feat(auth): support local username login mode

frontend/src/App.vue

@@ -4,6 +4,7 @@
 
 <script setup lang="ts">
 import { onMounted } from 'vue'
+import { authApi } from '@/api/auth'
 import { getToken } from '@/utils/auth'
 import { redirectToSSO } from '@/utils/sso'
 import { useAuthStore } from '@/stores/auth'
@@ -20,7 +21,12 @@ onMounted(async () => {
     await authStore.refreshUser()
   } catch {
     authStore.clearAuth()
-    redirectToSSO()
+    const { data } = await authApi.getConfig()
+    if (data.sso_enabled) {
+      redirectToSSO()
+    } else {
+      window.location.assign('/login')
+    }
   }
 })
 </script>

frontend/src/api/auth.ts

@@ -3,7 +3,7 @@ import { getToken } from '@/utils/auth'
 
 export interface LoginRequest {
   username: string
-  password: string
+  password?: string
 }
 
 export interface UserInfo {
@@ -20,9 +20,48 @@ export interface LoginResponse {
   user: UserInfo
 }
 
+export interface AuthConfig {
+  sso_enabled: boolean
+}
+
 export const authApi = {
-  login(_data: LoginRequest): Promise<ApiResponse<LoginResponse>> {
-    return Promise.reject(new Error('password login is disabled'))
+  async getConfig(): Promise<ApiResponse<AuthConfig>> {
+    const response = await fetch('/auth/api/v1/config', {
+      headers: {
+        Accept: 'application/json',
+      },
+    })
+    const data = await response.json().catch(() => ({}))
+    if (!response.ok) {
+      throw new Error(data.error || `HTTP ${response.status}`)
+    }
+    return {
+      code: 0,
+      message: 'success',
+      data: {
+        sso_enabled: data.sso_enabled !== false,
+      },
+    }
+  },
+
+  async login(data: LoginRequest): Promise<ApiResponse<LoginResponse>> {
+    const response = await fetch('/auth/api/v1/login', {
+      method: 'POST',
+      headers: {
+        Accept: 'application/json',
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ username: data.username }),
+    })
+    const result = await response.json().catch(() => ({}))
+    if (!response.ok) {
+      throw new Error(result.error || `HTTP ${response.status}`)
+    }
+    return {
+      code: 0,
+      message: 'success',
+      data: result,
+    }
   },
 
   async logout(): Promise<ApiResponse<null>> {

frontend/src/api/request.ts

@@ -61,7 +61,16 @@ request.interceptors.response.use(
 
       if (status === 401) {
         removeToken()
-        redirectToSSO()
+        fetch('/auth/api/v1/config', { headers: { Accept: 'application/json' } })
+          .then((response) => response.json())
+          .then((data) => {
+            if (data.sso_enabled === false) {
+              window.location.assign('/login')
+            } else {
+              redirectToSSO()
+            }
+          })
+          .catch(() => redirectToSSO())
         ElMessage.error(backendMessage || '未授权，请重新登录')
       } else {
         const message = backendMessage || httpMessageMap[status] || `请求失败 (${status})`

frontend/src/router/index.ts

@@ -2,6 +2,7 @@ import { createRouter, createWebHistory } from 'vue-router'
 import { getToken } from '@/utils/auth'
 import { consumeSSOToken, redirectToSSO } from '@/utils/sso'
 import { useAuthStore } from '@/stores/auth'
+import { authApi } from '@/api/auth'
 
 const router = createRouter({
   history: createWebHistory(),
@@ -113,6 +114,10 @@ router.beforeEach(async (to) => {
   const token = authStore.token || getToken()
 
