-REBOOT_ERROR_CODES = {
-    '103': 'ONU不存在',
-    '119': 'SNMP连接超时',
-    '120': '业务割接失败',
-    '121': 'ONU未运行',
-    '122': '重启失败',
-}
-
-
-class IMCService:
-    """iMC REST API 服务封装"""
-
-    def __init__(self):
-        self.base_url = settings.IMC_API_URL.rstrip('/')
-        self.username = settings.IMC_API_USERNAME
-        self.password = settings.IMC_API_PASSWORD
-        self.verify_ssl = settings.IMC_API_VERIFY_SSL
-        self.session = requests.Session()
-        self.realm = "iMC RESTful Web Services"
-        self.connect_timeout = getattr(settings, 'IMC_CONNECT_TIMEOUT', 5)
-        self.read_timeout = getattr(settings, 'IMC_READ_TIMEOUT', 20)
-        # Digest 认证状态（每次重新初始化时清空，让首次请求自动获取 nonce）
-        self.nonce = None
-        self.nc = 1
-
-    # ═══════════════════════════════════════════════
-    # 内部：Digest 认证
-    # ═══════════════════════════════════════════════
-
-    def _get_digest_auth_header(self, method: str, uri: str) -> str | None:
-        """
-        构建 HTTP Digest 认证头
-
-        首次调用时会自动发一个请求获取 nonce（服务器返回 401 + WWW-Authenticate），
-        后续复用 nonce 并递增 nc 值。
-        nonce 过期时调用方捕获 401 后清空 self.nonce，下次自动重新握手。
-        """
-        if not self.nonce:
-            try:
-                resp = self.session.get(
-                    f"{self.base_url}{uri}",
-                    verify=self.verify_ssl,
-                    headers={"Accept": "application/json"},
-                    timeout=(self.connect_timeout, self.read_timeout),
-                )
-                if resp.status_code == 401 and 'WWW-Authenticate' in resp.headers:
-                    auth_header = resp.headers['WWW-Authenticate']
-                    auth_parts = {}
-                    for part in auth_header.split(','):
-                        if '=' in part:
-                            key, value = part.split('=', 1)
-                            auth_parts[key.strip()] = value.strip(' "')
-                    self.nonce = auth_parts.get('nonce', '')
-                    self.realm = auth_parts.get('realm', self.realm)
-                    logger.info(f"获取 nonce 成功: {self.nonce}")
-                else:
-                    logger.error(f"获取 nonce 失败, 状态码: {resp.status_code}")
-                    return None
-            except requests.Timeout:
-                logger.error("获取 nonce 超时")
-                raise TimeoutError("iMC 认证超时")
-            except Exception as e:
-                logger.error(f"获取 nonce 异常: {e}")
-                return None
-
-        # 计算 Digest 响应
-        cnonce = hashlib.md5(str(time.time()).encode()).hexdigest()[:16]
-        ha1 = hashlib.md5(
-            f"{self.username}:{self.realm}:{self.password}".encode()
-        ).hexdigest()
-        ha2 = hashlib.md5(f"{method}:{uri}".encode()).hexdigest()
-        response_hash = hashlib.md5(
-            f"{ha1}:{self.nonce}:{self.nc:08d}:{cnonce}:auth:{ha2}".encode()
-        ).hexdigest()
-
-        auth_value = (
-            f'Digest username="{self.username}", '
-            f'realm="{self.realm}", '
-            f'nonce="{self.nonce}", '
-            f'uri="{uri}", '
-            f'response="{response_hash}", '
-            f'qop=auth, '
-            f'nc={self.nc:08d}, '
-            f'cnonce="{cnonce}"'
-        )
-        self.nc += 1
-        return auth_value
-
-    def _clear_auth(self):
-        """清除认证状态（nonce 过期时调用）"""
-        self.nonce = None
-        self.nc = 1
-
-    # ═══════════════════════════════════════════════
-    # 公共：重启 ONU
-    # ═══════════════════════════════════════════════
-
-    def reboot_onu(self, mac: str) -> dict:
-        """
-        远程重启 ONU 设备
-
-        Args:
-            mac: MAC 地址，格式如 "1484-7790-4840"
-
-        Returns:
-            {"success": True, "message": "设备正在重启，请稍后..."}
-            或 {"success": False, "message": "重启失败: ..."}
-        """
-        max_retries = 1
-        for retry in range(max_retries + 1):
-            try:
