新增更多使用者與管理者帳號，調整API呼叫行為，mail內文調整

api.py

@@ -16,7 +16,7 @@ from config import SYSTEM_WEIGHTS, ACTION_MAP, FIXED_TEST_EMAIL
 from plotting import get_plot_data_for_api
 import pandas as pd
 import models  # 使用 models.XXX 存取即時狀態，避免布林值被複製後失效
-from utils import get_geo_level
+from utils import get_geo_level, update_system_weights
 
 api_app = FastAPI(title="數位保鏢 API")
 
@@ -272,8 +272,8 @@ def _run_student_action_helper(ip, c, acc, action_code, tm, ct):
     # 每次請求時檢查超時
     check_session_timeouts(timeout_seconds=300)
     
-    # 檢查用戶當前狀態 (目前統一使用 FIXED_TEST_EMAIL 作為識別)
-    current_status = get_user_status(FIXED_TEST_EMAIL)
+    # 直接以帳戶名稱作為 key 查詢封鎖狀態
+    current_status = get_user_status(acc)
     
     if current_status == "verifying":
         return {
@@ -295,14 +295,12 @@ def _run_student_action_helper(ip, c, acc, action_code, tm, ct):
     }
 
 @api_app.post("/api/student/eval")
-def student_eval(req: StudentActionRequest):
-    default_acc = USER_DB["student"][0]
-    return _run_student_action_helper(req.ip, req.cookie, default_acc, "click_eval_system", req.time_mode, req.custom_time)
+def student_eval(req: StudentActionExtendedRequest):
+    return _run_student_action_helper(req.ip, req.cookie, req.account, "click_eval_system", req.time_mode, req.custom_time)
 
 @api_app.post("/api/student/pre_select")
-def student_pre_select(req: StudentActionRequest):
-    default_acc = USER_DB["student"][0]
-    return _run_student_action_helper(req.ip, req.cookie, default_acc, "click_pre_select_system", req.time_mode, req.custom_time)
+def student_pre_select(req: StudentActionExtendedRequest):
+    return _run_student_action_helper(req.ip, req.cookie, req.account, "click_pre_select_system", req.time_mode, req.custom_time)
 
 @api_app.post("/api/student/leave")
 def student_leave(req: StudentActionExtendedRequest):
@@ -330,8 +328,8 @@ def student_run_action(req: GenericActionRequest):
     # 每次請求時檢查超時
     check_session_timeouts(timeout_seconds=300)
     
-    # 檢查用戶當前狀態
-    current_status = get_user_status(FIXED_TEST_EMAIL)
+    # 直接以帳戶名稱作為 key 查詢封鎖狀態
+    current_status = get_user_status(req.account)
     
     if current_status == "verifying":
         return {
@@ -355,4 +353,53 @@ def student_run_action(req: GenericActionRequest):
             "action": req.action_code,
             "status": val or "success"
         }
-    }
+    }
+
+# --- 使用者管理 API 端點 ---
+class AccountRequest(BaseModel):
+    account: str
+
+@api_app.get("/api/users")
+def get_users_endpoint():
+    """取得所有使用者帳戶清單與其狀態"""
+    users_list = []
+    for acc, info in USER_DB.items():
+        role_en = "admin" if info[1] == "管理" else "student"
+        status = get_user_status(acc)
+        users_list.append({
+            "account": acc,
+            "role": role_en,
+            "role_zh": info[1],
+            "name": info[2],
+            "status": status
+        })
+    return {"status": "success", "data": users_list}
+
+@api_app.post("/api/users/block")
+def block_user_endpoint(req: AccountRequest):
+    """封鎖特定使用者"""
+    acc = req.account.strip()
+    if acc not in USER_DB:
+        return {"status": "error", "message": "帳號不存在"}
+    
+    from auth import session_cache_lock, session_cache
+    with session_cache_lock:
+        if acc not in session_cache:
+            session_cache[acc] = {}
+        session_cache[acc]["status"] = "blocked"
+        session_cache[acc]["pending_token"] = None
+        session_cache[acc]["anomaly_timestamp"] = None
+    
+    return {"status": "success", "message": f"帳號 {acc} 已成功封鎖"}
+
+@api_app.post("/api/users/unblock")
+def unblock_user_endpoint(req: AccountRequest):
+    """解鎖特定使用者"""
+    acc = req.account.strip()
+    if acc not in USER_DB:
+        return {"status": "error", "message": "帳號不存在"}
+    
+    from auth import unblock_user
+    unblock_user(acc)
+    
+    return {"status": "success", "message": f"帳號 {acc} 已成功解封"}

