Update Space: schedule, MySQL persistence, registration codes, registration flow

README.md

@@ -1,222 +1,222 @@
----
-title: Advanced SCU Course Catcher
-emoji: 🐳
-colorFrom: green
-colorTo: yellow
-sdk: docker
-app_port: 7860
-pinned: false
----
-
-# Advanced SCU Course Catcher
-
-这是一个面向 Hugging Face Space 的四川大学选课系统 Web 版抢课面板。当前版本已经从单机脚本改造成了可部署、可并行、可多用户管理的 Flask + Selenium 服务，支持普通用户端和管理员端分离运行。
-
-## 当前能力
-
-- 普通用户入口：`/login`
-  用户使用 `学号 + 密码` 登录，只能看到自己的课程、任务状态和实时日志。
-- 管理员入口：`/admin`
-  管理员使用 `账号 + 密码` 登录。此入口不会在用户登录页展示。
-- 多管理员体系
-  支持多位普通管理员，支持 1 位超级管理员。超级管理员账号和密码由环境变量 `ADMIN`、`PASSWORD` 提供。
-- 多用户管理
-  管理员可以手动录入用户账号、重置密码、启用/禁用用户、查看所有课程目标。
-- 课程录入
-  用户自己填写 `课程号` 和 `课序号`，管理员可见全部内容，也可以代为录入和修改。
-- 实时日志
-  用户和管理员都可以实时看到程序日志，前端通过 SSE 持续推送。
-- 并行调度
-  多用户任务由后台任务调度器并行执行，管理员可以在后台动态设置并行数。
-- Hugging Face Space 适配
-  使用 Docker Space 运行，内置 Chromium、chromedriver、中文字体和无头浏览器配置。
-- 登录验证码与提交验证码 OCR
-  登录阶段和提交选课阶段都支持验证码 OCR 自动识别。
-- Selenium 自恢复
-  单个 Selenium 会话连续错误达到 5 次时，会自动重建浏览器；连续重建 5 个会话仍失败时，任务才会终止。
-
-## 运行结构
-
-当前实际运行入口和核心模块如下：
-
-- `app.py`
-  Hugging Face / gunicorn 使用的 WSGI 入口。
-- `space_app.py`
-  Flask 路由、页面渲染、登录鉴权、SSE 日志流。
-- `core/config.py`
-  运行配置与内部密钥管理。
-- `core/db.py`
-  SQLite 数据层。
-- `core/task_manager.py`
-  并行调度、任务生命周期管理。
-- `core/course_bot.py`
-  Selenium 抢课核心逻辑、验证码识别、重试与重建策略。
-- `webdriver_utils.py`
-  Chromium / chromedriver 初始化。
-- `templates/` + `static/`
-  用户端、管理员端和响应式前端页面。
-
-## 环境变量
-
-为了减少 Space 配置复杂度，当前只保留少量必要环境变量。
-
-### 必填
-
-- `ADMIN`
-  超级管理员账号。
-- `PASSWORD`
-  超级管理员密码。
-
-### 可选
-
-- `DATA_DIR`
-  数据目录，默认会使用仓库下的 `data/`。在 Hugging Face Space 中建议保持为 `/data`。
-- `CHROME_BIN`
-  自定义 Chromium 路径。默认会自动尝试 `/usr/bin/chromium`。
-- `CHROMEDRIVER_PATH`
-  自定义 chromedriver 路径。默认会自动尝试 `/usr/bin/chromedriver`。
-
-### 不需要再手动配置的内容
-
-以下内容已经改为自动生成或写入程序默认值，不需要再手工配置环境变量：
-
-- Flask session secret
-- 用户密码加密密钥
-- 默认并行数
-- 登录重试次数
-- Selenium 会话错误阈值
-- Selenium 会话重建阈值
-- 提交验证码重试次数
-- 页面超时时间
-- 日志页容量
-
-程序会在 `DATA_DIR/.app_secrets.json` 中自动持久化内部密钥。这样即使以后修改 `ADMIN` 或 `PASSWORD`，也不会导致历史用户密码全部失效。
-
-## Hugging Face Space 部署
-
-### 1. 创建 Space
-
-在 Hugging Face 上创建一个新的 Space：
-
-- SDK 选择 `Docker`
-- 端口使用 `7860`
-- 仓库内容直接推送本项目即可
-
-本仓库根目录已经提供好 `README.md` 的 Space metadata 和 `Dockerfile`。
-
-### 2. 设置 Space Secrets
-
-进入 `Settings -> Variables and secrets`，至少配置：
-
-- `ADMIN=你的超级管理员账号`
-- `PASSWORD=你的超级管理员密码`
-
-通常不需要再设置其他环境变量。
-
-如果你想显式指定数据目录，也可以增加：
-
-- `DATA_DIR=/data`
-
-### 3. 开启持久化存储
-
-如果你希望以下数据在 Space 重启后仍然保留，建议在 Space 设置里开启 Persistent Storage：
-
-- 用户账号
-- 管理员账号
-- 课程目标
-- 任务历史
-- 运行日志
-- 自动生成的内部密钥文件
-
-当前 Dockerfile 已按 `/data` 目录进行适配，并预先处理了目录权限，方便在 Space 中直接持久化。
-
-### 4. 推送部署
-
-如果你使用 git 推送到 Hugging Face Space，可以参考：
-
-```bash
-git remote add space https://huggingface.co/spaces/<your-name>/<your-space>
-git push space main
-```
-
-### 5. 启动方式
-
-容器启动命令已经写入 `Dockerfile`：
-
-```bash
-gunicorn --bind 0.0.0.0:${PORT:-7860} --workers 1 --threads 8 --timeout 180 app:app
-```
-
-这里使用 `1` 个 gunicorn worker，是为了避免多进程情况下每个进程都各自启动一套本地任务调度器。并发能力由应用内部的线程调度和管理员可配置的任务并行数控制。
-
-## Space 端建议配置
-
-推荐的初始运行策略：
-
-- 后台并行数先设置为 `1` 或 `2`
-- 只有在 Space CPU / 内存足够稳定时，再逐步提升
-- 在真实高峰前，先做一次小规模联调
-
-对于 CPU 较小的 Space，同时拉起过多 Chromium 会明显增加失败率，因此管理员后台提供了并行数动态调整功能。
-
-## 管理员联调清单
-
-部署到 Space 后，建议按以下顺序联调：
-
-1. 访问 `/admin`，使用 `ADMIN` / `PASSWORD` 登录超级管理员。
-2. 在管理员后台创建 1 个普通管理员、2 个测试用户。
-3. 为两个测试用户分别录入不同课程号和课序号。
-4. 将并行数设置为 `2`。
-5. 分别触发两个用户任务，确认两条任务都能进入队列，并按并行数启动。
-6. 在管理员日志面板确认日志持续刷新，且可以看到不同学号的执行记录。
-7. 使用用户账号访问 `/login`，确认用户只能看到自己的课程和日志。
-8. 在任务运行过程中测试停止任务，确认状态能变为“停止中”并最终收敛。
-9. 如果学校页面出现提交验证码，确认日志中能看到提交阶段验证码识别提示。
-
-## 自动化测试
-
-仓库当前已补充以下自动化测试：
-
-- `tests/test_config.py`
-  验证内部密钥在超级管理员账号变更后依然保持稳定。
-- `tests/test_course_bot.py`
-  验证 Selenium 会话错误累计后会触发浏览器重建，并验证提交阶段验证码分支。
-- `tests/test_task_manager.py`
-  验证任务调度器会严格遵守管理员设置的并行上限。
-- `.github/workflows/linux-tests.yml`
-  在 `ubuntu-latest` 上自动运行上述测试，避免关键逻辑只在 Windows 本地验证。
-
-本地运行测试：
-
-```bash
-python -m unittest discover -s tests -v
-```
-
-## 本地运行
-
-### 直接运行
-
-```bash
-pip install -r requirements.txt
-set ADMIN=admin
-set PASSWORD=change-me
-python main.py
-```
-
-### Docker 运行
-
-```bash
-docker build -t advanced-scu-course-catcher .
-docker run --rm -p 7860:7860 \
-  -e ADMIN=admin \
-  -e PASSWORD=change-me \
-  advanced-scu-course-catcher
-```
-
-## 重要说明
-
-- 本项目当前的任务模型是“持续轮询直到成功、手动停止或达到错误上限”。
-- 用户密码会以应用内部密钥加密后保存在数据库中，用于后台自动登录教务系统。
-- 管理员可以看到全部用户、课程和日志，请在实际使用前明确权限边界。
-- 如果学校选课页面 DOM 结构变化较大，需要同步更新 `core/course_bot.py` 中的选择器以及 `javascript/` 下的辅助脚本。
+---
+title: Advanced SCU Course Catcher
+emoji: 🐳
+colorFrom: green
+colorTo: yellow
+sdk: docker
+app_port: 7860
+pinned: false
+---
+
+# Advanced SCU Course Catcher
+
+这是一个面向 Hugging Face Space 的四川大学选课系统 Web 版抢课面板。当前版本已经从单机脚本改造成了可部署、可并行、可多用户管理的 Flask + Selenium 服务，支持普通用户端和管理员端分离运行。
+
+## 当前能力
+
+- 普通用户入口：`/login`
+  用户使用 `学号 + 密码` 登录，只能看到自己的课程、任务状态和实时日志。
+- 管理员入口：`/admin`
+  管理员使用 `账号 + 密码` 登录。此入口不会在用户登录页展示。
+- 多管理员体系
+  支持多位普通管理员，支持 1 位超级管理员。超级管理员账号和密码由环境变量 `ADMIN`、`PASSWORD` 提供。
+- 多用户管理
+  管理员可以手动录入用户账号、重置密码、启用/禁用用户、查看所有课程目标。
+- 课程录入
+  用户自己填写 `课程号` 和 `课序号`，管理员可见全部内容，也可以代为录入和修改。
+- 实时日志
+  用户和管理员都可以实时看到程序日志，前端通过 SSE 持续推送。
+- 并行调度
+  多用户任务由后台任务调度器并行执行，管理员可以在后台动态设置并行数。
+- Hugging Face Space 适配
+  使用 Docker Space 运行，内置 Chromium、chromedriver、中文字体和无头浏览器配置。
+- 登录验证码与提交验证码 OCR
+  登录阶段和提交选课阶段都支持验证码 OCR 自动识别。
+- Selenium 自恢复
+  单个 Selenium 会话连续错误达到 5 次时，会自动重建浏览器；连续重建 5 个会话仍失败时，任务才会终止。
+
+## 运行结构
+
+当前实际运行入口和核心模块如下：
+
+- `app.py`
+  Hugging Face / gunicorn 使用的 WSGI 入口。
+- `space_app.py`
+  Flask 路由、页面渲染、登录鉴权、SSE 日志流。
+- `core/config.py`
+  运行配置与内部密钥管理。
+- `core/db.py`
+  SQLite 数据层。
+- `core/task_manager.py`
+  并行调度、任务生命周期管理。
+- `core/course_bot.py`
+  Selenium 抢课核心逻辑、验证码识别、重试与重建策略。
+- `webdriver_utils.py`
+  Chromium / chromedriver 初始化。
+- `templates/` + `static/`
+  用户端、管理员���和响应式前端页面。
+
+## 环境变量
+
+为了减少 Space 配置复杂度，当前只保留少量必要环境变量。
+
+### 必填
+
+- `ADMIN`
+  超级管理员账号。
+- `PASSWORD`
+  超级管理员密码。
+
+### 可选
+
+- `DATA_DIR`
+  数据目录，默认会使用仓库下的 `data/`。在 Hugging Face Space 中建议保持为 `/data`。
+- `CHROME_BIN`
+  自定义 Chromium 路径。默认会自动尝试 `/usr/bin/chromium`。
+- `CHROMEDRIVER_PATH`
+  自定义 chromedriver 路径。默认会自动尝试 `/usr/bin/chromedriver`。
+
+### 不需要再手动配置的内容
+
+以下内容已经改为自动生成或写入程序默认值，不需要再手工配置环境变量：
+
+- Flask session secret
+- 用户密码加密密钥
+- 默认并行数
+- 登录重试次数
+- Selenium 会话错误阈值
+- Selenium 会话重建阈值
+- 提交验证码重试次数
+- 页面超时时间
+- 日志页容量
+
+程序会在 `DATA_DIR/.app_secrets.json` 中自动持久化内部密钥。这样即使以后修改 `ADMIN` 或 `PASSWORD`，也不会导致历史用户密码全部失效。
+
+## Hugging Face Space 部署
+
+### 1. 创建 Space
+
+在 Hugging Face 上创建一个新的 Space：
+
+- SDK 选择 `Docker`
+- 端口使用 `7860`
+- 仓库内容直接推送本项目即可
+
+本仓库根目录已经提供好 `README.md` 的 Space metadata 和 `Dockerfile`。
+
+### 2. 设置 Space Secrets
+
+进入 `Settings -> Variables and secrets`，至少配置：
+
+- `ADMIN=你的超级管理员账号`
+- `PASSWORD=你的超级管理员密码`
+
+通常不需要再设置其他环境变量。
+
+如果你想显式指定数据目录，也可以增加：
+
+- `DATA_DIR=/data`
+
+### 3. 开启持久化存储
+
+如果你希望以下数据在 Space 重启后仍然保留，建议在 Space 设置里开启 Persistent Storage：
+
+- 用户账号
+- 管理员账号
+- 课程目标
+- 任务历史
+- 运行日志
+- 自动生成的内部密钥文件
+
+当前 Dockerfile 已按 `/data` 目录进行适配，并预先处理了目录权限，方便在 Space 中直接持久化。
+
+### 4. 推送部署
+
+如果你使用 git 推送到 Hugging Face Space，可以参考：
+
+```bash
+git remote add space https://huggingface.co/spaces/<your-name>/<your-space>
+git push space main
+```
+
+### 5. 启动方式
+
+容器启动命令已经写入 `Dockerfile`：
+
+```bash
+gunicorn --bind 0.0.0.0:${PORT:-7860} --workers 1 --threads 8 --timeout 180 app:app
+```
+
+这里使用 `1` 个 gunicorn worker，是为了避免多进程情况下每个进程都各自启动一套本地任务调度器。并发能力由应用内部的线程调度和管理员可配置的任务并行数控制。
+
+## Space 端建议配置
+
+推荐的初始运行策略：
+
+- 后台并行数先设置为 `1` 或 `2`
+- 只有在 Space CPU / 内存足够稳定时，再逐步提升
+- 在真实高峰前，先做一次小规模联调
+
+对于 CPU 较小的 Space，同时拉起过多 Chromium 会明显增加失败率，因此管理员后台提供了并行数动态调整功能。
+
+## 管理员联调清单
+
+部署到 Space 后，建议按以下顺序联调：
+
+1. 访问 `/admin`，使用 `ADMIN` / `PASSWORD` 登录超级管理员。
+2. 在管理员后台创建 1 个普通管理员、2 个测试用户。
+3. 为两个测试用户分别录入不同课程号和课序号。
+4. 将并行数设置为 `2`。
+5. 分别触发两个用户任务，确认两条任务都能进入队列，并按并行数启动。
+6. 在管理员日志面板确认日志持续刷新，且可以看到不同学号的执行记录。
+7. 使用用户账号访问 `/login`，确认用户只能看到自己的课程和日志。
+8. 在任务运行过程中测试停止任务，确认状态能变为“停止中”并最终收敛。
+9. 如果学校页面出现提交验证码，确认日志中能看到提交阶段验证码识别提示。
+
+## 自动化测试
+
+仓库当前已补充以下自动化测试：
+
+- `tests/test_config.py`
+  验证内部密钥在超级管理员账号变更后依然保持稳定。
+- `tests/test_course_bot.py`
+  验证 Selenium 会话错误累计后会触发浏览器重建，并验证提交阶段验证码分支。
+- `tests/test_task_manager.py`
+  验证任务调度器会严格遵守管理员设置的并行上限。
+- `.github/workflows/linux-tests.yml`
+  在 `ubuntu-latest` 上自动运行上述测试，避免关键逻辑只在 Windows 本地验证。
+
+本地运行测试：
+
+```bash
+python -m unittest discover -s tests -v
+```
+
+## 本地运行
+
+### 直接运行
+
+```bash
+pip install -r requirements.txt
+set ADMIN=admin
+set PASSWORD=change-me
+python main.py
+```
+
+### Docker 运行
+
+```bash
+docker build -t advanced-scu-course-catcher .
+docker run --rm -p 7860:7860 \
+  -e ADMIN=admin \
+  -e PASSWORD=change-me \
+  advanced-scu-course-catcher
+```
+
+## 重要说明
+
+- 本项目当前的任务���型是“持续轮询直到成功、手动停止或达到错误上限”。
+- 用户密码会以应用内部密钥加密后保存在数据库中，用于后台自动登录教务系统。
+- 管理员可以看到全部用户、课程和日志，请在实际使用前明确权限边界。
+- 如果学校选课页面 DOM 结构变化较大，需要同步更新 `core/course_bot.py` 中的选择器以及 `javascript/` 下的辅助脚本。
 - `course_catcher/` 目录是仓库中保留的旧实现，当前运行链路以 `space_app.py + core/*` 为准。

