2.3.0-rc2

Web：访问令牌 10 分钟；活跃时自动轮换刷新令牌；连续无操作 30 分钟后清除登录并跳转登录页。
App：会话窗口 3 天；打开 App、恢复前台或请求接口时自动刷新并重新顺延 3 天。
普通登录和 SSO 使用同一策略。
刷新令牌只以 SHA-256 摘要入库，每次刷新都会轮换，旧令牌无法再次使用；退出登录会吊销刷新令牌。
网络临时故障不会误清登录状态，多标签页同时刷新也做了竞争处理。

.env.example

@@ -67,7 +67,26 @@ Operations__MySqlClientPath=mysql
 Jwt__Issuer=Jiaowu.Api
 Jwt__Audience=Jiaowu.Web
 Jwt__Key=REPLACE_WITH_AT_LEAST_32_RANDOM_BYTES
-Jwt__ExpireMinutes=60
+Jwt__AccessTokenMinutes=10
+Jwt__WebIdleMinutes=30
+Jwt__AppIdleMinutes=4320
+
+# Keycloak SSO（可选）。Authority 必须指向 realm，例如：
+# https://sso.example.edu.cn/realms/mingxu
+Sso__Enabled=false
+# Sso__DisplayName=学校统一身份认证
+# Sso__Authority=https://sso.example.edu.cn/realms/mingxu
+# Sso__ClientId=jiaowu-web
+# Sso__ClientSecret=REPLACE_WITH_KEYCLOAK_CLIENT_SECRET
+# Sso__UserNameClaim=preferred_username
+# Sso__RequireHttpsMetadata=true
+# 首次 SSO 登录优先绑定同名本地账号；用户名不同时由用户输入现有账号密码完成绑定。
+# 不会自动创建账号或授予角色。
+# Sso__LinkExistingUsersByUserName=true
+# 前后端同域部署时留空；开发或分离部署时填写前端公开根地址。
+# Sso__FrontendBaseUrl=https://jiaowu.example.edu.cn
+# 必须与 Keycloak 客户端的 Valid redirect URI 完全一致。
+# Sso__CallbackUrl=https://jiaowu.example.edu.cn/signin-keycloak
 
 AllowedHosts=jiaowu.example.edu.cn
 Cors__Origins__0=https://jiaowu.example.edu.cn

README.md

@@ -144,6 +144,50 @@ Kubernetes 或密钥管理系统仍可覆盖文件中的值。
 `chmod 600 .env`，Windows 应通过 ACL 只允许服务账号和管理员读取。连接串中的证书
 路径必须是运行服务器上的实际路径。
 
+### Keycloak 单点登录（可选）
+
+系统支持 Keycloak 的 OpenID Connect 授权码流程。Keycloak 只负责验证身份；账号是否
+启用、角色和学院数据范围仍以本系统 Identity 数据为准。首次 SSO 登录会用
+`preferred_username`（可通过 `Sso__UserNameClaim` 修改）优先匹配已有登录账号并记录
+外部账号绑定。如果 Keycloak 用户名与教务系统账号不同，认证后会进入账户绑定页，用户
+需要再输入一次现有教务系统账号和密码；验证成功后建立永久绑定并直接登录。绑定不会
+自动创建本地账号、修改人员档案或从 Keycloak 导入高权限角色。同一 Keycloak 身份不能
+绑定多个本地账号，同一本地账号也不能绑定多个 Keycloak 身份。原账号密码登录和学生
+自助激活入口不受影响。
+
+在 Keycloak 中创建 OpenID Connect 客户端，并至少配置：
+
+- Valid redirect URI：`https://jiaowu.example.edu.cn/signin-keycloak`
+- Valid post logout redirect URI：`https://jiaowu.example.edu.cn/*`（若后续启用 Keycloak 全局退出）
+- Standard flow：开启；Implicit flow：关闭；PKCE：`S256`
+
+然后在 `.env` 中配置：
+
+```dotenv
+Sso__Enabled=true
+Sso__DisplayName=学校统一身份认证
+Sso__Authority=https://sso.example.edu.cn/realms/mingxu
+Sso__ClientId=jiaowu-web
+Sso__ClientSecret=REPLACE_WITH_KEYCLOAK_CLIENT_SECRET
+Sso__UserNameClaim=preferred_username
+Sso__RequireHttpsMetadata=true
+Sso__LinkExistingUsersByUserName=true
+Sso__FrontendBaseUrl=https://jiaowu.example.edu.cn
+Sso__CallbackUrl=https://jiaowu.example.edu.cn/signin-keycloak
+```
+
+前后端同域时 `Sso__FrontendBaseUrl` 可以留空。本地 Vite 开发默认回到
+`http://localhost:5173`，Keycloak 测试客户端需同时允许
+`http://localhost:5255/signin-keycloak`。`Sso__CallbackUrl` 是应用实际发送给 Keycloak
+的 `redirect_uri`，必须与客户端的 Valid redirect URI 完全一致；建议生产环境始终显式
+配置它，避免反向代理导致 scheme 或 host 推导错误。个人账户页的“管理员配置参考”也会
+显示当前生效的完整回调地址。多实例部署应配置 Redis，以便任意实例都能兑换两分钟内
+有效、使用后即删除的 SSO 登录码及五分钟内有效的绑定意图。
+
+用户登录后可从页面右上角进入“个人账户”，主动绑定或解除 Keycloak 账号。主动绑定先
+使用当前 JWT 创建五分钟有效的一次性绑定意图，再跳转 Keycloak；回调只能绑定到发起该
+意图的本地账号。解绑需要再次验证本地密码，避免仅凭未锁屏的登录会话解除身份关联。
+
 ### Linux systemd 服务
 
 仓库提供 [`deploy/systemd/jiaowu.service`](deploy/systemd/jiaowu.service)，适用于

compose.example.yml

@@ -30,7 +30,9 @@ x-jiaowu-environment: &jiaowu-environment
   Jwt__Issuer: Jiaowu.Api
   Jwt__Audience: Jiaowu.Web
   Jwt__Key: "${JWT_KEY:?请在 .env.docker 中设置 JWT_KEY}"
-  Jwt__ExpireMinutes: "60"
+  Jwt__AccessTokenMinutes: "10"
+  Jwt__WebIdleMinutes: "30"
+  Jwt__AppIdleMinutes: "4320"
   AllowedHosts: "${ALLOWED_HOSTS:-localhost}"
   Cors__Origins__0: "${CORS_ORIGIN:-http://localhost:8080}"
   OfficialDocuments__PublicBaseUrl: "${OFFICIAL_DOCUMENTS_PUBLIC_BASE_URL:-http://localhost:8080}"

src/Jiaowu.Api/Controllers/AuthController.cs

@@ -18,7 +18,7 @@ namespace Jiaowu.Api.Controllers;
 public sealed class AuthController(
     AppDbContext db,
     UserManager<ApplicationUser> userManager,
-    ITokenService tokenService,
+    IAuthSessionService authSessionService,
     IAppCache cache) : ControllerBase
 {
     [AllowAnonymous]
@@ -135,8 +135,11 @@ public sealed class AuthController(
     }
 
     [AllowAnonymous]
+    [EnableRateLimiting("public-auth")]
     [HttpPost("login")]
-    public async Task<ActionResult<LoginResponse>> Login(LoginRequest request)
+    public async Task<ActionResult<LoginResponse>> Login(
+        LoginRequest request,
+        CancellationToken cancellationToken)
     {
         var user = await userManager.FindByNameAsync(request.UserName);
         if (user is null || !user.IsEnabled)
@@ -166,15 +169,47 @@ public sealed class AuthController(
         await userManager.UpdateAsync(user);
         var roles = await userManager.GetRolesAsync(user);
 
-        return new LoginResponse(
-            tokenService.Create(user, roles),
-            new CurrentUserResponse(
-                user.Id,
-                user.UserName!,
-                user.DisplayName,
-                roles,
-                user.CollegeId,
-                EffectiveDataScopeResolver.Resolve(roles).ToString()));
+        var session = await authSessionService.CreateAsync(
+            user,
+            roles,
+            request.IsNativeApp
+                ? AuthenticationClientType.App
+                : AuthenticationClientType.Web,
+            cancellationToken);
+        return CreateLoginResponse(session);
+    }
+
+    [AllowAnonymous]
+    [EnableRateLimiting("token-refresh")]
+    [HttpPost("refresh")]
+    public async Task<ActionResult<LoginResponse>> Refresh(
+        RefreshTokenRequest request,
+        CancellationToken cancellationToken)
+    {
+        var session = await authSessionService.RefreshAsync(
+            request.RefreshToken,
+            cancellationToken);
+        if (session is null)
+        {
+            return Unauthorized(new ProblemDetails
+            {
+                Title = "登录已过期",
+                Detail = "登录已过期或刷新令牌已失效，请重新登录。",
+                Status = StatusCodes.Status401Unauthorized
+            });
+        }
+
+        return CreateLoginResponse(session);
+    }
+
+    [AllowAnonymous]
+    [HttpPost("logout")]
+    public async Task<IActionResult> Logout(
+        RefreshTokenRequest request,
+        CancellationToken cancellationToken)
+    {
+        await authSessionService.RevokeAsync(request.RefreshToken, cancellationToken);
+        return NoContent();
     }
 
     [Authorize]
@@ -212,11 +247,29 @@ public sealed class AuthController(
             Detail = detail,
             Status = status
         });
+
+    internal static LoginResponse CreateLoginResponse(AuthSessionResult session) =>
+        new(
+            session.AccessToken,
+            session.AccessTokenExpiresAt,
+            session.RefreshToken,
+            session.SessionExpiresAt,
+            new CurrentUserResponse(
+                session.User.Id,
+                session.User.UserName!,
+                session.User.DisplayName,
+                session.Roles,
+                session.User.CollegeId,
+                EffectiveDataScopeResolver.Resolve(session.Roles).ToString()));
 }
 
 public sealed record LoginRequest(
     [Required, MaxLength(100)] string UserName,
-    [Required, MaxLength(100)] string Password);
+    [Required, MaxLength(100)] string Password,
+    bool IsNativeApp = false);
+
+public sealed record RefreshTokenRequest(
+    [Required, MinLength(40), MaxLength(200)] string RefreshToken);
 
 public sealed record StudentActivationRequest(
     [Required, MaxLength(50)] string Name,
@@ -227,7 +280,12 @@ public sealed record StudentActivationRequest(
     Guid AdministrativeClassId,
     [Required, MinLength(8), MaxLength(100)] string Password);
 
-public sealed record LoginResponse(string Token, CurrentUserResponse User);
+public sealed record LoginResponse(
+    string Token,
+    DateTime AccessTokenExpiresAt,
+    string RefreshToken,
+    DateTime SessionExpiresAt,
+    CurrentUserResponse User);
 
 public sealed record CurrentUserResponse(
     Guid Id,

src/Jiaowu.Api/Controllers/CourseSelectionsController.cs

@@ -1639,13 +1639,25 @@ public sealed class CourseSelectionsController(
         var students = await LoadTeachingTaskRosterAsync(id, cancellationToken);
         var bytes = ExcelWorkbookHelper.Create(
             "教学班名单",
-            ["学号", "姓名", "班级", "专业", "进入方式", "选课时间"],
+            [
+                "学号", "姓名", "班级", "专业", "联系电话", "电子邮箱",
+                "微信", "紧急联系人", "与本人关系", "紧急联系电话",
+                "特殊标记", "特殊情况说明", "进入方式", "选课时间"
+            ],
             students.Select(student => new List<object?>
             {
                 student.StudentNumber,
                 student.Name,
                 student.ClassName,
                 student.MajorName,
+                student.Phone,
+                student.Email,
+                student.WeChat,
+                student.EmergencyContactName,
+                student.EmergencyContactRelationship,
+                student.EmergencyContactPhone,
+                student.SpecialTags,
+                student.SpecialNeeds,
                 student.EnrolledAt.HasValue ? "选课" : "行政班关联",
                 student.EnrolledAt?.ToString("yyyy-MM-dd HH:mm") ?? "-"
             }).ToList<IReadOnlyList<object?>>());
@@ -1754,6 +1766,14 @@ public sealed class CourseSelectionsController(
                 x.Name,
                 x.AdministrativeClass!.Name,
                 x.AdministrativeClass.Major!.Name,
+                x.Phone,
+                x.Email,
+                x.WeChat,
+                x.EmergencyContactName,
+                x.EmergencyContactRelationship,
+                x.EmergencyContactPhone,
+                x.SpecialTags,
+                x.SpecialNeeds,
                 db.CourseEnrollments
                     .Where(enrollment =>
                         enrollment.StudentId == x.Id &&
@@ -2154,6 +2174,14 @@ public sealed class CourseSelectionsController(
         string Name,
         string ClassName,
         string MajorName,
+        string? Phone,
+        string? Email,
+        string? WeChat,
+        string? EmergencyContactName,
+        string? EmergencyContactRelationship,
+        string? EmergencyContactPhone,
+        string? SpecialTags,
+        string? SpecialNeeds,
         DateTime? EnrolledAt);
 }
 

src/Jiaowu.Api/Controllers/PersonnelController.cs

@@ -224,6 +224,12 @@ public sealed class PersonnelController(
         [FromQuery] PersonnelQuery query,
         CancellationToken cancellationToken)
     {
+        var roles = currentUserDataScope.Current.Roles;
+        var canReadFullProfile = roles.Any(role =>
+            role is SystemRoles.SuperAdmin or
+                SystemRoles.AcademicAdmin or
+                SystemRoles.CollegeAdmin or
+                SystemRoles.Counselor);
         var page = NormalizePage(query.Page);
         var pageSize = NormalizePageSize(query.PageSize);
         var source = ApplyStudentScope(db.Students.AsNoTracking());
@@ -268,9 +274,26 @@ public sealed class PersonnelController(
                 x.EnrollmentDate,
                 x.Status,
                 x.DateOfBirth,
+                EnglishName = canReadFullProfile ? x.EnglishName : null,
+                IdCardNumber = canReadFullProfile ? x.IdCardNumber : null,
+                Nationality = canReadFullProfile ? x.Nationality : null,
+                Ethnicity = canReadFullProfile ? x.Ethnicity : null,
+                PoliticalStatus = canReadFullProfile ? x.PoliticalStatus : null,
+                NativePlace = canReadFullProfile ? x.NativePlace : null,
+                HouseholdAddress = canReadFullProfile ? x.HouseholdAddress : null,
+                CurrentAddress = canReadFullProfile ? x.CurrentAddress : null,
+                PostalCode = canReadFullProfile ? x.PostalCode : null,
                 x.Phone,
                 x.Email,
-                x.Notes,
+                Qq = canReadFullProfile ? x.Qq : null,
+                x.WeChat,
+                x.EmergencyContactName,
+                x.EmergencyContactRelationship,
+                x.EmergencyContactPhone,
+                x.SpecialTags,
+                x.SpecialNeeds,
+                Biography = canReadFullProfile ? x.Biography : null,
+                Notes = canReadFullProfile ? x.Notes : null,
                 x.UserId,
                 x.CreatedAt
             })
@@ -304,8 +327,26 @@ public sealed class PersonnelController(
             EnrollmentDate = request.EnrollmentDate,
             Status = request.Status,
             DateOfBirth = request.DateOfBirth,
+            EnglishName = Normalize(request.EnglishName),
+            IdCardNumber = Normalize(request.IdCardNumber),
+            Nationality = Normalize(request.Nationality),
+            Ethnicity = Normalize(request.Ethnicity),
+            PoliticalStatus = Normalize(request.PoliticalStatus),
+            NativePlace = Normalize(request.NativePlace),
+            HouseholdAddress = Normalize(request.HouseholdAddress),
+            CurrentAddress = Normalize(request.CurrentAddress),
+            PostalCode = Normalize(request.PostalCode),
             Phone = Normalize(request.Phone),
             Email = Normalize(request.Email),
+            Qq = Normalize(request.Qq),
+            WeChat = Normalize(request.WeChat),
+            EmergencyContactName = Normalize(request.EmergencyContactName),
+            EmergencyContactRelationship = Normalize(
+                request.EmergencyContactRelationship),
+            EmergencyContactPhone = Normalize(request.EmergencyContactPhone),
+            SpecialTags = Normalize(request.SpecialTags),
+            SpecialNeeds = Normalize(request.SpecialNeeds),
+            Biography = Normalize(request.Biography),
             Notes = Normalize(request.Notes)
         };
         db.Students.Add(entity);
@@ -343,8 +384,26 @@ public sealed class PersonnelController(
         entity.EnrollmentDate = request.EnrollmentDate;
         entity.Status = request.Status;
         entity.DateOfBirth = request.DateOfBirth;
+        entity.EnglishName = Normalize(request.EnglishName);
+        entity.IdCardNumber = Normalize(request.IdCardNumber);
+        entity.Nationality = Normalize(request.Nationality);
+        entity.Ethnicity = Normalize(request.Ethnicity);
+        entity.PoliticalStatus = Normalize(request.PoliticalStatus);
+        entity.NativePlace = Normalize(request.NativePlace);
+        entity.HouseholdAddress = Normalize(request.HouseholdAddress);
+        entity.CurrentAddress = Normalize(request.CurrentAddress);
+        entity.PostalCode = Normalize(request.PostalCode);
         entity.Phone = Normalize(request.Phone);
         entity.Email = Normalize(request.Email);
+        entity.Qq = Normalize(request.Qq);
+        entity.WeChat = Normalize(request.WeChat);
+        entity.EmergencyContactName = Normalize(request.EmergencyContactName);
+        entity.EmergencyContactRelationship = Normalize(
+            request.EmergencyContactRelationship);
+        entity.EmergencyContactPhone = Normalize(request.EmergencyContactPhone);
+        entity.SpecialTags = Normalize(request.SpecialTags);
+        entity.SpecialNeeds = Normalize(request.SpecialNeeds);
+        entity.Biography = Normalize(request.Biography);
         entity.Notes = Normalize(request.Notes);
         return await SaveNoContentAsync(cancellationToken);
     }
@@ -522,8 +581,25 @@ public sealed record StudentRequest(
     DateOnly EnrollmentDate,
     StudentStatus Status,
     DateOnly? DateOfBirth,
+    [MaxLength(100)] string? EnglishName,
+    [MaxLength(30)] string? IdCardNumber,
+    [MaxLength(50)] string? Nationality,
+    [MaxLength(50)] string? Ethnicity,
+    [MaxLength(50)] string? PoliticalStatus,
+    [MaxLength(100)] string? NativePlace,
+    [MaxLength(300)] string? HouseholdAddress,
+    [MaxLength(300)] string? CurrentAddress,
+    [MaxLength(20)] string? PostalCode,
     [MaxLength(30)] string? Phone,
     [EmailAddress, MaxLength(100)] string? Email,
+    [MaxLength(30)] string? Qq,
+    [MaxLength(60)] string? WeChat,
+    [MaxLength(50)] string? EmergencyContactName,
+    [MaxLength(30)] string? EmergencyContactRelationship,
+    [MaxLength(30)] string? EmergencyContactPhone,
+    [MaxLength(300)] string? SpecialTags,
+    [MaxLength(1000)] string? SpecialNeeds,
+    [MaxLength(1000)] string? Biography,
     [MaxLength(500)] string? Notes);
 
 public sealed record TeacherAccountActivationRequest(

src/Jiaowu.Api/Controllers/PersonnelExcelController.cs

@@ -31,6 +31,9 @@ public sealed class PersonnelExcelController(
         SystemRoles.AcademicAdmin + "," +
         SystemRoles.CollegeAdmin;
 
+    private const string ExportRoles =
+        WriteRoles + "," + SystemRoles.Counselor;
+
     private static readonly string[] TeacherHeaders =
     [
         "工号", "姓名", "性别", "学院编码", "职称", "任职状态",
@@ -40,7 +43,10 @@ public sealed class PersonnelExcelController(
     private static readonly string[] StudentHeaders =
     [
         "学号", "姓名", "性别", "行政班编码", "入学年级", "入学日期",
-        "学籍状态", "出生日期", "联系电话", "电子邮箱", "备注"
+        "学籍状态", "出生日期", "英文姓名", "证件号码", "国籍", "民族",
+        "政治面貌", "籍贯", "户籍地址", "现居住地址", "邮政编码",
+        "联系电话", "电子邮箱", "QQ", "微信", "紧急联系人", "与本人关系",
+        "紧急联系电话", "特殊标记", "特殊情况说明", "个人简介", "备注"
     ];
 
     [HttpGet("{kind}/template")]
@@ -66,6 +72,7 @@ public sealed class PersonnelExcelController(
     }
 