-                uri = f"/imcrs/epon/onu/reboot?mac={mac}"
-                auth = self._get_digest_auth_header("POST", uri)
-                if not auth:
-                    return {"success": False, "message": "认证失败，无法发送重启请求"}
-
-                headers = {
-                    "Accept": "application/xml",
-                    "Content-Type": "application/xml",
-                    "Content-Length": "0",
-                    "Authorization": auth,
-                }
-
-                resp = self.session.post(
-                    f"{self.base_url}{uri}",
-                    headers=headers,
-                    verify=self.verify_ssl,
-                    timeout=(self.connect_timeout, self.read_timeout),
-                )
-
-                if resp.status_code == 200:
-                    # 检查 XML 响应中是否有错误码
-                    if "<errorCode>" in resp.text:
-                        m = re.search(r"<errorCode>(\d+)</errorCode>", resp.text)
-                        if m:
-                            code = m.group(1)
-                            msg = REBOOT_ERROR_CODES.get(
-                                code, f"未知错误(代码: {code})"
-                            )
-                            return {"success": False, "message": f"重启失败: {msg}"}
-                    return {"success": True, "message": "设备正在重启，请稍后..."}
-
-                elif resp.status_code == 401:
-                    # nonce 过期，清空后重试
-                    self._clear_auth()
-                    continue
-                else:
-                    return {
-                        "success": False,
-                        "message": f"重启请求失败(HTTP {resp.status_code})",
-                    }
-
-            except TimeoutError:
-                return {"success": False, "message": "iMC 接口超时，请稍后重试"}
-            except Exception as e:
-                logger.error(f"重启异常: {e}")
-                if retry < max_retries:
-                    time.sleep(3)
-                    continue
-                return {"success": False, "message": f"重启异常: {e}"}
-
-        return {"success": False, "message": "重启失败，已达最大重试次数"}
-
-    # ═══════════════════════════════════════════════
-    # 公共：获取光功率
-    # ═══════════════════════════════════════════════
-
-    def get_optical_power(self, mac: str) -> dict | None:
-        """
-        获取 ONU 设备光功率信息
-
-        接口: /imcrs/epon/onu/onuLightWaneInfo?mac={mac}
-        响应 JSON 字段：powerIn(接收光功率), powerOut(发送光功率),
-                       bindMac, devId, eponDevName, oltIfName, onuIfDesc
-
-        Args:
-            mac: MAC 地址，格式如 "1484-7790-4840"
-
-        Returns:
-            dict: {
-                "powerIn": "-18.5",   # dBm，接收光功率
-                "powerOut": "2.3",    # dBm，发送光功率
-                "bindMac": "...",
-                "devId": ...,
-                "eponDevName": "...",
-                "oltIfName": "...",
-                "onuIfDesc": "..."
-            }
-            或 None（失败时）
-        """
-        max_retries = 1
-        for retry in range(max_retries + 1):
-            try:
-                uri = f"/imcrs/epon/onu/onuLightWaneInfo?mac={mac}"
-                auth = self._get_digest_auth_header("GET", uri)
-                if not auth:
-                    logger.error("生成认证头失败，无法获取光功率")
-                    return None
-
-                headers = {
-                    "Accept": "application/json",
-                    "Content-Type": "application/json",
-                    "Authorization": auth,
-                }
-
-                logger.info(f"获取光功率: {self.base_url}{uri}")
-                resp = self.session.get(
-                    f"{self.base_url}{uri}",
-                    headers=headers,
-                    verify=self.verify_ssl,
-                    timeout=(self.connect_timeout, self.read_timeout),
-                )
-                logger.info(f"光功率API响应状态码: {resp.status_code}")
-
-                if resp.status_code == 200:
-                    try:
-                        data = resp.json()
-                        logger.info(
-                            f"光功率响应: {json.dumps(data, ensure_ascii=False)}"
-                        )
-                        return {
-                            "powerIn": data.get("powerIn"),
-                            "powerOut": data.get("powerOut"),
-                            "bindMac": data.get("bindMac"),
-                            "devId": data.get("devId"),
-                            "eponDevName": data.get("eponDevName"),
-                            "oltIfName": data.get("oltIfName"),
-                            "onuIfDesc": data.get("onuIfDesc"),
-                        }
-                    except json.JSONDecodeError as e:
-                        logger.error(f"解析光功率 JSON 失败: {e}, 内容: {resp.text}")
-
-                elif resp.status_code == 401:
-                    self._clear_auth()
-                    continue
-                else:
-                    logger.error(
-                        f"光功率API请求失败, 状态码: {resp.status_code}, "
-                        f"内容: {resp.text}"
-                    )
-                break  # 非401不重试
-
-            except TimeoutError:
-                logger.error("获取光功率超时")
-                raise
-            except requests.Timeout:
-                logger.error("光功率接口请求超时")
-                raise TimeoutError("iMC 光功率接口请求超时，请稍后重试")
-            except Exception as e:
-                logger.error(f"获取光功率异常: {e}")
-                if retry < max_retries:
-                    time.sleep(3)
-                    continue
-        return None
-```
-
-### 4.4 Schema — `backend/app/schemas/device.py`
-
-添加重启和光功率的响应模型：
-
-```python
-class RebootResponse(BaseModel):
-    success: bool
-    message: str
-
-
-class OpticalPowerResponse(BaseModel):
-    power_in: Optional[str] = None      # 接收光功率 (dBm)
-    power_out: Optional[str] = None     # 发送光功率 (dBm)
-    bind_mac: Optional[str] = None
-    dev_id: Optional[int] = None
-    epon_dev_name: Optional[str] = None
-    olt_if_name: Optional[str] = None
-    onu_if_desc: Optional[str] = None
-```
-
-### 4.5 API 路由 — `backend/app/api/v1/devices.py`
-
-在文件顶部导入新 Schema：
-
-```python
-from app.schemas.device import (
-    DeviceListResponse,
-    ONUDeviceResponse,
-    RebootResponse,
-    OpticalPowerResponse,
-)
-```
-
-在文件末尾添加两个新端点：
-
-```python
-# ═══════════════════════════════════════════════
-# 重启 ONU
-# ═══════════════════════════════════════════════
-
-@router.post("/{device_id}/reboot", response_model=RebootResponse)
-def reboot_device(
-    device_id: int,
-    db: Session = Depends(get_db),
-    current: dict = Depends(require_permission('device.check')),
-):
-    """
-    远程重启 ONU 设备（通过 iMC REST API）
-
-    权限要求：device.check
-    区域/学校管理员只能操作自己范围内的设备。
-    """
-    device = db.query(ONUDevice).filter(ONUDevice.id == device_id).first()
-    if not device:
-        raise HTTPException(status_code=404, detail="设备不存在")
-
-    # 数据范围权限过滤
-    role = current.get('role', 'user')
-    if role == 'area_admin':
-        assigned = current.get('assigned_area') or ''
-        areas = [a.strip() for a in assigned.split(',') if a.strip()]
-        if device.region not in areas:
-            raise HTTPException(status_code=403, detail="无权限操作此区域的设备")
-    elif role == 'school_admin':
-        assigned = current.get('assigned_school') or ''
-        schools = [s.strip() for s in assigned.split(',') if s.strip()]
-        if device.school_name not in schools:
-            raise HTTPException(status_code=403, detail="无权限操作此学校的设备")
-
-    try:
-        from app.services.imc_service import IMCService
-        service = IMCService()
-        mac = device.mac_address
-        result = service.reboot_onu(mac)
-        return RebootResponse(**result)
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"重启失败: {str(e)}")
-
-
-# ═══════════════════════════════════════════════
-# 获取光功率
-# ═══════════════════════════════════════════════