ca.pem

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIERDCCAqygAwIBAgIUIZeUQD0xvEAJNu72uWDNezVfx/cwDQYJKoZIhvcNAQEM
+BQAwOjE4MDYGA1UEAwwvOTYzMmFjZDktZjBhOC00NjQ4LTg3M2QtNTRkYTAxNWEz
+NzllIFByb2plY3QgQ0EwHhcNMjYwMzA1MDgzMTU3WhcNMzYwMzAyMDgzMTU3WjA6
+MTgwNgYDVQQDDC85NjMyYWNkOS1mMGE4LTQ2NDgtODczZC01NGRhMDE1YTM3OWUg
+UHJvamVjdCBDQTCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAMSAckGu
+d3mDTOTdgrL/mCfF7WkNWx6CKNGU/R5WaKdJ0Ub0Fbsu3erzQ7Qi877qcPSQg06G
+qH9umxOvq6hZG2lrNXg+8AJihezMME1zmODu+OEOX96jsUn5Pr8OSa68zzRkoiOl
+fXtVDYwTaIhexLJT/U6ELKqUxkBIVHTSmY/hp0SFOuEtMdra6dbJdMOXrGhI+IQK
+KmbRh9H208NpfzjQBos1g27D4YHBe1p55CfihDFEso22i98Wxu2kRqv6hz2n35Qi
+PNdJEi38ascZCGjx24VuuhXGcghHC1GxuIcArxWExNt880HtGztSIu6mBeSW+k9m
+HQiORu9TGuaErD/Xa33wM+sLKFbjBspCjkejwWWp7Kz4T+yup1lOxBDZlqaBgUdD
+MqIcIwBlG/kEUqTPHHKiTcGzg/8KUVDtTTofEAEi5MSiu/7EBQkN/jcAmEfwm4E4
+eOCINwkv53IL5ZRKVg7+sPg0a3mFe2nC0jpO8SskAe00ny3glN+uVzG+2wIDAQAB
+o0IwQDAdBgNVHQ4EFgQUecg1zbigo7JiWmgY17t7E4L8cFIwEgYDVR0TAQH/BAgw
+BgEB/wIBADALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEMBQADggGBAFSdhJQ5fCO7
+FC4I7ri5Gh93iBzjFplqTpbKYZft1RCRZy/ddvwSh4RMylb4MAQbDNs5D/c45E0u
+CUSc449KkVmoZsrtRwQY7Z9BLGaSDlWNca8FO+cGNqrM7vhXOeMYiGADIeg2M/yU
+QMmNxR+Y6nQO6wHP9r3BG1rNMBrjNcOjIXoo65qXv3PGLmNnjlLWyHwTmkfm6E4o
+RIPPWQNo7zVzUnxNiGEDUOpMpeA/JxK4BY44JZTRy4TNVCoM+Qn6PoY4IYyFVjFo
+CG0dBZPHdSeeJGgqJjOVhQQj2hq7BMVdgMSIv1jhUezHQeyfW8XF42C80qG09psI
+CLuxu2geZC/4Y+I5NR21EecUf8nDHNcBHObAOsrPM7oOd7iPpiEMKh2s6kRa4yGt
+LWOL391h5HgNnNcancVe8fXuZ4q7ul4NmQYYt8vtj9e82VpppKPwCPtIZGi4XEv5
+qrYctjxBQUnw+Wp/aV+Q4MN1CD188XEJyo0re0n5Lzi/VBj8suXzcg==
+-----END CERTIFICATE-----

