From 7caff4d72d5853f2216edb3a1f2c18334aa52d19 Mon Sep 17 00:00:00 2001
From: jeremygan2021 <jeremygan2021@gmail.com>
Date: Fri, 20 Mar 2026 16:18:58 +0800
Subject: [PATCH] new

---
 __pycache__/main.cpython-312.pyc | Bin 90123 -> 92090 bytes
 main.py                          |  43 ++++++++++++++++
 templates/add_user.html          |  70 +++++++++++++++++++-------
 templates/admin.html             |  82 ++++++++++++++++++++++++++-----
 templates/data_base.html         |  74 ++++++++++++++++++++++++++++
 templates/edit.html              |  74 ++++++++++++++++++++++++++++
 6 files changed, 312 insertions(+), 31 deletions(-)

diff --git a/__pycache__/main.cpython-312.pyc b/__pycache__/main.cpython-312.pyc
index 40dc01a39d61f753b2e5d93e9378cdecec38bcf3..acda3f55534b84bbf008b8b797e9f559e3b2ea55 100644
GIT binary patch
delta 4645
zcmZuz3sh9)7C!sToCD18P-kF3K|mpyQc<v%Rw|{I<|{Gt$(=X{Azu13s3-^;6}N}M
zI_c5WtJbxLXlheyN~??JEy^BD_`u0qm;zcBqhe}C-o4K-Fs%h^@tuA4{`UU&-e>>+
zKQGh?2fh_TkA{R8IQ+XEKF-NXuL+Ih=Y{Q03KF58BSq}wl`EoI_jN5OlY>&CYk`;?
zC+(7TS-jLxsju}axOq0kBU%(kP;#7X-2HYf@6~q^kNFWZmAU{+{PA8`C;V6vu`DOM
z7i_BJx|fp47ILcF=C0(FR}Jx|9?kc11g3YoQm@n-;+2C2gUPG;!Ec3ZN_g0hz9>8=
z3sST1EeoVGvL0jnR4H_?n?oL!vp$Y=&M&8@$aY6dx2@IBmdkUKIH|3Ylg|74GA~c7
z??NwK_!+ZqHV*2ojTimWFVF(~+Dm}nFhE>zyrsQ68INBwOUTc9$!Dtu$s}EtM@v`a
zrBa8yG)t7O`jyOx9rL@7O-yXcHNQNHsPM$={tWG->!llhEW4cY)Gx}8k*35ydSTx5
zV=hBxJ292q5JMtmMzf}uI{i2+w1)nL4ZS6Y*6Nf4A@PH`?zo%f60Z-|27X>EG1G|K
zP|5d7)%j6ZVc8K0NY(qOC<|0OK1DxbDaCvUl>t7Ycj8eK=tnD)SED8<H;Lm|zQjpl
zUirLo?O8Fe0w=Gc8k98?%n?X3RKsqgFW9`b@>(>(z2;an1<OkjL-0QoNny2m?;ZmV