     [HttpGet("{kind}/export")]
+    [Authorize(Roles = ExportRoles)]
     public async Task<IActionResult> Export(
         string kind,
         [FromQuery] PersonnelQuery query,
@@ -96,7 +103,12 @@ public sealed class PersonnelExcelController(
                 .Select(x => Row(
                     x.StudentNumber, x.Name, GenderName(x.Gender),
                     x.AdministrativeClass!.Code, x.EnrollmentYear, x.EnrollmentDate,
-                    StudentStatusName(x.Status), x.DateOfBirth, x.Phone, x.Email, x.Notes))
+                    StudentStatusName(x.Status), x.DateOfBirth, x.EnglishName,
+                    x.IdCardNumber, x.Nationality, x.Ethnicity, x.PoliticalStatus,
+                    x.NativePlace, x.HouseholdAddress, x.CurrentAddress, x.PostalCode,
+                    x.Phone, x.Email, x.Qq, x.WeChat, x.EmergencyContactName,
+                    x.EmergencyContactRelationship, x.EmergencyContactPhone,
+                    x.SpecialTags, x.SpecialNeeds, x.Biography, x.Notes))
                 .ToList();
         }
 
@@ -296,8 +308,25 @@ public sealed class PersonnelExcelController(
             entity.EnrollmentDate = enrollmentDate.Value;
             entity.Status = status.Value;
             entity.DateOfBirth = dateOfBirth;
+            entity.EnglishName = Optional(row, "英文姓名");
+            entity.IdCardNumber = Optional(row, "证件号码");
+            entity.Nationality = Optional(row, "国籍");
+            entity.Ethnicity = Optional(row, "民族");
+            entity.PoliticalStatus = Optional(row, "政治面貌");
+            entity.NativePlace = Optional(row, "籍贯");
+            entity.HouseholdAddress = Optional(row, "户籍地址");
+            entity.CurrentAddress = Optional(row, "现居住地址");
+            entity.PostalCode = Optional(row, "邮政编码");
             entity.Phone = Optional(row, "联系电话");
             entity.Email = Optional(row, "电子邮箱");
+            entity.Qq = Optional(row, "QQ");
+            entity.WeChat = Optional(row, "微信");
+            entity.EmergencyContactName = Optional(row, "紧急联系人");
+            entity.EmergencyContactRelationship = Optional(row, "与本人关系");
+            entity.EmergencyContactPhone = Optional(row, "紧急联系电话");
+            entity.SpecialTags = Optional(row, "特殊标记");
+            entity.SpecialNeeds = Optional(row, "特殊情况说明");
+            entity.Biography = Optional(row, "个人简介");
             entity.Notes = Optional(row, "备注");
         }
         return new(created, updated, rows.Count);

src/Jiaowu.Api/Controllers/SsoController.cs

@@ -0,0 +1,550 @@
+using System.ComponentModel.DataAnnotations;
+using System.Security.Claims;
+using System.Security.Cryptography;
+using System.Text.Json;
+using Jiaowu.Api.Domain.Identity;
+using Jiaowu.Api.Infrastructure.Auth;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.RateLimiting;
+using Microsoft.AspNetCore.WebUtilities;
+using Microsoft.Extensions.Caching.Distributed;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Protocols.OpenIdConnect;
+
+namespace Jiaowu.Api.Controllers;
+
+[ApiController]
+[Route("api/auth/sso")]
+public sealed class SsoController(
+    UserManager<ApplicationUser> userManager,
+    IAuthSessionService authSessionService,
+    IDistributedCache cache,
+    IOptions<SsoOptions> options,
+    ILogger<SsoController> logger) : ControllerBase
+{
+    private const string BindingIntentProperty = "sso-binding-intent";
+    private readonly SsoOptions _options = options.Value;
+
+    [AllowAnonymous]
+    [HttpGet("settings")]
+    public ActionResult<SsoSettingsResponse> Settings() =>
+        new SsoSettingsResponse(
+            _options.Enabled,
+            _options.DisplayName,
+            EffectiveCallbackUrl());
+
+    [AllowAnonymous]
+    [EnableRateLimiting("public-auth")]
+    [HttpGet("login")]
+    public async Task<IActionResult> Login(
+        [FromQuery] string? returnUrl = null,
+        [FromQuery] string? bindingIntent = null,
+        CancellationToken cancellationToken = default)
+    {
+        if (!_options.Enabled)
+            return SsoProblem("统一身份认证尚未启用。", StatusCodes.Status404NotFound);
+
+        var safeReturnUrl = NormalizeReturnUrl(returnUrl);
+        var properties = new AuthenticationProperties();
+        if (!string.IsNullOrWhiteSpace(bindingIntent))
+        {
+            var targetUserId = await cache.GetStringAsync(
+                BindingIntentCacheKey(bindingIntent),
+                cancellationToken);
+            if (targetUserId is null)
+                return RedirectToFrontendError("binding_intent_expired", "/account");
+            properties.Items[BindingIntentProperty] = bindingIntent;
+        }
+        var completeUrl = Url.Action(
+            nameof(Complete),
+            values: new { returnUrl = safeReturnUrl })!;
+        properties.RedirectUri = completeUrl;
+        try
+        {
+            await HttpContext.ChallengeAsync(SsoAuthSchemes.Keycloak, properties);
+            return new EmptyResult();
+        }
+        catch (OpenIdConnectProtocolException exception)
+        {
+            logger.LogWarning(
+                exception,
+                "Keycloak 拒绝了 OIDC 授权请求。当前回调地址为 {CallbackUrl}",
+                EffectiveCallbackUrl());
+            return RedirectToFrontendError(
+                "configuration_error",
+                string.IsNullOrWhiteSpace(bindingIntent) ? "/login" : "/account");
+        }
+    }
+
+    [AllowAnonymous]
+    [ApiExplorerSettings(IgnoreApi = true)]
+    [HttpGet("complete")]
+    public async Task<ActionResult> Complete(
+        [FromQuery] string? returnUrl,
+        CancellationToken cancellationToken)
+    {
+        if (!_options.Enabled)
+            return SsoProblem("统一身份认证尚未启用。", StatusCodes.Status404NotFound);
+
+        var authentication = await HttpContext.AuthenticateAsync(
+            SsoAuthSchemes.ExternalCookie);
+        if (!authentication.Succeeded || authentication.Principal is null)
+            return RedirectToFrontendError("authentication_failed");
+
+        var principal = authentication.Principal;
+        var subject = principal.FindFirstValue("sub") ??
+                      principal.FindFirstValue(ClaimTypes.NameIdentifier);
+        if (string.IsNullOrWhiteSpace(subject))
+            return RedirectToFrontendError("missing_subject");
+
+        ApplicationUser? user = null;
+        var bindingIntent =
+            authentication.Properties is { } authenticationProperties &&
+            authenticationProperties.Items.TryGetValue(
+                BindingIntentProperty,
+                out var storedBindingIntent)
+                ? storedBindingIntent
+                : null;
+        if (!string.IsNullOrWhiteSpace(bindingIntent))
+        {
+            var targetUserId = await cache.GetStringAsync(
+                BindingIntentCacheKey(bindingIntent),
+                cancellationToken);
+            user = targetUserId is null
+                ? null
+                : await userManager.FindByIdAsync(targetUserId);
+            if (user is null)
+                return RedirectToFrontendError("binding_intent_expired", "/account");
+            if (!user.IsEnabled || await userManager.IsLockedOutAsync(user))
+                return RedirectToFrontendError("account_disabled", "/account");
+
+            var linkError = await LinkSsoIdentityAsync(user, subject);
+            if (linkError is not null)
+                return RedirectToFrontendError(linkError, "/account");
+            await cache.RemoveAsync(
+                BindingIntentCacheKey(bindingIntent),
+                cancellationToken);
+        }
+
+        user ??= await userManager.FindByLoginAsync(
+            SsoAuthSchemes.LoginProvider,
+            subject);
+        if (user is null && _options.LinkExistingUsersByUserName)
+        {
+            var userName = principal.FindFirstValue(_options.UserNameClaim)?.Trim();
+            if (!string.IsNullOrWhiteSpace(userName))
+            {
+                user = await userManager.FindByNameAsync(userName);
+                if (user is not null)
+                {
+                    var linkError = await LinkSsoIdentityAsync(user, subject);
+                    if (linkError is not null)
+                        return RedirectToFrontendError(linkError);
+                }
+            }
+        }
+
+        if (user is null)
+        {
+            var bindingCode = WebEncoders.Base64UrlEncode(
+                RandomNumberGenerator.GetBytes(32));
+            var externalUserName =
+                principal.FindFirstValue(_options.UserNameClaim)?.Trim() ??
+                principal.FindFirstValue("name")?.Trim() ??
+                subject;
+            await cache.SetStringAsync(
+                BindingCacheKey(bindingCode),
+                JsonSerializer.Serialize(new SsoBindingTicket(subject, externalUserName)),
+                new DistributedCacheEntryOptions
+                {
+                    AbsoluteExpirationRelativeToNow = TimeSpan.FromMinutes(5)
+                },
+                cancellationToken);
+            await HttpContext.SignOutAsync(SsoAuthSchemes.ExternalCookie);
+
+            var bindingPage = BuildFrontendUrl("/sso/bind") +
+                $"?code={Uri.EscapeDataString(bindingCode)}" +
+                $"&redirect={Uri.EscapeDataString(NormalizeReturnUrl(returnUrl))}";
+            return Redirect(bindingPage);
+        }
+        if (!user.IsEnabled || await userManager.IsLockedOutAsync(user))
+            return RedirectToFrontendError("account_disabled");
+
+        user.LastLoginAt = DateTime.UtcNow;
+        var updateResult = await userManager.UpdateAsync(user);
+        if (!updateResult.Succeeded)
+            return RedirectToFrontendError("account_update_failed");
+
+        var exchangeCode = WebEncoders.Base64UrlEncode(
+            RandomNumberGenerator.GetBytes(32));
+        await cache.SetStringAsync(
+            ExchangeCacheKey(exchangeCode),
+            user.Id.ToString("D"),
+            new DistributedCacheEntryOptions
+            {
+                AbsoluteExpirationRelativeToNow = TimeSpan.FromMinutes(2)
+            },
+            cancellationToken);
+        await HttpContext.SignOutAsync(SsoAuthSchemes.ExternalCookie);
+
+        var callback = BuildFrontendUrl("/sso/callback") +
+            $"?code={Uri.EscapeDataString(exchangeCode)}" +
+            $"&redirect={Uri.EscapeDataString(NormalizeReturnUrl(returnUrl))}";
+        return Redirect(callback);
+    }
+
+    [AllowAnonymous]
+    [EnableRateLimiting("public-auth")]
+    [HttpPost("exchange")]
+    public async Task<ActionResult<LoginResponse>> Exchange(
+        SsoExchangeRequest request,
+        CancellationToken cancellationToken)
+    {
+        if (!_options.Enabled)
+            return SsoProblem("统一身份认证尚未启用。", StatusCodes.Status404NotFound);
+
+        var cacheKey = ExchangeCacheKey(request.Code);
+        var userId = await cache.GetStringAsync(cacheKey, cancellationToken);
+        if (userId is null)
+            return SsoProblem(
+                "统一身份认证结果已失效，请重新登录。",
+                StatusCodes.Status401Unauthorized);
+
+        await cache.RemoveAsync(cacheKey, cancellationToken);
+        var user = await userManager.FindByIdAsync(userId);
+        if (user is null || !user.IsEnabled || await userManager.IsLockedOutAsync(user))
+            return SsoProblem(
+                "本地账号不存在、已停用或已锁定。",
+                StatusCodes.Status401Unauthorized);
+
+        var roles = await userManager.GetRolesAsync(user);
+        var session = await authSessionService.CreateAsync(
+            user,
+            roles,
+            request.IsNativeApp
+                ? AuthenticationClientType.App
+                : AuthenticationClientType.Web,
+            cancellationToken);
+        return AuthController.CreateLoginResponse(session);
+    }
+
+    [AllowAnonymous]
+    [EnableRateLimiting("public-auth")]
+    [HttpGet("binding")]
+    public async Task<ActionResult<SsoBindingInfoResponse>> BindingInfo(
+        [FromQuery, Required, MinLength(20), MaxLength(200)] string code,
+        CancellationToken cancellationToken)
+    {
+        if (!_options.Enabled)
+            return SsoProblem("统一身份认证尚未启用。", StatusCodes.Status404NotFound);
+
+        var ticket = await ReadBindingTicketAsync(code, cancellationToken);
+        if (ticket is null)
+            return SsoProblem(
+                "账户绑定请求已失效，请重新使用统一身份认证登录。",
+                StatusCodes.Status401Unauthorized);
+
+        return new SsoBindingInfoResponse(_options.DisplayName, ticket.ExternalUserName);
+    }
+
+    [AllowAnonymous]
+    [EnableRateLimiting("public-auth")]
+    [HttpPost("bind")]
+    public async Task<ActionResult<LoginResponse>> Bind(
+        SsoBindRequest request,
+        CancellationToken cancellationToken)
+    {
+        if (!_options.Enabled)
+            return SsoProblem("统一身份认证尚未启用。", StatusCodes.Status404NotFound);
+
+        var ticket = await ReadBindingTicketAsync(request.Code, cancellationToken);
+        if (ticket is null)
+            return SsoProblem(
+                "账户绑定请求已失效，请重新使用统一身份认证登录。",
+                StatusCodes.Status401Unauthorized);
+
+        var user = await userManager.FindByNameAsync(request.UserName.Trim());
+        if (user is null || !user.IsEnabled || await userManager.IsLockedOutAsync(user))
+            return InvalidLocalCredentials();
+
+        if (!await userManager.CheckPasswordAsync(user, request.Password))
+        {
+            await userManager.AccessFailedAsync(user);
+            return InvalidLocalCredentials();
+        }
+
+        var subjectOwner = await userManager.FindByLoginAsync(
+            SsoAuthSchemes.LoginProvider,
+            ticket.Subject);
+        if (subjectOwner is not null && subjectOwner.Id != user.Id)
+            return BindingConflict("该统一身份账号已绑定其他教务系统账号。");
+
+        var keycloakLogins = (await userManager.GetLoginsAsync(user))
+            .Where(x => x.LoginProvider == SsoAuthSchemes.LoginProvider)
+            .ToList();
+        if (keycloakLogins.Any(x => x.ProviderKey != ticket.Subject))
+            return BindingConflict("该教务系统账号已绑定其他统一身份账号。");
+
+        if (subjectOwner is null)
+        {
+            var linkResult = await userManager.AddLoginAsync(
+                user,
+                new UserLoginInfo(
+                    SsoAuthSchemes.LoginProvider,
+                    ticket.Subject,
+                    _options.DisplayName));
+            if (!linkResult.Succeeded)
+            {
+                subjectOwner = await userManager.FindByLoginAsync(
+                    SsoAuthSchemes.LoginProvider,
+                    ticket.Subject);
+                if (subjectOwner?.Id != user.Id)
+                    return BindingConflict("账户绑定失败，请重新发起统一身份认证。");
+            }
+        }
+
+        await userManager.ResetAccessFailedCountAsync(user);
+        user.LastLoginAt = DateTime.UtcNow;
+        var updateResult = await userManager.UpdateAsync(user);
+        if (!updateResult.Succeeded)
+            return SsoProblem("本地账号状态更新失败，请稍后重试。", StatusCodes.Status500InternalServerError);
+
+        await cache.RemoveAsync(BindingCacheKey(request.Code), cancellationToken);
+        var roles = await userManager.GetRolesAsync(user);
+        var session = await authSessionService.CreateAsync(
+            user,
+            roles,
+            request.IsNativeApp
+                ? AuthenticationClientType.App
+                : AuthenticationClientType.Web,
+            cancellationToken);
+        return AuthController.CreateLoginResponse(session);
+    }
+
+    [Authorize]
+    [HttpGet("account")]
+    public async Task<ActionResult<SsoAccountResponse>> Account()
+    {
+        var user = await CurrentUserAsync();
+        if (user is null)
+            return Unauthorized();
+
+        var login = (await userManager.GetLoginsAsync(user))
+            .SingleOrDefault(x => x.LoginProvider == SsoAuthSchemes.LoginProvider);
+        return new SsoAccountResponse(
+            _options.Enabled,
+            _options.DisplayName,
+            login is not null,
+            EffectiveCallbackUrl());
+    }
+
+    [Authorize]
+    [HttpPost("prepare-binding")]
+    public async Task<ActionResult<SsoBindingStartResponse>> PrepareBinding(
+        CancellationToken cancellationToken)
+    {
+        if (!_options.Enabled)
+            return SsoProblem("统一身份认证尚未启用。", StatusCodes.Status404NotFound);
+
+        var user = await CurrentUserAsync();
+        if (user is null || !user.IsEnabled || await userManager.IsLockedOutAsync(user))
+            return Unauthorized();
+        if ((await userManager.GetLoginsAsync(user))
+            .Any(x => x.LoginProvider == SsoAuthSchemes.LoginProvider))
+        {
+            return BindingConflict("当前账号已绑定统一身份账号，请先解绑后再更换绑定。");
+        }
+
+        var intentCode = WebEncoders.Base64UrlEncode(
+            RandomNumberGenerator.GetBytes(32));
+        await cache.SetStringAsync(
+            BindingIntentCacheKey(intentCode),
+            user.Id.ToString("D"),
+            new DistributedCacheEntryOptions
+            {
+                AbsoluteExpirationRelativeToNow = TimeSpan.FromMinutes(5)
+            },
+            cancellationToken);
+        var loginUrl = Url.Action(
+            nameof(Login),
+            values: new
+            {
+                returnUrl = "/account",
+                bindingIntent = intentCode
+            })!;
+        return new SsoBindingStartResponse(loginUrl);
+    }
+
+    [Authorize]
+    [EnableRateLimiting("public-auth")]
+    [HttpPost("unbind")]
+    public async Task<IActionResult> Unbind(SsoUnbindRequest request)
+    {
+        var user = await CurrentUserAsync();
+        if (user is null || !user.IsEnabled || await userManager.IsLockedOutAsync(user))
+            return Unauthorized();
+        if (!await userManager.HasPasswordAsync(user))
+            return BindingConflict("当前账号没有本地密码，不能自行解绑，请联系管理员处理。");
+        if (!await userManager.CheckPasswordAsync(user, request.Password))
+        {
+            await userManager.AccessFailedAsync(user);
+            return InvalidLocalCredentials();
+        }
+
+        var login = (await userManager.GetLoginsAsync(user))
+            .SingleOrDefault(x => x.LoginProvider == SsoAuthSchemes.LoginProvider);
+        if (login is null)
+            return NoContent();
+
+        var result = await userManager.RemoveLoginAsync(
+            user,
+            login.LoginProvider,
+            login.ProviderKey);
+        if (!result.Succeeded)
+            return SsoProblem("解除统一身份绑定失败，请稍后重试。", StatusCodes.Status500InternalServerError);
+
+        await userManager.ResetAccessFailedCountAsync(user);
+        return NoContent();
+    }
+
+    internal static string NormalizeReturnUrl(string? returnUrl) =>
+        !string.IsNullOrWhiteSpace(returnUrl) &&
+        returnUrl.StartsWith('/') &&
+        !returnUrl.StartsWith("//", StringComparison.Ordinal)
+            ? returnUrl
+            : "/dashboard";
+
+    private string BuildFrontendUrl(string path) =>
+        string.IsNullOrWhiteSpace(_options.FrontendBaseUrl)
+            ? path
+            : _options.FrontendBaseUrl.TrimEnd('/') + path;
+
+    private RedirectResult RedirectToFrontendError(
+        string error,
+        string path = "/login") =>
+        Redirect(BuildFrontendUrl(path) +
+                 $"?ssoError={Uri.EscapeDataString(error)}");
+
+    private static string ExchangeCacheKey(string code) => $"sso:exchange:{code}";
+
+    private static string BindingCacheKey(string code) => $"sso:binding:{code}";
+
+    private static string BindingIntentCacheKey(string code) =>
+        $"sso:binding-intent:{code}";
+
+    private async Task<ApplicationUser?> CurrentUserAsync()
+    {
+        var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
+        return userId is null ? null : await userManager.FindByIdAsync(userId);
+    }
+
+    private async Task<string?> LinkSsoIdentityAsync(
+        ApplicationUser user,
+        string subject)
+    {
+        var subjectOwner = await userManager.FindByLoginAsync(
+            SsoAuthSchemes.LoginProvider,
+            subject);
+        if (subjectOwner is not null)
+            return subjectOwner.Id == user.Id ? null : "identity_already_bound";
+
+        if ((await userManager.GetLoginsAsync(user)).Any(x =>
+                x.LoginProvider == SsoAuthSchemes.LoginProvider &&
+                x.ProviderKey != subject))
+        {
+            return "account_already_bound";
+        }
+
+        var result = await userManager.AddLoginAsync(
+            user,
+            new UserLoginInfo(
+                SsoAuthSchemes.LoginProvider,
+                subject,
+                _options.DisplayName));
+        if (result.Succeeded)
+            return null;
+
+        subjectOwner = await userManager.FindByLoginAsync(
+            SsoAuthSchemes.LoginProvider,
+            subject);
+        return subjectOwner?.Id == user.Id ? null : "account_link_failed";
+    }
+
+    private string EffectiveCallbackUrl()
+    {
+        if (!string.IsNullOrWhiteSpace(_options.CallbackUrl))
+            return _options.CallbackUrl;
+        return $"{Request.Scheme}://{Request.Host}{Request.PathBase}/signin-keycloak";
+    }
+
+    private async Task<SsoBindingTicket?> ReadBindingTicketAsync(
+        string code,
+        CancellationToken cancellationToken)
+    {
+        var json = await cache.GetStringAsync(BindingCacheKey(code), cancellationToken);
+        if (json is null)
+            return null;
+        try
+        {
+            return JsonSerializer.Deserialize<SsoBindingTicket>(json);
+        }
+        catch (JsonException)
+        {
+            return null;
+        }
+    }
+
+    private UnauthorizedObjectResult InvalidLocalCredentials() =>
+        Unauthorized(new ProblemDetails
+        {
+            Title = "账户绑定失败",
+            Detail = "教务系统账号或密码不正确，或账号已停用。",
+            Status = StatusCodes.Status401Unauthorized
+        });
+
+    private ObjectResult BindingConflict(string detail) =>
+        SsoProblem(detail, StatusCodes.Status409Conflict);
+
+    private ObjectResult SsoProblem(string detail, int status) =>
+        StatusCode(status, new ProblemDetails
+        {
+            Title = "统一身份认证失败",
+            Detail = detail,
+            Status = status
+        });
+}
+
+public sealed record SsoSettingsResponse(
+    bool Enabled,
+    string DisplayName,
+    string CallbackUrl);
+
+public sealed record SsoExchangeRequest(
+    [Required, MinLength(20), MaxLength(200)] string Code,
+    bool IsNativeApp = false);
+
+public sealed record SsoBindingInfoResponse(
+    string ProviderDisplayName,
+    string ExternalUserName);
+
+public sealed record SsoBindRequest(
+    [Required, MinLength(20), MaxLength(200)] string Code,
+    [Required, MaxLength(100)] string UserName,
+    [Required, MaxLength(100)] string Password,
+    bool IsNativeApp = false);
+
+internal sealed record SsoBindingTicket(string Subject, string ExternalUserName);
+
+public sealed record SsoAccountResponse(
+    bool Enabled,
+    string ProviderDisplayName,
+    bool IsBound,
+    string CallbackUrl);
+
+public sealed record SsoBindingStartResponse(string LoginUrl);
+
+public sealed record SsoUnbindRequest(
+    [Required, MaxLength(100)] string Password);