core/config.py

@@ -6,11 +6,12 @@ import secrets
 import shutil
 from dataclasses import dataclass
 from pathlib import Path
+from urllib.parse import quote
 
 from cryptography.fernet import Fernet
 
 
-DEFAULT_PARALLEL_LIMIT = 2
+DEFAULT_PARALLEL_LIMIT = 4
 POLL_INTERVAL_SECONDS = 10
 LOGIN_RETRY_LIMIT = 6
 TASK_BACKOFF_SECONDS = 6
@@ -19,6 +20,8 @@ LOGS_PAGE_SIZE = 180
 SELENIUM_ERROR_LIMIT = 5
 SELENIUM_RESTART_LIMIT = 5
 SUBMIT_CAPTCHA_RETRY_LIMIT = 5
+SCHEDULE_TIMEZONE = "Asia/Shanghai"
+AIVEN_MYSQL_TEMPLATE = "mysql://avnadmin:{password}@mysql-2bace9cd-cacode.i.aivencloud.com:21260/SACC?ssl-mode=REQUIRED"
 
 
 def _pick_binary(env_name: str, *fallbacks: str) -> str:
@@ -79,11 +82,38 @@ def _load_or_create_internal_secrets(data_dir: Path) -> tuple[str, str]:
     return session_secret, encryption_key
 
 
+def _build_database_target(root_dir: Path, data_dir: Path) -> tuple[str | Path, str, Path | None]:
+    explicit_database_url = os.getenv("DATABASE_URL", "").strip()
+    if explicit_database_url:
+        normalized_url = explicit_database_url
+    else:
+        sql_password = os.getenv("SQL_PASSWORD", "").strip()
+        if sql_password:
+            normalized_url = AIVEN_MYSQL_TEMPLATE.format(password=quote(sql_password, safe=""))
+        else:
+            return (data_dir / "course_catcher.db").resolve(), "sqlite", None
+
+    if normalized_url.startswith("mysql://"):
+        normalized_url = f"mysql+pymysql://{normalized_url[len('mysql://') :]}"
+
+    if normalized_url.startswith("mysql+pymysql://"):
+        mysql_ssl_ca_path = Path(os.getenv("MYSQL_SSL_CA", str(root_dir / "ca.pem"))).resolve()
+        return normalized_url, "mysql", mysql_ssl_ca_path
+
+    if normalized_url.startswith("sqlite:///"):
+        sqlite_path = Path(normalized_url[len("sqlite:///") :]).resolve()
+        return sqlite_path, "sqlite", None
+
+    return Path(normalized_url).resolve(), "sqlite", None
+
+
 @dataclass(slots=True)
 class AppConfig:
     root_dir: Path
     data_dir: Path
-    db_path: Path
+    db_path: str | Path
+    database_backend: str
+    mysql_ssl_ca_path: Path | None
     session_secret: str
     encryption_key: str
     super_admin_username: str
@@ -99,6 +129,7 @@ class AppConfig:
     submit_captcha_retry_limit: int
     chrome_binary: str
     chromedriver_path: str
+    schedule_timezone: str
 
     @classmethod
     def load(cls) -> "AppConfig":
@@ -109,11 +140,14 @@ class AppConfig:
         super_admin_username = os.getenv("ADMIN", "superadmin")
         super_admin_password = os.getenv("PASSWORD", "change-me-in-hf-space")
         session_secret, encryption_key = _load_or_create_internal_secrets(data_dir)
+        db_path, database_backend, mysql_ssl_ca_path = _build_database_target(root_dir, data_dir)
 
         return cls(
             root_dir=root_dir,
             data_dir=data_dir,
-            db_path=data_dir / "course_catcher.db",
+            db_path=db_path,
+            database_backend=database_backend,
+            mysql_ssl_ca_path=mysql_ssl_ca_path,
             session_secret=session_secret,
             encryption_key=encryption_key,
             super_admin_username=super_admin_username,
@@ -139,4 +173,5 @@ class AppConfig:
                 "/usr/bin/chromedriver",
                 "chromedriver",
             ),
+            schedule_timezone=os.getenv("APP_TIMEZONE", SCHEDULE_TIMEZONE),
         )

core/db.py

@@ -1,16 +1,28 @@
-from __future__ import annotations
+from __future__ import annotations
 
+import secrets
 import sqlite3
+import string
 from contextlib import contextmanager
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any, Iterator
+from urllib.parse import parse_qs, unquote, urlparse
+
+try:
+    import pymysql
+    from pymysql.cursors import DictCursor as MySQLDictCursor
+except ImportError:  # pragma: no cover - optional dependency in local SQLite mode
+    pymysql = None
+    MySQLDictCursor = None
 
 
 ACTIVE_TASK_STATUSES = {"pending", "running", "cancel_requested"}
 DEFAULT_REFRESH_INTERVAL_SECONDS = 10
 MIN_REFRESH_INTERVAL_SECONDS = 1
 MAX_REFRESH_INTERVAL_SECONDS = 120
+DEFAULT_REGISTRATION_CODE_MAX_USES = 1
+REGISTRATION_CODE_ALPHABET = string.ascii_uppercase + string.digits
 
 
 def utc_now() -> str:
@@ -25,21 +37,103 @@ def clamp_refresh_interval_seconds(value: int | str | None, default: int = DEFAU
     return max(MIN_REFRESH_INTERVAL_SECONDS, min(MAX_REFRESH_INTERVAL_SECONDS, normalized))
 
 
+def normalize_registration_code(value: str) -> str:
+    return str(value or "").strip().upper()
+
+
 class Database:
-    def __init__(self, path: Path, default_parallel_limit: int = 2) -> None:
-        self.path = Path(path)
+    def __init__(
+        self,
+        path: Path | str,
+        default_parallel_limit: int = 4,
+        *,
+        mysql_ssl_ca_path: Path | str | None = None,
+    ) -> None:
         self.default_parallel_limit = default_parallel_limit
-        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._mysql_ssl_ca_path = Path(mysql_ssl_ca_path).resolve() if mysql_ssl_ca_path else None
+        self._dialect = "sqlite"
+        self._sqlite_path: Path | None = None
+        self._mysql_options: dict[str, Any] = {}
+        self._mysql_database_name = ""
+
+        raw_path = str(path)
+        if isinstance(path, Path) or "://" not in raw_path:
+            self._sqlite_path = Path(path).resolve()
+            self._sqlite_path.parent.mkdir(parents=True, exist_ok=True)
+            self.path = self._sqlite_path
+        elif raw_path.startswith("sqlite:///"):
+            self._sqlite_path = Path(raw_path[len("sqlite:///") :]).resolve()
+            self._sqlite_path.parent.mkdir(parents=True, exist_ok=True)
+            self.path = self._sqlite_path
+        elif raw_path.startswith("mysql://") or raw_path.startswith("mysql+pymysql://"):
+            self._dialect = "mysql"
+            self._mysql_options = self._parse_mysql_options(raw_path)
+            self._mysql_database_name = str(self._mysql_options["database"])
+            self.path = self._mysql_display_label()
+        else:
+            raise ValueError(f"Unsupported database target: {raw_path}")
 
-    def _connect(self) -> sqlite3.Connection:
-        connection = sqlite3.connect(self.path, timeout=30)
-        connection.row_factory = sqlite3.Row
-        connection.execute("PRAGMA foreign_keys = ON")
-        connection.execute("PRAGMA journal_mode = WAL")
-        return connection
+    @property
+    def is_mysql(self) -> bool:
+        return self._dialect == "mysql"
+
+    def _mysql_display_label(self) -> str:
+        if not self._mysql_options:
+            return "mysql://unknown"
+        return (
+            f"mysql://{self._mysql_options.get('user', '')}@"
+            f"{self._mysql_options.get('host', '')}:{self._mysql_options.get('port', '')}/"
+            f"{self._mysql_options.get('database', '')}"
+        )
+
+    @staticmethod
+    def _parse_mysql_options(raw_url: str) -> dict[str, Any]:
+        normalized_url = raw_url.replace("mysql+pymysql://", "mysql://", 1)
+        parsed = urlparse(normalized_url)
+        return {
+            "host": parsed.hostname or "localhost",
+            "port": parsed.port or 3306,
+            "user": unquote(parsed.username or ""),
+            "password": unquote(parsed.password or ""),
+            "database": (parsed.path or "/").lstrip("/"),
+            "query": parse_qs(parsed.query),
+        }
+
+    def _connect(self):
+        if not self.is_mysql:
+            connection = sqlite3.connect(self._sqlite_path, timeout=30, check_same_thread=False)
+            connection.row_factory = sqlite3.Row
+            connection.execute("PRAGMA foreign_keys = ON")
+            connection.execute("PRAGMA journal_mode = WAL")
+            return connection
+
+        if pymysql is None or MySQLDictCursor is None:
+            raise RuntimeError("PyMySQL is required when DATABASE_URL/SQL_PASSWORD enables MySQL persistence.")
+
+        ssl_config: dict[str, str] | None = None
+        ssl_mode = str(self._mysql_options.get("query", {}).get("ssl-mode", [""])[0]).upper()
+        if ssl_mode == "REQUIRED" or self._mysql_ssl_ca_path is not None:
+            if self._mysql_ssl_ca_path is None or not self._mysql_ssl_ca_path.exists():
+                raise RuntimeError("MySQL SSL is enabled but ca.pem was not found.")
+            ssl_config = {"ca": str(self._mysql_ssl_ca_path)}
+
+        return pymysql.connect(
+            host=self._mysql_options["host"],
+            port=int(self._mysql_options["port"]),
+            user=self._mysql_options["user"],
+            password=self._mysql_options["password"],
+            database=self._mysql_options["database"],
+            charset="utf8mb4",
+            cursorclass=MySQLDictCursor,
+            autocommit=False,
+            ssl=ssl_config,
+            connect_timeout=10,
+            read_timeout=30,
+            write_timeout=30,
+        )
 