-
-@router.get("/{device_id}/optical-power", response_model=OpticalPowerResponse)
-def get_device_optical_power(
-    device_id: int,
-    db: Session = Depends(get_db),
-    current: dict = Depends(require_permission('device.view')),
-):
-    """
-    获取 ONU 设备光功率信息（通过 iMC REST API）
-
-    返回接收光功率(power_in)和发送光功率(power_out)，单位 dBm。
-    权限要求：device.view（只读操作）
-    """
-    device = db.query(ONUDevice).filter(ONUDevice.id == device_id).first()
-    if not device:
-        raise HTTPException(status_code=404, detail="设备不存在")
-
-    # 数据范围权限过滤（同上）
-    role = current.get('role', 'user')
-    if role == 'area_admin':
-        assigned = current.get('assigned_area') or ''
-        areas = [a.strip() for a in assigned.split(',') if a.strip()]
-        if device.region not in areas:
-            raise HTTPException(status_code=403, detail="无权限操作此区域的设备")
-    elif role == 'school_admin':
-        assigned = current.get('assigned_school') or ''
-        schools = [s.strip() for s in assigned.split(',') if s.strip()]
-        if device.school_name not in schools:
-            raise HTTPException(status_code=403, detail="无权限操作此学校的设备")
-
-    try:
-        from app.services.imc_service import IMCService
-        service = IMCService()
-        mac = device.mac_address
-        result = service.get_optical_power(mac)
-        if result is None:
-            raise HTTPException(status_code=502, detail="获取光功率失败，iMC 接口无响应")
-
-        # 字段名转换：下划线转驼峰前先映射
-        from app.schemas.device import OpticalPowerResponse
-        return OpticalPowerResponse(
-            power_in=result.get("powerIn"),
-            power_out=result.get("powerOut"),
-            bind_mac=result.get("bindMac"),
-            dev_id=result.get("devId"),
-            epon_dev_name=result.get("eponDevName"),
-            olt_if_name=result.get("oltIfName"),
-            onu_if_desc=result.get("onuIfDesc"),
-        )
-    except HTTPException:
-        raise
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"获取光功率失败: {str(e)}")
-```
-
-### 4.6 注册 Service — `backend/app/services/__init__.py`
-
-```python
-from .imc_service import IMCService
-
-__all__ = ["IMCService"]
-```
-
----
-
-## 5. 关键陷阱与注意事项
-
-### ⚠️ Digest 认证的 nonce 过期问题
-
-iMC 的 nonce 有有效期（通常 5-10 分钟）。过期后服务器返回 **401**。
-- 代码中 `_clear_auth()` 清空 nonce，下次请求自动重新握手
-- 重启和光功率方法都在 for 循环中捕获 401 并 `continue` 重试
-
-### ⚠️ MAC 地址格式
-
-iMC REST API 要求 MAC 地址格式为 **1484-7790-4840**（连字符分隔，大写十六进制）。
-如果数据库存储格式不同，需要做格式转换：
-
-```python
-def normalize_mac(mac: str) -> str:
-    """标准化 MAC 为 iMC 要求的格式：1484-7790-4840"""
-    clean = mac.replace(':', '').replace('-', '').replace('.', '').upper()
-    return f"{clean[0:4]}-{clean[4:8]}-{clean[8:12]}"
-```
-
-### ⚠️ 重启接口需要 Content-Length: 0
-
-即使请求体为空，也必须显式设置 `Content-Length: 0` 头，否则 iMC 会报错。
-
-### ⚠️ 光功率接口返回空数据的情况
-
-当 ONU 离线或光模块故障时，iMC 返回的 `powerIn` / `powerOut` 可能是 `" --"`（两个空格+两个横线）或 `None`。前端需做占位符处理。
-
-### ⚠️ 重启操作较慢
-
-从发起请求到设备实际重启完成约需 **30-60 秒**（取决于 SNMP 响应）。建议：
-- 前端按钮显示 loading 状态
-- 后端设置合理超时（connect=5s, read=20s）
-- 不要在短时间内对同一设备重复操作
-
-### ⚠️ 并发控制
-
-建议对重启操作添加简单的并发控制，避免同一设备被多次重启：
-
-```python
-import threading
-
-_reboot_locks = {}
-_reboot_lock = threading.Lock()
-
-def reboot_onu(self, mac):
-    with _reboot_lock:
-        if mac not in _reboot_locks:
-            _reboot_locks[mac] = threading.Lock()
-    lock = _reboot_locks[mac]
-
-    if not lock.acquire(blocking=False):
-        return {"success": False, "message": "该设备正在重启中，请稍后"}
-    try:
-        # ... 重启逻辑 ...
-    finally:
-        lock.release()
-```
-
-### ⚠️ Docker 部署注意
-
-- 在 `docker-compose.yml` 的 `backend` 服务中新增环境变量：
-  ```yaml
-  environment:
-    - IMC_API_URL=https://172.16.1.252:8443
-    - IMC_API_USERNAME=admin
-    - IMC_API_PASSWORD=Pwd@12345
-    - IMC_API_VERIFY_SSL=false
-  ```
-- `backend` 和 `celery-worker` 容器都需要这些变量
-- 修改后必须重新构建镜像：
-  ```bash
-  docker compose build --no-cache backend
-  docker compose rm -f backend && docker compose up -d backend