src/Jiaowu.Api/Controllers/StudentProfileController.cs

@@ -0,0 +1,158 @@
+using System.ComponentModel.DataAnnotations;
+using Jiaowu.Api.Domain.Academic;
+using Jiaowu.Api.Domain.Identity;
+using Jiaowu.Api.Infrastructure.Auth;
+using Jiaowu.Api.Infrastructure.Caching;
+using Jiaowu.Api.Infrastructure.Persistence;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Jiaowu.Api.Controllers;
+
+[ApiController]
+[Authorize(Roles = SystemRoles.Student)]
+[Route("api/student/profile")]
+public sealed class StudentProfileController(
+    AppDbContext db,
+    ICurrentUserDataScope currentUserDataScope,
+    IAppCache cache) : ControllerBase
+{
+    [HttpGet]
+    public async Task<ActionResult<StudentProfileDto>> Get(
+        CancellationToken cancellationToken)
+    {
+        var userId = currentUserDataScope.Current.UserId;
+        var profile = await db.Students.AsNoTracking()
+            .Where(x => x.UserId == userId)
+            .Select(x => new StudentProfileDto(
+                x.StudentNumber,
+                x.Name,
+                x.AdministrativeClass!.Name,
+                x.AdministrativeClass.Major!.Name,
+                x.AdministrativeClass.Major.College!.Name,
+                x.EnrollmentYear,
+                x.EnrollmentDate,
+                x.Status,
+                x.Gender,
+                x.DateOfBirth,
+                x.EnglishName,
+                x.IdCardNumber,
+                x.Nationality,
+                x.Ethnicity,
+                x.PoliticalStatus,
+                x.NativePlace,
+                x.HouseholdAddress,
+                x.CurrentAddress,
+                x.PostalCode,
+                x.Phone,
+                x.Email,
+                x.Qq,
+                x.WeChat,
+                x.EmergencyContactName,
+                x.EmergencyContactRelationship,
+                x.EmergencyContactPhone,
+                x.SpecialTags,
+                x.SpecialNeeds,
+                x.Biography))
+            .SingleOrDefaultAsync(cancellationToken);
+
+        return profile is null ? NotFound() : Ok(profile);
+    }
+
+    [HttpPut]
+    public async Task<IActionResult> Update(
+        StudentProfileUpdateRequest request,
+        CancellationToken cancellationToken)
+    {
+        var userId = currentUserDataScope.Current.UserId;
+        var student = await db.Students.SingleOrDefaultAsync(
+            x => x.UserId == userId,
+            cancellationToken);
+        if (student is null) return NotFound();
+
+        student.Gender = request.Gender;
+        student.DateOfBirth = request.DateOfBirth;
+        student.EnglishName = Normalize(request.EnglishName);
+        student.IdCardNumber = Normalize(request.IdCardNumber);
+        student.Nationality = Normalize(request.Nationality);
+        student.Ethnicity = Normalize(request.Ethnicity);
+        student.PoliticalStatus = Normalize(request.PoliticalStatus);
+        student.NativePlace = Normalize(request.NativePlace);
+        student.HouseholdAddress = Normalize(request.HouseholdAddress);
+        student.CurrentAddress = Normalize(request.CurrentAddress);
+        student.PostalCode = Normalize(request.PostalCode);
+        student.Phone = Normalize(request.Phone);
+        student.Email = Normalize(request.Email);
+        student.Qq = Normalize(request.Qq);
+        student.WeChat = Normalize(request.WeChat);
+        student.EmergencyContactName = Normalize(request.EmergencyContactName);
+        student.EmergencyContactRelationship = Normalize(
+            request.EmergencyContactRelationship);
+        student.EmergencyContactPhone = Normalize(request.EmergencyContactPhone);
+        student.SpecialTags = Normalize(request.SpecialTags);
+        student.SpecialNeeds = Normalize(request.SpecialNeeds);
+        student.Biography = Normalize(request.Biography);
+
+        await db.SaveChangesAsync(cancellationToken);
+        await cache.RemoveByTagAsync(AppCacheTags.Analytics, cancellationToken);
+        return NoContent();
+    }
+
+    private static string? Normalize(string? value) =>
+        string.IsNullOrWhiteSpace(value) ? null : value.Trim();
+}
+
+public sealed record StudentProfileDto(
+    string StudentNumber,
+    string Name,
+    string ClassName,
+    string MajorName,
+    string CollegeName,
+    int EnrollmentYear,
+    DateOnly EnrollmentDate,
+    StudentStatus Status,
+    Gender Gender,
+    DateOnly? DateOfBirth,
+    string? EnglishName,
+    string? IdCardNumber,
+    string? Nationality,
+    string? Ethnicity,
+    string? PoliticalStatus,
+    string? NativePlace,
+    string? HouseholdAddress,
+    string? CurrentAddress,
+    string? PostalCode,
+    string? Phone,
+    string? Email,
+    string? Qq,
+    string? WeChat,
+    string? EmergencyContactName,
+    string? EmergencyContactRelationship,
+    string? EmergencyContactPhone,
+    string? SpecialTags,
+    string? SpecialNeeds,
+    string? Biography);
+
+public sealed record StudentProfileUpdateRequest(
+    Gender Gender,
+    DateOnly? DateOfBirth,
+    [MaxLength(100)] string? EnglishName,
+    [MaxLength(30)] string? IdCardNumber,
+    [MaxLength(50)] string? Nationality,
+    [MaxLength(50)] string? Ethnicity,
+    [MaxLength(50)] string? PoliticalStatus,
+    [MaxLength(100)] string? NativePlace,
+    [MaxLength(300)] string? HouseholdAddress,
+    [MaxLength(300)] string? CurrentAddress,
+    [MaxLength(20)] string? PostalCode,
+    [MaxLength(30)] string? Phone,
+    [EmailAddress, MaxLength(100)] string? Email,
+    [MaxLength(30)] string? Qq,
+    [MaxLength(60)] string? WeChat,
+    [MaxLength(50)] string? EmergencyContactName,
+    [MaxLength(30)] string? EmergencyContactRelationship,
+    [MaxLength(30)] string? EmergencyContactPhone,
+    [MaxLength(300)] string? SpecialTags,
+    [MaxLength(1000)] string? SpecialNeeds,
+    [MaxLength(1000)] string? Biography);

src/Jiaowu.Api/Domain/Academic/PeopleAndCourseEntities.cs

@@ -30,8 +30,25 @@ public sealed class Student : EntityBase
     public DateOnly EnrollmentDate { get; set; }
     public StudentStatus Status { get; set; } = StudentStatus.Active;
     public DateOnly? DateOfBirth { get; set; }
+    public string? EnglishName { get; set; }
+    public string? IdCardNumber { get; set; }
+    public string? Nationality { get; set; }
+    public string? Ethnicity { get; set; }
+    public string? PoliticalStatus { get; set; }
+    public string? NativePlace { get; set; }
+    public string? HouseholdAddress { get; set; }
+    public string? CurrentAddress { get; set; }
+    public string? PostalCode { get; set; }
     public string? Phone { get; set; }
     public string? Email { get; set; }
+    public string? Qq { get; set; }
+    public string? WeChat { get; set; }
+    public string? EmergencyContactName { get; set; }
+    public string? EmergencyContactRelationship { get; set; }
+    public string? EmergencyContactPhone { get; set; }
+    public string? SpecialTags { get; set; }
+    public string? SpecialNeeds { get; set; }
+    public string? Biography { get; set; }
     public string? Notes { get; set; }
     public Guid? UserId { get; set; }
 }

src/Jiaowu.Api/Domain/Identity/RefreshSession.cs

@@ -0,0 +1,22 @@
+namespace Jiaowu.Api.Domain.Identity;
+
+public enum AuthenticationClientType
+{
+    Web = 0,
+    App = 1
+}
+
+public sealed class RefreshSession
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    public Guid UserId { get; set; }
+    public ApplicationUser? User { get; set; }
+    public required string TokenHash { get; set; }
+    public AuthenticationClientType ClientType { get; set; }
+    public required string SecurityStamp { get; set; }
+    public DateTime ExpiresAt { get; set; }
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+    public DateTime LastRefreshedAt { get; set; } = DateTime.UtcNow;
+    public DateTime? RevokedAt { get; set; }
+    public Guid? ReplacedBySessionId { get; set; }
+}

src/Jiaowu.Api/Infrastructure/Auth/AuthSessionService.cs

@@ -0,0 +1,180 @@
+using System.Security.Cryptography;
+using Jiaowu.Api.Domain.Identity;
+using Jiaowu.Api.Infrastructure.Persistence;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+
+namespace Jiaowu.Api.Infrastructure.Auth;
+
+public interface IAuthSessionService
+{
+    Task<AuthSessionResult> CreateAsync(
+        ApplicationUser user,
+        IEnumerable<string> roles,
+        AuthenticationClientType clientType,
+        CancellationToken cancellationToken = default);
+
+    Task<AuthSessionResult?> RefreshAsync(
+        string refreshToken,
+        CancellationToken cancellationToken = default);
+
+    Task RevokeAsync(
+        string refreshToken,
+        CancellationToken cancellationToken = default);
+}
+
+public sealed record AuthSessionResult(
+    string AccessToken,
+    DateTime AccessTokenExpiresAt,
+    string RefreshToken,
+    DateTime SessionExpiresAt,
+    ApplicationUser User,
+    IReadOnlyList<string> Roles);
+
+public sealed class AuthSessionService(
+    AppDbContext db,
+    UserManager<ApplicationUser> userManager,
+    ITokenService tokenService,
+    IOptions<JwtOptions> options) : IAuthSessionService
+{
+    private readonly JwtOptions _options = options.Value;
+
+    public async Task<AuthSessionResult> CreateAsync(
+        ApplicationUser user,
+        IEnumerable<string> roles,
+        AuthenticationClientType clientType,
+        CancellationToken cancellationToken = default)
+    {
+        var roleList = roles.ToList();
+        var now = DateTime.UtcNow;
+        var rawRefreshToken = CreateRefreshToken();
+        var session = new RefreshSession
+        {
+            UserId = user.Id,
+            TokenHash = HashToken(rawRefreshToken),
+            ClientType = clientType,
+            SecurityStamp = user.SecurityStamp ?? string.Empty,
+            CreatedAt = now,
+            LastRefreshedAt = now,
+            ExpiresAt = now.Add(GetIdleTimeout(clientType))
+        };
+
+        await RemoveExpiredSessionsAsync(user.Id, now, cancellationToken);
+        db.RefreshSessions.Add(session);
+        await db.SaveChangesAsync(cancellationToken);
+
+        return BuildResult(user, roleList, rawRefreshToken, session.ExpiresAt);
+    }
+
+    public async Task<AuthSessionResult?> RefreshAsync(
+        string refreshToken,
+        CancellationToken cancellationToken = default)
+    {
+        var tokenHash = HashToken(refreshToken);
+        var now = DateTime.UtcNow;
+        var current = await db.RefreshSessions
+            .Include(x => x.User)
+            .SingleOrDefaultAsync(x => x.TokenHash == tokenHash, cancellationToken);
+        var user = current?.User;
+        if (current is null || user is null || current.RevokedAt.HasValue ||
+            current.ExpiresAt <= now || !user.IsEnabled ||
+            await userManager.IsLockedOutAsync(user) ||
+            !string.Equals(current.SecurityStamp, user.SecurityStamp ?? string.Empty,
+                StringComparison.Ordinal))
+        {
+            return null;
+        }
+
+        var newRawToken = CreateRefreshToken();
+        var replacement = new RefreshSession
+        {
+            UserId = user.Id,
+            TokenHash = HashToken(newRawToken),
+            ClientType = current.ClientType,
+            SecurityStamp = current.SecurityStamp,
+            CreatedAt = now,
+            LastRefreshedAt = now,
+            ExpiresAt = now.Add(GetIdleTimeout(current.ClientType))
+        };
+
+        var rotated = await db.ExecuteInRetriableTransactionAsync(
+            async transaction =>
+            {
+                db.ChangeTracker.Clear();
+                var updated = await db.RefreshSessions
+                    .Where(x => x.Id == current.Id && x.RevokedAt == null && x.ExpiresAt > now)
+                    .ExecuteUpdateAsync(setters => setters
+                        .SetProperty(x => x.RevokedAt, now)
+                        .SetProperty(x => x.ReplacedBySessionId, replacement.Id),
+                        cancellationToken);
+                if (updated != 1)
+                {
+                    await transaction.RollbackAsync(cancellationToken);
+                    return false;
+                }
+
+                db.RefreshSessions.Add(replacement);
+                await db.SaveChangesAsync(cancellationToken);
+                await transaction.CommitAsync(cancellationToken);
+                return true;
+            },
+            cancellationToken);
+        if (!rotated) return null;
+
+        var roles = await userManager.GetRolesAsync(user);
+        return BuildResult(user, roles.ToList(), newRawToken, replacement.ExpiresAt);
+    }
+
+    public async Task RevokeAsync(
+        string refreshToken,
+        CancellationToken cancellationToken = default)
+    {
+        var tokenHash = HashToken(refreshToken);
+        var now = DateTime.UtcNow;
+        await db.RefreshSessions
+            .Where(x => x.TokenHash == tokenHash && x.RevokedAt == null)
+            .ExecuteUpdateAsync(
+                setters => setters.SetProperty(x => x.RevokedAt, now),
+                cancellationToken);
+    }
+
+    private AuthSessionResult BuildResult(
+        ApplicationUser user,
+        IReadOnlyList<string> roles,
+        string refreshToken,
+        DateTime sessionExpiresAt)
+    {
+        var accessToken = tokenService.Create(user, roles);
+        return new AuthSessionResult(
+            accessToken.Token,
+            accessToken.ExpiresAt,
+            refreshToken,
+            sessionExpiresAt,
+            user,
+            roles);
+    }
+
+    private TimeSpan GetIdleTimeout(AuthenticationClientType clientType) =>
+        TimeSpan.FromMinutes(clientType == AuthenticationClientType.App
+            ? _options.AppIdleMinutes
+            : _options.WebIdleMinutes);
+
+    private async Task RemoveExpiredSessionsAsync(
+        Guid userId,
+        DateTime now,
+        CancellationToken cancellationToken)
+    {
+        var retentionCutoff = now.AddDays(-7);
+        await db.RefreshSessions
+            .Where(x => x.UserId == userId &&
+                (x.ExpiresAt < now || x.RevokedAt < retentionCutoff))
+            .ExecuteDeleteAsync(cancellationToken);
+    }
+
+    private static string CreateRefreshToken() =>
+        Convert.ToBase64String(RandomNumberGenerator.GetBytes(48));
+
+    private static string HashToken(string token) =>
+        Convert.ToHexString(SHA256.HashData(System.Text.Encoding.UTF8.GetBytes(token)));
+}

src/Jiaowu.Api/Infrastructure/Auth/JwtOptions.cs

@@ -6,5 +6,7 @@ public sealed class JwtOptions
     public string Issuer { get; set; } = "Jiaowu.Api";
     public string Audience { get; set; } = "Jiaowu.Web";
     public string Key { get; set; } = string.Empty;
-    public int ExpireMinutes { get; set; } = 480;
+    public int AccessTokenMinutes { get; set; } = 10;
+    public int WebIdleMinutes { get; set; } = 30;
+    public int AppIdleMinutes { get; set; } = 3 * 24 * 60;
 }

src/Jiaowu.Api/Infrastructure/Auth/SsoOptions.cs

@@ -0,0 +1,24 @@
+namespace Jiaowu.Api.Infrastructure.Auth;
+
+public sealed class SsoOptions
+{
+    public const string SectionName = "Sso";
+
+    public bool Enabled { get; set; }
+    public string DisplayName { get; set; } = "学校统一身份认证";
+    public string Authority { get; set; } = string.Empty;
+    public string ClientId { get; set; } = string.Empty;
+    public string ClientSecret { get; set; } = string.Empty;
+    public string UserNameClaim { get; set; } = "preferred_username";
+    public bool RequireHttpsMetadata { get; set; } = true;
+    public bool LinkExistingUsersByUserName { get; set; } = true;
+    public string FrontendBaseUrl { get; set; } = string.Empty;
+    public string CallbackUrl { get; set; } = string.Empty;
+}
+
+public static class SsoAuthSchemes
+{
+    public const string Keycloak = "Keycloak";
+    public const string ExternalCookie = "KeycloakExternal";
+    public const string LoginProvider = "Keycloak";
+}

src/Jiaowu.Api/Infrastructure/Auth/TokenService.cs

@@ -9,14 +9,16 @@ namespace Jiaowu.Api.Infrastructure.Auth;
 
 public interface ITokenService
 {
-    string Create(ApplicationUser user, IEnumerable<string> roles);
+    AccessTokenResult Create(ApplicationUser user, IEnumerable<string> roles);
 }
 
+public sealed record AccessTokenResult(string Token, DateTime ExpiresAt);
+
 public sealed class TokenService(IOptions<JwtOptions> options) : ITokenService
 {
     private readonly JwtOptions _options = options.Value;
 
-    public string Create(ApplicationUser user, IEnumerable<string> roles)
+    public AccessTokenResult Create(ApplicationUser user, IEnumerable<string> roles)
     {
         var claims = new List<Claim>
         {
@@ -37,13 +39,16 @@ public sealed class TokenService(IOptions<JwtOptions> options) : ITokenService
             new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_options.Key)),
             SecurityAlgorithms.HmacSha256);
 
+        var expiresAt = DateTime.UtcNow.AddMinutes(_options.AccessTokenMinutes);
         var token = new JwtSecurityToken(
             issuer: _options.Issuer,
             audience: _options.Audience,
             claims: claims,
-            expires: DateTime.UtcNow.AddMinutes(_options.ExpireMinutes),
+            expires: expiresAt,
             signingCredentials: credentials);
 
-        return new JwtSecurityTokenHandler().WriteToken(token);
+        return new AccessTokenResult(
+            new JwtSecurityTokenHandler().WriteToken(token),
+            expiresAt);
     }
 }

src/Jiaowu.Api/Infrastructure/Persistence/AppDbContext.cs

@@ -127,6 +127,7 @@ public sealed class AppDbContext(DbContextOptions<AppDbContext> options)
         Set<BackgroundJobOutboxMessage>();
     public DbSet<AppUpdateRelease> AppUpdateReleases =>
         Set<AppUpdateRelease>();
+    public DbSet<RefreshSession> RefreshSessions => Set<RefreshSession>();
 
     protected override void ConfigureConventions(
         ModelConfigurationBuilder configurationBuilder)
@@ -163,6 +164,21 @@ public sealed class AppDbContext(DbContextOptions<AppDbContext> options)
             entity.Property(x => x.Description).HasMaxLength(100);
         });
 
