feat: add scoped cookie operations for support

web/backend/permissions.py

@@ -23,6 +23,7 @@ PERMISSIONS = {
     "login:view_assigned": "查看自己账号的登录任务",
     # Cookie
     "cookie:view": "查看 Cookie",
+    "cookie:operate": "检测/重登已分配账号 Cookie（不含查看）",
     "cookie:export": "导出 Cookie",
     # 斗鱼活动
     "douyu:task": "斗鱼任务管理",
@@ -88,6 +89,7 @@ ROLE_PERMISSIONS = {
     ],
     "support": [
         "account:view_assigned",
+        "cookie:operate",
         "douyu:task",
         "yyb:session",
         "yyb:history",

web/backend/routers/cookies.py

@@ -12,7 +12,7 @@ import io
 import csv
 
 from ..database import get_db, SessionLocal
-from ..models import User, LoginTask, Account, ProxyConfig as ProxyConfigModel
+from ..models import User, LoginTask, Account, AuditLog, ProxyConfig as ProxyConfigModel
 from ..deps import get_current_user, require_permission
 from ..permissions import user_has_permission, get_user_permissions
 from ..schemas import CookieReloginRequest
@@ -30,6 +30,15 @@ def _fmt_dt(dt) -> str | None:
 router = APIRouter(prefix="/api/cookies", tags=["Cookie管理"])
 
 
+def _require_cookie_operation_perm(current: User) -> None:
+    """允许脱敏的 CK 检测与重登，不授予 CK 查看或导出能力。"""
+    if not (
+        user_has_permission(current, "cookie:operate")
+        or user_has_permission(current, "cookie:view")
+    ):
+        raise HTTPException(status_code=403, detail="无权限: cookie:operate")
+
+
 def _parse_account_names(raw_names: str) -> list[str]:
     """解析前端粘贴的 Excel 账号名，每行一个并去重。"""
     names = []
@@ -162,6 +171,8 @@ def list_cookies(
     current: User = Depends(get_current_user),
 ):
     """查看登录成功的 Cookie 列表。"""
+    if not user_has_permission(current, "cookie:view"):
+        raise HTTPException(status_code=403, detail="无权限: cookie:view")
     if not include_cookie:
         query = _visible_cookie_tasks_query(db, current).options(defer(LoginTask.cookie))
     else:
@@ -248,6 +259,8 @@ def cookies_summary(
     current: User = Depends(get_current_user),
 ):
     """Cookie 管理统计，避免前端为了卡片统计拉全量 Cookie。"""
+    if not user_has_permission(current, "cookie:view"):
+        raise HTTPException(status_code=403, detail="无权限: cookie:view")
     query = _visible_cookie_tasks_query(db, current)
     if user_has_permission(current, "login:view_all"):
         query = query.join(Account, LoginTask.account_id == Account.id)
@@ -260,6 +273,47 @@ def cookies_summary(
     }
 
 
+@router.get("/operations")
+def list_cookie_operations(
+    search: str = Query(""),
+    page: int = Query(1, ge=1),
+    page_size: int = Query(20, ge=1, le=200),
+    db: Session = Depends(get_db),
+    current: User = Depends(get_current_user),
+):
+    """脱敏的 CK 操作列表，只用于检测与重登。"""
+    _require_cookie_operation_perm(current)
+    query = _visible_cookie_tasks_query(db, current)
+    if user_has_permission(current, "login:view_all"):
+        query = query.join(Account, LoginTask.account_id == Account.id)
+    search_text = (search or "").strip()
+    if search_text:
+        query = query.filter(Account.username.ilike(f"%{search_text}%"))
+
+    total = query.order_by(None).count()
+    tasks = (
+        query.order_by(LoginTask.finished_at.desc(), LoginTask.id.desc())
+        .offset((page - 1) * page_size)
+        .limit(page_size)
+        .all()
+    )
+    return {
+        "items": [
+            {
+                "id": task.id,
+                "account_username": task.account.username if task.account else "",
+                "ck_check_status": task.ck_check_status or "",
+                "ck_checked_at": _fmt_dt(task.ck_checked_at),
+                "created_at": _fmt_dt(task.finished_at),
+            }
+            for task in tasks
+        ],
+        "total": total,
+        "page": page,
+        "page_size": page_size,
+    }
+
+
 @router.get("/duplicates")
 def find_duplicate_cookies(
     db: Session = Depends(get_db),
@@ -390,13 +444,8 @@ def export_cookies(
     )
 