   if (to.meta.requiresAuth !== false && !token) {
+    const { data } = await authApi.getConfig()
+    if (!data.sso_enabled) {
+      return { path: '/login', query: to.fullPath === '/' ? {} : { redirect: to.fullPath } }
+    }
     redirectToSSO()
     return false
   }
@@ -121,6 +126,10 @@ router.beforeEach(async (to) => {
       await authStore.refreshUser()
     } catch {
       authStore.clearAuth()
+      const { data } = await authApi.getConfig()
+      if (!data.sso_enabled) {
+        return { path: '/login', query: to.fullPath === '/' ? {} : { redirect: to.fullPath } }
+      }
       redirectToSSO()
       return false
     }

frontend/src/views/auth/Login.vue

@@ -9,32 +9,83 @@
         <h2>{{ title }}</h2>
         <p>{{ subtitle }}</p>
       </div>
-      <el-button type="primary" size="large" class="login-btn" @click="redirectToSSO('', '/')">
+      <div v-if="!ssoEnabled" class="local-login">
+        <el-input
+          v-model="username"
+          size="large"
+          placeholder="输入用户名"
+          @keyup.enter="handleLocalLogin"
+        />
+      </div>
+      <el-button type="primary" size="large" class="login-btn" :loading="loading" @click="handleLoginClick">
         {{ buttonText }}
       </el-button>
       <div class="login-footer">
-        <p>统一 LDAP 账号，同账号同密码</p>
+        <p>{{ footerText }}</p>
       </div>
     </div>
   </div>
 </template>
 
 <script setup lang="ts">
-import { computed, onMounted } from 'vue'
-import { useRoute } from 'vue-router'
+import { computed, onMounted, ref } from 'vue'
+import { useRoute, useRouter } from 'vue-router'
 import { redirectToSSO } from '@/utils/sso'
+import { useAuth } from '@/composables/useAuth'
+import { authApi } from '@/api/auth'
 
 const route = useRoute()
+const router = useRouter()
+const { login } = useAuth()
+const loading = ref(false)
+const username = ref('')
+const ssoEnabled = ref(true)
 const loggedOut = computed(() => route.query.logged_out === '1')
 const title = computed(() => loggedOut.value ? '已退出登录' : '统一基础设施平台')
-const subtitle = computed(() => loggedOut.value ? '本地登录态已清除' : '正在跳转到 SSO 登录')
-const buttonText = computed(() => loggedOut.value ? '重新登录' : '重新跳转')
+const subtitle = computed(() => {
+  if (!ssoEnabled.value) {
+    return '开发测试模式，输入用户名登录'
+  }
+  return loggedOut.value ? '本地登录态已清除' : '正在跳转到 SSO 登录'
+})
+const buttonText = computed(() => {
+  if (!ssoEnabled.value) {
+    return '登录'
+  }
+  return loggedOut.value ? '重新登录' : '重新跳转'
+})
+const footerText = computed(() => ssoEnabled.value ? '统一 LDAP 账号，同账号同密码' : 'SSO 已关闭，仅用于开发测试')
 
-onMounted(() => {
-  if (!loggedOut.value) {
+onMounted(async () => {
+  const { data } = await authApi.getConfig()
+  ssoEnabled.value = data.sso_enabled
+  if (ssoEnabled.value && !loggedOut.value) {
     redirectToSSO('', '/')
   }
 })
+
+const handleLoginClick = () => {
+  if (ssoEnabled.value) {
+    redirectToSSO('', '/')
+    return
+  }
+  handleLocalLogin()
+}
+
+const handleLocalLogin = async () => {
+  const value = username.value.trim()
+  if (!value) {
+    return
+  }
+  loading.value = true
+  try {
+    await login(value, '')
+    const redirect = typeof route.query.redirect === 'string' ? route.query.redirect : '/'
+    router.replace(redirect)
+  } finally {
+    loading.value = false
+  }
+}
 </script>
 
 <style scoped>
@@ -58,6 +109,10 @@ onMounted(() => {
   width: 100%;
 }
 
+.local-login {
+  margin-bottom: 14px;
+}
+
 .login-header {
   text-align: center;
   margin-bottom: 32px;