+        builder.Entity<RefreshSession>(entity =>
+        {
+            entity.Property(x => x.TokenHash).HasMaxLength(64);
+            entity.Property(x => x.SecurityStamp).HasMaxLength(100);
+            entity.Property(x => x.ClientType)
+                .HasConversion<string>()
+                .HasMaxLength(20);
+            entity.HasIndex(x => x.TokenHash).IsUnique();
+            entity.HasIndex(x => new { x.UserId, x.ExpiresAt });
+            entity.HasOne(x => x.User)
+                .WithMany()
+                .HasForeignKey(x => x.UserId)
+                .OnDelete(DeleteBehavior.Cascade);
+        });
+
         ConfigureCatalog<Campus>(builder);
         ConfigureCatalog<College>(builder);
         ConfigureCatalog<Major>(builder);
@@ -241,8 +257,25 @@ public sealed class AppDbContext(DbContextOptions<AppDbContext> options)
         {
             entity.Property(x => x.StudentNumber).HasMaxLength(30);
             entity.Property(x => x.Name).HasMaxLength(50);
+            entity.Property(x => x.EnglishName).HasMaxLength(100);
+            entity.Property(x => x.IdCardNumber).HasMaxLength(30);
+            entity.Property(x => x.Nationality).HasMaxLength(50);
+            entity.Property(x => x.Ethnicity).HasMaxLength(50);
+            entity.Property(x => x.PoliticalStatus).HasMaxLength(50);
+            entity.Property(x => x.NativePlace).HasMaxLength(100);
+            entity.Property(x => x.HouseholdAddress).HasMaxLength(300);
+            entity.Property(x => x.CurrentAddress).HasMaxLength(300);
+            entity.Property(x => x.PostalCode).HasMaxLength(20);
             entity.Property(x => x.Phone).HasMaxLength(30);
             entity.Property(x => x.Email).HasMaxLength(100);
+            entity.Property(x => x.Qq).HasMaxLength(30);
+            entity.Property(x => x.WeChat).HasMaxLength(60);
+            entity.Property(x => x.EmergencyContactName).HasMaxLength(50);
+            entity.Property(x => x.EmergencyContactRelationship).HasMaxLength(30);
+            entity.Property(x => x.EmergencyContactPhone).HasMaxLength(30);
+            entity.Property(x => x.SpecialTags).HasMaxLength(300);
+            entity.Property(x => x.SpecialNeeds).HasMaxLength(1000);
+            entity.Property(x => x.Biography).HasMaxLength(1000);
             entity.Property(x => x.Notes).HasMaxLength(500);
             entity.HasIndex(x => x.StudentNumber).IsUnique();
             entity.HasIndex(x => new { x.AdministrativeClassId, x.Status });

src/Jiaowu.Api/Infrastructure/Persistence/DevelopmentSqliteMigrator.cs

@@ -78,6 +78,10 @@ public sealed class DevelopmentSqliteMigrator(
         "20260729_41_app_update_releases";
     private const string IntegratedExperimentSchedulingMigration =
         "20260802_42_integrated_experiment_scheduling";
+    private const string RefreshSessionsMigration =
+        "20260803_43_refresh_sessions";
+    private const string StudentPersonalProfileMigration =
+        "20260803_44_student_personal_profile";
 
     public async Task MigrateAsync(CancellationToken cancellationToken = default)
     {
@@ -593,6 +597,22 @@ public sealed class DevelopmentSqliteMigrator(
                 ? []
                 : IntegratedExperimentSchedulingStatements,
             cancellationToken);
+        await ApplyMigrationAsync(
+            RefreshSessionsMigration,
+            RefreshSessionsStatements,
+            cancellationToken);
+        var studentPersonalProfileExists = await db.Database
+            .SqlQueryRaw<int>(
+                """
+                SELECT COUNT(*) AS "Value"
+                FROM pragma_table_info('Students')
+                WHERE name = 'SpecialTags'
+                """)
+            .AnyAsync(value => value > 0, cancellationToken);
+        await ApplyMigrationAsync(
+            StudentPersonalProfileMigration,
+            studentPersonalProfileExists ? [] : StudentPersonalProfileStatements,
+            cancellationToken);
     }
 
     private async Task ApplyMigrationAsync(
@@ -2104,6 +2124,55 @@ public sealed class DevelopmentSqliteMigrator(
         """
     ];
 
+    private static readonly string[] RefreshSessionsStatements =
+    [
+        """
+        CREATE TABLE IF NOT EXISTS "RefreshSessions" (
+            "Id" TEXT NOT NULL CONSTRAINT "PK_RefreshSessions" PRIMARY KEY,
+            "UserId" TEXT NOT NULL,
+            "TokenHash" TEXT NOT NULL,
+            "ClientType" TEXT NOT NULL,
+            "SecurityStamp" TEXT NOT NULL,
+            "ExpiresAt" TEXT NOT NULL,
+            "CreatedAt" TEXT NOT NULL,
+            "LastRefreshedAt" TEXT NOT NULL,
+            "RevokedAt" TEXT NULL,
+            "ReplacedBySessionId" TEXT NULL,
+            CONSTRAINT "FK_RefreshSessions_AspNetUsers_UserId"
+                FOREIGN KEY ("UserId") REFERENCES "AspNetUsers" ("Id") ON DELETE CASCADE
+        );
+        """,
+        """
+        CREATE UNIQUE INDEX IF NOT EXISTS "IX_RefreshSessions_TokenHash"
+            ON "RefreshSessions" ("TokenHash");
+        """,
+        """
+        CREATE INDEX IF NOT EXISTS "IX_RefreshSessions_UserId_ExpiresAt"
+            ON "RefreshSessions" ("UserId", "ExpiresAt");
+        """
+    ];
+
+    private static readonly string[] StudentPersonalProfileStatements =
+    [
+        """ALTER TABLE "Students" ADD COLUMN "Biography" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "CurrentAddress" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "EmergencyContactName" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "EmergencyContactPhone" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "EmergencyContactRelationship" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "EnglishName" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "Ethnicity" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "HouseholdAddress" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "IdCardNumber" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "Nationality" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "NativePlace" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "PoliticalStatus" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "PostalCode" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "Qq" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "SpecialNeeds" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "SpecialTags" TEXT NULL;""",
+        """ALTER TABLE "Students" ADD COLUMN "WeChat" TEXT NULL;"""
+    ];
+
     private static readonly string[] ApprovalTableStatements =
     [
         """CREATE TABLE "CourseExemptions" ("Id" TEXT NOT NULL CONSTRAINT "PK_CourseExemptions" PRIMARY KEY, "StudentId" TEXT NOT NULL, "TeachingTaskId" TEXT NOT NULL, "Reason" TEXT NOT NULL, "Status" INTEGER NOT NULL, "ReviewComment" TEXT NULL, "SubmittedAt" TEXT NOT NULL, "ReviewedAt" TEXT NULL, "ReviewedByUserId" TEXT NULL, "CreatedAt" TEXT NOT NULL, "UpdatedAt" TEXT NOT NULL, CONSTRAINT "FK_CourseExemptions_Students" FOREIGN KEY ("StudentId") REFERENCES "Students" ("Id") ON DELETE RESTRICT, CONSTRAINT "FK_CourseExemptions_TeachingTasks" FOREIGN KEY ("TeachingTaskId") REFERENCES "TeachingTasks" ("Id") ON DELETE RESTRICT);""",

src/Jiaowu.Api/Infrastructure/Persistence/Migrations/MySql/20260803094013_RefreshSessions.cs

@@ -0,0 +1,60 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Jiaowu.Api.Infrastructure.Persistence.Migrations.MySql
+{
+    /// <inheritdoc />
+    public partial class RefreshSessions : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "RefreshSessions",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "char(36)", nullable: false),
+                    UserId = table.Column<Guid>(type: "char(36)", nullable: false),
+                    TokenHash = table.Column<string>(type: "varchar(64)", maxLength: 64, nullable: false),
+                    ClientType = table.Column<string>(type: "varchar(20)", maxLength: 20, nullable: false),
+                    SecurityStamp = table.Column<string>(type: "varchar(100)", maxLength: 100, nullable: false),
+                    ExpiresAt = table.Column<DateTime>(type: "datetime(6)", nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "datetime(6)", nullable: false),
+                    LastRefreshedAt = table.Column<DateTime>(type: "datetime(6)", nullable: false),
+                    RevokedAt = table.Column<DateTime>(type: "datetime(6)", nullable: true),
+                    ReplacedBySessionId = table.Column<Guid>(type: "char(36)", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_RefreshSessions", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_RefreshSessions_AspNetUsers_UserId",
+                        column: x => x.UserId,
+                        principalTable: "AspNetUsers",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                })
+                .Annotation("MySQL:Charset", "utf8mb4");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_RefreshSessions_TokenHash",
+                table: "RefreshSessions",
+                column: "TokenHash",
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_RefreshSessions_UserId_ExpiresAt",
+                table: "RefreshSessions",
+                columns: new[] { "UserId", "ExpiresAt" });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "RefreshSessions");
+        }
+    }
+}

src/Jiaowu.Api/Infrastructure/Persistence/Migrations/MySql/20260803124242_StudentPersonalProfile.cs

@@ -0,0 +1,205 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Jiaowu.Api.Infrastructure.Persistence.Migrations.MySql
+{
+    /// <inheritdoc />
+    public partial class StudentPersonalProfile : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "Biography",
+                table: "Students",
+                type: "varchar(1000)",
+                maxLength: 1000,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "CurrentAddress",
+                table: "Students",
+                type: "varchar(300)",
+                maxLength: 300,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "EmergencyContactName",
+                table: "Students",
+                type: "varchar(50)",
+                maxLength: 50,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "EmergencyContactPhone",
+                table: "Students",
+                type: "varchar(30)",
+                maxLength: 30,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "EmergencyContactRelationship",
+                table: "Students",
+                type: "varchar(30)",
+                maxLength: 30,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "EnglishName",
+                table: "Students",
+                type: "varchar(100)",
+                maxLength: 100,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "Ethnicity",
+                table: "Students",
+                type: "varchar(50)",
+                maxLength: 50,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "HouseholdAddress",
+                table: "Students",
+                type: "varchar(300)",
+                maxLength: 300,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "IdCardNumber",
+                table: "Students",
+                type: "varchar(30)",
+                maxLength: 30,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "Nationality",
+                table: "Students",
+                type: "varchar(50)",
+                maxLength: 50,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "NativePlace",
+                table: "Students",
+                type: "varchar(100)",
+                maxLength: 100,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "PoliticalStatus",
+                table: "Students",
+                type: "varchar(50)",
+                maxLength: 50,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "PostalCode",
+                table: "Students",
+                type: "varchar(20)",
+                maxLength: 20,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "Qq",
+                table: "Students",
+                type: "varchar(30)",
+                maxLength: 30,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "SpecialNeeds",
+                table: "Students",
+                type: "varchar(1000)",
+                maxLength: 1000,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "SpecialTags",
+                table: "Students",
+                type: "varchar(300)",
+                maxLength: 300,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "WeChat",
+                table: "Students",
+                type: "varchar(60)",
+                maxLength: 60,
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "Biography",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "CurrentAddress",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "EmergencyContactName",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "EmergencyContactPhone",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "EmergencyContactRelationship",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "EnglishName",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "Ethnicity",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "HouseholdAddress",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "IdCardNumber",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "Nationality",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "NativePlace",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "PoliticalStatus",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "PostalCode",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "Qq",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "SpecialNeeds",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "SpecialTags",
+                table: "Students");
+
+            migrationBuilder.DropColumn(
+                name: "WeChat",
+                table: "Students");
+        }
+    }
+}

src/Jiaowu.Api/Infrastructure/Persistence/Migrations/MySql/AppDbContextModelSnapshot.cs

@@ -3297,6 +3297,7 @@ namespace Jiaowu.Api.Infrastructure.Persistence.Migrations.MySql
                         .HasColumnType("int");
 
                     b.Property<int>("Kind")
+                        .ValueGeneratedOnAdd()
                         .HasColumnType("int")
                         .HasDefaultValue(1);
 
@@ -3491,9 +3492,17 @@ namespace Jiaowu.Api.Infrastructure.Persistence.Migrations.MySql
                     b.Property<Guid>("AdministrativeClassId")
                         .HasColumnType("char(36)");
 
+                    b.Property<string>("Biography")
+                        .HasMaxLength(1000)
+                        .HasColumnType("varchar(1000)");
+
                     b.Property<DateTime>("CreatedAt")
                         .HasColumnType("datetime(6)");
 
+                    b.Property<string>("CurrentAddress")
+                        .HasMaxLength(300)
+                        .HasColumnType("varchar(300)");
+
                     b.Property<DateTime?>("DateOfBirth")
                         .HasColumnType("date");
 
@@ -3501,20 +3510,56 @@ namespace Jiaowu.Api.Infrastructure.Persistence.Migrations.MySql
                         .HasMaxLength(100)
                         .HasColumnType("varchar(100)");
 
+                    b.Property<string>("EmergencyContactName")
+                        .HasMaxLength(50)
+                        .HasColumnType("varchar(50)");
+
+                    b.Property<string>("EmergencyContactPhone")
+                        .HasMaxLength(30)
+                        .HasColumnType("varchar(30)");
+
+                    b.Property<string>("EmergencyContactRelationship")
+                        .HasMaxLength(30)
+                        .HasColumnType("varchar(30)");
+
+                    b.Property<string>("EnglishName")
+                        .HasMaxLength(100)
+                        .HasColumnType("varchar(100)");
+
                     b.Property<DateTime>("EnrollmentDate")
                         .HasColumnType("date");
 
                     b.Property<int>("EnrollmentYear")
                         .HasColumnType("int");
 
+                    b.Property<string>("Ethnicity")
+                        .HasMaxLength(50)
+                        .HasColumnType("varchar(50)");
+
                     b.Property<int>("Gender")
                         .HasColumnType("int");
 
+                    b.Property<string>("HouseholdAddress")
+                        .HasMaxLength(300)
+                        .HasColumnType("varchar(300)");
+
+                    b.Property<string>("IdCardNumber")
+                        .HasMaxLength(30)
+                        .HasColumnType("varchar(30)");
+
                     b.Property<string>("Name")
                         .IsRequired()
                         .HasMaxLength(50)
                         .HasColumnType("varchar(50)");
 
+                    b.Property<string>("Nationality")
+                        .HasMaxLength(50)
+                        .HasColumnType("varchar(50)");
+
+                    b.Property<string>("NativePlace")
+                        .HasMaxLength(100)
+                        .HasColumnType("varchar(100)");
+
                     b.Property<string>("Notes")
                         .HasMaxLength(500)
                         .HasColumnType("varchar(500)");
@@ -3523,6 +3568,26 @@ namespace Jiaowu.Api.Infrastructure.Persistence.Migrations.MySql
                         .HasMaxLength(30)
                         .HasColumnType("varchar(30)");
 
+                    b.Property<string>("PoliticalStatus")
+                        .HasMaxLength(50)
+                        .HasColumnType("varchar(50)");
+
+                    b.Property<string>("PostalCode")
+                        .HasMaxLength(20)
+                        .HasColumnType("varchar(20)");
+
+                    b.Property<string>("Qq")
+                        .HasMaxLength(30)
+                        .HasColumnType("varchar(30)");
+
+                    b.Property<string>("SpecialNeeds")
+                        .HasMaxLength(1000)
+                        .HasColumnType("varchar(1000)");
+
+                    b.Property<string>("SpecialTags")
+                        .HasMaxLength(300)
+                        .HasColumnType("varchar(300)");
+
                     b.Property<int>("Status")
                         .HasColumnType("int");
 
@@ -3537,6 +3602,10 @@ namespace Jiaowu.Api.Infrastructure.Persistence.Migrations.MySql
                     b.Property<Guid?>("UserId")
                         .HasColumnType("char(36)");
 
+                    b.Property<string>("WeChat")
+                        .HasMaxLength(60)
+                        .HasColumnType("varchar(60)");
+
                     b.HasKey("Id");
 
                     b.HasIndex("EnrollmentYear");
@@ -4133,6 +4202,55 @@ namespace Jiaowu.Api.Infrastructure.Persistence.Migrations.MySql
                     b.ToTable("AspNetUsers", (string)null);
                 });
 
+            modelBuilder.Entity("Jiaowu.Api.Domain.Identity.RefreshSession", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("char(36)");
+
+                    b.Property<string>("ClientType")
+                        .IsRequired()
+                        .HasMaxLength(20)
+                        .HasColumnType("varchar(20)");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("datetime(6)");
+
+                    b.Property<DateTime>("ExpiresAt")
+                        .HasColumnType("datetime(6)");
+
+                    b.Property<DateTime>("LastRefreshedAt")
+                        .HasColumnType("datetime(6)");
+
+                    b.Property<Guid?>("ReplacedBySessionId")
+                        .HasColumnType("char(36)");
+
+                    b.Property<DateTime?>("RevokedAt")
+                        .HasColumnType("datetime(6)");
+
+                    b.Property<string>("SecurityStamp")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("varchar(100)");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("varchar(64)");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("char(36)");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TokenHash")
+                        .IsUnique();
+
+                    b.HasIndex("UserId", "ExpiresAt");
+
+                    b.ToTable("RefreshSessions");
+                });
+
             modelBuilder.Entity("Jiaowu.Api.Domain.System.AppUpdateRelease", b =>
                 {
                     b.Property<Guid>("Id")
@@ -5742,6 +5860,17 @@ namespace Jiaowu.Api.Infrastructure.Persistence.Migrations.MySql
                     b.Navigation("AcademicTerm");
                 });
 
+            modelBuilder.Entity("Jiaowu.Api.Domain.Identity.RefreshSession", b =>
+                {
+                    b.HasOne("Jiaowu.Api.Domain.Identity.ApplicationUser", "User")
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
             modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<System.Guid>", b =>
                 {
                     b.HasOne("Jiaowu.Api.Domain.Identity.ApplicationRole", null)

src/Jiaowu.Api/Jiaowu.Api.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <TargetFramework>net10.0</TargetFramework>
-    <Version>2.2.0</Version>
+    <Version>2.3.0-rc2</Version>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
     <SpaRoot>$([System.IO.Path]::GetFullPath('$(MSBuildProjectDirectory)/../../web'))</SpaRoot>
@@ -23,6 +23,7 @@
   <ItemGroup>
     <PackageReference Include="ClosedXML" Version="0.105.0" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="10.0.10" />
     <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Caching.Hybrid" Version="10.1.0" />
     <PackageReference Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="10.0.10" />

src/Jiaowu.Api/Program.cs

@@ -13,7 +13,10 @@ using Jiaowu.Api.Infrastructure.Operations;
 using Jiaowu.Api.Infrastructure.Persistence;
 using Jiaowu.Api.Infrastructure.Scheduling;
 using Jiaowu.Api.Infrastructure.Timetables;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Microsoft.AspNetCore.RateLimiting;
 using Microsoft.Data.Sqlite;
 using Microsoft.EntityFrameworkCore;
@@ -91,6 +94,29 @@ var performanceReportingOptions = builder.Configuration
 var rabbitMqOptions = builder.Configuration
     .GetSection(RabbitMqOptions.SectionName)
     .Get<RabbitMqOptions>() ?? new RabbitMqOptions();
+var ssoOptions = builder.Configuration
+    .GetSection(SsoOptions.SectionName)
+    .Get<SsoOptions>() ?? new SsoOptions();
+
+if (ssoOptions.Enabled &&
+    (string.IsNullOrWhiteSpace(ssoOptions.ClientId) ||
+     !Uri.TryCreate(ssoOptions.Authority, UriKind.Absolute, out var ssoAuthority) ||
+     ssoAuthority.Scheme is not ("http" or "https") ||
+     (ssoOptions.RequireHttpsMetadata && ssoAuthority.Scheme != "https") ||
+     string.IsNullOrWhiteSpace(ssoOptions.UserNameClaim) ||
+     (!string.IsNullOrWhiteSpace(ssoOptions.CallbackUrl) &&
+      (!Uri.TryCreate(ssoOptions.CallbackUrl, UriKind.Absolute, out var callbackUrl) ||
+       callbackUrl.Scheme is not ("http" or "https") ||
+       !callbackUrl.AbsolutePath.EndsWith(
+           "/signin-keycloak",
+           StringComparison.OrdinalIgnoreCase))) ||
+     (!string.IsNullOrWhiteSpace(ssoOptions.FrontendBaseUrl) &&
+      (!Uri.TryCreate(ssoOptions.FrontendBaseUrl, UriKind.Absolute, out var frontendBaseUrl) ||
+       frontendBaseUrl.Scheme is not ("http" or "https")))))
+{
+    throw new InvalidOperationException(
+        "启用 Sso 时必须配置有效的 Authority、ClientId、UserNameClaim、CallbackUrl 和 FrontendBaseUrl；CallbackUrl 必须以 /signin-keycloak 结尾，生产元数据地址必须使用 HTTPS。");
+}
 
 if (string.IsNullOrWhiteSpace(officialDocumentOptions.InstitutionName) ||
     string.IsNullOrWhiteSpace(officialDocumentOptions.IssuingOffice) ||
@@ -330,6 +356,10 @@ if (cacheOptions.Enabled && !string.IsNullOrWhiteSpace(redisConnectionString))
     builder.Services.AddStackExchangeRedisCache(options =>
         options.Configuration = redisConnectionString);
 }
+else
+{
+    builder.Services.AddDistributedMemoryCache();
+}
 builder.Services.AddHybridCache(options =>
 {
     options.MaximumKeyLength = 512;
@@ -360,11 +390,22 @@ if (Encoding.UTF8.GetByteCount(jwtOptions.Key) < 32 ||
     throw new InvalidOperationException(
         "Jwt:Key 必须配置为至少 32 字节的随机生产密钥，不能使用示例值。");
 }
+if (jwtOptions.AccessTokenMinutes is < 1 or > 30 ||
+    jwtOptions.WebIdleMinutes is < 5 or > 1440 ||
+    jwtOptions.AppIdleMinutes is < 60 or > 43200 ||
+    jwtOptions.AccessTokenMinutes > jwtOptions.WebIdleMinutes)
+{
+    throw new InvalidOperationException(
+        "Jwt 访问令牌或 Web/App 空闲有效期配置超出允许范围。");
+}
 
 builder.Services.Configure<JwtOptions>(
     builder.Configuration.GetSection(JwtOptions.SectionName));
+builder.Services.Configure<SsoOptions>(
+    builder.Configuration.GetSection(SsoOptions.SectionName));
 builder.Services.AddHttpContextAccessor();
 builder.Services.AddScoped<ITokenService, TokenService>();
+builder.Services.AddScoped<IAuthSessionService, AuthSessionService>();
 builder.Services.AddScoped<ICurrentUserDataScope, CurrentUserDataScope>();
 builder.Services.AddScoped<DatabaseInitializer>();
 builder.Services.AddScoped<DemoDataSeeder>();
@@ -407,8 +448,12 @@ builder.Services.AddHostedService<BackgroundJobOutboxPublisher>();
 builder.Services.AddSingleton<IOfficialDocumentPdfGenerator, OfficialDocumentPdfGenerator>();
 builder.Services.AddScoped<OfficialDocumentService>();
 