 
-@router.post("/check")
-def check_cookies(
-    ids: str = "",
-    db: Session = Depends(get_db),
-    current: User = Depends(get_current_user),
-):
-    """批量检测斗鱼 Cookie 有效性（鱼丸接口），返回每条有效性与鱼丸数/昵称。"""
+def _check_cookies(ids: str, db: Session, current: User, *, detailed: bool) -> dict:
+    """执行 CK 检测；客服操作页仅返回状态，不返回账号衍生信息。"""
     if not ids:
         raise HTTPException(status_code=400, detail="请指定记录ID")
     id_list = [int(x) for x in ids.split(",") if x.strip().isdigit()]
@@ -439,16 +488,48 @@ def check_cookies(
             "message": item.get("message", ""),
         }
         task.ck_checked_at = datetime.now(timezone.utc)
+    db.add(AuditLog(
+        user_id=current.id,
+        username=current.username,
+        action="cookie:check",
+        target=f"检测 {len(results)} 条已分配账号 CK",
+    ))
     db.commit()
-
+    if not detailed:
+        results = [
+            {"id": item["id"], "valid": item["valid"], "checked_at": item["checked_at"]}
+            for item in results
+        ]
     return {"results": results, "success": True}
 
 
-@router.post("/relogin")
-def relogin_cookies(
-    req: CookieReloginRequest,
+@router.post("/check")
+def check_cookies(
+    ids: str = "",
     db: Session = Depends(get_db),
-    current: User = Depends(require_permission("login:batch")),
+    current: User = Depends(get_current_user),
+):
+    """批量检测斗鱼 Cookie 有效性，供 Cookie 管理页查看详细结果。"""
+    if not user_has_permission(current, "cookie:view"):
+        raise HTTPException(status_code=403, detail="无权限: cookie:view")
+    return _check_cookies(ids, db, current, detailed=True)
+
+
+@router.post("/operations/check")
+def check_cookie_operations(
+    ids: str = "",
+    db: Session = Depends(get_db),
+    current: User = Depends(get_current_user),
+):
+    """脱敏 CK 检测，只返回有效性与检测时间。"""
+    _require_cookie_operation_perm(current)
+    return _check_cookies(ids, db, current, detailed=False)
+
+
+def _start_relogin(
+    req: CookieReloginRequest,
+    db: Session,
+    current: User,
 ):
     """重新登录失效的 Cookie：用账号信息重新登录，成功后替换旧 Cookie。
 
@@ -498,6 +579,13 @@ def relogin_cookies(
     thread = threading.Thread(target=runner.run, daemon=True)
     thread.start()
 
+    db.add(AuditLog(
+        user_id=current.id,
+        username=current.username,
+        action="cookie:relogin",
+        target=f"重登 {len(task_ids)} 条已分配账号 CK",
+    ))
+    db.commit()
     return {
         "batch_id": batch_id,
         "count": len(task_ids),
@@ -506,6 +594,27 @@ def relogin_cookies(
     }
 
 
+@router.post("/relogin")
+def relogin_cookies(
+    req: CookieReloginRequest,
+    db: Session = Depends(get_db),
+    current: User = Depends(require_permission("login:batch")),
+):
+    """Cookie 管理页的重登入口，保留既有 login:batch 权限。"""
+    return _start_relogin(req, db, current)
+
+
+@router.post("/operations/relogin")
+def relogin_cookie_operations(
+    req: CookieReloginRequest,
+    db: Session = Depends(get_db),
+    current: User = Depends(get_current_user),
+):
+    """脱敏 CK 操作页的重登入口。"""
+    _require_cookie_operation_perm(current)
+    return _start_relogin(req, db, current)
+
+
 @router.get("/{task_id}")
 def get_cookie(
     task_id: int,
@@ -513,6 +622,8 @@ def get_cookie(
     current: User = Depends(get_current_user),
 ):
     """获取单条 Cookie 详情，供复制操作按需读取完整敏感字段。"""
+    if not user_has_permission(current, "cookie:view"):
+        raise HTTPException(status_code=403, detail="无权限: cookie:view")
     task = _visible_cookie_tasks_query(db, current).filter(LoginTask.id == task_id).first()
     if not task:
         raise HTTPException(status_code=404, detail="记录不存在")