zNlNu+F@f`*!C2+hppLj5%*wt{LFgktgZ?8s%x3iHTdVVVl!zr_lG*W7=tuAM?UQU<
zl9Ozc@^cE3^9mQ|6e!6PB0{rpt54y8Q@J3nlv7=17^XBcOQ^(4I^PtR@yfJqv1<Dy
zFb*x#mGY%Jt->MppsrH^E0qGIz%BglAYVyk`cl1e=1O?EK{BE>SPI!4S}XYSD%H>8
z{Jg`YKIAR+-QCZ(<}B`R?#1lEoITjLMgqqMmkIt}_AsBVRPe2<#WD57DbM8RauSpY
ztA$xz&*iY3TcMlFEr&h2<zO`z-+^HaaroEv&W^U~XIrY*wY<EqZPUS)kJn$=_2T)x
zYg*UsY<c<hvlVMK)-;xaO=FYLi<$8NWZ?+u#gwSmskN%Q<@s&wAH*u}Ky(|lwrALi
z?b&X<ofXSD6{CYVw=U1N!YZ&Fiu4qMJ22aBUs70*SK<!Hx2?#qEtcJZMYepoD90{O
z)K+NO`)u3xH5XplbbjyNoElo;G(j_hHIUgTQamXZkYwSx`#5H#$c7@>o{?Etn42TB
z`-p(woU@ATbCOF4w4x%g6n7w#i!h5KSy{R(qTJ}sT^kuT2JOdjAd5c1py#>k6`aRl
z5*9#Hc(l5pW`VNkWZ2*;eUr(e-cxhW#>sE-jix)Q0?+j|sZlji4FiTY41b`p@7OA_
z*=VX>_MI{2v}N!I`uc&cp-&vM%&mI3DcF26IMx*$+hmSwiimECifI}ZIjAXWpvTCC
z#C33DNT?^2Ge=iVKWB>FH=(Y;l{C8{GwYaXaYOK8PdwKr;YP<GE;wA-|4l;qpG7k<
z$+eI+5-Lq;Jf}h$r{6f<g5sfM(jFQSM)Fva4|9O>VLm8rxbCnqGR>+xJQzq$5Xfp3
zNFJ_3d1biYM#{{VGjoU0cg@5ecK^`^40{^k%Hs&${iPiGHbPlh9ii;|Ik3D8O7VcA
zZRC4Ox-I-HPMb)5&qTJqUeUU3XV+ZTY;4`Qx25`x7U#R(LGw){OQkU!g<$2G4HI#P
zP)c%vJtxy<mnAFj4)A{aB5gXX<-GRc-A1ByjYSc<b8&GjA0O^MT45PIW6Q>&xt+fJ
zNVIo-dCt^dO|D5k*)P%6FL8TbW53jjDNU9^+p}Djp&zWO&vK1TcNu3l=x5(3qC;%$
z5G$<gOWjN8Ifn|1?U`un{-ZNO>)bSD<Tg{Vgl(eM?8YNn$@^}ga%+O29Pp^>>XleL
z2p#-)Z_UOF6%{Sd9r$~T(u?V^z|Q#_y<3!asMbMjp0-y)BsovE%Uyl30vnCB7t#0i
zc4vk=xO-1v`s_h8U!&I0L87&$!@%{4-luOE|ClRb*0Hekiiex@!6)_oUHbkT?>nYX
zYBHKCrgt@Ea3VOieky=C0mE>D<E<l6AWlL#P;h+y-wK`h2+Dm0$J8&L0AUKs!<AiM
zo)M;^bf=^G=<B@j7>eT^_k82zVV2@)2uBoM<AwRCPIo-&>If7vP_#KFxTlE0(@~tr
z79z4mjxEhKJe+b2Kii)Vf09(01gkI)CXpm73tKFZtrWM+hl>tZOAf$HWlY;#F_)}`
z%ByWD!g3V<<#4ra)AMH0!7hHxLzyz7eE_Ud9&I1O$B2&N_BlM1DqmlkVJss*Y9*Vk