     @contextmanager
-    def _cursor(self) -> Iterator[tuple[sqlite3.Connection, sqlite3.Cursor]]:
+    def _cursor(self) -> Iterator[tuple[Any, Any]]:
         connection = self._connect()
         try:
             cursor = connection.cursor()
@@ -48,18 +142,38 @@ class Database:
         finally:
             connection.close()
 
+    def _placeholder(self, name: str) -> str:
+        return f":{name}" if not self.is_mysql else f"%({name})s"
+
     @staticmethod
-    def _rows_to_dicts(rows: list[sqlite3.Row]) -> list[dict[str, Any]]:
+    def _rows_to_dicts(rows: list[Any]) -> list[dict[str, Any]]:
         return [dict(row) for row in rows]
 
     @staticmethod
     def _normalize_course_identity(value: str) -> str:
         return str(value or "").strip().upper()
 
-    @staticmethod
-    def _column_exists(cursor: sqlite3.Cursor, table_name: str, column_name: str) -> bool:
-        rows = cursor.execute(f"PRAGMA table_info({table_name})").fetchall()
-        return any(str(row[1]) == column_name for row in rows)
+    def _column_exists(self, cursor: Any, table_name: str, column_name: str) -> bool:
+        if not self.is_mysql:
+            rows = cursor.execute(f"PRAGMA table_info({table_name})").fetchall()
+            return any(str(row[1]) == column_name for row in rows)
+
+        query = (
+            f"SELECT COUNT(*) AS total FROM information_schema.columns "
+            f"WHERE table_schema = {self._placeholder('schema_name')} "
+            f"AND table_name = {self._placeholder('table_name')} "
+            f"AND column_name = {self._placeholder('column_name')}"
+        )
+        cursor.execute(
+            query,
+            {
+                "schema_name": self._mysql_database_name,
+                "table_name": table_name,
+                "column_name": column_name,
+            },
+        )
+        row = cursor.fetchone()
+        return int(dict(row).get("total", 0)) > 0
 
     def _ensure_column(self, table_name: str, column_name: str, definition: str) -> None:
         with self._cursor() as (_connection, cursor):
@@ -67,105 +181,248 @@ class Database:
                 return
             cursor.execute(f"ALTER TABLE {table_name} ADD COLUMN {column_name} {definition}")
 
+    def _create_tables_sqlite(self, cursor: Any) -> None:
+        cursor.executescript(
+            """
+            CREATE TABLE IF NOT EXISTS users (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                student_id TEXT NOT NULL UNIQUE,
+                password_encrypted TEXT NOT NULL,
+                display_name TEXT NOT NULL DEFAULT '',
+                is_active INTEGER NOT NULL DEFAULT 1,
+                refresh_interval_seconds INTEGER NOT NULL DEFAULT 10,
+                created_at TEXT NOT NULL,
+                updated_at TEXT NOT NULL
+            );
+            CREATE TABLE IF NOT EXISTS course_targets (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                user_id INTEGER NOT NULL,
+                category TEXT NOT NULL DEFAULT 'free',
+                course_id TEXT NOT NULL,
+                course_index TEXT NOT NULL,
+                created_at TEXT NOT NULL,
+                UNIQUE(user_id, category, course_id, course_index),
+                FOREIGN KEY(user_id) REFERENCES users(id) ON DELETE CASCADE
+            );
+            CREATE TABLE IF NOT EXISTS admins (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                username TEXT NOT NULL UNIQUE,
+                password_hash TEXT NOT NULL,
+                created_at TEXT NOT NULL,
+                updated_at TEXT NOT NULL
+            );
+            CREATE TABLE IF NOT EXISTS app_settings (
+                `key` TEXT PRIMARY KEY,
+                value TEXT NOT NULL,
+                updated_at TEXT NOT NULL
+            );
+            CREATE TABLE IF NOT EXISTS tasks (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                user_id INTEGER NOT NULL,
+                status TEXT NOT NULL,
+                requested_by TEXT NOT NULL,
+                requested_by_role TEXT NOT NULL,
+                last_error TEXT NOT NULL DEFAULT '',
+                total_attempts INTEGER NOT NULL DEFAULT 0,
+                total_errors INTEGER NOT NULL DEFAULT 0,
+                created_at TEXT NOT NULL,
+                started_at TEXT,
+                finished_at TEXT,
+                updated_at TEXT NOT NULL,
+                FOREIGN KEY(user_id) REFERENCES users(id) ON DELETE CASCADE
+            );
+            CREATE TABLE IF NOT EXISTS logs (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                task_id INTEGER,
+                user_id INTEGER,
+                scope TEXT NOT NULL,
+                level TEXT NOT NULL,
+                message TEXT NOT NULL,
+                created_at TEXT NOT NULL,
+                FOREIGN KEY(task_id) REFERENCES tasks(id) ON DELETE CASCADE,
+                FOREIGN KEY(user_id) REFERENCES users(id) ON DELETE CASCADE
+            );
+            CREATE TABLE IF NOT EXISTS user_schedules (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                user_id INTEGER NOT NULL UNIQUE,
+                is_enabled INTEGER NOT NULL DEFAULT 0,
+                start_date TEXT,
+                end_date TEXT,
+                daily_start_time TEXT,
+                daily_stop_time TEXT,
+                last_auto_start_on TEXT NOT NULL DEFAULT '',
+                last_auto_stop_on TEXT NOT NULL DEFAULT '',
+                created_at TEXT NOT NULL,
+                updated_at TEXT NOT NULL,
+                FOREIGN KEY(user_id) REFERENCES users(id) ON DELETE CASCADE
+            );
+            CREATE TABLE IF NOT EXISTS registration_codes (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                code TEXT NOT NULL UNIQUE,
+                note TEXT NOT NULL DEFAULT '',
+                is_active INTEGER NOT NULL DEFAULT 1,
+                max_uses INTEGER NOT NULL DEFAULT 1,
+                used_count INTEGER NOT NULL DEFAULT 0,
+                created_by TEXT NOT NULL DEFAULT '',
+                used_by_user_id INTEGER,
+                used_at TEXT,
+                created_at TEXT NOT NULL,
+                updated_at TEXT NOT NULL,
+                FOREIGN KEY(used_by_user_id) REFERENCES users(id) ON DELETE SET NULL
+            );
+            """
+        )
+    def _create_tables_mysql(self, cursor: Any) -> None:
+        statements = [
+            """
+            CREATE TABLE IF NOT EXISTS users (
+                id BIGINT PRIMARY KEY AUTO_INCREMENT,
+                student_id VARCHAR(32) NOT NULL UNIQUE,
+                password_encrypted TEXT NOT NULL,
+                display_name VARCHAR(255) NOT NULL DEFAULT '',
+                is_active TINYINT(1) NOT NULL DEFAULT 1,
+                refresh_interval_seconds INT NOT NULL DEFAULT 10,
+                created_at VARCHAR(32) NOT NULL,
+                updated_at VARCHAR(32) NOT NULL
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
+            """,
+            """
+            CREATE TABLE IF NOT EXISTS course_targets (
+                id BIGINT PRIMARY KEY AUTO_INCREMENT,
+                user_id BIGINT NOT NULL,
+                category VARCHAR(32) NOT NULL DEFAULT 'free',
+                course_id VARCHAR(64) NOT NULL,
+                course_index VARCHAR(32) NOT NULL,
+                created_at VARCHAR(32) NOT NULL,
+                UNIQUE KEY uq_course_targets_identity (user_id, category, course_id, course_index),
+                CONSTRAINT fk_course_targets_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
+            """,
+            """
+            CREATE TABLE IF NOT EXISTS admins (
+                id BIGINT PRIMARY KEY AUTO_INCREMENT,
+                username VARCHAR(255) NOT NULL UNIQUE,
+                password_hash TEXT NOT NULL,
+                created_at VARCHAR(32) NOT NULL,
+                updated_at VARCHAR(32) NOT NULL
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
+            """,
+            """
+            CREATE TABLE IF NOT EXISTS app_settings (
+                `key` VARCHAR(191) PRIMARY KEY,
+                value TEXT NOT NULL,
+                updated_at VARCHAR(32) NOT NULL
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
+            """,
+            """
+            CREATE TABLE IF NOT EXISTS tasks (
+                id BIGINT PRIMARY KEY AUTO_INCREMENT,
+                user_id BIGINT NOT NULL,
+                status VARCHAR(32) NOT NULL,
+                requested_by VARCHAR(255) NOT NULL,
+                requested_by_role VARCHAR(32) NOT NULL,
+                last_error TEXT NOT NULL,
+                total_attempts INT NOT NULL DEFAULT 0,
+                total_errors INT NOT NULL DEFAULT 0,
+                created_at VARCHAR(32) NOT NULL,
+                started_at VARCHAR(32),
+                finished_at VARCHAR(32),
+                updated_at VARCHAR(32) NOT NULL,
+                CONSTRAINT fk_tasks_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
+            """,
+            """
+            CREATE TABLE IF NOT EXISTS logs (
+                id BIGINT PRIMARY KEY AUTO_INCREMENT,
+                task_id BIGINT NULL,
+                user_id BIGINT NULL,
+                scope VARCHAR(64) NOT NULL,
+                level VARCHAR(32) NOT NULL,
+                message TEXT NOT NULL,
+                created_at VARCHAR(32) NOT NULL,
+                CONSTRAINT fk_logs_task FOREIGN KEY (task_id) REFERENCES tasks(id) ON DELETE CASCADE,
+                CONSTRAINT fk_logs_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
+            """,
+            """
+            CREATE TABLE IF NOT EXISTS user_schedules (
+                id BIGINT PRIMARY KEY AUTO_INCREMENT,
+                user_id BIGINT NOT NULL UNIQUE,
+                is_enabled TINYINT(1) NOT NULL DEFAULT 0,
+                start_date VARCHAR(10) NULL,
+                end_date VARCHAR(10) NULL,
+                daily_start_time VARCHAR(5) NULL,
+                daily_stop_time VARCHAR(5) NULL,
+                last_auto_start_on VARCHAR(10) NOT NULL DEFAULT '',
+                last_auto_stop_on VARCHAR(10) NOT NULL DEFAULT '',
+                created_at VARCHAR(32) NOT NULL,
+                updated_at VARCHAR(32) NOT NULL,
+                CONSTRAINT fk_user_schedules_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
+            """,
+            """
+            CREATE TABLE IF NOT EXISTS registration_codes (
+                id BIGINT PRIMARY KEY AUTO_INCREMENT,
+                code VARCHAR(64) NOT NULL UNIQUE,
+                note TEXT NOT NULL,
+                is_active TINYINT(1) NOT NULL DEFAULT 1,
+                max_uses INT NOT NULL DEFAULT 1,
+                used_count INT NOT NULL DEFAULT 0,
+                created_by VARCHAR(255) NOT NULL DEFAULT '',
+                used_by_user_id BIGINT NULL,
+                used_at VARCHAR(32) NULL,
+                created_at VARCHAR(32) NOT NULL,
+                updated_at VARCHAR(32) NOT NULL,
+                CONSTRAINT fk_registration_codes_user FOREIGN KEY (used_by_user_id) REFERENCES users(id) ON DELETE SET NULL
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
+            """,
+        ]
+        for statement in statements:
+            cursor.execute(statement)
+
     def init_db(self) -> None:
         with self._cursor() as (_connection, cursor):
-            cursor.executescript(
-                """
-                CREATE TABLE IF NOT EXISTS users (
-                    id INTEGER PRIMARY KEY AUTOINCREMENT,
-                    student_id TEXT NOT NULL UNIQUE,
-                    password_encrypted TEXT NOT NULL,
-                    display_name TEXT NOT NULL DEFAULT '',
-                    is_active INTEGER NOT NULL DEFAULT 1,
-                    refresh_interval_seconds INTEGER NOT NULL DEFAULT 10,
-                    created_at TEXT NOT NULL,
-                    updated_at TEXT NOT NULL
-                );
-
-                CREATE TABLE IF NOT EXISTS course_targets (
-                    id INTEGER PRIMARY KEY AUTOINCREMENT,
-                    user_id INTEGER NOT NULL,
-                    category TEXT NOT NULL DEFAULT 'free',
-                    course_id TEXT NOT NULL,
-                    course_index TEXT NOT NULL,
-                    created_at TEXT NOT NULL,
-                    UNIQUE(user_id, category, course_id, course_index),
-                    FOREIGN KEY(user_id) REFERENCES users(id) ON DELETE CASCADE
-                );
-
-                CREATE TABLE IF NOT EXISTS admins (
-                    id INTEGER PRIMARY KEY AUTOINCREMENT,
-                    username TEXT NOT NULL UNIQUE,
-                    password_hash TEXT NOT NULL,
-                    created_at TEXT NOT NULL,
-                    updated_at TEXT NOT NULL
-                );
-
-                CREATE TABLE IF NOT EXISTS app_settings (
-                    key TEXT PRIMARY KEY,
-                    value TEXT NOT NULL,
-                    updated_at TEXT NOT NULL
-                );
-
-                CREATE TABLE IF NOT EXISTS tasks (
-                    id INTEGER PRIMARY KEY AUTOINCREMENT,
-                    user_id INTEGER NOT NULL,
-                    status TEXT NOT NULL,
-                    requested_by TEXT NOT NULL,
-                    requested_by_role TEXT NOT NULL,
-                    last_error TEXT NOT NULL DEFAULT '',
-                    total_attempts INTEGER NOT NULL DEFAULT 0,
-                    total_errors INTEGER NOT NULL DEFAULT 0,
-                    created_at TEXT NOT NULL,
-                    started_at TEXT,
-                    finished_at TEXT,
-                    updated_at TEXT NOT NULL,
-                    FOREIGN KEY(user_id) REFERENCES users(id) ON DELETE CASCADE
-                );
-
-                CREATE TABLE IF NOT EXISTS logs (
-                    id INTEGER PRIMARY KEY AUTOINCREMENT,
-                    task_id INTEGER,
-                    user_id INTEGER,
-                    scope TEXT NOT NULL,
-                    level TEXT NOT NULL,
-                    message TEXT NOT NULL,
-                    created_at TEXT NOT NULL,
-                    FOREIGN KEY(task_id) REFERENCES tasks(id) ON DELETE CASCADE,
-                    FOREIGN KEY(user_id) REFERENCES users(id) ON DELETE CASCADE
-                );
-                """
-            )
+            if self.is_mysql:
+                self._create_tables_mysql(cursor)
+            else:
+                self._create_tables_sqlite(cursor)
 