web/frontend/src/App.tsx

@@ -17,6 +17,7 @@ const LoginTasksPage = lazy(() => import('./pages/LoginTasksPage'));
 const ProxyPage = lazy(() => import('./pages/ProxyPage'));
 const UsersPage = lazy(() => import('./pages/UsersPage'));
 const CookiePage = lazy(() => import('./pages/CookiePage'));
+const CookieOperationsPage = lazy(() => import('./pages/CookieOperationsPage'));
 const DouyuTasksPage = lazy(() => import('./pages/DouyuTasksPage'));
 const HuyaAccountsPage = lazy(() => import('./pages/HuyaAccountsPage'));
 const HuyaAssignmentsPage = lazy(() => import('./pages/HuyaAssignmentsPage'));
@@ -79,6 +80,7 @@ function AppContent() {
               <Route path="assignments" element={lazyRoute(<AssignmentsPage />)} />
               <Route path="login-tasks" element={lazyRoute(<LoginTasksPage />)} />
               <Route path="cookies" element={lazyRoute(<CookiePage />)} />
+              <Route path="cookie-operations" element={lazyRoute(<CookieOperationsPage />)} />
               <Route path="douyu/tasks" element={<Navigate to="/douyu/elite" replace />} />
               <Route path="douyu/elite" element={lazyRoute(<DouyuTasksPage key="elite" handbook="elite" />)} />
               <Route path="douyu/esports" element={lazyRoute(<DouyuTasksPage key="esports" handbook="esports" />)} />

web/frontend/src/api/cookies.ts

@@ -1,11 +1,13 @@
 import api from './client';
-import type { BasicSummary, CookieCheckResult, CookieDuplicateResponse, CookieItem, LoginTaskItem, PageParams, PaginatedResponse, MessageDeletedResponse, MessageResponse } from './types';
+import type { BasicSummary, CookieCheckResult, CookieDuplicateResponse, CookieItem, CookieOperationCheckResult, CookieOperationItem, LoginTaskItem, PageParams, PaginatedResponse, MessageDeletedResponse, MessageResponse } from './types';
 
 export const cookieApi = {
   list: () => api.get<CookieItem[], CookieItem[]>('/cookies'),
   listPaged: (params: PageParams & { include_cookie?: boolean; account_names?: string }) =>
     api.get<PaginatedResponse<CookieItem>, PaginatedResponse<CookieItem>>('/cookies', { params }),
   summary: () => api.get<BasicSummary, BasicSummary>('/cookies/summary'),
+  listOperations: (params: PageParams) =>
+    api.get<PaginatedResponse<CookieOperationItem>, PaginatedResponse<CookieOperationItem>>('/cookies/operations', { params }),
   duplicates: () => api.get<CookieDuplicateResponse, CookieDuplicateResponse>('/cookies/duplicates'),
   get: (id: number) => api.get<CookieItem, CookieItem>(`/cookies/${id}`),
   exportCsv: (format?: string, accountNames?: string) => api.get<Blob, Blob>('/cookies/export', {
@@ -17,8 +19,12 @@ export const cookieApi = {
   }),
   check: (ids: number[]) =>
     api.post<{ results: CookieCheckResult[] }, { results: CookieCheckResult[] }>('/cookies/check', null, { params: { ids: ids.join(',') } }),
+  checkOperations: (ids: number[]) =>
+    api.post<{ results: CookieOperationCheckResult[] }, { results: CookieOperationCheckResult[] }>('/cookies/operations/check', null, { params: { ids: ids.join(',') } }),
   relogin: (ids: number[]) =>
     api.post<{ batch_id: string; count: number; skipped: number; success: boolean }, { batch_id: string; count: number; skipped: number; success: boolean }>('/cookies/relogin', { ids }),
+  reloginOperations: (ids: number[]) =>
+    api.post<{ batch_id: string; count: number; skipped: number; success: boolean }, { batch_id: string; count: number; skipped: number; success: boolean }>('/cookies/operations/relogin', { ids }),
   loginTasks: (batchId: string) =>
     api.get<LoginTaskItem[], LoginTaskItem[]>('/login/tasks', { params: { batch_id: batchId } }),
   delete: (id: number) => api.delete<MessageResponse, MessageResponse>(`/cookies/${id}`),

web/frontend/src/api/types.ts

@@ -253,6 +253,20 @@ export interface CookieItem {
   ck_checked_at: string | null;
 }
 