auth.py

@@ -60,7 +60,7 @@ def get_user_status(user_email: str):
         return session_cache[user_email].get("status", "active")
 
 def unblock_user(user_email: str):
-    """手動解封用戶"""
+    """手動解封用戶（以帳戶名稱作為 key）"""
     user_email = user_email.strip().replace("\xa0", " ")
     with session_cache_lock:
         if user_email in session_cache:
@@ -68,7 +68,9 @@ def unblock_user(user_email: str):
             session_cache[user_email]["pending_token"] = None
             session_cache[user_email]["anomaly_timestamp"] = None
             return True
-    return False
+        else:
+            # 就算 session_cache 中沒有此 key，也視為解鎖成功（帳戶原本就是 active）
+            return True
 
 def _verify_token_to_user(token: str):
     """根據 token 驗證用戶"""
@@ -107,6 +109,10 @@ def internal_process_login(ip, cookie, account, password, captcha, time_mode, cu
         df_all, df_abn, inp_upd = record_log(ip, cookie, account, "Unknown", "login_attempt", "failed_no_account", time_mode, custom_time)
         return {"status": "error", "message": "帳號不存在！"}
 
+    if get_user_status(account) == "blocked":
+        df_all, df_abn, inp_upd = record_log(ip, cookie, account, USER_DB[account][1], "login_attempt", "failed_blocked", time_mode, custom_time)
+        return {"status": "error", "message": "此帳號已被封鎖，無法登入！"}
+
     role, name = USER_DB[account][1], USER_DB[account][2]
 
     if captcha.upper() != "FEIK":
@@ -153,8 +159,8 @@ def logout(ip, cookie, account, time_mode, custom_time):
 
 def simulate_click(ip, cookie, account, button_name, time_mode, custom_time):
     """模擬點擊操作"""
-    # 檢查用戶狀態
-    status = get_user_status(FIXED_TEST_EMAIL)
+    # 以帳戶名稱查詢封鎖狀態（不再使用全域 FIXED_TEST_EMAIL 作為 key）
+    status = get_user_status(account)
     if status == "verifying":
         gr.Info("偵測到異常，請於5分鐘內確認 Email 以繼續使用")
         return gr.update(), gr.update(), gr.update()

config.py

@@ -9,7 +9,7 @@ from dotenv import load_dotenv
 load_dotenv()
 
 # 測試用固定郵箱
-FIXED_TEST_EMAIL = os.getenv("FIXED_TEST_EMAIL", "t111360205@ntut.org.tw").strip()
+FIXED_TEST_EMAIL = os.getenv("FIXED_TEST_EMAIL", "[EMAIL_ADDRESS]").strip()
 
 # SMTP 設定
 SMTP_CONFIG = {
@@ -46,8 +46,10 @@ ACTION_MAP = {
 
 # 用戶資料庫
 USER_DB = {
-    "student": ["1234", "學生", "同學"],
-    "admin": ["1234", "管理", "管理員"]
+    "student": ["1234", "學生", "Alex Wang"],
+    "student2": ["1234", "學生", "Bella Lin"],
+    "admin": ["1234", "管理", "Charles Chen"],
+    "admin2": ["1234", "管理", "David Lee"]
 }
 