         self._ensure_column(
             "users",
             "refresh_interval_seconds",
-            f"INTEGER NOT NULL DEFAULT {DEFAULT_REFRESH_INTERVAL_SECONDS}",
+            f"INT NOT NULL DEFAULT {DEFAULT_REFRESH_INTERVAL_SECONDS}",
         )
-        self._ensure_column("tasks", "total_attempts", "INTEGER NOT NULL DEFAULT 0")
-        self._ensure_column("tasks", "total_errors", "INTEGER NOT NULL DEFAULT 0")
+        self._ensure_column("tasks", "total_attempts", "INT NOT NULL DEFAULT 0")
+        self._ensure_column("tasks", "total_errors", "INT NOT NULL DEFAULT 0")
 
         if self.get_setting("parallel_limit") is None:
             self.set_setting("parallel_limit", str(self.default_parallel_limit))
 
     def get_setting(self, key: str) -> str | None:
+        query = f"SELECT value FROM app_settings WHERE `key` = {self._placeholder('key')}"
         with self._cursor() as (_connection, cursor):
-            row = cursor.execute("SELECT value FROM app_settings WHERE key = ?", (key,)).fetchone()
-            return None if row is None else str(row["value"])
+            cursor.execute(query, {"key": key})
+            row = cursor.fetchone()
+            return None if row is None else str(dict(row)["value"])
 
     def set_setting(self, key: str, value: str) -> None:
         now = utc_now()
         with self._cursor() as (_connection, cursor):
             cursor.execute(
-                """
-                INSERT INTO app_settings (key, value, updated_at)
-                VALUES (?, ?, ?)
-                ON CONFLICT(key) DO UPDATE SET
-                    value = excluded.value,
-                    updated_at = excluded.updated_at
-                """,
-                (key, value, now),
+                f"SELECT value FROM app_settings WHERE `key` = {self._placeholder('key')}",
+                {"key": key},
             )
+            existing = cursor.fetchone()
+            if existing is None:
+                cursor.execute(
+                    f"INSERT INTO app_settings (`key`, value, updated_at) VALUES ({self._placeholder('key')}, {self._placeholder('value')}, {self._placeholder('updated_at')})",
+                    {"key": key, "value": value, "updated_at": now},
+                )
+            else:
+                cursor.execute(
+                    f"UPDATE app_settings SET value = {self._placeholder('value')}, updated_at = {self._placeholder('updated_at')} WHERE `key` = {self._placeholder('key')}",
+                    {"key": key, "value": value, "updated_at": now},
+                )
 
     def get_parallel_limit(self) -> int:
         raw_value = self.get_setting("parallel_limit")
@@ -191,22 +448,78 @@ class Database:
         refresh_interval = clamp_refresh_interval_seconds(refresh_interval_seconds)
         with self._cursor() as (_connection, cursor):
             cursor.execute(
-                """
-                INSERT INTO users (
-                    student_id,
-                    password_encrypted,
-                    display_name,
-                    is_active,
-                    refresh_interval_seconds,
-                    created_at,
-                    updated_at
-                )
-                VALUES (?, ?, ?, 1, ?, ?, ?)
-                """,
-                (student_id.strip(), password_encrypted, display_name.strip(), refresh_interval, now, now),
+                f"INSERT INTO users (student_id, password_encrypted, display_name, is_active, refresh_interval_seconds, created_at, updated_at) VALUES ({self._placeholder('student_id')}, {self._placeholder('password_encrypted')}, {self._placeholder('display_name')}, {self._placeholder('is_active')}, {self._placeholder('refresh_interval_seconds')}, {self._placeholder('created_at')}, {self._placeholder('updated_at')})",
+                {
+                    "student_id": student_id.strip(),
+                    "password_encrypted": password_encrypted,
+                    "display_name": display_name.strip(),
+                    "is_active": 1,
+                    "refresh_interval_seconds": refresh_interval,
+                    "created_at": now,
+                    "updated_at": now,
+                },
             )
             return int(cursor.lastrowid)
 