+export interface CookieOperationItem {
+  id: number;
+  account_username: string;
+  ck_check_status: string;
+  ck_checked_at: string | null;
+  created_at: string | null;
+}
+
+export interface CookieOperationCheckResult {
+  id: number;
+  valid: boolean;
+  checked_at: string;
+}
+
 export interface CookieCheckResult {
   id: number;
   valid: boolean;

web/frontend/src/layouts/MainLayout.tsx

@@ -71,6 +71,9 @@ export default function MainLayout({ onLogout }: { onLogout?: () => void }) {
   if (can('cookie:view')) {
     douyuItems.push({ key: '/cookies', label: 'Cookie 管理', icon: <KeyOutlined /> });
   }
+  if (can('cookie:operate')) {
+    douyuItems.push({ key: '/cookie-operations', label: 'CK 检测与重登', icon: <SafetyCertificateOutlined /> });
+  }
   if (can('douyu:task')) {
     douyuItems.push({ key: '/douyu/elite', label: '精英宝典', icon: <BookOutlined /> });
     douyuItems.push({ key: '/douyu/esports', label: '电竞手册', icon: <TrophyOutlined /> });

web/frontend/src/pages/CookieOperationsPage.tsx

@@ -0,0 +1,207 @@
+import { useCallback, useEffect, useState } from 'react';
+import { Button, Input, Popconfirm, Space, Table, Tag, Typography } from 'antd';
+import { message } from '../utils/antdMessage';
+import { LoadingOutlined, ReloadOutlined, SearchOutlined } from '@ant-design/icons';
+import { cookieApi, type CookieOperationCheckResult, type CookieOperationItem } from '../api/modules';
+import { formatTime } from '../utils/time';
+import { getErrorMessage } from '../utils/error';
+
+const { Text } = Typography;
+
+export default function CookieOperationsPage() {
+  const [items, setItems] = useState<CookieOperationItem[]>([]);
+  const [loading, setLoading] = useState(false);
+  const [search, setSearch] = useState('');
+  const [selectedRowKeys, setSelectedRowKeys] = useState<React.Key[]>([]);
+  const [checkingIds, setCheckingIds] = useState<Set<number>>(new Set());
+  const [reloginIds, setReloginIds] = useState<Set<number>>(new Set());
+  const [checkResults, setCheckResults] = useState<Map<number, CookieOperationCheckResult>>(new Map());
+  const [total, setTotal] = useState(0);
+  const [pageSize, setPageSize] = useState(() => {
+    const value = localStorage.getItem('cookie_operations_page_size');
+    return value ? Number(value) || 20 : 20;
+  });
+  const [currentPage, setCurrentPage] = useState(1);
+
+  const loadItems = useCallback(async () => {
+    setLoading(true);
+    try {
+      const data = await cookieApi.listOperations({
+        page: currentPage,
+        page_size: pageSize,
+        search: search.trim() || undefined,
+      });
+      setItems(data.items);
+      setTotal(data.total);
+      setCheckResults((previous) => {
+        const next = new Map(previous);
+        for (const item of data.items) {
+          if (!item.ck_check_status) continue;
+          next.set(item.id, {
+            id: item.id,
+            valid: item.ck_check_status === 'valid',
+            checked_at: item.ck_checked_at ?? '',
+          });
+        }
+        return next;
+      });
+    } catch (error: unknown) {
+      message.error(getErrorMessage(error));
+    } finally {
+      setLoading(false);
+    }
+  }, [currentPage, pageSize, search]);
+
+  useEffect(() => {
+    void loadItems();
+  }, [loadItems]);
+
+  const handleCheck = async (ids: number[]) => {
+    if (ids.length === 0) return;
+    setCheckingIds((previous) => new Set([...previous, ...ids]));
+    try {
+      const response = await cookieApi.checkOperations(ids);
+      setCheckResults((previous) => {
+        const next = new Map(previous);
+        response.results.forEach((item) => next.set(item.id, item));
+        return next;
+      });
+      message.success(`检测完成：${response.results.filter((item) => item.valid).length}/${response.results.length} 条有效`);
+      void loadItems();
+    } catch (error: unknown) {
+      message.error(getErrorMessage(error));
+    } finally {
+      setCheckingIds((previous) => {
+        const next = new Set(previous);
+        ids.forEach((id) => next.delete(id));
+        return next;
+      });
+    }
+  };
+
+  const handleRelogin = async (ids: number[]) => {
+    if (ids.length === 0) return;
+    setReloginIds((previous) => new Set([...previous, ...ids]));
+    try {