-builder.Services
-    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+var authentication = builder.Services
+    .AddAuthentication(options =>
+    {
+        options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
+        options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
+    })
     .AddJwtBearer(options =>
     {
         options.TokenValidationParameters = new TokenValidationParameters
@@ -423,7 +468,51 @@ builder.Services
                 Encoding.UTF8.GetBytes(jwtOptions.Key)),
             ClockSkew = TimeSpan.FromMinutes(1)
         };
+    })
+    .AddCookie(SsoAuthSchemes.ExternalCookie, options =>
+    {
+        options.Cookie.Name = "__Host-jiaowu-sso";
+        options.Cookie.HttpOnly = true;
+        options.Cookie.SameSite = SameSiteMode.Lax;
+        options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
+        options.ExpireTimeSpan = TimeSpan.FromMinutes(5);
     });
+if (ssoOptions.Enabled)
+{
+    authentication.AddOpenIdConnect(SsoAuthSchemes.Keycloak, options =>
+    {
+        options.Authority = ssoOptions.Authority.TrimEnd('/');
+        options.ClientId = ssoOptions.ClientId;
+        options.ClientSecret = ssoOptions.ClientSecret;
+        options.SignInScheme = SsoAuthSchemes.ExternalCookie;
+        options.ResponseType = "code";
+        options.UsePkce = true;
+        options.SaveTokens = false;
+        options.RequireHttpsMetadata = ssoOptions.RequireHttpsMetadata;
+        options.CallbackPath = "/signin-keycloak";
+        options.GetClaimsFromUserInfoEndpoint = true;
+        options.MapInboundClaims = false;
+        options.ClaimActions.MapUniqueJsonKey(
+            ssoOptions.UserNameClaim,
+            ssoOptions.UserNameClaim);
+        options.TokenValidationParameters.NameClaimType = ssoOptions.UserNameClaim;
+        options.Events.OnRedirectToIdentityProvider = context =>
+        {
+            if (!string.IsNullOrWhiteSpace(ssoOptions.CallbackUrl))
+                context.ProtocolMessage.RedirectUri = ssoOptions.CallbackUrl;
+            return Task.CompletedTask;
+        };
+        options.Events.OnRemoteFailure = context =>
+        {
+            context.HandleResponse();
+            var loginUrl = string.IsNullOrWhiteSpace(ssoOptions.FrontendBaseUrl)
+                ? "/login"
+                : ssoOptions.FrontendBaseUrl.TrimEnd('/') + "/login";
+            context.Response.Redirect(loginUrl + "?ssoError=authentication_failed");
+            return Task.CompletedTask;
+        };
+    });
+}
 builder.Services.AddAuthorization();
 builder.Services.AddRateLimiter(options =>
 {
@@ -438,6 +527,16 @@ builder.Services.AddRateLimiter(options =>
                 QueueLimit = 0,
                 AutoReplenishment = true
             }));
+    options.AddPolicy("token-refresh", context =>
+        RateLimitPartition.GetFixedWindowLimiter(
+            context.Connection.RemoteIpAddress?.ToString() ?? "unknown",
+            _ => new FixedWindowRateLimiterOptions
+            {
+                PermitLimit = 600,
+                Window = TimeSpan.FromMinutes(1),
+                QueueLimit = 0,
+                AutoReplenishment = true
+            }));
     options.AddPolicy("official-verification", context =>
         RateLimitPartition.GetFixedWindowLimiter(
             context.Connection.RemoteIpAddress?.ToString() ?? "unknown",

src/Jiaowu.Api/appsettings.Development.json

@@ -10,7 +10,13 @@
   },
   "Jwt": {
     "Key": "jiaowu-development-secret-key-change-before-production",
-    "ExpireMinutes": 480
+    "AccessTokenMinutes": 10,
+    "WebIdleMinutes": 30,
+    "AppIdleMinutes": 4320
+  },
+  "Sso": {
+    "FrontendBaseUrl": "http://localhost:5173",
+    "CallbackUrl": "http://localhost:5255/signin-keycloak"
   },
   "Cors": {
     "Origins": [

src/Jiaowu.Api/appsettings.json

@@ -77,7 +77,21 @@
     "Issuer": "Jiaowu.Api",
     "Audience": "Jiaowu.Web",
     "Key": "",
-    "ExpireMinutes": 60
+    "AccessTokenMinutes": 10,
+    "WebIdleMinutes": 30,
+    "AppIdleMinutes": 4320
+  },
+  "Sso": {
+    "Enabled": false,
+    "DisplayName": "学校统一身份认证",
+    "Authority": "",
+    "ClientId": "",
+    "ClientSecret": "",
+    "UserNameClaim": "preferred_username",
+    "RequireHttpsMetadata": true,
+    "LinkExistingUsersByUserName": true,
+    "FrontendBaseUrl": "",
+    "CallbackUrl": ""
   },
   "Cors": {
     "Origins": [

tests/Jiaowu.Api.Tests/AuthControllerTests.cs

@@ -107,7 +107,7 @@ public sealed class AuthControllerTests
         var controller = new AuthController(
             db,
             userManager,
-            new StubTokenService(),
+            new StubAuthSessionService(),
             NoOpAppCache.Instance);
         var request = new StudentActivationRequest(
             student.Name,
@@ -143,8 +143,27 @@ public sealed class AuthControllerTests
         protected override bool ShouldRetryOn(Exception exception) => false;
     }
 
-    private sealed class StubTokenService : ITokenService
+    private sealed class StubAuthSessionService : IAuthSessionService
     {
-        public string Create(ApplicationUser user, IEnumerable<string> roles) => string.Empty;
+        public Task<AuthSessionResult> CreateAsync(
+            ApplicationUser user,
+            IEnumerable<string> roles,
+            AuthenticationClientType clientType,
+            CancellationToken cancellationToken = default) =>
+            Task.FromResult(new AuthSessionResult(
+                string.Empty,
+                DateTime.UtcNow.AddMinutes(10),
+                "test-refresh-token-value-with-sufficient-length",
+                DateTime.UtcNow.AddMinutes(30),
+                user,
+                roles.ToList()));
+
+        public Task<AuthSessionResult?> RefreshAsync(
+            string refreshToken,
+            CancellationToken cancellationToken = default) => Task.FromResult<AuthSessionResult?>(null);
+
+        public Task RevokeAsync(
+            string refreshToken,
+            CancellationToken cancellationToken = default) => Task.CompletedTask;
     }
 }

tests/Jiaowu.Api.Tests/AuthSessionServiceTests.cs

@@ -0,0 +1,133 @@
+using Jiaowu.Api.Domain.Identity;
+using Jiaowu.Api.Infrastructure.Auth;
+using Jiaowu.Api.Infrastructure.Persistence;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Jiaowu.Api.Tests;
+
+public sealed class AuthSessionServiceTests
+{
+    [Fact]
+    public async Task Web_session_rotates_refresh_token_and_rejects_reuse()
+    {
+        await using var fixture = await SessionFixture.CreateAsync();
+
+        var issued = await fixture.Service.CreateAsync(
+            fixture.User,
+            [SystemRoles.Student],
+            AuthenticationClientType.Web);
+
+        Assert.InRange(
+            issued.SessionExpiresAt,
+            DateTime.UtcNow.AddMinutes(29),
+            DateTime.UtcNow.AddMinutes(31));
+        var stored = await fixture.Db.RefreshSessions.SingleAsync();
+        Assert.NotEqual(issued.RefreshToken, stored.TokenHash);
+
+        var refreshed = await fixture.Service.RefreshAsync(issued.RefreshToken);
+
+        Assert.NotNull(refreshed);
+        Assert.NotEqual(issued.RefreshToken, refreshed.RefreshToken);
+        Assert.Null(await fixture.Service.RefreshAsync(issued.RefreshToken));
+        Assert.Equal(1, await fixture.Db.RefreshSessions.CountAsync(x => x.RevokedAt == null));
+    }
+
+    [Fact]
+    public async Task App_session_uses_three_day_sliding_window()
+    {
+        await using var fixture = await SessionFixture.CreateAsync();
+
+        var issued = await fixture.Service.CreateAsync(
+            fixture.User,
+            [SystemRoles.Student],
+            AuthenticationClientType.App);
+
+        Assert.InRange(
+            issued.SessionExpiresAt,
+            DateTime.UtcNow.AddDays(3).AddMinutes(-1),
+            DateTime.UtcNow.AddDays(3).AddMinutes(1));
+    }
+
+    private sealed class SessionFixture : IAsyncDisposable
+    {
+        private readonly SqliteConnection _connection;
+        private readonly ServiceProvider _provider;
+        private readonly AsyncServiceScope _scope;
+
+        private SessionFixture(
+            SqliteConnection connection,
+            ServiceProvider provider,
+            AsyncServiceScope scope,
+            AppDbContext db,
+            ApplicationUser user,
+            IAuthSessionService service)
+        {
+            _connection = connection;
+            _provider = provider;
+            _scope = scope;
+            Db = db;
+            User = user;
+            Service = service;
+        }
+
+        public AppDbContext Db { get; }
+        public ApplicationUser User { get; }
+        public IAuthSessionService Service { get; }
+
+        public static async Task<SessionFixture> CreateAsync()
+        {
+            var connection = new SqliteConnection("Data Source=:memory:");
+            await connection.OpenAsync();
+            var services = new ServiceCollection();
+            services.AddLogging();
+            services.AddDbContext<AppDbContext>(options => options.UseSqlite(connection));
+            services.Configure<JwtOptions>(options =>
+            {
+                options.Issuer = "tests";
+                options.Audience = "tests-web";
+                options.Key = "a-test-signing-key-that-is-at-least-32-bytes-long";
+                options.AccessTokenMinutes = 10;
+                options.WebIdleMinutes = 30;
+                options.AppIdleMinutes = 4320;
+            });
+            services
+                .AddIdentityCore<ApplicationUser>()
+                .AddRoles<ApplicationRole>()
+                .AddEntityFrameworkStores<AppDbContext>();
+            services.AddScoped<ITokenService, TokenService>();
+            services.AddScoped<IAuthSessionService, AuthSessionService>();
+
+            var provider = services.BuildServiceProvider();
+            var scope = provider.CreateAsyncScope();
+            var db = scope.ServiceProvider.GetRequiredService<AppDbContext>();
+            await db.Database.EnsureCreatedAsync();
+            var userManager = scope.ServiceProvider.GetRequiredService<UserManager<ApplicationUser>>();
+            var user = new ApplicationUser
+            {
+                UserName = "session-user",
+                DisplayName = "会话测试用户",
+                IsEnabled = true,
+                LockoutEnabled = true
+            };
+            Assert.True((await userManager.CreateAsync(user, "SessionUser@123")).Succeeded);
+
+            return new SessionFixture(
+                connection,
+                provider,
+                scope,
+                db,
+                user,
+                scope.ServiceProvider.GetRequiredService<IAuthSessionService>());
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            await _scope.DisposeAsync();
+            await _provider.DisposeAsync();
+            await _connection.DisposeAsync();
+        }
+    }
+}

tests/Jiaowu.Api.Tests/SsoControllerTests.cs

@@ -0,0 +1,245 @@
+using System.Text.Json;
+using System.Security.Claims;
+using Jiaowu.Api.Controllers;
+using Jiaowu.Api.Domain.Identity;
+using Jiaowu.Api.Infrastructure.Auth;
+using Jiaowu.Api.Infrastructure.Persistence;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Caching.Distributed;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
+
+namespace Jiaowu.Api.Tests;
+
+public sealed class SsoControllerTests
+{
+    [Fact]
+    public async Task Bind_WithValidLocalCredentials_LinksKeycloakIdentityAndLogsIn()
+    {
+        await using var fixture = await BindingFixture.CreateAsync();
+        var code = new string('a', 32);
+        await fixture.StoreTicketAsync(code, "keycloak-subject", "external.name");
+
+        var result = await fixture.Controller.Bind(
+            new SsoBindRequest(code, fixture.User.UserName!, "LocalUser@123"),
+            CancellationToken.None);
+
+        var response = Assert.IsType<LoginResponse>(result.Value);
+        Assert.Equal("test-token", response.Token);
+        Assert.Equal(fixture.User.Id, response.User.Id);
+        var linkedUser = await fixture.UserManager.FindByLoginAsync(
+            SsoAuthSchemes.LoginProvider,
+            "keycloak-subject");
+        Assert.Equal(fixture.User.Id, linkedUser?.Id);
+        Assert.Null(await fixture.Cache.GetStringAsync($"sso:binding:{code}"));
+    }
+
+    [Fact]
+    public async Task Bind_WithWrongPassword_DoesNotLinkKeycloakIdentity()
+    {
+        await using var fixture = await BindingFixture.CreateAsync();
+        var code = new string('b', 32);
+        await fixture.StoreTicketAsync(code, "keycloak-subject", "external.name");
+
+        var result = await fixture.Controller.Bind(
+            new SsoBindRequest(code, fixture.User.UserName!, "WrongPassword@123"),
+            CancellationToken.None);
+
+        Assert.NotNull(result.Result);
+        Assert.Null(await fixture.UserManager.FindByLoginAsync(
+            SsoAuthSchemes.LoginProvider,
+            "keycloak-subject"));
+        var user = await fixture.UserManager.FindByIdAsync(fixture.User.Id.ToString());
+        Assert.Equal(1, user?.AccessFailedCount);
+    }
+
+    [Fact]
+    public async Task Account_ReportsCurrentKeycloakBindingAndConfiguredCallback()
+    {
+        await using var fixture = await BindingFixture.CreateAsync();
+        Assert.True((await fixture.UserManager.AddLoginAsync(
+            fixture.User,
+            new UserLoginInfo(
+                SsoAuthSchemes.LoginProvider,
+                "keycloak-subject",
+                "学校统一身份认证"))).Succeeded);
+        fixture.SignInController();
+
+        var result = await fixture.Controller.Account();
+
+        var response = Assert.IsType<SsoAccountResponse>(result.Value);
+        Assert.True(response.Enabled);
+        Assert.True(response.IsBound);
+        Assert.Equal(
+            "https://jiaowu.example.edu.cn/signin-keycloak",
+            response.CallbackUrl);
+    }
+
+    [Fact]
+    public async Task Unbind_WithCurrentPassword_RemovesOnlyKeycloakLogin()
+    {
+        await using var fixture = await BindingFixture.CreateAsync();
+        Assert.True((await fixture.UserManager.AddLoginAsync(
+            fixture.User,
+            new UserLoginInfo(
+                SsoAuthSchemes.LoginProvider,
+                "keycloak-subject",
+                "学校统一身份认证"))).Succeeded);
+        fixture.SignInController();
+
+        var result = await fixture.Controller.Unbind(
+            new SsoUnbindRequest("LocalUser@123"));
+
+        Assert.IsType<NoContentResult>(result);
+        Assert.Null(await fixture.UserManager.FindByLoginAsync(
+            SsoAuthSchemes.LoginProvider,
+            "keycloak-subject"));
+        Assert.True(await fixture.UserManager.CheckPasswordAsync(
+            fixture.User,
+            "LocalUser@123"));
+    }
+
+    [Theory]
+    [InlineData(null, "/dashboard")]
+    [InlineData("", "/dashboard")]
+    [InlineData("https://evil.example/path", "/dashboard")]
+    [InlineData("//evil.example/path", "/dashboard")]
+    [InlineData("/grades?term=2026-1", "/grades?term=2026-1")]
+    public void NormalizeReturnUrl_AllowsOnlyLocalApplicationPaths(
+        string? value,
+        string expected)
+    {
+        Assert.Equal(expected, SsoController.NormalizeReturnUrl(value));
+    }
+
+    private sealed class BindingFixture : IAsyncDisposable
+    {
+        private readonly SqliteConnection _connection;
+        private readonly ServiceProvider _provider;
+
+        private BindingFixture(
+            SqliteConnection connection,
+            ServiceProvider provider,
+            ApplicationUser user,
+            UserManager<ApplicationUser> userManager,
+            IDistributedCache cache,
+            SsoController controller)
+        {
+            _connection = connection;
+            _provider = provider;
+            User = user;
+            UserManager = userManager;
+            Cache = cache;
+            Controller = controller;
+        }
+
+        public ApplicationUser User { get; }
+        public UserManager<ApplicationUser> UserManager { get; }
+        public IDistributedCache Cache { get; }
+        public SsoController Controller { get; }
+
+        public void SignInController()
+        {
+            Controller.ControllerContext = new ControllerContext
+            {
+                HttpContext = new DefaultHttpContext
+                {
+                    User = new ClaimsPrincipal(new ClaimsIdentity(
+                        [new Claim(ClaimTypes.NameIdentifier, User.Id.ToString())],
+                        "test"))
+                }
+            };
+        }
+
+        public static async Task<BindingFixture> CreateAsync()
+        {
+            var connection = new SqliteConnection("Data Source=:memory:");
+            await connection.OpenAsync();
+            var services = new ServiceCollection();
+            services.AddLogging();
+            services.AddDistributedMemoryCache();
+            services.AddDbContext<AppDbContext>(options => options.UseSqlite(connection));
+            services
+                .AddIdentityCore<ApplicationUser>()
+                .AddRoles<ApplicationRole>()
+                .AddEntityFrameworkStores<AppDbContext>();
+
+            var provider = services.BuildServiceProvider();
+            var db = provider.GetRequiredService<AppDbContext>();
+            await db.Database.EnsureCreatedAsync();
+            var userManager = provider.GetRequiredService<UserManager<ApplicationUser>>();
+            var user = new ApplicationUser
+            {
+                UserName = "local.user",
+                DisplayName = "本地用户",
+                IsEnabled = true,
+                LockoutEnabled = true
+            };
+            Assert.True((await userManager.CreateAsync(user, "LocalUser@123")).Succeeded);
+
+            var cache = provider.GetRequiredService<IDistributedCache>();
+            var controller = new SsoController(
+                userManager,
+                new StubAuthSessionService(),
+                cache,
+                Options.Create(new SsoOptions
+                {
+                    Enabled = true,
+                    DisplayName = "学校统一身份认证",
+                    CallbackUrl = "https://jiaowu.example.edu.cn/signin-keycloak"
+                }),
+                NullLogger<SsoController>.Instance);
+            return new BindingFixture(
+                connection,
+                provider,
+                user,
+                userManager,
+                cache,
+                controller);
+        }
+
+        public Task StoreTicketAsync(
+            string code,
+            string subject,
+            string externalUserName) =>
+            Cache.SetStringAsync(
+                $"sso:binding:{code}",
+                JsonSerializer.Serialize(
+                    new SsoBindingTicket(subject, externalUserName)));
+
+        public async ValueTask DisposeAsync()
+        {
+            await _provider.DisposeAsync();
+            await _connection.DisposeAsync();
+        }
+    }
+
+    private sealed class StubAuthSessionService : IAuthSessionService
+    {
+        public Task<AuthSessionResult> CreateAsync(
+            ApplicationUser user,
+            IEnumerable<string> roles,
+            AuthenticationClientType clientType,
+            CancellationToken cancellationToken = default) =>
+            Task.FromResult(new AuthSessionResult(
+                "test-token",
+                DateTime.UtcNow.AddMinutes(10),
+                "test-refresh-token-value-with-sufficient-length",
+                DateTime.UtcNow.AddMinutes(30),
+                user,
+                roles.ToList()));
+
+        public Task<AuthSessionResult?> RefreshAsync(
+            string refreshToken,
+            CancellationToken cancellationToken = default) => Task.FromResult<AuthSessionResult?>(null);
+
+        public Task RevokeAsync(
+            string refreshToken,
+            CancellationToken cancellationToken = default) => Task.CompletedTask;
+    }
+}