+    def register_user_with_code(
+        self,
+        registration_code: str,
+        student_id: str,
+        password_encrypted: str,
+        display_name: str = "",
+        *,
+        refresh_interval_seconds: int = DEFAULT_REFRESH_INTERVAL_SECONDS,
+    ) -> int:
+        now = utc_now()
+        normalized_code = normalize_registration_code(registration_code)
+        normalized_student_id = str(student_id or "").strip()
+        refresh_interval = clamp_refresh_interval_seconds(refresh_interval_seconds)
+        with self._cursor() as (_connection, cursor):
+            cursor.execute(
+                f"SELECT * FROM registration_codes WHERE code = {self._placeholder('code')}",
+                {"code": normalized_code},
+            )
+            code_row = cursor.fetchone()
+            if code_row is None:
+                raise ValueError("注册码不存在。")
+            code_payload = dict(code_row)
+            if not bool(code_payload.get("is_active", 0)):
+                raise ValueError("注册码已停用。")
+            if int(code_payload.get("used_count", 0)) >= int(code_payload.get("max_uses", 1)):
+                raise ValueError("注册码已使用完毕。")
+            cursor.execute(
+                f"SELECT id FROM users WHERE student_id = {self._placeholder('student_id')}",
+                {"student_id": normalized_student_id},
+            )
+            if cursor.fetchone() is not None:
+                raise ValueError("该学号已经注册。")
+            cursor.execute(
+                f"INSERT INTO users (student_id, password_encrypted, display_name, is_active, refresh_interval_seconds, created_at, updated_at) VALUES ({self._placeholder('student_id')}, {self._placeholder('password_encrypted')}, {self._placeholder('display_name')}, {self._placeholder('is_active')}, {self._placeholder('refresh_interval_seconds')}, {self._placeholder('created_at')}, {self._placeholder('updated_at')})",
+                {
+                    "student_id": normalized_student_id,
+                    "password_encrypted": password_encrypted,
+                    "display_name": display_name.strip(),
+                    "is_active": 1,
+                    "refresh_interval_seconds": refresh_interval,
+                    "created_at": now,
+                    "updated_at": now,
+                },
+            )
+            user_id = int(cursor.lastrowid)
+            used_count = int(code_payload.get("used_count", 0)) + 1
+            max_uses = int(code_payload.get("max_uses", 1))
+            cursor.execute(
+                f"UPDATE registration_codes SET used_count = {self._placeholder('used_count')}, used_by_user_id = {self._placeholder('used_by_user_id')}, used_at = {self._placeholder('used_at')}, is_active = {self._placeholder('is_active')}, updated_at = {self._placeholder('updated_at')} WHERE id = {self._placeholder('id')}",
+                {
+                    "id": int(code_payload["id"]),
+                    "used_count": used_count,
+                    "used_by_user_id": user_id,
+                    "used_at": now,
+                    "is_active": 0 if used_count >= max_uses else 1,
+                    "updated_at": now,
+                },
+            )
+            return user_id
     def update_user(
         self,
         user_id: int,
@@ -217,28 +530,34 @@ class Database:
         refresh_interval_seconds: int | None = None,
     ) -> None:
         assignments: list[str] = []
-        values: list[Any] = []
+        values: dict[str, Any] = {"user_id": user_id, "updated_at": utc_now()}
         if password_encrypted is not None:
-            assignments.append("password_encrypted = ?")
-            values.append(password_encrypted)
+            assignments.append(f"password_encrypted = {self._placeholder('password_encrypted')}")
+            values["password_encrypted"] = password_encrypted
         if display_name is not None:
-            assignments.append("display_name = ?")
-            values.append(display_name.strip())
+            assignments.append(f"display_name = {self._placeholder('display_name')}")
+            values["display_name"] = display_name.strip()
         if is_active is not None:
-            assignments.append("is_active = ?")
-            values.append(1 if is_active else 0)
+            assignments.append(f"is_active = {self._placeholder('is_active')}")
+            values["is_active"] = 1 if is_active else 0
         if refresh_interval_seconds is not None:
-            assignments.append("refresh_interval_seconds = ?")
-            values.append(clamp_refresh_interval_seconds(refresh_interval_seconds))
+            assignments.append(f"refresh_interval_seconds = {self._placeholder('refresh_interval_seconds')}")
+            values["refresh_interval_seconds"] = clamp_refresh_interval_seconds(refresh_interval_seconds)
         if not assignments:
             return
+        assignments.append(f"updated_at = {self._placeholder('updated_at')}")
+        with self._cursor() as (_connection, cursor):
+            cursor.execute(
+                f"UPDATE users SET {', '.join(assignments)} WHERE id = {self._placeholder('user_id')}",
+                values,
+            )
 
-        assignments.append("updated_at = ?")
-        values.append(utc_now())
-        values.append(user_id)
-
+    def delete_user(self, user_id: int) -> None:
         with self._cursor() as (_connection, cursor):
-            cursor.execute(f"UPDATE users SET {', '.join(assignments)} WHERE id = ?", tuple(values))
+            cursor.execute(
+                f"DELETE FROM users WHERE id = {self._placeholder('user_id')}",
+                {"user_id": user_id},
+            )
 
     def toggle_user_active(self, user_id: int) -> dict[str, Any] | None:
         user = self.get_user(user_id)
@@ -249,42 +568,35 @@ class Database:
 
     def get_user(self, user_id: int) -> dict[str, Any] | None:
         with self._cursor() as (_connection, cursor):
-            row = cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,)).fetchone()
+            cursor.execute(
+                f"SELECT * FROM users WHERE id = {self._placeholder('user_id')}",
+                {"user_id": user_id},
+            )
+            row = cursor.fetchone()
             return None if row is None else dict(row)
 
     def get_user_by_student_id(self, student_id: str) -> dict[str, Any] | None:
         with self._cursor() as (_connection, cursor):
-            row = cursor.execute("SELECT * FROM users WHERE student_id = ?", (student_id.strip(),)).fetchone()
+            cursor.execute(
+                f"SELECT * FROM users WHERE student_id = {self._placeholder('student_id')}",
+                {"student_id": student_id.strip()},
+            )
+            row = cursor.fetchone()
             return None if row is None else dict(row)
 
     def list_users(self) -> list[dict[str, Any]]:
+        query = f"""
+            SELECT
+                u.*,
+                (SELECT COUNT(*) FROM course_targets c WHERE c.user_id = u.id) AS course_count,
+                (SELECT t.status FROM tasks t WHERE t.user_id = u.id ORDER BY t.created_at DESC LIMIT 1) AS latest_task_status,
+                (SELECT t.updated_at FROM tasks t WHERE t.user_id = u.id ORDER BY t.created_at DESC LIMIT 1) AS latest_task_updated_at
+            FROM users u
+            ORDER BY u.student_id ASC
+        """
         with self._cursor() as (_connection, cursor):
-            rows = cursor.execute(
-                """
-                SELECT
-                    u.*,
-                    COUNT(c.id) AS course_count,
-                    (
-                        SELECT t.status
-                        FROM tasks t
-                        WHERE t.user_id = u.id
-                        ORDER BY t.created_at DESC
-                        LIMIT 1
-                    ) AS latest_task_status,
-                    (
-                        SELECT t.updated_at
-                        FROM tasks t
-                        WHERE t.user_id = u.id
-                        ORDER BY t.created_at DESC
-                        LIMIT 1
-                    ) AS latest_task_updated_at
-                FROM users u
-                LEFT JOIN course_targets c ON c.user_id = u.id
-                GROUP BY u.id
-                ORDER BY u.student_id ASC
-                """
-            ).fetchall()
-            return self._rows_to_dicts(rows)
+            cursor.execute(query)
+            return self._rows_to_dicts(cursor.fetchall())
 
     def add_course(self, user_id: int, category: str, course_id: str, course_index: str) -> int | None:
         now = utc_now()
@@ -293,210 +605,199 @@ class Database:
         normalized_course_index = self._normalize_course_identity(course_index)
         with self._cursor() as (_connection, cursor):
             cursor.execute(
-                """
-                INSERT OR IGNORE INTO course_targets (user_id, category, course_id, course_index, created_at)
-                VALUES (?, ?, ?, ?, ?)
-                """,
-                (user_id, normalized_category, normalized_course_id, normalized_course_index, now),
+                f"SELECT id FROM course_targets WHERE user_id = {self._placeholder('user_id')} AND category = {self._placeholder('category')} AND course_id = {self._placeholder('course_id')} AND course_index = {self._placeholder('course_index')}",
+                {
+                    "user_id": user_id,
+                    "category": normalized_category,
+                    "course_id": normalized_course_id,
+                    "course_index": normalized_course_index,
+                },
+            )
+            if cursor.fetchone() is not None:
+                return None
+            cursor.execute(
+                f"INSERT INTO course_targets (user_id, category, course_id, course_index, created_at) VALUES ({self._placeholder('user_id')}, {self._placeholder('category')}, {self._placeholder('course_id')}, {self._placeholder('course_index')}, {self._placeholder('created_at')})",
+                {
+                    "user_id": user_id,
+                    "category": normalized_category,
+                    "course_id": normalized_course_id,
+                    "course_index": normalized_course_index,
+                    "created_at": now,
+                },
             )
-            return int(cursor.lastrowid) if cursor.lastrowid else None
+            return int(cursor.lastrowid)
 
     def delete_course(self, course_target_id: int) -> None:
         with self._cursor() as (_connection, cursor):
-            cursor.execute("DELETE FROM course_targets WHERE id = ?", (course_target_id,))
+            cursor.execute(
+                f"DELETE FROM course_targets WHERE id = {self._placeholder('course_target_id')}",
+                {"course_target_id": course_target_id},
+            )
 
     def remove_course_by_identity(self, user_id: int, category: str, course_id: str, course_index: str) -> None:
         with self._cursor() as (_connection, cursor):
             cursor.execute(
-                """
-                DELETE FROM course_targets
-                WHERE user_id = ? AND category = ? AND course_id = ? AND course_index = ?
-                """,
-                (
-                    user_id,
-                    category,
-                    self._normalize_course_identity(course_id),
-                    self._normalize_course_identity(course_index),
-                ),
+                f"DELETE FROM course_targets WHERE user_id = {self._placeholder('user_id')} AND category = {self._placeholder('category')} AND course_id = {self._placeholder('course_id')} AND course_index = {self._placeholder('course_index')}",
+                {
+                    "user_id": user_id,
+                    "category": category,
+                    "course_id": self._normalize_course_identity(course_id),
+                    "course_index": self._normalize_course_identity(course_index),
+                },
             )
 
     def list_courses_for_user(self, user_id: int) -> list[dict[str, Any]]:
         with self._cursor() as (_connection, cursor):
-            rows = cursor.execute(
-                """
-                SELECT *
-                FROM course_targets
-                WHERE user_id = ?
-                ORDER BY category ASC, course_id ASC, course_index ASC
-                """,
-                (user_id,),
-            ).fetchall()
-            return self._rows_to_dicts(rows)
+            cursor.execute(
+                f"SELECT * FROM course_targets WHERE user_id = {self._placeholder('user_id')} ORDER BY category ASC, course_id ASC, course_index ASC",
+                {"user_id": user_id},
+            )
+            return self._rows_to_dicts(cursor.fetchall())
 
     def create_admin(self, username: str, password_hash: str) -> int:
         now = utc_now()
         with self._cursor() as (_connection, cursor):
             cursor.execute(
-                """
-                INSERT INTO admins (username, password_hash, created_at, updated_at)
-                VALUES (?, ?, ?, ?)
-                """,
-                (username.strip(), password_hash, now, now),
+                f"INSERT INTO admins (username, password_hash, created_at, updated_at) VALUES ({self._placeholder('username')}, {self._placeholder('password_hash')}, {self._placeholder('created_at')}, {self._placeholder('updated_at')})",
+                {
+                    "username": username.strip(),
+                    "password_hash": password_hash,
+                    "created_at": now,
+                    "updated_at": now,
+                },
             )
             return int(cursor.lastrowid)
 