zBwb#`Cy9=om$Ud0)uexz)}4Z24PbsmGHEB&OC+r$cv%^9bs>y$Y`R*{!&2qR>+3*O
zE?tlH#@|7drOJRC*1@w$Tu5=tXi*B|*3;0lLVBkUtK{7n2jd-kZoI~qZzB4u2zW9+
zLS9-*-gso1O1jrblE^)m;NSH6Cc#?-y9nqOvj%&M=<(h|rgsQ>NsH~{xj^ixmX>nj
z&&jaZ5#PCm7k84w8_K7*CV{%%2nn%TYnJ{!3_AOK*H447@Z9=!aPt1uq+Laz^;acn
zKY@e5Nl--<{gZ(9Ju4v{fk{+f1GpPXoNj<j5DuVjvolQxVIY2l@=j5iyE9f@riUMe
zPw>6gIZuGeI^i(N@2YPHLMPNY-wc8fJt*q?A+RWFGg{onB`hc3#!51B<r4NOYS<B8
zIaF^}$A!X7V;w2HT6Ie(M2TOJVzYWM6q2A`Jr@co!ndgU+BqN$7V7zW@-+pqL#V@h
zv`*b%g3+Q2-}nIM2@`baaPgxSNC3O)vB2%(mlW@)8W#z7L7h4$5@Mq2Np&2-9lRvZ
zmMLc!=1DRuV)^PzkuXtgLQ8Cb^Hd~c3gTzP{apP|0>p*1Zho(I!#>tXDn%_E2u~W1
zlB_LpTs=JySFKYa7LuaBBE42hK1y9zah|QXNM^^?39)dm@ITZ);Cwn3?($z`h^R$B
zrd~{d+pq*vB2-$n9`)SXKT_-$X=q*|=vnH7T9=67&Y(Tdc{35d=M86xORzz0P68X8
zb*5QijR+q)k0iqi{-Itb)h%Y<nNiI0(ycn}Vqupk1`XdIraAJ1**1IJ3|mRuL|aat
zERBw1m1;!_6o+eLw3QNih4||UHmHVFcntQd3sWIAl0xA1lV4a|V9zKiwiPh%?ojFu
zMXN_rvEEDSFR5_9@D~!dIfsn`k6}g&#rcqcu2t4bQX9fFwu0Vg6HFvHPZp5?|2cLi
zWpaUDe<t`9q4*m#D2G0bSGSFTbmvcF;ZYd(8(G^4JP7W<%tA^2TlE}X>{|8gGO;QN
zt`N}gFV>+JjECW|y%tZTs|1~Dd@97KP2+LAwQcyjdTl%;gkK}$bpmP)yFsuAyAjj>
z4-#(@{7FzsOKFL8s*BUGLx4%$a=x7g1N8h-UKuta()q(gXyW00r}GioukVvvrTW!m
zxLeecbE-j8Aa$g+P|vzrV2#@|Puf}6N&c&GS*1DIqE=1;v!KT{pKxxS0;6=iPNz0b
zgY|*|buXy-)8QuUP;+L$aM-GDoB`vYN<B3L>SMJj(0-TN=%dV`sGTHfGxEH%ZYFGp
z@-d{Q9~;`W%IH#LbQ?0d1{vLdY$^d=dTc%cU2beSfmR%yRE&-&M&}Zv1Bq#)NGAt#
z5zwY~>z3fvO&iZGdhdHid&Qz{5JpqSsIiPHWd@zvHVc*+lkf%mz!e#So!RM75l|kv
zCbGd0-3T!r-U16?<MPWKJ+J6EexO(7N#S_mIm;SLLr`2J#Cv!F9*6CdE_3uG-XO0E
zf7l{Vix<-f126F+n8_ULA<5IHD@s-5_MsJ)Mo1>F1<o7u;VKU<wS5sp!WA_z1ETx8
u46%(6=iwg*%%malUJs{9b(5~B51>836*ROFhFwx^888>VQx9gqjQ<1mT@392