 # 伺服器設定

models.py

@@ -257,13 +257,13 @@ def record_log(ip, cookie, account, role, action, status, time_mode, custom_time
         if ai_judgment != "success":
             status = ai_judgment
             
-            # 如果是異常行為，觸發安全警報與驗證流程
+            # 如果是異常行為，觸發安全警報與驗證流程（以帳戶名稱作為 session key）
             if "異常" in status or "受限" in status:
                 try:
                     from security import trigger_identity_verification
                     from config import FIXED_TEST_EMAIL
-                    # 我們將 account 映射到測試信箱進行警報寄送
-                    trigger_identity_verification(FIXED_TEST_EMAIL, log_time)
+                    # 以帳戶名稱作為識別 key，信件收件人統一使用 FIXED_TEST_EMAIL
+                    trigger_identity_verification(account, FIXED_TEST_EMAIL, log_time)
                     print(f"🚨 [Security Alert Triggered] Account: {account}, Status: {status}")
                 except Exception as e:
                     print(f"❌ [Security Alert Error] {e}")

security.py

@@ -18,11 +18,12 @@ from auth import _get_or_create_session_entry, session_cache_lock, session_cache
 from utils import get_current_time
 from fastapi.responses import JSONResponse
 
-def send_security_alert(user_email: str, verify_token: str):
+def send_security_alert(recipient_email: str, verify_token: str, account_name: str = ""):
     """
     當偵測到異常時，發送包含兩個鏈接的郵件：
     - 這是我本人（信任）
     - 這不是我（封鎖）
+    account_name: 觸發異常的帳戶名稱（用於顯示在信件中）
     """
     smtp_host = SMTP_CONFIG["host"]
     smtp_port = SMTP_CONFIG["port"]
@@ -36,35 +37,42 @@ def send_security_alert(user_email: str, verify_token: str):
     smtp_username = smtp_username.replace("\xa0", " ")
     smtp_password = smtp_password.replace("\xa0", " ")
     base_url = base_url.replace("\xa0", " ")
-    user_email = user_email.replace("\xa0", " ")
+    recipient_email = recipient_email.replace("\xa0", " ")
 
     trust_url = f"{base_url}/verify_identity?token={quote(verify_token)}&choice=trust"
     block_url = f"{base_url}/verify_identity?token={quote(verify_token)}&choice=block"
 
     # 始終記錄鏈接以供調試/測試（即使 SMTP 未配置）
-    print(f"🔗 [Security Alert] trust_url={trust_url}")
-    print(f"🔗 [Security Alert] block_url={block_url}")
+    print(f"🔗 [Security Alert] account={account_name}, trust_url={trust_url}")
+    print(f"🔗 [Security Alert] account={account_name}, block_url={block_url}")
 
     if not smtp_host or not smtp_username or not smtp_password:
         print("⚠️ SMTP 設定未完成（SMTP_HOST/SMTP_USERNAME/SMTP_PASSWORD 缺少），跳過寄信。")
         return False
 