     def get_admin_by_username(self, username: str) -> dict[str, Any] | None:
         with self._cursor() as (_connection, cursor):
-            row = cursor.execute("SELECT * FROM admins WHERE username = ?", (username.strip(),)).fetchone()
+            cursor.execute(
+                f"SELECT * FROM admins WHERE username = {self._placeholder('username')}",
+                {"username": username.strip()},
+            )
+            row = cursor.fetchone()
             return None if row is None else dict(row)
 
     def list_admins(self) -> list[dict[str, Any]]:
         with self._cursor() as (_connection, cursor):
-            rows = cursor.execute(
-                "SELECT id, username, created_at, updated_at FROM admins ORDER BY username ASC"
-            ).fetchall()
-            return self._rows_to_dicts(rows)
+            cursor.execute("SELECT id, username, created_at, updated_at FROM admins ORDER BY username ASC")
+            return self._rows_to_dicts(cursor.fetchall())
 
     def find_active_task_for_user(self, user_id: int) -> dict[str, Any] | None:
         with self._cursor() as (_connection, cursor):
-            row = cursor.execute(
-                """
-                SELECT *
-                FROM tasks
-                WHERE user_id = ? AND status IN ('pending', 'running', 'cancel_requested')
-                ORDER BY created_at DESC
-                LIMIT 1
-                """,
-                (user_id,),
-            ).fetchone()
+            cursor.execute(
+                f"SELECT * FROM tasks WHERE user_id = {self._placeholder('user_id')} AND status IN ('pending', 'running', 'cancel_requested') ORDER BY created_at DESC LIMIT 1",
+                {"user_id": user_id},
+            )
+            row = cursor.fetchone()
             return None if row is None else dict(row)
 
     def create_task(self, user_id: int, requested_by: str, requested_by_role: str) -> int:
         now = utc_now()
         with self._cursor() as (_connection, cursor):
             cursor.execute(
-                """
-                INSERT INTO tasks (user_id, status, requested_by, requested_by_role, created_at, updated_at)
-                VALUES (?, 'pending', ?, ?, ?, ?)
-                """,
-                (user_id, requested_by, requested_by_role, now, now),
+                f"INSERT INTO tasks (user_id, status, requested_by, requested_by_role, last_error, total_attempts, total_errors, created_at, updated_at) VALUES ({self._placeholder('user_id')}, {self._placeholder('status')}, {self._placeholder('requested_by')}, {self._placeholder('requested_by_role')}, {self._placeholder('last_error')}, {self._placeholder('total_attempts')}, {self._placeholder('total_errors')}, {self._placeholder('created_at')}, {self._placeholder('updated_at')})",
+                {
+                    "user_id": user_id,
+                    "status": "pending",
+                    "requested_by": requested_by,
+                    "requested_by_role": requested_by_role,
+                    "last_error": "",
+                    "total_attempts": 0,
+                    "total_errors": 0,
+                    "created_at": now,
+                    "updated_at": now,
+                },
             )
             return int(cursor.lastrowid)
 
     def get_task(self, task_id: int) -> dict[str, Any] | None:
+        query = f"""
+            SELECT t.*, u.student_id, u.display_name, u.refresh_interval_seconds
+            FROM tasks t
+            JOIN users u ON u.id = t.user_id
+            WHERE t.id = {self._placeholder('task_id')}
+        """
         with self._cursor() as (_connection, cursor):
-            row = cursor.execute(
-                """
-                SELECT
-                    t.*,
-                    u.student_id,
-                    u.display_name,
-                    u.refresh_interval_seconds
-                FROM tasks t
-                JOIN users u ON u.id = t.user_id
-                WHERE t.id = ?
-                """,
-                (task_id,),
-            ).fetchone()
+            cursor.execute(query, {"task_id": task_id})
+            row = cursor.fetchone()
             return None if row is None else dict(row)
 
     def get_latest_task_for_user(self, user_id: int) -> dict[str, Any] | None:
+        query = f"""
+            SELECT t.*, u.student_id, u.display_name, u.refresh_interval_seconds
+            FROM tasks t
+            JOIN users u ON u.id = t.user_id
+            WHERE t.user_id = {self._placeholder('user_id')}
+            ORDER BY t.created_at DESC
+            LIMIT 1
+        """
         with self._cursor() as (_connection, cursor):
-            row = cursor.execute(
-                """
-                SELECT
-                    t.*,
-                    u.student_id,
-                    u.display_name,
-                    u.refresh_interval_seconds
-                FROM tasks t
-                JOIN users u ON u.id = t.user_id
-                WHERE t.user_id = ?
-                ORDER BY t.created_at DESC
-                LIMIT 1
-                """,
-                (user_id,),
-            ).fetchone()
+            cursor.execute(query, {"user_id": user_id})
+            row = cursor.fetchone()
             return None if row is None else dict(row)
 
     def list_pending_tasks(self, limit: int) -> list[dict[str, Any]]:
+        query = f"""
+            SELECT t.*, u.student_id, u.display_name, u.password_encrypted, u.is_active, u.refresh_interval_seconds
+            FROM tasks t
+            JOIN users u ON u.id = t.user_id
+            WHERE t.status = 'pending'
+            ORDER BY t.created_at ASC
+            LIMIT {self._placeholder('limit')}
+        """
         with self._cursor() as (_connection, cursor):
-            rows = cursor.execute(
-                """
-                SELECT
-                    t.*,
-                    u.student_id,
-                    u.display_name,
-                    u.password_encrypted,
-                    u.is_active,
-                    u.refresh_interval_seconds
-                FROM tasks t
-                JOIN users u ON u.id = t.user_id
-                WHERE t.status = 'pending'
-                ORDER BY t.created_at ASC
-                LIMIT ?
-                """,
-                (limit,),
-            ).fetchall()
-            return self._rows_to_dicts(rows)
+            cursor.execute(query, {"limit": int(limit)})
+            return self._rows_to_dicts(cursor.fetchall())
 
     def list_recent_tasks(self, limit: int = 20) -> list[dict[str, Any]]:
+        query = f"""
+            SELECT t.*, u.student_id, u.display_name, u.refresh_interval_seconds
+            FROM tasks t
+            JOIN users u ON u.id = t.user_id
+            ORDER BY t.created_at DESC
+            LIMIT {self._placeholder('limit')}
+        """
         with self._cursor() as (_connection, cursor):
-            rows = cursor.execute(
-                """
-                SELECT
-                    t.*,
-                    u.student_id,
-                    u.display_name,
-                    u.refresh_interval_seconds
-                FROM tasks t
-                JOIN users u ON u.id = t.user_id
-                ORDER BY t.created_at DESC
-                LIMIT ?
-                """,
-                (limit,),
-            ).fetchall()
-            return self._rows_to_dicts(rows)
-
+            cursor.execute(query, {"limit": int(limit)})
+            return self._rows_to_dicts(cursor.fetchall())
     def mark_task_running(self, task_id: int) -> None:
         now = utc_now()
         with self._cursor() as (_connection, cursor):
             cursor.execute(
-                """
-                UPDATE tasks
-                SET status = 'running',
-                    started_at = COALESCE(started_at, ?),
-                    updated_at = ?,
-                    last_error = ''
-                WHERE id = ?
-                """,
-                (now, now, task_id),
+                f"UPDATE tasks SET status = {self._placeholder('status')}, started_at = COALESCE(started_at, {self._placeholder('started_at')}), updated_at = {self._placeholder('updated_at')}, last_error = {self._placeholder('last_error')} WHERE id = {self._placeholder('task_id')}",
+                {
+                    "status": "running",
+                    "started_at": now,
+                    "updated_at": now,
+                    "last_error": "",
+                    "task_id": task_id,
+                },
             )
 
     def finish_task(self, task_id: int, status: str, last_error: str = "") -> None:
         now = utc_now()
         with self._cursor() as (_connection, cursor):
             cursor.execute(
-                """
-                UPDATE tasks
-                SET status = ?,
-                    finished_at = ?,
-                    updated_at = ?,
-                    last_error = ?
-                WHERE id = ?
-                """,
-                (status, now, now, last_error, task_id),
+                f"UPDATE tasks SET status = {self._placeholder('status')}, finished_at = {self._placeholder('finished_at')}, updated_at = {self._placeholder('updated_at')}, last_error = {self._placeholder('last_error')} WHERE id = {self._placeholder('task_id')}",
+                {
+                    "status": status,
+                    "finished_at": now,
+                    "updated_at": now,
+                    "last_error": last_error,
+                    "task_id": task_id,
+                },
             )
 
     def update_task_status(self, task_id: int, status: str, last_error: str = "") -> None:
         with self._cursor() as (_connection, cursor):
             cursor.execute(
-                """
-                UPDATE tasks
-                SET status = ?, updated_at = ?, last_error = ?
-                WHERE id = ?
-                """,
-                (status, utc_now(), last_error, task_id),
+                f"UPDATE tasks SET status = {self._placeholder('status')}, updated_at = {self._placeholder('updated_at')}, last_error = {self._placeholder('last_error')} WHERE id = {self._placeholder('task_id')}",
+                {
+                    "status": status,
+                    "updated_at": utc_now(),
+                    "last_error": last_error,
+                    "task_id": task_id,
+                },
             )
 
     def increment_task_attempts(self, task_id: int, delta: int = 1) -> None:
@@ -505,13 +806,8 @@ class Database:
             return
         with self._cursor() as (_connection, cursor):
             cursor.execute(
-                """
-                UPDATE tasks
-                SET total_attempts = COALESCE(total_attempts, 0) + ?,
-                    updated_at = ?
-                WHERE id = ?
-                """,
-                (increment, utc_now(), task_id),
+                f"UPDATE tasks SET total_attempts = total_attempts + {self._placeholder('delta')}, updated_at = {self._placeholder('updated_at')} WHERE id = {self._placeholder('task_id')}",
+                {"delta": increment, "updated_at": utc_now(), "task_id": task_id},
             )
 
     def increment_task_errors(self, task_id: int, delta: int = 1) -> None:
@@ -520,13 +816,8 @@ class Database:
             return
         with self._cursor() as (_connection, cursor):
             cursor.execute(
-                """
-                UPDATE tasks
-                SET total_errors = COALESCE(total_errors, 0) + ?,
-                    updated_at = ?
-                WHERE id = ?
-                """,
-                (increment, utc_now(), task_id),
+                f"UPDATE tasks SET total_errors = total_errors + {self._placeholder('delta')}, updated_at = {self._placeholder('updated_at')} WHERE id = {self._placeholder('task_id')}",
+                {"delta": increment, "updated_at": utc_now(), "task_id": task_id},
             )
 
     def request_task_stop(self, task_id: int) -> bool:
@@ -535,12 +826,8 @@ class Database:
             return False
         with self._cursor() as (_connection, cursor):
             cursor.execute(
-                """
-                UPDATE tasks
-                SET status = 'cancel_requested', updated_at = ?
-                WHERE id = ?
-                """,
-                (utc_now(), task_id),
+                f"UPDATE tasks SET status = {self._placeholder('status')}, updated_at = {self._placeholder('updated_at')} WHERE id = {self._placeholder('task_id')}",
+                {"status": "cancel_requested", "updated_at": utc_now(), "task_id": task_id},
             )
         return True
 