delta 3014
zcmZuz4Nz3q6@KUKzPIcyKX&BL9|RmB&`RQ9lmTRvS`lJ&5L;A`;D+}=egt{}BLY<;
zmN-eO=?l4auxf3R(O`nf#=O*~Ep6;*lhlAh#8o3C5yXlj8e0-EJ?E{!CId73?RU@l
z?m6e4y+54zRC>Nu^8MJy$0p$4<@+BLcCUEJH&}en_w6XF4BpOIc|_DcwD?>8t=f+s
zX%@8<Ypnc`Zn1`tOKY}17T63FKoFFUdZF1(g{(YnP!0+?H|Fb91M@}YvwHKGLNOHQ
zf1v2{P^hGcxiG2_1yxd9qoaIKE~;jXd8u9+i<wU|d@he_l+Wu0?R{Ig=3}?cRJuLN
z+aL-{1*NB6P`+pu-8E+wYOR)_@Gspfbla3SR1>E7%A=?vLv?imRj-Gt*iiLNpt|Ov
zDj}6m|5&-#vD_~E%o(GGJ)rm~H`D}WKrK~ns-^j|a;sj_QoX}N21hmI#}aRQge|8o
zL=1T<jD?t$J07ZEs<A~^wd91!5qBq0e(j;GKxIEE<L*tM{I7?y%4qBVu&u+YZ?oxP
zV>eMf;opqSZBjQqtmj*gxzCVFtMRb~jr&JD{F|v+K@Y~Fd`IiX4hf{u-tY-ehB2S<
zv!PG)n7>7>L5rz4N)T9yA}Df6ZC0)EU6)mdd#kSKzP8@af3jlU14pINP+42mt$Vb#
z+W}!XSyoFCE%@<5jkVeAULXjl0j)jLUz_7+wLFW#YH|FdxBP8tEQ)RFvp5WY)88Lw
z*+<&~LbY5iNBKH`?f1dE7WpxUvazsKTlrd`HuO=SJQsImr`dVs<0&A|Lw?!peDKLO
zlN^V<*X*osTLV%&a+B86-XkR<vpG+l{i7%?LK^5S>(s@dWTb2Xo=#@RLYaUp+RT!*
zq^@Ks4Smth9bI?5q~%EGJ8OHE$=*pwQ`j<^_oVY&-%BFA<y5av6=TxLw348PLS+zJ
zg%E9G4V0jVpblM_AX7VfBOCti^cpAxSg5g^Yvr}1&(Yd%#!4#E3a8ht17@*bavr(!
z7tvBo-U2~O?(`Q~p|<1RBjS+cJbG`n2t}HCINfdtDk#NbEqAy^9Fd%thV#WazoLn$
zRM0X?ZDAfla#hom8e+8sb$puz0<?zvsbF=s-9IftuD18P-@wksC<t{Y*-g6K#tevt
z#f`NPVsm*hwW7SNv_fs%4~ro1_!T%LZfzjha|qEgOQZZo5$?(4T28h-#1tx_nBccG
zY$SMv;CBRj5u&}_WslEpBG*2G#RNGNtd2q$>)9^~R)Lk#_<*SGdvOY%X@)tlKwo8s
zeWI+<l$ZI}GAxCiJjnvHLXEEEem@>Y84W^RSqSTRs|C&{m5{xVz-aDHVh0Hh5xh?D
z9M!XnU?V{R*$A#lyu%CPpg{MwLLNv*&{nQj+Q1LwX5?FBZRE93e%KCIq&IQAO@F}~
zo-j#oBX8gr{a^%I^b3=~#|+zfpFcbmybC=pdpRrI=wQ{k#cDNs2QAFWa{?gW-a`DL
z;Y<Kbk>4l7E<O+dQK0j{K!}z8il#&Q@<7Nj&(M*lu=UiqZh}h)E7&o#MoX-PpPmW{
zax0F`%evPzxNE{HMrOb)c$&`)g&)g*LKi#1GeTiLwD4V_5Hf`#vXcld@A48yp1Pr|
zL{V7<%jSOzg%tS|dhW`)Jq+?B`8a9c<F|hTVLrW0@AkfOjQxX5+xZ_N;A#5_;zo*-
z+&2=lw(z-;5H<bJWH%O;jm%}MP%CruN*q-cDm%%aiG+CR6SPm(k4M6M&m@n?M)VK)
zjM)&0OIR`+>Z6U0ouaiHJLwF?eu0KB5{#$%Cm))P;o8ujtjEN_MbYmpX$gugcz#!D
z|5_BPJ+<(0TZcKqy%)~vm2+Ub42Si5^I^02vkA7dOWrUqw~Ceg9B&N=W$dP)v@yS#
zyjoqn!BH8O?x+q+aTJ!QN<tW8{GE8H3NSX<?@5n0tH5>;)bj-ikO2qz?gW?{Od(u$
z$Hua%(#qWGDn}`EA0h5afS*D)4@rb1X#ho)dTt^N+R{5H#$kd?+QOa0K0{c+Hq-bQ
z1StgP$s-fsM_}`)iY^*nAh?83bp{>$SR7R8{!8IWSag{@pA%d`aCzmGDeCuDeT#g?
zaqJ;Rk=Yjn#;*L5A54Wur%t$N5`D$5r9z^7i1<|=od&Z4dWrWD7*VegYofJJpT_!W
zaGl^k1hupPqktQHZyI)G5Um~h#Wa{^7IQ_deMzuBX$5qN@T%UQPAB(On#TBpl@KQz
zMZL}wGhlACk!n1%5!ld<Zz$seyumrjr8^iVM*lPe9yf_YB9}6uQ5r_udVU}izJ=Yq
zX*E0w&-0H~<1M?B+t<M9P~(?gM}2n?ETKw9h#C7}vp%#24#HM?DH%PHjNV2TPmoAJ
zFCj}KpcjtO!{ffJ=wf1YBQd&$7~Mb2*k5#8FuDTRDFm0PysDDX@p8$ETB25}j824c
z3K;DsM$PkLv@|v>@~CXsWDmlBda%br#Xh@!BpbF_be;#Y3EKGnd<c#k5^@06!5xzz
zh75`ZAH<7Rlp2D!2e;Wm&q3Irm`Rehi1<OlV697s_&`2Px3pPjpM#h|KB)lKLOU-i
Hfb{<ZU^goB