tests/Jiaowu.Api.Tests/StudentProfileControllerTests.cs

@@ -0,0 +1,153 @@
+using Jiaowu.Api.Controllers;
+using Jiaowu.Api.Domain.Academic;
+using Jiaowu.Api.Domain.Identity;
+using Jiaowu.Api.Infrastructure.Auth;
+using Jiaowu.Api.Infrastructure.Caching;
+using Jiaowu.Api.Infrastructure.Persistence;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+
+namespace Jiaowu.Api.Tests;
+
+public sealed class StudentProfileControllerTests
+{
+    [Fact]
+    public async Task Student_can_update_profile_without_changing_identity_or_registration()
+    {
+        await using var connection = new SqliteConnection("Data Source=:memory:");
+        await connection.OpenAsync();
+        var options = new DbContextOptionsBuilder<AppDbContext>()
+            .UseSqlite(connection)
+            .Options;
+        await using var db = new AppDbContext(options);
+        await db.Database.EnsureCreatedAsync();
+
+        var user = new ApplicationUser
+        {
+            Id = Guid.NewGuid(),
+            UserName = "2026001",
+            NormalizedUserName = "2026001",
+            DisplayName = "原姓名"
+        };
+        var college = new College { Code = "CS", Name = "计算机学院" };
+        var major = new Major
+        {
+            Code = "080901",
+            Name = "计算机科学与技术",
+            CollegeId = college.Id,
+            DegreeType = "工学学士"
+        };
+        var administrativeClass = new AdministrativeClass
+        {
+            Code = "CS2026-01",
+            Name = "计科 2026-1 班",
+            MajorId = major.Id,
+            Grade = 2026
+        };
+        var student = new Student
+        {
+            StudentNumber = "2026001",
+            Name = "原姓名",
+            UserId = user.Id,
+            AdministrativeClassId = administrativeClass.Id,
+            EnrollmentYear = 2026,
+            EnrollmentDate = new DateOnly(2026, 9, 1),
+            Status = StudentStatus.Active
+        };
+        db.AddRange(user, college);
+        await db.SaveChangesAsync();
+        db.Add(major);
+        await db.SaveChangesAsync();
+        db.Add(administrativeClass);
+        await db.SaveChangesAsync();
+        db.Add(student);
+        await db.SaveChangesAsync();
+
+        var controller = new StudentProfileController(
+            db,
+            new StudentDataScope(user.Id),
+            new NoOpCache());
+        var request = new StudentProfileUpdateRequest(
+            Gender.Female,
+            new DateOnly(2008, 3, 12),
+            " Alice ",
+            "370000000000000000",
+            "中国",
+            "汉族",
+            "共青团员",
+            "山东济南",
+            "户籍地址",
+            "现住地址",
+            "250000",
+            "13800000000",
+            "student@example.edu.cn",
+            "123456",
+            "alice-wechat",
+            "家长",
+            "母亲",
+            "13900000000",
+            "听力支持, 走读",
+            "上课时需要靠前座位",
+            "个人简介");
+
+        Assert.IsType<NoContentResult>(await controller.Update(
+            request,
+            CancellationToken.None));
+
+        db.ChangeTracker.Clear();
+        var updated = await db.Students.SingleAsync();
+        Assert.Equal("2026001", updated.StudentNumber);
+        Assert.Equal("原姓名", updated.Name);
+        Assert.Equal(administrativeClass.Id, updated.AdministrativeClassId);
+        Assert.Equal(StudentStatus.Active, updated.Status);
+        Assert.Equal("Alice", updated.EnglishName);
+        Assert.Equal("13800000000", updated.Phone);
+        Assert.Equal("听力支持, 走读", updated.SpecialTags);
+        Assert.Equal("上课时需要靠前座位", updated.SpecialNeeds);
+    }
+
+    [Fact]
+    public async Task Missing_linked_student_returns_not_found()
+    {
+        await using var connection = new SqliteConnection("Data Source=:memory:");
+        await connection.OpenAsync();
+        var options = new DbContextOptionsBuilder<AppDbContext>()
+            .UseSqlite(connection)
+            .Options;
+        await using var db = new AppDbContext(options);
+        await db.Database.EnsureCreatedAsync();
+        var controller = new StudentProfileController(
+            db,
+            new StudentDataScope(Guid.NewGuid()),
+            new NoOpCache());
+
+        var result = await controller.Get(CancellationToken.None);
+
+        Assert.IsType<NotFoundResult>(result.Result);
+    }
+
+    private sealed class NoOpCache : IAppCache
+    {
+        public Task<T> GetOrCreateAsync<T>(
+            string key,
+            Func<CancellationToken, Task<T>> factory,
+            AppCacheProfile profile,
+            IReadOnlyCollection<string> tags,
+            CancellationToken cancellationToken) => factory(cancellationToken);
+
+        public ValueTask RemoveByTagAsync(
+            string tag,
+            CancellationToken cancellationToken = default) => ValueTask.CompletedTask;
+    }
+
+    private sealed class StudentDataScope(Guid userId) : ICurrentUserDataScope
+    {
+        public CurrentUserScope Current { get; } = new(
+            userId,
+            "测试学生",
+            null,
+            DataScope.Self,
+            new HashSet<string>([SystemRoles.Student]));
+    }
+}

tests/Jiaowu.Api.Tests/TeachingTaskRosterProfileTests.cs

@@ -0,0 +1,123 @@
+using ClosedXML.Excel;
+using Jiaowu.Api.Controllers;
+using Jiaowu.Api.Domain.Academic;
+using Jiaowu.Api.Domain.Identity;
+using Jiaowu.Api.Infrastructure.Auth;
+using Jiaowu.Api.Infrastructure.Persistence;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+
+namespace Jiaowu.Api.Tests;
+
+public sealed class TeachingTaskRosterProfileTests
+{
+    [Fact]
+    public async Task Assigned_teacher_receives_contact_and_special_fields_in_roster_and_export()
+    {
+        await using var connection = new SqliteConnection("Data Source=:memory:");
+        await connection.OpenAsync();
+        var options = new DbContextOptionsBuilder<AppDbContext>()
+            .UseSqlite(connection)
+            .Options;
+        await using var db = new AppDbContext(options);
+        await db.Database.EnsureCreatedAsync();
+
+        var teacherUser = User("T001", "任课教师");
+        var studentUser = User("S001", "学生甲");
+        var college = new College { Code = "CS", Name = "计算机学院" };
+        var major = new Major
+        {
+            Code = "080901", Name = "计算机科学与技术",
+            CollegeId = college.Id, DegreeType = "工学学士"
+        };
+        var administrativeClass = new AdministrativeClass
+        {
+            Code = "CS2026-01", Name = "计科一班", MajorId = major.Id, Grade = 2026
+        };
+        var teacher = new Teacher
+        {
+            TeacherNumber = "T001", Name = "任课教师", CollegeId = college.Id,
+            UserId = teacherUser.Id
+        };
+        var student = new Student
+        {
+            StudentNumber = "S001", Name = "学生甲", UserId = studentUser.Id,
+            AdministrativeClassId = administrativeClass.Id,
+            EnrollmentYear = 2026, EnrollmentDate = new DateOnly(2026, 9, 1),
+            Phone = "13800000000", Email = "s@example.edu.cn", WeChat = "student-wechat",
+            EmergencyContactName = "家长", EmergencyContactRelationship = "母亲",
+            EmergencyContactPhone = "13900000000", SpecialTags = "走读",
+            SpecialNeeds = "需留意交通延误"
+        };
+        var term = new AcademicTerm
+        {
+            Code = "2026-1", Name = "2026-2027-1", AcademicYear = "2026-2027",
+            Season = TermSeason.Autumn, StartDate = new DateOnly(2026, 9, 1),
+            EndDate = new DateOnly(2027, 1, 20)
+        };
+        var course = new Course
+        {
+            Code = "CS101", Name = "程序设计", CollegeId = college.Id,
+            Credits = 4, TotalHours = 64, LectureHours = 48, PracticeHours = 16,
+            Nature = CourseNature.MajorRequired,
+            AssessmentMethod = AssessmentMethod.Examination
+        };
+        db.AddRange(teacherUser, studentUser, college);
+        await db.SaveChangesAsync();
+        db.AddRange(major, teacher, term, course);
+        await db.SaveChangesAsync();
+        db.Add(administrativeClass);
+        await db.SaveChangesAsync();
+        db.Add(student);
+        await db.SaveChangesAsync();
+        var task = new TeachingTask
+        {
+            TaskNumber = "2026-CS101-01", Name = "程序设计教学班",
+            AcademicTermId = term.Id, CourseId = course.Id, Capacity = 40,
+            Status = TeachingTaskStatus.Published,
+            Teachers = [new TeachingTaskTeacher { TeacherId = teacher.Id }],
+            Classes = [new TeachingTaskClass { AdministrativeClassId = administrativeClass.Id }]
+        };
+        db.Add(task);
+        await db.SaveChangesAsync();
+
+        var controller = new CourseSelectionsController(
+            db,
+            new TeacherDataScope(teacherUser.Id));
+        var rosterResult = Assert.IsType<OkObjectResult>(
+            await controller.GetTeachingTaskRoster(task.Id, CancellationToken.None));
+        var students = Assert.IsAssignableFrom<System.Collections.IEnumerable>(
+            rosterResult.Value!.GetType().GetProperty("Students")!.GetValue(rosterResult.Value));
+        var row = Assert.Single(students.Cast<object>());
+        Assert.Equal("13800000000", Property(row, "Phone"));
+        Assert.Equal("走读", Property(row, "SpecialTags"));
+        Assert.Equal("需留意交通延误", Property(row, "SpecialNeeds"));
+
+        var export = Assert.IsType<FileContentResult>(
+            await controller.ExportTeachingTaskRoster(task.Id, CancellationToken.None));
+        using var stream = new MemoryStream(export.FileContents);
+        using var workbook = new XLWorkbook(stream);
+        var sheet = workbook.Worksheet("教学班名单");
+        Assert.Equal("联系电话", sheet.Cell(1, 5).GetString());
+        Assert.Equal("特殊标记", sheet.Cell(1, 11).GetString());
+        Assert.Equal("13800000000", sheet.Cell(2, 5).GetString());
+        Assert.Equal("走读", sheet.Cell(2, 11).GetString());
+    }
+
+    private static string? Property(object value, string name) =>
+        value.GetType().GetProperty(name)!.GetValue(value)?.ToString();
+
+    private static ApplicationUser User(string userName, string displayName) => new()
+    {
+        Id = Guid.NewGuid(), UserName = userName,
+        NormalizedUserName = userName.ToUpperInvariant(), DisplayName = displayName
+    };
+
+    private sealed class TeacherDataScope(Guid userId) : ICurrentUserDataScope
+    {
+        public CurrentUserScope Current { get; } = new(
+            userId, "任课教师", null, DataScope.Self,
+            new HashSet<string>([SystemRoles.Teacher]));
+    }
+}

tests/Jiaowu.Api.Tests/TokenServiceTests.cs

@@ -25,12 +25,16 @@ public sealed class TokenServiceTests
         };
         var service = new TokenService(options);
 
-        var token = new JwtSecurityTokenHandler().ReadJwtToken(
-            service.Create(user, [SystemRoles.Teacher]));
+        var result = service.Create(user, [SystemRoles.Teacher]);
+        var token = new JwtSecurityTokenHandler().ReadJwtToken(result.Token);
 
         Assert.Contains(token.Claims, x =>
             x.Type == ClaimTypes.Role && x.Value == SystemRoles.Teacher);
         Assert.Contains(token.Claims, x =>
             x.Type == ClaimTypes.Name && x.Value == "陈老师");
+        Assert.InRange(
+            result.ExpiresAt,
+            DateTime.UtcNow.AddMinutes(9),
+            DateTime.UtcNow.AddMinutes(11));
     }
 }

web/package.json

@@ -1,7 +1,7 @@
 {
   "name": "web",
   "private": true,
-  "version": "2.2.0-rc1",
+  "version": "2.3.0-rc2",
   "type": "module",
   "scripts": {
     "dev": "vite",

web/src/api/http.ts

@@ -1,23 +1,56 @@
 import axios from 'axios'
 import { goLogin } from '../utils/navigate'
+import {
+  authStorageKeys,
+  clearAuthSession,
+  markActivity,
+  refreshAuthSession,
+  refreshIfNeeded,
+} from '../auth/session'
 
 const http = axios.create({
   baseURL: import.meta.env.VITE_API_BASE_URL ?? '/api',
   timeout: 15000,
 })
 
-http.interceptors.request.use((config) => {
-  const token = localStorage.getItem('jiaowu_token')
+http.interceptors.request.use(async (config) => {
+  const isAuthenticationRequest =
+    config.url?.endsWith('/auth/login') ||
+    config.url?.endsWith('/auth/refresh') ||
+    config.url?.endsWith('/auth/logout') ||
+    config.url?.endsWith('/auth/sso/exchange') ||
+    config.url?.endsWith('/auth/sso/bind')
+  if (!isAuthenticationRequest) {
+    const activeToken = await refreshIfNeeded(true)
+    if (activeToken) markActivity()
+  }
+  const token = localStorage.getItem(authStorageKeys.token)
   if (token) config.headers.Authorization = `Bearer ${token}`
   return config
 })
 
 http.interceptors.response.use(
   (response) => response,
-  (error) => {
-    if (error.response?.status === 401 && !error.config?.url?.endsWith('/auth/login')) {
-      localStorage.removeItem('jiaowu_token')
-      localStorage.removeItem('jiaowu_user')
+  async (error) => {
+    const isAuthenticationRequest =
+      error.config?.url?.endsWith('/auth/login') ||
+      error.config?.url?.endsWith('/auth/refresh') ||
+      error.config?.url?.endsWith('/auth/logout') ||
+      error.config?.url?.endsWith('/auth/sso/exchange') ||
+      error.config?.url?.endsWith('/auth/sso/bind')
+    const retryableConfig = error.config as
+      (typeof error.config & { _jiaowuRetried?: boolean }) | undefined
+    if (error.response?.status === 401 && !isAuthenticationRequest &&
+      !retryableConfig?._jiaowuRetried) {
+      const token = await refreshAuthSession()
+      if (token && retryableConfig) {
+        retryableConfig._jiaowuRetried = true
+        retryableConfig.headers.Authorization = `Bearer ${token}`
+        return http.request(retryableConfig)
+      }
+    }
+    if (error.response?.status === 401 && !isAuthenticationRequest) {
+      clearAuthSession()
       goLogin(location.pathname + location.search + location.hash)
     }
     return Promise.reject(error)

web/src/auth/session.ts

@@ -0,0 +1,167 @@
+import axios from 'axios'
+import { Capacitor } from '@capacitor/core'
+
+const TOKEN_KEY = 'jiaowu_token'
+const REFRESH_TOKEN_KEY = 'jiaowu_refresh_token'
+const ACCESS_EXPIRES_KEY = 'jiaowu_access_expires_at'
+const SESSION_EXPIRES_KEY = 'jiaowu_session_expires_at'
+const USER_KEY = 'jiaowu_user'
+const LAST_ACTIVITY_KEY = 'jiaowu_last_activity_at'
+const WEB_IDLE_MILLISECONDS = 30 * 60 * 1000
+const REFRESH_AHEAD_MILLISECONDS = 60 * 1000
+const WEB_SLIDING_TOUCH_MILLISECONDS = 60 * 1000
+
+export interface AuthSessionPayload {
+  token: string
+  accessTokenExpiresAt: string
+  refreshToken: string
+  sessionExpiresAt: string
+  user: unknown
+}
+
+export const isNativeApp = () => Capacitor.isNativePlatform()
+
+export function saveAuthSession(payload: AuthSessionPayload, recordActivity = true) {
+  localStorage.setItem(TOKEN_KEY, payload.token)
+  localStorage.setItem(REFRESH_TOKEN_KEY, payload.refreshToken)
+  localStorage.setItem(ACCESS_EXPIRES_KEY, payload.accessTokenExpiresAt)
+  localStorage.setItem(SESSION_EXPIRES_KEY, payload.sessionExpiresAt)
+  localStorage.setItem(USER_KEY, JSON.stringify(payload.user))
+  if (recordActivity) markActivity()
+  window.dispatchEvent(new Event('mingxu-auth-changed'))
+}
+
+export function clearAuthSession(notifyExpired = false) {
+  localStorage.removeItem(TOKEN_KEY)
+  localStorage.removeItem(REFRESH_TOKEN_KEY)
+  localStorage.removeItem(ACCESS_EXPIRES_KEY)
+  localStorage.removeItem(SESSION_EXPIRES_KEY)
+  localStorage.removeItem(USER_KEY)
+  localStorage.removeItem(LAST_ACTIVITY_KEY)
+  window.dispatchEvent(new Event('mingxu-auth-changed'))
+  if (notifyExpired) window.dispatchEvent(new Event('mingxu-session-expired'))
+}
+
+export function markActivity() {
+  localStorage.setItem(LAST_ACTIVITY_KEY, String(Date.now()))
+}
+
+export function hasExceededWebIdleTimeout(now = Date.now()) {
+  if (isNativeApp()) return false
+  const lastActivity = Number(localStorage.getItem(LAST_ACTIVITY_KEY) ?? 0)
+  return lastActivity > 0 && now - lastActivity >= WEB_IDLE_MILLISECONDS
+}
+
+export function hasLocallyExpired(now = Date.now()) {
+  const sessionExpiresAt = Date.parse(localStorage.getItem(SESSION_EXPIRES_KEY) ?? '')
+  return hasExceededWebIdleTimeout(now) ||
+    (Number.isFinite(sessionExpiresAt) && sessionExpiresAt <= now)
+}
+
+let refreshPromise: Promise<string | null> | null = null
+
+export function refreshAuthSession(): Promise<string | null> {
+  if (refreshPromise) return refreshPromise
+  const refreshToken = localStorage.getItem(REFRESH_TOKEN_KEY)
+  if (!refreshToken || hasLocallyExpired()) {
+    clearAuthSession(true)
+    return Promise.resolve(null)
+  }
+
+  refreshPromise = axios.post<AuthSessionPayload>(
+    `${import.meta.env.VITE_API_BASE_URL ?? '/api'}/auth/refresh`,
+    { refreshToken },
+    { timeout: 15000 },
+  ).then(({ data }) => {
+    saveAuthSession(data, false)
+    return data.token
+  }).catch((error: unknown) => {
+    const currentRefreshToken = localStorage.getItem(REFRESH_TOKEN_KEY)
+    if (currentRefreshToken && currentRefreshToken !== refreshToken) {
+      return localStorage.getItem(TOKEN_KEY)
+    }
+    if (axios.isAxiosError(error) &&
+      error.response &&
+      [400, 401, 403].includes(error.response.status)) {
+      clearAuthSession(true)
+      return null
+    }
+    throw error
+  }).finally(() => {
+    refreshPromise = null
+  })
+  return refreshPromise
+}
+
+export async function refreshIfNeeded(isCurrentRequestActivity = false) {
+  const token = localStorage.getItem(TOKEN_KEY)
+  if (!token) return null
+  if (hasLocallyExpired()) {
+    clearAuthSession(true)
+    return null
+  }
+  const expiresAt = Date.parse(localStorage.getItem(ACCESS_EXPIRES_KEY) ?? '')
+  const sessionExpiresAt = Date.parse(localStorage.getItem(SESSION_EXPIRES_KEY) ?? '')
+  const lastActivity = Number(localStorage.getItem(LAST_ACTIVITY_KEY) ?? 0)
+  const now = Date.now()
+  const hasRecentWebActivity = !isNativeApp() &&
+    (isCurrentRequestActivity || now - lastActivity <= WEB_SLIDING_TOUCH_MILLISECONDS)
+  const webSessionNeedsSlidingTouch = hasRecentWebActivity &&
+    Number.isFinite(sessionExpiresAt) &&
+    sessionExpiresAt - now <= WEB_IDLE_MILLISECONDS - WEB_SLIDING_TOUCH_MILLISECONDS
+  if (!Number.isFinite(expiresAt) ||
+    expiresAt - now <= REFRESH_AHEAD_MILLISECONDS ||
+    webSessionNeedsSlidingTouch) {
+    return refreshAuthSession()
+  }
+  return token
+}
+
+export function initializeAuthSession() {
+  if (!localStorage.getItem(TOKEN_KEY)) return
+  if (hasLocallyExpired()) {
+    clearAuthSession(true)
+    return
+  }
+
+  let lastActivityWrite = 0
+  const recordActivity = () => {
+    const now = Date.now()
+    if (now - lastActivityWrite < 5000) return
+    lastActivityWrite = now
+    markActivity()
+  }
+  const activityEvents: Array<keyof WindowEventMap> = [
+    'pointerdown',
+    'keydown',
+    'touchstart',
+    'scroll',
+  ]
+  activityEvents.forEach(event =>
+    window.addEventListener(event, recordActivity, { passive: true }))
+
+  window.setInterval(() => {
+    if (!localStorage.getItem(TOKEN_KEY)) return
+    if (hasLocallyExpired()) {
+      clearAuthSession(true)
+      return
+    }
+    if (document.visibilityState === 'visible') {
+      void refreshIfNeeded().catch(() => undefined)
+    }
+  }, 30000)
+
+  document.addEventListener('visibilitychange', () => {
+    if (document.visibilityState === 'visible') {
+      void refreshIfNeeded(true).catch(() => undefined)
+    }
+  })
+  window.addEventListener('online', () =>
+    void refreshIfNeeded(true).catch(() => undefined))
+}
+
+export const authStorageKeys = {
+  token: TOKEN_KEY,
+  refreshToken: REFRESH_TOKEN_KEY,
+  user: USER_KEY,
+}