-    subject = "安全提醒：請確認是否為本人操作"
+    # 帳號顯示名稱（若有提供則加入說明）
+    account_info = f"<p><strong>⚠️ 警示帳號：{account_name}</strong></p>" if account_name else ""
+
+    subject = f"[數位保鏢] 安全提醒：帳號 {account_name} 偵測到異常操作" if account_name else "安全提醒：請確認是否為本人操作"
     html_body = f"""
-    <p>系統偵測到可能的異常登入/操作。</p>
-    <p>請你在下方選擇其中一項：</p>
-    <ul>
-        <li><a href="{trust_url}">這是我本人（信任）</a></li>
-        <li><a href="{block_url}">這不是我（封鎖）</a></li>
-    </ul>
-    <p>若你未主動發起這次操作，建議選擇「這不是我（封鎖）」。</p>
+    <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; border: 1px solid #e0e0e0; border-radius: 8px;">
+        <h2 style="color: #d32f2f;">🔐 數位保鏢安全警示通知</h2>
+        {account_info}
+        <p>系統偵測到此帳號可能發生異常登入或操作行為，請確認是否為本人所為。</p>
+        <p>請於 <strong>5 分鐘內</strong> 點選以下其中一項進行確認：</p>
+        <div style="margin: 20px 0;">
+            <a href="{trust_url}" style="display: inline-block; padding: 12px 24px; background-color: #2e7d32; color: white; text-decoration: none; border-radius: 6px; margin-right: 12px;">✅ 這是我本人（繼續使用）</a>
+            <a href="{block_url}" style="display: inline-block; padding: 12px 24px; background-color: #c62828; color: white; text-decoration: none; border-radius: 6px;">🚫 這不是我（立即封鎖）</a>
+        </div>
+        <p style="color: #757575; font-size: 12px;">若您未主動進行任何操作，請立即點選「這不是我（立即封鎖）」以保護帳號安全。逾時未確認將自動封鎖帳號。</p>
+    </div>
     """
     # 某些環境可能引入非斷行空格，會觸發 ASCII 編碼錯誤
     html_body = html_body.replace("\xa0", " ")
     msg = MIMEText(html_body, "html", "utf-8", policy=SMTPUTF8)
     msg["Subject"] = subject
     msg["From"] = smtp_from
-    msg["To"] = user_email
+    msg["To"] = recipient_email
 
     try:
         # 使用 SMTP + STARTTLS 進行安全傳輸
@@ -77,16 +85,20 @@ def send_security_alert(user_email: str, verify_token: str):
             server.login(smtp_username, smtp_password)
             # send_message 處理非 ascii 內容的正確編碼
             server.send_message(msg)
-            print(f"✅ 安全警報郵件已成功寄送至: {user_email}")
+            print(f"✅ 安全警報郵件已成功寄送至: {recipient_email}（帳號：{account_name}）")
         return True
     except Exception as e:
         print(f"❌ 寄信失敗: {e}")
         return False
 
-def trigger_identity_verification(user_email: str, anomaly_timestamp: str):
-    """觸發身份驗證"""
+def trigger_identity_verification(account_key: str, recipient_email: str, anomaly_timestamp: str):
+    """
+    觸發身份驗證
+    account_key: 用於 session_cache 的識別 key（帳戶名稱）
+    recipient_email: 安全警報信件的收件人（統一使用 FIXED_TEST_EMAIL）
+    """
     # 如果已經封鎖，保持更強的決定
-    entry = _get_or_create_session_entry(user_email)
+    entry = _get_or_create_session_entry(account_key)
     with session_cache_lock:
         if entry.get("status") == "blocked":
             return None, False
@@ -98,7 +110,8 @@ def trigger_identity_verification(user_email: str, anomaly_timestamp: str):
             "anomaly_timestamp": anomaly_timestamp,
         })
 
-    success = send_security_alert(user_email, verify_token)
+    # 寄送信件時傳入帳戶名稱，讓收件人知道是哪個帳號觸發警示
+    success = send_security_alert(recipient_email, verify_token, account_name=account_key)
     return verify_token, success
 
 def verify_identity(token: str, choice: str):
@@ -145,7 +158,8 @@ def test_send_security_alert():
     - 返回生成的 verify token（token 也存儲在 session_cache 中）
     """
     anomaly_timestamp = datetime.datetime.now(datetime.timezone(datetime.timedelta(hours=8))).strftime("%Y-%m-%d %H:%M:%S")
-    token, success = trigger_identity_verification(FIXED_TEST_EMAIL, anomaly_timestamp)
+    # 測試時以 FIXED_TEST_EMAIL 同時作為 account_key 與收件人
+    token, success = trigger_identity_verification(FIXED_TEST_EMAIL, FIXED_TEST_EMAIL, anomaly_timestamp)
     if not token:
         return {"ok": False, "error": "Already blocked or session not available"}
     return {"ok": True, "user_email": FIXED_TEST_EMAIL, "token": token, "email_sent": success}