diff --git a/main.py b/main.py
index 41accc8..70eacc3 100644
--- a/main.py
+++ b/main.py
@@ -1234,6 +1234,49 @@ def add_user_api(user_data: AddUserRequest):
             release_db_connection(conn)
         return JSONResponse(content={"success": False, "message": f"添加失败: {str(e)}"}, status_code=500)
 
+@app.post("/api/admin/login")
+async def admin_login(request: Request):
+    """
+    管理后台登录验证接口。
+    """
+    try:
+        body = await request.json()
+        password = body.get('password', '')
+        
+        secret = os.getenv("ADD_USER_SECRET", "123quant-speed")
+        
+        if password == secret:
+            response = JSONResponse(content={"success": True, "message": "登录成功"})
+            response.set_cookie(
+                key="admin_auth",
+                value="true",
+                httponly=True,
+                max_age=60*60*24*7,
+                samesite="lax"
+            )
+            return response
+        else:
+            return JSONResponse(content={"success": False, "message": "密码错误"}, status_code=401)
+    except Exception as e:
+        return JSONResponse(content={"success": False, "message": str(e)}, status_code=500)
+
+@app.get("/api/admin/check-auth")
+async def check_admin_auth(request: Request):
+    """
+    检查管理员是否已登录。
+    """
+    auth_cookie = request.cookies.get("admin_auth")
+    return {"success": auth_cookie == "true", "authenticated": auth_cookie == "true"}
+
+@app.post("/api/admin/logout")
+async def admin_logout():
+    """
+    管理员退出登录。
+    """
+    response = JSONResponse(content={"success": True, "message": "已退出登录"})
+    response.delete_cookie("admin_auth")
+    return response
+
 @app.get("/admin", response_class=HTMLResponse)
 async def admin_page(request: Request):
     """
diff --git a/templates/add_user.html b/templates/add_user.html
index 4acd99f..bf6bb6d 100644
--- a/templates/add_user.html
+++ b/templates/add_user.html
@@ -297,28 +297,62 @@
     </div>
 
     <script>
-        // Use secret from backend
-        const ACCESS_SECRET = "{{ secret }}";
+        document.addEventListener('DOMContentLoaded', checkAuthStatus);
 
-        // Password Check Logic
-        function checkSecret() {
-            const input = document.getElementById('secret-input');
-            const error = document.getElementById('secret-error');
-            const overlay = document.getElementById('password-overlay');
-            
-            if (input.value === ACCESS_SECRET) {
-                overlay.style.opacity = '0';
-                setTimeout(() => {
-                    overlay.style.display = 'none';
-                }, 500);
-            } else {
-                error.classList.remove('hidden');
-                input.value = '';
-                input.focus();
+        async function checkAuthStatus() {
+            try {
+                const res = await fetch('/api/admin/check-auth');
+                const data = await res.json();
+                
+                if (data.authenticated) {
+                    hideOverlay();
+                } else {
+                    showOverlay();
+                }
+            } catch (e) {
+                showOverlay();
+            }
+        }
+
+        function showOverlay() {
+            document.getElementById('password-overlay').style.display = 'flex';
+        }
+
+        function hideOverlay() {
+            const overlay = document.getElementById('password-overlay');
+            overlay.style.opacity = '0';
+            setTimeout(() => {
+                overlay.style.display = 'none';
+            }, 500);
+        }
+
+        async function checkSecret() {
+            const input = document.getElementById('secret-input');
+            const error = document.getElementById('secret-error');
+            const password = input.value;
+            
+            try {
+                const res = await fetch('/api/admin/login', {
+                    method: 'POST',
+                    headers: {'Content-Type': 'application/json'},
+                    body: JSON.stringify({password: password})
+                });
+                const data = await res.json();
+                
+                if (data.success) {
+                    error.classList.add('hidden');
+                    hideOverlay();
+                } else {
+                    error.classList.remove('hidden');
+                    input.value = '';
+                    input.focus();
+                }
+            } catch (e) {
+                error.textContent = '网络错误';
+                error.classList.remove('hidden');
             }
         }
 