web/src/layouts/AdminLayout.vue

@@ -212,6 +212,10 @@ const navigationGroups = computed<NavigationGroup[]>(() => [
     key: 'student-status',
     label: '学籍管理',
     items: [
+      ...whenVisible(
+        isStudent.value,
+        { path: '/my-profile', label: '个人信息' },
+      ),
       ...whenVisible(
         hasAnyRole(['SuperAdmin', 'AcademicAdmin', 'CollegeAdmin', 'Counselor', 'Student']),
         { path: '/student-status-changes', label: isStudent.value ? '学籍异动' : '异动审核' },
@@ -263,6 +267,7 @@ const workspaceLabel = computed(() => {
 })
 
 const pageTitle = computed(() => {
+  if (route.path === '/account') return '个人账户'
   const matchedItem = navigationGroups.value
     .flatMap((group) => group.items)
     .find((item) => item.path === route.path)
@@ -318,6 +323,7 @@ onMounted(() => {
             <b>{{ auth.user?.displayName ?? '系统管理员' }}</b>
             <span>{{ auth.user?.roles?.[0] ?? '教务人员' }}</span>
           </div>
+          <el-button text @click="router.push('/account')">个人账户</el-button>
           <el-button text @click="signOut">退出</el-button>
         </div>
       </div>

web/src/main.ts

@@ -6,11 +6,17 @@ import router from './router'
 import { initializeAppUpdates } from './services/appUpdates'
 import { initializeNativeHome } from './services/nativeHome'
 import { setRouter } from './utils/navigate'
+import { initializeAuthSession } from './auth/session'
 
 const app = createApp(App)
 app.use(createPinia())
 app.use(router)
 setRouter(router)
+window.addEventListener('mingxu-session-expired', () => {
+  const returnUrl = location.pathname + location.search + location.hash
+  void router.push({ name: 'login', query: { redirect: returnUrl } })
+})
+initializeAuthSession()
 app.mount('#app')
 void initializeAppUpdates()
 initializeNativeHome(router)

web/src/router/index.ts

@@ -13,6 +13,18 @@ const router = createRouter({
       component: () => import('../views/LoginView.vue'),
       meta: { public: true },
     },
+    {
+      path: '/sso/callback',
+      name: 'sso-callback',
+      component: () => import('../views/SsoCallbackView.vue'),
+      meta: { public: true },
+    },
+    {
+      path: '/sso/bind',
+      name: 'sso-bind',
+      component: () => import('../views/SsoBindView.vue'),
+      meta: { public: true },
+    },
     {
       path: '/timetable',
       name: 'public-timetable',
@@ -41,6 +53,17 @@ const router = createRouter({
           name: 'dashboard',
           component: () => import('../views/DashboardView.vue'),
         },
+        {
+          path: 'account',
+          name: 'account',
+          component: () => import('../views/AccountView.vue'),
+        },
+        {
+          path: 'my-profile',
+          name: 'my-profile',
+          component: () => import('../views/StudentProfileView.vue'),
+          meta: { roles: ['Student'] },
+        },
         {
           path: 'base-data',
           redirect: '/base-data/organization',

web/src/stores/auth.ts

@@ -1,6 +1,12 @@
 import { computed, ref } from 'vue'
 import { defineStore } from 'pinia'
 import http from '../api/http'
+import {
+  authStorageKeys,
+  clearAuthSession,
+  isNativeApp,
+  saveAuthSession,
+} from '../auth/session'
 
 export interface CurrentUser {
   id: string
@@ -12,35 +18,75 @@ export interface CurrentUser {
 }
 
 export const useAuthStore = defineStore('auth', () => {
-  const token = ref(localStorage.getItem('jiaowu_token') ?? '')
-  const saved = localStorage.getItem('jiaowu_user')
+  const token = ref(localStorage.getItem(authStorageKeys.token) ?? '')
+  const saved = localStorage.getItem(authStorageKeys.user)
   const user = ref<CurrentUser | null>(saved ? JSON.parse(saved) : null)
   const isLoggedIn = computed(() => Boolean(token.value))
   const isSuperAdmin = computed(() => user.value?.roles.includes('SuperAdmin') ?? false)
 
   async function login(userName: string, password: string) {
-    const { data } = await http.post('/auth/login', { userName, password })
+    const { data } = await http.post('/auth/login', {
+      userName,
+      password,
+      isNativeApp: isNativeApp(),
+    })
     token.value = data.token
     user.value = data.user
-    localStorage.setItem('jiaowu_token', data.token)
-    localStorage.setItem('jiaowu_user', JSON.stringify(data.user))
-    window.dispatchEvent(new Event('mingxu-auth-changed'))
+    saveAuthSession(data)
+  }
+
+  async function exchangeSso(code: string) {
+    const { data } = await http.post('/auth/sso/exchange', {
+      code,
+      isNativeApp: isNativeApp(),
+    })
+    token.value = data.token
+    user.value = data.user
+    saveAuthSession(data)
+  }
+
+  async function bindSso(code: string, userName: string, password: string) {
+    const { data } = await http.post('/auth/sso/bind', {
+      code,
+      userName,
+      password,
+      isNativeApp: isNativeApp(),
+    })
+    token.value = data.token
+    user.value = data.user
+    saveAuthSession(data)
   }
 
   async function refresh() {
     if (!token.value) return
     const { data } = await http.get('/auth/me')
     user.value = data
-    localStorage.setItem('jiaowu_user', JSON.stringify(data))
+    localStorage.setItem(authStorageKeys.user, JSON.stringify(data))
   }
 
   function logout() {
+    const refreshToken = localStorage.getItem(authStorageKeys.refreshToken)
+    if (refreshToken) void http.post('/auth/logout', { refreshToken }).catch(() => undefined)
     token.value = ''
     user.value = null
-    localStorage.removeItem('jiaowu_token')
-    localStorage.removeItem('jiaowu_user')
-    window.dispatchEvent(new Event('mingxu-auth-changed'))
+    clearAuthSession()
   }
 
-  return { token, user, isLoggedIn, isSuperAdmin, login, refresh, logout }
+  window.addEventListener('mingxu-auth-changed', () => {
+    token.value = localStorage.getItem(authStorageKeys.token) ?? ''
+    const currentUser = localStorage.getItem(authStorageKeys.user)
+    user.value = currentUser ? JSON.parse(currentUser) : null
+  })
+
+  return {
+    token,
+    user,
+    isLoggedIn,
+    isSuperAdmin,
+    login,
+    exchangeSso,
+    bindSso,
+    refresh,
+    logout,
+  }
 })

web/src/style.css

@@ -1208,6 +1208,23 @@ button { cursor: pointer; }
 .public-timetable-link { display: block; margin: 14px 0 18px; color: #176b87; font-size: 13px; font-weight: 650; text-align: center; text-decoration: none; }
 .account-activation-link { display: block; margin: -8px 0 18px; color: #315b73; font-size: 13px; font-weight: 650; text-align: center; text-decoration: none; }
 .login-submit { width: 100%; margin-top: 6px; height: 46px; }
+.sso-login-submit { width: 100%; height: 46px; border-color: #176b87; color: #176b87; font-weight: 650; }
+.login-divider { display: flex; align-items: center; gap: 12px; margin: 16px 0; color: #9aa4b2; font-size: 12px; }
+.login-divider::before, .login-divider::after { content: ""; flex: 1; height: 1px; background: #e5e9ef; }
+.sso-callback-page { min-height: 100vh; display: grid; place-content: center; justify-items: center; padding: 24px; background: #f4f7fa; color: #263445; text-align: center; }
+.sso-callback-page h1 { margin: 18px 0 8px; font-size: 22px; }
+.sso-callback-page p { margin: 0; color: var(--muted); }
+.sso-binding-page { min-height: 100vh; display: grid; place-items: center; padding: 28px; background: radial-gradient(circle at top left, #e3f5f2, transparent 42%), #f4f7fa; }
+.sso-binding-card { width: min(470px, 100%); padding: 38px; border: 1px solid #e3e8ee; border-radius: 18px; background: #fff; box-shadow: 0 20px 55px rgba(35, 57, 78, .12); }
+.sso-binding-card .brand-mark { margin-bottom: 24px; }
+.sso-binding-card h1 { margin: 8px 0 12px; font-family: "STZhongsong", "Songti SC", serif; font-size: 28px; }
+.binding-description { margin: 0 0 26px; color: var(--muted); line-height: 1.75; }
+.binding-description strong { color: #176b87; }
+.sso-binding-card label { display: block; margin-bottom: 18px; }
+.sso-binding-card label > span { display: block; margin-bottom: 8px; color: #525b6d; font-size: 12px; font-weight: 650; }
+.binding-submit { width: 100%; height: 46px; }
+.binding-security-note { margin: 18px 0 10px; color: #7b8794; font-size: 12px; line-height: 1.65; }
+.sso-binding-card > a { color: #315b73; font-size: 13px; font-weight: 650; text-decoration: none; }
 
 @media (max-width: 1100px) {
   .metric-grid { grid-template-columns: repeat(2, 1fr); }

web/src/views/AccountView.vue

@@ -0,0 +1,203 @@
+<script setup lang="ts">
+import { onMounted, reactive, ref } from 'vue'
+import { useRoute, useRouter } from 'vue-router'
+import http, { apiErrorMessage } from '../api/http'
+import { useAuthStore } from '../stores/auth'
+
+const route = useRoute()
+const router = useRouter()
+const auth = useAuthStore()
+const loading = ref(true)
+const actionLoading = ref(false)
+const sso = reactive({
+  enabled: false,
+  providerDisplayName: '学校统一身份认证',
+  isBound: false,
+  callbackUrl: '',
+})
+
+const ssoErrors: Record<string, string> = {
+  binding_intent_expired: '绑定请求已失效，请重新发起绑定。',
+  identity_already_bound: '该统一身份账号已经绑定其他教务系统账号。',
+  account_already_bound: '当前教务系统账号已经绑定其他统一身份账号。',
+  account_disabled: '当前教务系统账号已停用或锁定。',
+  account_link_failed: '统一身份账户绑定失败，请重新尝试。',
+  configuration_error: '统一身份认证回调地址配置不正确，请联系管理员。',
+}
+
+async function loadAccount() {
+  loading.value = true
+  try {
+    const { data } = await http.get('/auth/sso/account')
+    sso.enabled = Boolean(data.enabled)
+    sso.providerDisplayName = String(data.providerDisplayName || sso.providerDisplayName)
+    sso.isBound = Boolean(data.isBound)
+    sso.callbackUrl = String(data.callbackUrl || '')
+  } catch (error) {
+    ElMessage.error(apiErrorMessage(error))
+  } finally {
+    loading.value = false
+  }
+}
+
+async function startBinding() {
+  actionLoading.value = true
+  try {
+    const { data } = await http.post('/auth/sso/prepare-binding')
+    window.location.assign(String(data.loginUrl))
+  } catch (error) {
+    ElMessage.error(apiErrorMessage(error))
+    actionLoading.value = false
+  }
+}
+
+async function unbind() {
+  try {
+    const result = await ElMessageBox.prompt(
+      '解绑后将不能再使用当前统一身份账号登录。请输入教务系统密码确认。',
+      '解除统一身份绑定',
+      {
+        inputType: 'password',
+        inputPlaceholder: '请输入教务系统密码',
+        inputValidator: (value) => Boolean(value) || '密码不能为空',
+        confirmButtonText: '确认解绑',
+        cancelButtonText: '取消',
+        type: 'warning',
+      },
+    )
+    actionLoading.value = true
+    await http.post('/auth/sso/unbind', { password: result.value })
+    ElMessage.success('统一身份账户已解绑。')
+    await loadAccount()
+  } catch (error) {
+    if (error === 'cancel' || error === 'close') return
+    ElMessage.error(apiErrorMessage(error))
+  } finally {
+    actionLoading.value = false
+  }
+}
+
+onMounted(async () => {
+  const ssoError = String(route.query.ssoError ?? '')
+  if (ssoError) {
+    ElMessage.error(ssoErrors[ssoError] ?? '统一身份账户绑定失败，请重新尝试。')
+    await router.replace('/account')
+  }
+  await loadAccount()
+})
+</script>
+
+<template>
+  <section class="account-page">
+    <header class="account-heading">
+      <div>
+        <span class="eyebrow">ACCOUNT &amp; SECURITY</span>
+        <h1>个人账户</h1>
+        <p>管理您的登录身份与单点登录绑定。</p>
+      </div>
+      <div class="account-avatar">{{ auth.user?.displayName?.slice(0, 1) ?? '用' }}</div>
+    </header>
+
+    <div class="account-grid">
+      <article class="account-card identity-card">
+        <div class="card-title">
+          <div>
+            <span>基本信息</span>
+            <h2>{{ auth.user?.displayName }}</h2>
+          </div>
+          <el-tag type="success" effect="light">账号已启用</el-tag>
+        </div>
+        <dl>
+          <div>
+            <dt>登录账号</dt>
+            <dd>{{ auth.user?.userName }}</dd>
+          </div>
+          <div>
+            <dt>系统角色</dt>
+            <dd class="role-list">
+              <el-tag v-for="role in auth.user?.roles" :key="role" effect="plain">{{ role }}</el-tag>
+            </dd>
+          </div>
+          <div>
+            <dt>数据范围</dt>
+            <dd>{{ auth.user?.effectiveDataScope }}</dd>
+          </div>
+        </dl>
+      </article>
+
+      <article v-loading="loading" class="account-card sso-card">
+        <div class="card-title">
+          <div>
+            <span>单点登录</span>
+            <h2>{{ sso.providerDisplayName }}</h2>
+          </div>
+          <el-tag v-if="sso.isBound" type="success">已绑定</el-tag>
+          <el-tag v-else-if="sso.enabled" type="info">未绑定</el-tag>
+          <el-tag v-else type="warning">未启用</el-tag>
+        </div>
+
+        <p v-if="sso.isBound" class="sso-description">
+          当前教务系统账号已经关联统一身份认证。您可以直接通过 Keycloak 登录。
+        </p>
+        <p v-else-if="sso.enabled" class="sso-description">
+          绑定后，即使统一身份用户名与教务系统账号不同，也可以直接登录当前账号。
+        </p>
+        <p v-else class="sso-description">管理员尚未启用统一身份认证。</p>
+
+        <el-button
+          v-if="sso.enabled && !sso.isBound"
+          type="primary"
+          :loading="actionLoading"
+          @click="startBinding"
+        >
+          绑定统一身份账户
+        </el-button>
+        <el-button
+          v-else-if="sso.isBound"
+          type="danger"
+          plain
+          :loading="actionLoading"
+          @click="unbind"
+        >
+          解除绑定
+        </el-button>
+
+        <details v-if="sso.enabled && sso.callbackUrl" class="callback-details">
+          <summary>管理员配置参考</summary>
+          <p>Keycloak Valid redirect URI 必须与下列地址完全一致：</p>
+          <code>{{ sso.callbackUrl }}</code>
+        </details>
+      </article>
+    </div>
+  </section>
+</template>
+
+<style scoped>
+.account-page { display: grid; gap: 22px; }
+.account-heading { display: flex; align-items: center; justify-content: space-between; padding: 26px 30px; border-radius: 18px; background: linear-gradient(125deg, #173a50, #176b87 65%, #2e9b91); color: white; box-shadow: 0 18px 45px rgba(23, 58, 80, .18); }
+.account-heading h1 { margin: 7px 0 5px; font-family: "STZhongsong", "Songti SC", serif; font-size: 30px; }
+.account-heading p { margin: 0; color: rgba(255,255,255,.72); }
+.account-heading .eyebrow { color: #8ee4d8; }
+.account-avatar { display: grid; place-items: center; width: 68px; height: 68px; border: 1px solid rgba(255,255,255,.34); border-radius: 22px; background: rgba(255,255,255,.12); font-size: 28px; font-weight: 700; }
+.account-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 20px; }
+.account-card { min-width: 0; min-height: 310px; padding: 28px; border: 1px solid #e2e8ee; border-radius: 16px; background: white; box-shadow: 0 12px 34px rgba(35, 57, 78, .07); }
+.card-title { display: flex; align-items: flex-start; justify-content: space-between; gap: 16px; padding-bottom: 20px; border-bottom: 1px solid #edf0f3; }
+.card-title span { color: #73808d; font-size: 12px; }
+.card-title h2 { margin: 6px 0 0; color: #263445; font-size: 21px; }
+dl { margin: 6px 0 0; }
+dl > div { display: grid; grid-template-columns: 100px 1fr; gap: 18px; padding: 16px 0; border-bottom: 1px solid #f0f2f4; }
+dt { color: #7b8794; font-size: 13px; }
+dd { margin: 0; color: #263445; font-weight: 650; }
+.role-list { display: flex; flex-wrap: wrap; gap: 7px; }
+.sso-description { min-height: 54px; margin: 22px 0; color: #65717e; line-height: 1.7; }
+.callback-details { margin-top: 24px; color: #65717e; font-size: 12px; }
+.callback-details summary { cursor: pointer; color: #315b73; font-weight: 650; }
+.callback-details p { margin: 10px 0 7px; }
+.callback-details code { display: block; overflow-wrap: anywhere; padding: 10px 12px; border-radius: 8px; background: #f4f7f9; color: #176b87; }
+@media (max-width: 1100px) {
+  .account-grid { grid-template-columns: 1fr; }
+  .account-heading { padding: 22px; }
+  .account-avatar { width: 56px; height: 56px; border-radius: 18px; }
+  .account-card { min-height: 0; padding: 22px; }
+}
+</style>

web/src/views/LoginView.vue

@@ -1,13 +1,16 @@
 <script setup lang="ts">
-import { reactive, ref } from 'vue'
+import { onMounted, reactive, ref } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
 import { apiErrorMessage } from '../api/http'
 import { useAuthStore } from '../stores/auth'
+import http from '../api/http'
 
 const route = useRoute()
 const router = useRouter()
 const auth = useAuthStore()
 const loading = ref(false)
+const ssoLoading = ref(false)
+const sso = reactive({ enabled: false, displayName: '学校统一身份认证' })
 const form = reactive({
   userName: String(route.query.userName ?? ''),
   password: '',
@@ -24,6 +27,37 @@ async function submit() {
     loading.value = false
   }
 }
+
+function startSso() {
+  ssoLoading.value = true
+  const apiBaseUrl = String(import.meta.env.VITE_API_BASE_URL ?? '/api').replace(/\/$/, '')
+  const redirect = String(route.query.redirect ?? '/dashboard')
+  window.location.assign(
+    `${apiBaseUrl}/auth/sso/login?returnUrl=${encodeURIComponent(redirect)}`,
+  )
+}
+
+const ssoErrors: Record<string, string> = {
+  authentication_failed: '统一身份认证未完成，请重新尝试。',
+  missing_subject: 'Keycloak 未返回用户唯一标识，请联系管理员检查客户端映射。',
+  account_disabled: '教务系统账号已停用或锁定，请联系管理员。',
+  account_link_failed: '统一身份账号绑定失败，请联系管理员。',
+  account_update_failed: '登录状态更新失败，请稍后重试。',
+  binding_expired: '账户绑定请求已失效，请重新使用统一身份认证登录。',
+  configuration_error: '统一身份认证回调地址配置不正确，请联系管理员。',
+}
+
+onMounted(async () => {
+  const ssoError = String(route.query.ssoError ?? '')
+  if (ssoError) ElMessage.error(ssoErrors[ssoError] ?? '统一身份认证失败，请重新尝试。')
+  try {
+    const { data } = await http.get('/auth/sso/settings')
+    sso.enabled = Boolean(data.enabled)
+    sso.displayName = String(data.displayName || sso.displayName)
+  } catch {
+    sso.enabled = false
+  }
+})
 </script>
 
