From 351f791f1ac5f1b5944fe376346e1440824030cd Mon Sep 17 00:00:00 2001
From: bot_dev1 <bot_dev1@xayunmei.com>
Date: Wed, 5 Aug 2026 02:07:59 +0000
Subject: [PATCH] =?UTF-8?q?feat(#150):=20=E7=99=BB=E5=BD=95=E9=A1=B5=20log?=
 =?UTF-8?q?in.html=EF=BC=88=E6=B7=B1=E8=89=B2=E4=B8=BB=E9=A2=98=EF=BC=8C?=
 =?UTF-8?q?=E5=AF=B9=E6=8E=A5=20/auth/login=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 web/auth/login.html | 53 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 web/auth/login.html
diff --git a/web/auth/login.html b/web/auth/login.html
new file mode 100644
index 0000000..c4ff7f0
--- /dev/null
+++ b/web/auth/login.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>iAOP 登录</title>
+  <link rel="stylesheet" href="auth.css">
+</head>
+<body>
+  <!--
+    iAOP 登录页（issue #150 / PRD 8.2）。
+    后端：core/auth/auth_api.py（POST /auth/login → token + Set-Cookie）。
+    会话：core/auth/session.py（HMAC token，HttpOnly cookie iaop_session）。
+    写操作守卫：core/auth/auth_api.py require_auth / can_write（未登录/readonly 拒绝写）。
+  -->
+  <form class="auth-card" id="loginForm" autocomplete="on" novalidate>
+    <div class="auth-brand">
+      <div class="auth-logo">iA</div>
+      <h1>云美工业AI优化平台</h1>
+    </div>
+    <div class="auth-sub">Template-Ti 一期 · 配置台登录</div>
+
+    <div class="alert" id="alert" role="alert" aria-live="polite"></div>
+
+    <div class="field">
+      <label for="username">用户名</label>
+      <input id="username" name="username" type="text" required
+             autocomplete="username" placeholder="请输入用户名" maxlength="64">
+    </div>
+    <div class="field">
+      <label for="password">密码</label>
+      <input id="password" name="password" type="password" required
+             autocomplete="current-password" placeholder="请输入密码" minlength="8">
+    </div>
+
+    <div class="auth-actions">
+      <button type="submit" class="btn btn-primary" id="loginBtn">登录</button>
+      <button type="button" class="btn btn-ghost" id="togglePwd" title="显示/隐藏密码" aria-label="显示或隐藏密码">👁</button>
+    </div>
+
+    <div class="role-hint">
+      角色：readonly 只读 / engineer 可配置 / admin 可发布回滚。<br>
+      未登录或只读角色不可执行写操作（PRD 8.2）。
+    </div>
+
+    <div class="auth-foot">
+      认证后端 core/auth · 会话 HttpOnly cookie · 密码 PBKDF2-HMAC-SHA256
+    </div>
+  </form>
+
+  <script src="auth.js"></script>
+</body>
+</html>