-  ```
-
----
-
-## 6. 测试验证
-
-### 手动测试
-
-```bash
-# 1. 重启设备
-curl -X POST "http://localhost:8000/api/devices/1/reboot" \
-  -H "Authorization: Bearer <token>"
-
-# 2. 获取光功率
-curl "http://localhost:8000/api/devices/1/optical-power" \
-  -H "Authorization: Bearer <token>"
-
-# 3. 查看后端日志
-docker compose logs backend | grep IMCService
-
-# 4. 直接测试 iMC API（验证认证是否工作）
-curl -k -v "https://172.16.1.252:8443/imcrs/epon/onu/onuLightWaneInfo?mac=1484-7790-4840"
-```
-
-### 测试响应示例
-
-**重启成功：**
-```json
-{"success": true, "message": "设备正在重启，请稍后..."}
-```
-
-**重启失败（ONU不存在）：**
-```json
-{"success": false, "message": "重启失败: ONU不存在"}
-```
-
-**光功率获取成功：**
-```json
-{
-  "power_in": "-18.5",
-  "power_out": "2.3",
-  "bind_mac": "1484-7790-4840",
-  "dev_id": 123,
-  "epon_dev_name": "OLT-1-1",
-  "olt_if_name": "1/0/2",
-  "onu_if_desc": "ONU-学校A"
-}
-```
-
-**光功率获取失败（设备离线）：**
-```json
-{
-  "power_in": null,
-  "power_out": null,
-  "bind_mac": null,
-  "dev_id": null,
-  "epon_dev_name": null,
-  "olt_if_name": null,
-  "onu_if_desc": null
-}
-```
-
----
-
-## 7. 完整调用时序图
-
-```
-客户端                         后端 FastAPI                      iMC 平台
- │                                │                                │
- │  POST /api/devices/1/reboot    │                                │
- │ ────────────────────────────►  │                                │
- │                                │  ── 查数据库：设备存在？──►     │
- │                                │  ◄── 返回设备信息 ──────────    │
- │                                │  ── 权限检查 ─────────────     │
- │                                │                                │
- │                                │  ── GET /imcrs/epon/onu/reboot │
- │                                │     (无认证，获取 nonce)       │
- │                                │ ────────────────────────────►  │
- │                                │  ◄── 401 + WWW-Authenticate  ──│
- │                                │     nonce=xxx, realm=...       │
- │                                │                                │
- │                                │  ── POST 同 URI + Digest ────► │
- │                                │     Authorization: Digest ...  │
- │                                │  ◄── 200 OK (XML) ────────────│
- │                                │                                │
- │  ◄── {success: true,           │                                │
- │        message: "设备重启中"}   │                                │
- │                                │                                │
- │  ── 或 ──                      │                                │
- │                                │                                │
- │  GET /api/devices/1/optical-power                               │
- │ ────────────────────────────►  │                                │
- │                                │  ── 查 + 权限 (同上) ────      │
- │                                │                                │
- │                                │  ── GET /imcrs/epon/onu/       │
- │                                │     onuLightWaneInfo?mac=...   │
- │                                │     (+ Digest Auth)            │
- │                                │ ────────────────────────────►  │
- │                                │  ◄── 200 OK (JSON) ───────────│
- │                                │     {powerIn, powerOut, ...}   │
- │                                │                                │
- │  ◄── {power_in: "-18.5",       │                                │
- │        power_out: "2.3", ...}  │                                │
-```
-
----
-
-## 附录：源项目参考文件位置
-
-| 内容 | 路径 |
-|------|------|
-| IMCService 完整实现 | `/home/v6ole/pyproject/H3ConuMS/app/services/imc_service.py` |
-| 重启控制器 | `/home/v6ole/pyproject/H3ConuMS/app/controllers/device.py` (第1059行) |
-| 优化版控制器 | `/home/v6ole/pyproject/H3ConuMS/app/controllers/optimized_device.py` (第157行) |
-| iMC 配置项 | `/home/v6ole/pyproject/H3ConuMS/app/config.py` (第61-67行) |