-        // Allow pressing Enter to submit password
         document.getElementById('secret-input').addEventListener('keypress', function (e) {
             if (e.key === 'Enter') {
                 checkSecret();
diff --git a/templates/admin.html b/templates/admin.html
index ac3944c..fc6699f 100644
--- a/templates/admin.html
+++ b/templates/admin.html
@@ -329,6 +329,27 @@
                 </button>
             </a>
         </div>
+
+        <div class="card" style="padding: 20px;">
+            <h2 style="margin-bottom: 15px;">快捷导航</h2>
+            <div style="display: flex; gap: 10px; flex-wrap: wrap; justify-content: center;">
+                <a href="/add-user" style="text-decoration: none;">
+                    <button style="background: linear-gradient(90deg, #28a745 0%, #20c997 100%);">
+                        ➕ 添加嘉宾
+                    </button>
+                </a>
+                <a href="/edit" style="text-decoration: none;">
+                    <button style="background: linear-gradient(90deg, #ffc107 0%, #fd7e14 100%);">
+                        ✏️ 编辑信息
+                    </button>
+                </a>
+                <a href="/data-base" style="text-decoration: none;">
+                    <button style="background: linear-gradient(90deg, #17a2b8 0%, #138496 100%);">
+                        🗄️ 数据库管理
+                    </button>
+                </a>
+            </div>
+        </div>
         
         <div class="card">
             <h2>基本信息设置</h2>
@@ -603,26 +624,61 @@
                     header.parentElement.classList.toggle('collapsed');
                 });
             });
+            
+            checkAuthStatus();
         });
 
-        // Use secret from backend
-        const ACCESS_SECRET = "{{ secret }}";
+        async function checkAuthStatus() {
+            try {
+                const res = await fetch('/api/admin/check-auth');
+                const data = await res.json();
+                
+                if (data.authenticated) {
+                    hideOverlay();
+                } else {
+                    showOverlay();
+                }
+            } catch (e) {
+                showOverlay();
+            }
+        }
 
-        // Password Check Logic
-        function checkSecret() {
+        function showOverlay() {
+            document.getElementById('password-overlay').style.display = 'flex';
+        }
+
+        function hideOverlay() {
+            const overlay = document.getElementById('password-overlay');
+            overlay.style.opacity = '0';
+            setTimeout(() => {
+                overlay.style.display = 'none';
+            }, 500);
+        }
+
+        async function checkSecret() {
             const input = document.getElementById('secret-input');
             const error = document.getElementById('secret-error');
-            const overlay = document.getElementById('password-overlay');
+            const password = input.value;
             
-            if (input.value === ACCESS_SECRET) {
-                overlay.style.opacity = '0';
-                setTimeout(() => {
-                    overlay.style.display = 'none';
-                }, 500);
-            } else {
+            try {
+                const res = await fetch('/api/admin/login', {
+                    method: 'POST',
+                    headers: {'Content-Type': 'application/json'},
+                    body: JSON.stringify({password: password})
+                });
+                const data = await res.json();
+                
+                if (data.success) {
+                    error.style.display = 'none';
+                    hideOverlay();
+                } else {
+                    error.style.display = 'block';
+                    input.value = '';
+                    input.focus();
+                }
+            } catch (e) {
+                error.textContent = '网络错误';
                 error.style.display = 'block';
-                input.value = '';
-                input.focus();
             }
         }
 
diff --git a/templates/data_base.html b/templates/data_base.html
index 5fde983..a9e441d 100644
--- a/templates/data_base.html
+++ b/templates/data_base.html
@@ -360,6 +360,18 @@
     </style>
 </head>
 <body>
+    <!-- Password Overlay -->
+    <div id="password-overlay" style="position: fixed; top: 0; left: 0; width: 100%; height: 100%; background-color: var(--bg-color); z-index: 9999; display: flex; align-items: center; justify-content: center; backdrop-filter: blur(10px);">
+        <div class="card" style="text-align: center; width: 90%; max-width: 400px;">
+            <h2 style="margin-bottom: 20px; color: var(--primary-color);">请输入访问密钥</h2>
+            <div class="form-group">
+                <input type="password" id="secret-input" placeholder="输入密钥" style="text-align: center;">
+            </div>
+            <button onclick="checkSecret()">确认</button>
+            <p id="secret-error" style="color: #ff6b6b; margin-top: 15px; display: none;">密钥错误</p>
+        </div>
+    </div>
+
     <div class="container">
         <h1>数据库管理</h1>
         