 <template>
@@ -82,6 +116,16 @@ async function submit() {
         >
           进入工作台
         </el-button>
+        <div v-if="sso.enabled" class="login-divider"><span>或</span></div>
+        <el-button
+          v-if="sso.enabled"
+          class="sso-login-submit"
+          size="large"
+          :loading="ssoLoading"
+          @click="startSso"
+        >
+          使用{{ sso.displayName }}登录
+        </el-button>
         <router-link class="public-timetable-link" to="/timetable">无需登录，查询班级课表 →</router-link>
         <router-link class="account-activation-link" to="/activate">学生首次登录？自助激活账号 →</router-link>
       </form>

web/src/views/PersonnelView.vue

@@ -133,8 +133,25 @@ function resetForm(row?: any) {
       enrollmentDate: `${currentYear}-09-01`,
       status: 'Active',
       dateOfBirth: '',
+      englishName: '',
+      idCardNumber: '',
+      nationality: '',
+      ethnicity: '',
+      politicalStatus: '',
+      nativePlace: '',
+      householdAddress: '',
+      currentAddress: '',
+      postalCode: '',
       phone: '',
       email: '',
+      qq: '',
+      weChat: '',
+      emergencyContactName: '',
+      emergencyContactRelationship: '',
+      emergencyContactPhone: '',
+      specialTags: '',
+      specialNeeds: '',
+      biography: '',
       notes: '',
     }, row ?? {})
   }
@@ -516,7 +533,7 @@ watch(active, async () => {
       </div>
     </section>
 
-    <el-dialog v-model="dialogVisible" :title="`${editingId ? '编辑' : '新增'}${pageTitle}`" width="620px">
+    <el-dialog v-model="dialogVisible" :title="`${editingId ? '编辑' : '新增'}${pageTitle}`" width="min(860px, 94vw)">
       <el-form label-position="top" class="entity-form">
         <template v-if="active === 'teachers'">
           <div class="form-grid">
@@ -580,6 +597,38 @@ watch(active, async () => {
             </el-form-item>
           </div>
           <el-form-item label="出生日期"><el-date-picker v-model="form.dateOfBirth" value-format="YYYY-MM-DD" /></el-form-item>
+          <el-divider content-position="left">个人资料</el-divider>
+          <div class="form-grid">
+            <el-form-item label="英文姓名"><el-input v-model="form.englishName" /></el-form-item>
+            <el-form-item label="证件号码"><el-input v-model="form.idCardNumber" /></el-form-item>
+          </div>
+          <div class="form-grid">
+            <el-form-item label="国籍"><el-input v-model="form.nationality" /></el-form-item>
+            <el-form-item label="民族"><el-input v-model="form.ethnicity" /></el-form-item>
+          </div>
+          <div class="form-grid">
+            <el-form-item label="政治面貌"><el-input v-model="form.politicalStatus" /></el-form-item>
+            <el-form-item label="籍贯"><el-input v-model="form.nativePlace" /></el-form-item>
+          </div>
+          <div class="form-grid">
+            <el-form-item label="户籍地址"><el-input v-model="form.householdAddress" /></el-form-item>
+            <el-form-item label="现居住地址"><el-input v-model="form.currentAddress" /></el-form-item>
+          </div>
+          <div class="form-grid">
+            <el-form-item label="邮政编码"><el-input v-model="form.postalCode" /></el-form-item>
+            <el-form-item label="微信"><el-input v-model="form.weChat" /></el-form-item>
+          </div>
+          <div class="form-grid">
+            <el-form-item label="QQ"><el-input v-model="form.qq" /></el-form-item>
+            <el-form-item label="紧急联系人"><el-input v-model="form.emergencyContactName" /></el-form-item>
+          </div>
+          <div class="form-grid">
+            <el-form-item label="与本人关系"><el-input v-model="form.emergencyContactRelationship" /></el-form-item>
+            <el-form-item label="紧急联系电话"><el-input v-model="form.emergencyContactPhone" /></el-form-item>
+          </div>
+          <el-form-item label="特殊标记"><el-input v-model="form.specialTags" placeholder="多个标记可用逗号分隔" /></el-form-item>
+          <el-form-item label="特殊情况说明"><el-input v-model="form.specialNeeds" type="textarea" :rows="3" /></el-form-item>
+          <el-form-item label="个人简介"><el-input v-model="form.biography" type="textarea" :rows="3" /></el-form-item>
         </template>
         <div class="form-grid">
           <el-form-item label="联系电话"><el-input v-model="form.phone" /></el-form-item>

web/src/views/SsoBindView.vue

@@ -0,0 +1,109 @@
+<script setup lang="ts">
+import { onMounted, reactive, ref } from 'vue'
+import { useRoute, useRouter } from 'vue-router'
+import http, { apiErrorMessage } from '../api/http'
+import { useAuthStore } from '../stores/auth'
+
+const route = useRoute()
+const router = useRouter()
+const auth = useAuthStore()
+const loading = ref(false)
+const checking = ref(true)
+const binding = reactive({
+  providerDisplayName: '学校统一身份认证',
+  externalUserName: '',
+})
+const form = reactive({ userName: '', password: '' })
+
+function safeRedirect(value: unknown) {
+  const path = String(value ?? '')
+  return path.startsWith('/') && !path.startsWith('//') ? path : '/dashboard'
+}
+
+async function submit() {
+  if (!form.userName.trim() || !form.password) {
+    ElMessage.warning('请填写现有教务系统账号和密码。')
+    return
+  }
+
+  loading.value = true
+  try {
+    await auth.bindSso(String(route.query.code ?? ''), form.userName, form.password)
+    ElMessage.success('账户绑定成功。')
+    await router.replace(safeRedirect(route.query.redirect))
+  } catch (error) {
+    ElMessage.error(apiErrorMessage(error))
+  } finally {
+    loading.value = false
+  }
+}
+
+onMounted(async () => {
+  const code = String(route.query.code ?? '')
+  if (!code) {
+    await router.replace({ name: 'login', query: { ssoError: 'authentication_failed' } })
+    return
+  }
+
+  try {
+    const { data } = await http.get('/auth/sso/binding', { params: { code } })
+    binding.providerDisplayName = String(data.providerDisplayName || binding.providerDisplayName)
+    binding.externalUserName = String(data.externalUserName || '')
+  } catch (error) {
+    ElMessage.error(apiErrorMessage(error))
+    await router.replace({ name: 'login', query: { ssoError: 'binding_expired' } })
+  } finally {
+    checking.value = false
+  }
+})
+</script>
+
+<template>
+  <main class="sso-binding-page">
+    <section v-loading="checking" class="sso-binding-card">
+      <div class="brand-mark" aria-hidden="true">
+        <span v-for="index in 9" :key="index" />
+      </div>
+      <span class="eyebrow">首次使用统一身份认证</span>
+      <h1>绑定现有教务系统账号</h1>
+      <p class="binding-description">
+        已通过{{ binding.providerDisplayName }}验证
+        <strong v-if="binding.externalUserName">{{ binding.externalUserName }}</strong>。
+        请输入一次现有教务系统账号和密码，今后即可直接使用单点登录。
+      </p>
+
+      <form @submit.prevent="submit">
+        <label>
+          <span>教务系统账号</span>
+          <el-input v-model="form.userName" size="large" autocomplete="username" />
+        </label>
+        <label>
+          <span>教务系统密码</span>
+          <el-input
+            v-model="form.password"
+            size="large"
+            type="password"
+            show-password
+            autocomplete="current-password"
+            @keyup.enter="submit"
+          />
+        </label>
+        <el-button
+          class="binding-submit"
+          type="primary"
+          size="large"
+          native-type="submit"
+          :loading="loading"
+          :disabled="checking"
+        >
+          确认绑定并登录
+        </el-button>
+      </form>
+
+      <p class="binding-security-note">
+        绑定只建立登录关联，不会修改您的角色、学院或人员档案。
+      </p>
+      <router-link to="/login">取消并返回登录页</router-link>
+    </section>
+  </main>
+</template>

web/src/views/SsoCallbackView.vue

@@ -0,0 +1,39 @@
+<script setup lang="ts">
+import { onMounted } from 'vue'
+import { useRoute, useRouter } from 'vue-router'
+import { apiErrorMessage } from '../api/http'
+import { useAuthStore } from '../stores/auth'
+
+const route = useRoute()
+const router = useRouter()
+const auth = useAuthStore()
+
+function safeRedirect(value: unknown) {
+  const path = String(value ?? '')
+  return path.startsWith('/') && !path.startsWith('//') ? path : '/dashboard'
+}
+
+onMounted(async () => {
+  const code = String(route.query.code ?? '')
+  if (!code) {
+    await router.replace({ name: 'login', query: { ssoError: 'authentication_failed' } })
+    return
+  }
+
+  try {
+    await auth.exchangeSso(code)
+    await router.replace(safeRedirect(route.query.redirect))
+  } catch (error) {
+    ElMessage.error(apiErrorMessage(error))
+    await router.replace({ name: 'login', query: { ssoError: 'authentication_failed' } })
+  }
+})
+</script>
+
+<template>
+  <main class="sso-callback-page">
+    <el-icon class="is-loading" :size="34"><Loading /></el-icon>
+    <h1>正在完成统一身份认证</h1>
+    <p>请稍候，不要关闭此页面。</p>
+  </main>
+</template>

web/src/views/StudentProfileView.vue

@@ -0,0 +1,169 @@
+<script setup lang="ts">
+import { onMounted, reactive, ref } from 'vue'
+import { Check, EditPen, Refresh } from '@element-plus/icons-vue'
+import http, { apiErrorMessage } from '../api/http'
+
+const loading = ref(true)
+const saving = ref(false)
+const editing = ref(false)
+const profile = reactive<Record<string, any>>({})
+const form = reactive<Record<string, any>>({})
+
+const genderLabels: Record<string, string> = {
+  Unknown: '未设置', Male: '男', Female: '女',
+}
+const statusLabels: Record<string, string> = {
+  Active: '在籍', Suspended: '休学', Graduated: '毕业', Withdrawn: '退学',
+}
+
+const editableFields = [
+  'gender', 'dateOfBirth', 'englishName', 'idCardNumber', 'nationality',
+  'ethnicity', 'politicalStatus', 'nativePlace', 'householdAddress',
+  'currentAddress', 'postalCode', 'phone', 'email', 'qq', 'weChat',
+  'emergencyContactName', 'emergencyContactRelationship',
+  'emergencyContactPhone', 'specialTags', 'specialNeeds', 'biography',
+]
+
+function copyToForm() {
+  for (const key of editableFields) form[key] = profile[key] ?? ''
+}
+
+async function load() {
+  loading.value = true
+  try {
+    Object.assign(profile, (await http.get('/student/profile')).data)
+    copyToForm()
+  } catch (error) {
+    ElMessage.error(apiErrorMessage(error))
+  } finally {
+    loading.value = false
+  }
+}
+
+function startEdit() {
+  copyToForm()
+  editing.value = true
+}
+
+function cancelEdit() {
+  copyToForm()
+  editing.value = false
+}
+
+async function save() {
+  saving.value = true
+  try {
+    await http.put('/student/profile', form)
+    ElMessage.success('个人信息已保存，无需审核。')
+    editing.value = false
+    await load()
+  } catch (error) {
+    ElMessage.error(apiErrorMessage(error))
+  } finally {
+    saving.value = false
+  }
+}
+
+onMounted(load)
+</script>
+
+<template>
+  <div class="profile-page" v-loading="loading">
+    <section class="profile-hero">
+      <div>
+        <span>STUDENT PROFILE</span>
+        <h2>我的个人信息</h2>
+        <p>完善个人资料、联系方式与需要任课教师关注的特殊情况。</p>
+      </div>
+      <div class="profile-actions">
+        <el-button :icon="Refresh" @click="load">刷新</el-button>
+        <el-button v-if="!editing" type="primary" :icon="EditPen" @click="startEdit">修改信息</el-button>
+        <template v-else>
+          <el-button @click="cancelEdit">取消</el-button>
+          <el-button type="primary" :icon="Check" :loading="saving" @click="save">直接保存</el-button>
+        </template>
+      </div>
+    </section>
+
+    <el-alert
+      title="联系电话、电子邮箱、微信、紧急联系人以及特殊标记/说明会向你的任课教师展示，并写入教学班名单导出文件。"
+      type="info"
+      :closable="false"
+      show-icon
+    />
+
+    <section class="identity-strip">
+      <div><span>学号</span><b>{{ profile.studentNumber }}</b><small>不可自行修改</small></div>
+      <div><span>姓名</span><b>{{ profile.name }}</b><small>不可自行修改</small></div>
+      <div><span>学院 / 专业</span><b>{{ profile.collegeName }}</b><small>{{ profile.majorName }}</small></div>
+      <div><span>行政班 / 学籍</span><b>{{ profile.className }}</b><small>{{ statusLabels[profile.status] }} · {{ profile.enrollmentYear }} 级</small></div>
+    </section>
+
+    <el-form :model="form" label-position="top" class="profile-form" :disabled="!editing">
+      <article class="profile-card">
+        <header><span>01</span><div><h3>身份与背景</h3><p>除学号和姓名外，可直接维护常用身份信息。</p></div></header>
+        <div class="form-grid">
+          <el-form-item label="英文姓名"><el-input v-model="form.englishName" maxlength="100" /></el-form-item>
+          <el-form-item label="性别"><el-select v-model="form.gender"><el-option v-for="(label, value) in genderLabels" :key="value" :label="label" :value="value" /></el-select></el-form-item>
+          <el-form-item label="出生日期"><el-date-picker v-model="form.dateOfBirth" value-format="YYYY-MM-DD" /></el-form-item>
+          <el-form-item label="证件号码"><el-input v-model="form.idCardNumber" maxlength="30" /></el-form-item>
+          <el-form-item label="国籍"><el-input v-model="form.nationality" maxlength="50" /></el-form-item>
+          <el-form-item label="民族"><el-input v-model="form.ethnicity" maxlength="50" /></el-form-item>
+          <el-form-item label="政治面貌"><el-input v-model="form.politicalStatus" maxlength="50" /></el-form-item>
+          <el-form-item label="籍贯"><el-input v-model="form.nativePlace" maxlength="100" /></el-form-item>
+        </div>
+      </article>
+
+      <article class="profile-card">
+        <header><span>02</span><div><h3>联系方式与地址</h3><p>任课教师仅能看到本区的电话、邮箱和微信。</p></div></header>
+        <div class="form-grid">
+          <el-form-item label="联系电话"><el-input v-model="form.phone" maxlength="30" /></el-form-item>
+          <el-form-item label="电子邮箱"><el-input v-model="form.email" maxlength="100" /></el-form-item>
+          <el-form-item label="微信"><el-input v-model="form.weChat" maxlength="60" /></el-form-item>
+          <el-form-item label="QQ"><el-input v-model="form.qq" maxlength="30" /></el-form-item>
+          <el-form-item label="邮政编码"><el-input v-model="form.postalCode" maxlength="20" /></el-form-item>
+          <el-form-item label="户籍地址" class="span-2"><el-input v-model="form.householdAddress" maxlength="300" /></el-form-item>
+          <el-form-item label="现居住地址" class="span-2"><el-input v-model="form.currentAddress" maxlength="300" /></el-form-item>
+        </div>
+      </article>
+
+      <article class="profile-card attention-card">
+        <header><span>03</span><div><h3>紧急联系与特殊标记</h3><p>本区内容会向任课教师展示，请填写真实且必要的信息。</p></div></header>
+        <div class="form-grid">
+          <el-form-item label="紧急联系人"><el-input v-model="form.emergencyContactName" maxlength="50" /></el-form-item>
+          <el-form-item label="与本人关系"><el-input v-model="form.emergencyContactRelationship" maxlength="30" /></el-form-item>
+          <el-form-item label="紧急联系电话"><el-input v-model="form.emergencyContactPhone" maxlength="30" /></el-form-item>
+          <el-form-item label="特殊标记"><el-input v-model="form.specialTags" maxlength="300" placeholder="多个标记可用逗号分隔" /></el-form-item>
+          <el-form-item label="特殊情况说明" class="span-2"><el-input v-model="form.specialNeeds" type="textarea" :rows="4" maxlength="1000" show-word-limit placeholder="例如学习支持、健康与安全方面需教师留意的事项" /></el-form-item>
+          <el-form-item label="个人简介" class="span-2"><el-input v-model="form.biography" type="textarea" :rows="4" maxlength="1000" show-word-limit /></el-form-item>
+        </div>
+      </article>
+    </el-form>
+  </div>
+</template>
+
+<style scoped>
+.profile-page { display: grid; gap: 18px; }
+.profile-hero { display: flex; align-items: center; justify-content: space-between; gap: 20px; padding: 26px 30px; border-radius: 18px; color: white; background: linear-gradient(125deg, #173a50, #176b87 62%, #2e9b91); box-shadow: 0 18px 45px rgba(23, 58, 80, .16); }
+.profile-hero span { color: #8ee4d8; font-size: 11px; font-weight: 800; letter-spacing: .12em; }
+.profile-hero h2 { margin: 7px 0 5px; font-size: 30px; font-family: "STZhongsong", "Songti SC", serif; }
+.profile-hero p { margin: 0; color: rgba(255,255,255,.75); }
+.profile-actions { display: flex; flex-wrap: wrap; justify-content: flex-end; }
+.identity-strip { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); border: 1px solid var(--line); background: white; }
+.identity-strip > div { display: grid; gap: 5px; padding: 18px 20px; border-right: 1px solid var(--line); }
+.identity-strip > div:last-child { border-right: 0; }
+.identity-strip span, .identity-strip small { color: var(--muted); font-size: 12px; }
+.identity-strip b { color: #263445; }
+.profile-form { display: grid; gap: 18px; }
+.profile-card { padding: 24px; border: 1px solid var(--line); border-radius: 14px; background: white; box-shadow: 0 10px 28px rgba(35,57,78,.05); }
+.profile-card > header { display: flex; gap: 14px; margin-bottom: 22px; padding-bottom: 16px; border-bottom: 1px solid #edf0f3; }
+.profile-card > header > span { color: var(--teal); font: 800 12px/1 Consolas, monospace; }
+.profile-card h3 { margin: 0 0 5px; color: #263445; }
+.profile-card p { margin: 0; color: var(--muted); font-size: 12px; }
+.attention-card { border-top: 3px solid #d89b36; }
+.form-grid { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 0 18px; }
+.span-2 { grid-column: span 2; }
+:deep(.el-form.is-disabled .el-input__wrapper), :deep(.el-form.is-disabled .el-textarea__inner) { background: #f8fafb; color: #364655; }
+@media (max-width: 900px) { .identity-strip { grid-template-columns: repeat(2, 1fr); } .form-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); } }
+@media (max-width: 620px) { .profile-hero { align-items: flex-start; flex-direction: column; padding: 22px; } .profile-actions { justify-content: flex-start; } .identity-strip, .form-grid { grid-template-columns: 1fr; } .identity-strip > div { border-right: 0; border-bottom: 1px solid var(--line); } .span-2 { grid-column: auto; } .profile-card { padding: 18px; } }
+</style>

web/src/views/TeacherRosterView.vue

@@ -118,6 +118,31 @@ onMounted(async () => {
             <el-table-column prop="name" label="姓名" min-width="100" />
             <el-table-column prop="className" label="班级" min-width="130" />
             <el-table-column prop="majorName" label="专业" min-width="150" />
+            <el-table-column label="联系方式" min-width="210">
+              <template #default="{ row }">
+                <div class="contact-cell">
+                  <span>{{ row.phone || '未填写电话' }}</span>
+                  <small>{{ row.email || row.weChat ? [row.email, row.weChat && `微信 ${row.weChat}`].filter(Boolean).join(' · ') : '未填写邮箱或微信' }}</small>
+                </div>
+              </template>
+            </el-table-column>
+            <el-table-column label="紧急联系人" min-width="180">
+              <template #default="{ row }">
+                <div class="contact-cell">
+                  <span>{{ row.emergencyContactName || '—' }}<template v-if="row.emergencyContactRelationship">（{{ row.emergencyContactRelationship }}）</template></span>
+                  <small>{{ row.emergencyContactPhone || '未填写联系电话' }}</small>
+                </div>
+              </template>
+            </el-table-column>
+            <el-table-column label="特殊标记" min-width="210">
+              <template #default="{ row }">
+                <div class="special-cell">
+                  <el-tag v-if="row.specialTags" type="warning" effect="light">{{ row.specialTags }}</el-tag>
+                  <span v-else>—</span>
+                  <small v-if="row.specialNeeds">{{ row.specialNeeds }}</small>
+                </div>
+              </template>
+            </el-table-column>
             <el-table-column label="名单来源" width="210">
               <template #default="{ row }">{{ row.enrolledAt ? `选课 · ${new Date(row.enrolledAt).toLocaleString('zh-CN')}` : '行政班关联' }}</template>
             </el-table-column>
@@ -156,6 +181,9 @@ onMounted(async () => {
 .roster-head h3 { margin: 5px 0 4px; font-size: 18px; }
 .roster-head p { color: var(--muted); font-size: 12px; margin: 0; }
 .roster-head span { color: var(--teal); font-size: 10px; font-weight: 700; }
+.contact-cell, .special-cell { display: grid; gap: 4px; line-height: 1.35; }
+.contact-cell small, .special-cell small { color: var(--muted); white-space: normal; }
+.special-cell .el-tag { width: fit-content; max-width: 100%; white-space: normal; height: auto; padding-block: 3px; }
 @media (max-width: 760px) {
   .roster-workspace { grid-template-columns: 1fr; }
   .roster-task-list { max-height: 220px; border-right: none; border-bottom: 1px solid var(--line); }