run_celery.py

@@ -1,28 +0,0 @@
-#!/usr/bin/env python
-import sys
-import os
-
-# 切换到项目根目录
-os.chdir('/home/v6ole/pyproject/H3ConuMS2')
-
-# 设置 PYTHONPATH
-sys.path.insert(0, '/home/v6ole/pyproject/H3ConuMS2/backend')
-
-# 设置环境变量
-os.environ['SECRET_KEY'] = 'your-secret-key-change-this'
-os.environ['DATABASE_URL'] = 'postgresql://H3C_onu_ms:nEHBFFpBsJfiZp3N@10.10.10.14:5432/H3C_onu_ms'
-os.environ['REDIS_URL'] = 'redis://:redis_c4FFJQ@10.10.10.14:6379'
-os.environ['CASDOOR_ENDPOINT'] = 'https://casdoor.dhdx.fun'
-os.environ['CASDOOR_CLIENT_ID'] = '2289912424bcea5f9859'
-os.environ['CASDOOR_CLIENT_SECRET'] = 'cfa97de106762c8293901a8daef11e04f1b10043'
-os.environ['CASDOOR_REDIRECT_URL'] = 'http://10.10.10.14:5173/callback'
-os.environ['CASDOOR_ORG_NAME'] = 'dahua'
-os.environ['CASDOOR_APP_NAME'] = 'H3ConuMS'
-os.environ['CASDOOR_CERTIFICATE'] = 'token_jwt_key.pem'
-
-# 加载 celery app
-from celery_worker import celery_app
-
-# 运行 worker
-if __name__ == '__main__':
-    celery_app.worker_main(['worker', '--loglevel=info'])

setup.sh

@@ -1,31 +0,0 @@
-#!/bin/bash
-# 快速启动脚本
-
-echo "=== H3C ONU 设备管理系统 ==="
-echo ""
-
-# 检查虚拟环境
-if [ ! -d "backend/venv" ]; then
-    echo "创建虚拟环境..."
-    cd backend && python3 -m venv venv && cd ..
-fi
-
-# 激活虚拟环境
-source backend/venv/bin/activate
-
-# 检查依赖
-if ! python -c "import fastapi" 2>/dev/null; then
-    echo "安装依赖..."
-    pip install -r backend/requirements.txt
-fi
-
-# 初始化数据库
-echo "初始化数据库..."
-python backend/scripts/init_db.py
-
-echo ""
-echo "✅ 初始化完成！"
-echo ""
-echo "启动服务："
-echo "  后端: cd backend && uvicorn app.main:app --reload"
-echo "  前端: cd frontend && npm run dev"

skills-lock.json

@@ -1,10 +0,0 @@
-{
-  "version": 1,
-  "skills": {
-    "frontend-design": {
-      "source": "anthropics/skills",
-      "sourceType": "github",
-      "computedHash": "063a0e6448123cd359ad0044cc46b0e490cc7964d45ef4bb9fd842bd2ffbca67"
-    }
-  }
-}

skills/frontend-design

@@ -1 +0,0 @@
-../.agents/skills/frontend-design

start-backend.sh

@@ -1,8 +0,0 @@
-#!/bin/bash
-# 启动开发环境
-
-echo "启动后端服务..."
-cd backend
-source venv/bin/activate 2>/dev/null || python -m venv venv && source venv/bin/activate
-pip install -r requirements.txt
-uvicorn app.main:app --reload --host 0.0.0.0 --port 8000

start-celery.sh

@@ -1,18 +0,0 @@
-#!/bin/bash
-cd /home/v6ole/pyproject/H3ConuMS2
-
-export PYTHONPATH=/home/v6ole/pyproject/H3ConuMS2/backend
-
-# 设置环境变量
-export SECRET_KEY="your-secret-key-change-this"
-export DATABASE_URL="postgresql://H3C_onu_ms:nEHBFFpBsJfiZp3N@10.10.10.14:5432/H3C_onu_ms"
-export REDIS_URL="redis://:redis_c4FFJQ@10.10.10.14:6379"
-export CASDOOR_ENDPOINT="https://casdoor.dhdx.fun"
-export CASDOOR_CLIENT_ID="2289912424bcea5f9859"
-export CASDOOR_CLIENT_SECRET="cfa97de106762c8293901a8daef11e04f1b10043"
-export CASDOOR_REDIRECT_URL="http://10.10.10.14:5173/callback"
-export CASDOOR_ORG_NAME="dahua"
-export CASDOOR_APP_NAME="H3ConuMS"
-export CASDOOR_CERTIFICATE="token_jwt_key.pem"
-
-exec /home/v6ole/pyproject/H3ConuMS2/backend/venv/bin/celery -A celery_worker.celery worker --loglevel=info

start-frontend.sh

@@ -1,7 +0,0 @@
-#!/bin/bash
-# 启动前端服务
-
-echo "启动前端服务..."
-cd frontend
-npm install
-npm run dev