@@ -410,6 +422,68 @@
     <div id="message"></div>
 
     <script>
+        document.addEventListener('DOMContentLoaded', checkAuthStatus);
+
+        async function checkAuthStatus() {
+            try {
+                const res = await fetch('/api/admin/check-auth');
+                const data = await res.json();
+                
+                if (data.authenticated) {
+                    hideOverlay();
+                } else {
+                    showOverlay();
+                }
+            } catch (e) {
+                showOverlay();
+            }
+        }
+
+        function showOverlay() {
+            document.getElementById('password-overlay').style.display = 'flex';
+        }
+
+        function hideOverlay() {
+            const overlay = document.getElementById('password-overlay');
+            overlay.style.opacity = '0';
+            setTimeout(() => {
+                overlay.style.display = 'none';
+            }, 500);
+        }
+
+        async function checkSecret() {
+            const input = document.getElementById('secret-input');
+            const error = document.getElementById('secret-error');
+            const password = input.value;
+            
+            try {
+                const res = await fetch('/api/admin/login', {
+                    method: 'POST',
+                    headers: {'Content-Type': 'application/json'},
+                    body: JSON.stringify({password: password})
+                });
+                const data = await res.json();
+                
+                if (data.success) {
+                    error.style.display = 'none';
+                    hideOverlay();
+                } else {
+                    error.style.display = 'block';
+                    input.value = '';
+                    input.focus();
+                }
+            } catch (e) {
+                error.textContent = '网络错误';
+                error.style.display = 'block';
+            }
+        }
+
+        document.getElementById('secret-input').addEventListener('keypress', function (e) {
+            if (e.key === 'Enter') {
+                checkSecret();
+            }
+        });
+
         let currentTable = '';
         let currentPage = 1;
         let pageSize = 50;
diff --git a/templates/edit.html b/templates/edit.html
index 69733bd..1d7556d 100644
--- a/templates/edit.html
+++ b/templates/edit.html
@@ -273,6 +273,18 @@
     </style>
 </head>
 <body>
+    <!-- Password Overlay -->
+    <div id="password-overlay" style="position: fixed; top: 0; left: 0; width: 100%; height: 100%; background-color: var(--bg-color); z-index: 9999; display: flex; align-items: center; justify-content: center; backdrop-filter: blur(10px);">
+        <div class="card" style="text-align: center; width: 90%; max-width: 400px;">
+            <h2 style="margin-bottom: 20px;">请输入访问密钥</h2>
+            <div class="input-group">
+                <input type="password" id="secret-input" placeholder="输入密钥" style="text-align: center;">
+            </div>
+            <button onclick="checkSecret()">确认</button>
+            <p id="secret-error" class="error-msg hidden">密钥错误</p>
+        </div>
+    </div>
+
     <div class="container">
         <header>
             <img src="{{ config.header_image }}" alt="{{ config.event_title }}" class="header-img" onerror="this.style.display='none'">
@@ -384,6 +396,68 @@
     </div>
 
     <script>
+        document.addEventListener('DOMContentLoaded', checkAuthStatus);
+
+        async function checkAuthStatus() {
+            try {
+                const res = await fetch('/api/admin/check-auth');
+                const data = await res.json();
+                
+                if (data.authenticated) {
+                    hideOverlay();
+                } else {
+                    showOverlay();
+                }
+            } catch (e) {
+                showOverlay();
+            }
+        }
+
+        function showOverlay() {
+            document.getElementById('password-overlay').style.display = 'flex';
+        }
+
+        function hideOverlay() {
+            const overlay = document.getElementById('password-overlay');
+            overlay.style.opacity = '0';
+            setTimeout(() => {
+                overlay.style.display = 'none';
+            }, 500);
+        }
+
+        async function checkSecret() {
+            const input = document.getElementById('secret-input');
+            const error = document.getElementById('secret-error');
+            const password = input.value;
+            
+            try {
+                const res = await fetch('/api/admin/login', {
+                    method: 'POST',
+                    headers: {'Content-Type': 'application/json'},
+                    body: JSON.stringify({password: password})
+                });
+                const data = await res.json();
+                
+                if (data.success) {
+                    error.classList.add('hidden');
+                    hideOverlay();
+                } else {
+                    error.classList.remove('hidden');
+                    input.value = '';
+                    input.focus();
+                }
+            } catch (e) {
+                error.textContent = '网络错误';
+                error.classList.remove('hidden');
+            }
+        }
+
+        document.getElementById('secret-input').addEventListener('keypress', function (e) {
+            if (e.key === 'Enter') {
+                checkSecret();
+            }
+        });
+
         async function searchUser() {
             const query = document.getElementById('search-input').value.trim();
             const btn = document.getElementById('search-btn');