+      const response = await cookieApi.reloginOperations(ids);
+      const skipped = response.skipped ? `，${response.skipped} 条因缺少登录凭据跳过` : '';
+      message.success(`已开始重登 ${response.count} 个账号${skipped}`);
+      setSelectedRowKeys([]);
+      window.setTimeout(() => void loadItems(), 1000);
+    } catch (error: unknown) {
+      message.error(getErrorMessage(error));
+    } finally {
+      setReloginIds((previous) => {
+        const next = new Set(previous);
+        ids.forEach((id) => next.delete(id));
+        return next;
+      });
+    }
+  };
+
+  const resultFor = (item: CookieOperationItem) => checkResults.get(item.id);
+  const selectedIds = selectedRowKeys.map((key) => Number(key));
+  const columns = [
+    { title: '账号', dataIndex: 'account_username', ellipsis: true },
+    {
+      title: '有效性',
+      width: 110,
+      render: (_: unknown, item: CookieOperationItem) => {
+        if (checkingIds.has(item.id)) return <Tag color="processing" icon={<LoadingOutlined />}>检测中</Tag>;
+        const result = resultFor(item);
+        if (!result) return <Text type="secondary">未检测</Text>;
+        return <Tag color={result.valid ? 'success' : 'error'}>{result.valid ? '有效' : '无效'}</Tag>;
+      },
+    },
+    {
+      title: '检测时间',
+      width: 180,
+      render: (_: unknown, item: CookieOperationItem) => {
+        const checkedAt = resultFor(item)?.checked_at || item.ck_checked_at;
+        return checkedAt ? formatTime(checkedAt) : <Text type="secondary">-</Text>;
+      },
+    },
+    {
+      title: '操作',
+      width: 190,
+      render: (_: unknown, item: CookieOperationItem) => (
+        <Space size={4}>
+          <Button
+            size="small"
+            loading={checkingIds.has(item.id)}
+            disabled={checkingIds.has(item.id)}
+            onClick={() => void handleCheck([item.id])}
+          >
+            检测
+          </Button>
+          <Popconfirm title="将使用已保存的账号信息重新登录并替换 CK，确认继续？" onConfirm={() => void handleRelogin([item.id])}>
+            <Button
+              size="small"
+              icon={<ReloadOutlined />}
+              loading={reloginIds.has(item.id)}
+              disabled={reloginIds.has(item.id)}
+            >
+              重登
+            </Button>
+          </Popconfirm>
+        </Space>
+      ),
+    },
+  ];
+
+  return (
+    <div>
+      <div style={{ marginBottom: 16, display: 'flex', justifyContent: 'space-between', alignItems: 'center', gap: 12 }}>
+        <h2 style={{ margin: 0 }}>CK 检测与重登</h2>
+        <Space wrap>
+          <Button loading={checkingIds.size > 0} disabled={selectedIds.length === 0} onClick={() => void handleCheck(selectedIds)}>
+            检测选中 {selectedIds.length > 0 ? `(${selectedIds.length})` : ''}
+          </Button>
+          <Popconfirm
+            title={`将重新登录选中的 ${selectedIds.length} 个账号并替换 CK，确认继续？`}
+            disabled={selectedIds.length === 0}
+            onConfirm={() => void handleRelogin(selectedIds)}
+          >
+            <Button icon={<ReloadOutlined />} disabled={selectedIds.length === 0}>
+              重登选中 {selectedIds.length > 0 ? `(${selectedIds.length})` : ''}
+            </Button>
+          </Popconfirm>
+        </Space>
+      </div>
+      <Input.Search
+        allowClear
+        prefix={<SearchOutlined />}
+        placeholder="搜索账号"
+        style={{ width: 280, marginBottom: 12 }}
+        value={search}
+        onChange={(event) => {
+          setSearch(event.target.value);
+          setCurrentPage(1);
+          setSelectedRowKeys([]);
+        }}
+      />
+      <Table
+        rowKey="id"
+        size="small"
+        loading={loading}
+        columns={columns}
+        dataSource={items}
+        rowSelection={{ selectedRowKeys, onChange: setSelectedRowKeys, preserveSelectedRowKeys: true }}
+        pagination={{
+          current: currentPage,
+          pageSize,
+          total,
+          showSizeChanger: true,
+          showTotal: (count) => `共 ${count} 条`,
+          onChange: (page, size) => {
+            setCurrentPage(size === pageSize ? page : 1);
+            if (size !== pageSize) {
+              setPageSize(size);
+              localStorage.setItem('cookie_operations_page_size', String(size));
+            }
+          },
+        }}
+      />
+    </div>
+  );
+}