@@ -548,102 +835,246 @@ class Database:
         now = utc_now()
         with self._cursor() as (_connection, cursor):
             cursor.execute(
-                """
-                UPDATE tasks
-                SET status = 'stopped',
-                    finished_at = COALESCE(finished_at, ?),
-                    updated_at = ?
-                WHERE status IN ('pending', 'running', 'cancel_requested')
-                """,
-                (now, now),
+                f"UPDATE tasks SET status = {self._placeholder('status')}, finished_at = COALESCE(finished_at, {self._placeholder('finished_at')}), updated_at = {self._placeholder('updated_at')} WHERE status IN ('pending', 'running', 'cancel_requested')",
+                {"status": "stopped", "finished_at": now, "updated_at": now},
             )
 
     def add_log(self, task_id: int | None, user_id: int | None, scope: str, level: str, message: str) -> int:
         now = utc_now()
         with self._cursor() as (_connection, cursor):
             cursor.execute(
-                """
-                INSERT INTO logs (task_id, user_id, scope, level, message, created_at)
-                VALUES (?, ?, ?, ?, ?, ?)
-                """,
-                (task_id, user_id, scope, level.upper(), message, now),
+                f"INSERT INTO logs (task_id, user_id, scope, level, message, created_at) VALUES ({self._placeholder('task_id')}, {self._placeholder('user_id')}, {self._placeholder('scope')}, {self._placeholder('level')}, {self._placeholder('message')}, {self._placeholder('created_at')})",
+                {
+                    "task_id": task_id,
+                    "user_id": user_id,
+                    "scope": scope,
+                    "level": level.upper(),
+                    "message": message,
+                    "created_at": now,
+                },
             )
             return int(cursor.lastrowid)
 
     def list_recent_logs(self, *, user_id: int | None = None, limit: int = 120) -> list[dict[str, Any]]:
         if user_id is None:
-            query = """
-                SELECT
-                    l.*,
-                    u.student_id,
-                    u.display_name
+            query = f"""
+                SELECT l.*, u.student_id, u.display_name
                 FROM logs l
                 LEFT JOIN users u ON u.id = l.user_id
                 ORDER BY l.id DESC
-                LIMIT ?
+                LIMIT {self._placeholder('limit')}
             """
-            params = (limit,)
+            params = {"limit": int(limit)}
         else:
-            query = """
-                SELECT
-                    l.*,
-                    u.student_id,
-                    u.display_name
+            query = f"""
+                SELECT l.*, u.student_id, u.display_name
                 FROM logs l
                 LEFT JOIN users u ON u.id = l.user_id
-                WHERE l.user_id = ?
+                WHERE l.user_id = {self._placeholder('user_id')}
                 ORDER BY l.id DESC
-                LIMIT ?
+                LIMIT {self._placeholder('limit')}
             """
-            params = (user_id, limit)
-
+            params = {"user_id": user_id, "limit": int(limit)}
         with self._cursor() as (_connection, cursor):
-            rows = cursor.execute(query, params).fetchall()
+            cursor.execute(query, params)
+            rows = cursor.fetchall()
             return list(reversed(self._rows_to_dicts(rows)))
 
     def list_logs_after(self, after_id: int, *, user_id: int | None = None, limit: int = 100) -> list[dict[str, Any]]:
         if user_id is None:
-            query = """
-                SELECT
-                    l.*,
-                    u.student_id,
-                    u.display_name
+            query = f"""
+                SELECT l.*, u.student_id, u.display_name
                 FROM logs l
                 LEFT JOIN users u ON u.id = l.user_id
-                WHERE l.id > ?
+                WHERE l.id > {self._placeholder('after_id')}
                 ORDER BY l.id ASC
-                LIMIT ?
+                LIMIT {self._placeholder('limit')}
             """
-            params = (after_id, limit)
+            params = {"after_id": after_id, "limit": int(limit)}
         else:
-            query = """
-                SELECT
-                    l.*,
-                    u.student_id,
-                    u.display_name
+            query = f"""
+                SELECT l.*, u.student_id, u.display_name
                 FROM logs l
                 LEFT JOIN users u ON u.id = l.user_id
-                WHERE l.id > ? AND l.user_id = ?
+                WHERE l.id > {self._placeholder('after_id')} AND l.user_id = {self._placeholder('user_id')}
                 ORDER BY l.id ASC
-                LIMIT ?
+                LIMIT {self._placeholder('limit')}
             """
-            params = (after_id, user_id, limit)
-
+            params = {"after_id": after_id, "user_id": user_id, "limit": int(limit)}
         with self._cursor() as (_connection, cursor):
-            rows = cursor.execute(query, params).fetchall()
-            return self._rows_to_dicts(rows)
+            cursor.execute(query, params)
+            return self._rows_to_dicts(cursor.fetchall())
 
     def get_admin_stats(self) -> dict[str, int]:
         with self._cursor() as (_connection, cursor):
-            users_count = cursor.execute("SELECT COUNT(*) AS total FROM users").fetchone()["total"]
-            courses_count = cursor.execute("SELECT COUNT(*) AS total FROM course_targets").fetchone()["total"]
-            admins_count = cursor.execute("SELECT COUNT(*) AS total FROM admins").fetchone()["total"]
-            running_count = cursor.execute("SELECT COUNT(*) AS total FROM tasks WHERE status = 'running'").fetchone()["total"]
-            pending_count = cursor.execute("SELECT COUNT(*) AS total FROM tasks WHERE status = 'pending'").fetchone()["total"]
+            cursor.execute("SELECT COUNT(*) AS total FROM users")
+            users_count = int(dict(cursor.fetchone())["total"])
+            cursor.execute("SELECT COUNT(*) AS total FROM course_targets")
+            courses_count = int(dict(cursor.fetchone())["total"])
+            cursor.execute("SELECT COUNT(*) AS total FROM admins")
+            admins_count = int(dict(cursor.fetchone())["total"])
+            cursor.execute("SELECT COUNT(*) AS total FROM tasks WHERE status = 'running'")
+            running_count = int(dict(cursor.fetchone())["total"])
+            cursor.execute("SELECT COUNT(*) AS total FROM tasks WHERE status = 'pending'")
+            pending_count = int(dict(cursor.fetchone())["total"])
+            cursor.execute("SELECT COUNT(*) AS total FROM registration_codes")
+            registration_code_count = int(dict(cursor.fetchone())["total"])
+            cursor.execute("SELECT COUNT(*) AS total FROM user_schedules WHERE is_enabled = 1")
+            active_schedule_count = int(dict(cursor.fetchone())["total"])
             return {
-                "users_count": int(users_count),
-                "courses_count": int(courses_count),
-                "admins_count": int(admins_count) + 1,
-                "running_count": int(running_count),
-                "pending_count": int(pending_count),
+                "users_count": users_count,
+                "courses_count": courses_count,
+                "admins_count": admins_count + 1,
+                "running_count": running_count,
+                "pending_count": pending_count,
+                "registration_code_count": registration_code_count,
+                "active_schedule_count": active_schedule_count,
             }
+
+    def get_user_schedule(self, user_id: int) -> dict[str, Any] | None:
+        with self._cursor() as (_connection, cursor):
+            cursor.execute(
+                f"SELECT * FROM user_schedules WHERE user_id = {self._placeholder('user_id')}",
+                {"user_id": user_id},
+            )
+            row = cursor.fetchone()
+            return None if row is None else dict(row)
+
+    def upsert_user_schedule(
+        self,
+        user_id: int,
+        *,
+        is_enabled: bool,
+        start_date: str | None,
+        end_date: str | None,
+        daily_start_time: str | None,
+        daily_stop_time: str | None,
+    ) -> None:
+        now = utc_now()
+        current = self.get_user_schedule(user_id)
+        payload = {
+            "user_id": user_id,
+            "is_enabled": 1 if is_enabled else 0,
+            "start_date": start_date,
+            "end_date": end_date,
+            "daily_start_time": daily_start_time,
+            "daily_stop_time": daily_stop_time,
+            "last_auto_start_on": "",
+            "last_auto_stop_on": "",
+            "created_at": now,
+            "updated_at": now,
+            "id": int(current["id"]) if current else None,
+        }
+        with self._cursor() as (_connection, cursor):
+            if current is None:
+                cursor.execute(
+                    f"INSERT INTO user_schedules (user_id, is_enabled, start_date, end_date, daily_start_time, daily_stop_time, last_auto_start_on, last_auto_stop_on, created_at, updated_at) VALUES ({self._placeholder('user_id')}, {self._placeholder('is_enabled')}, {self._placeholder('start_date')}, {self._placeholder('end_date')}, {self._placeholder('daily_start_time')}, {self._placeholder('daily_stop_time')}, {self._placeholder('last_auto_start_on')}, {self._placeholder('last_auto_stop_on')}, {self._placeholder('created_at')}, {self._placeholder('updated_at')})",
+                    payload,
+                )
+            else:
+                cursor.execute(
+                    f"UPDATE user_schedules SET is_enabled = {self._placeholder('is_enabled')}, start_date = {self._placeholder('start_date')}, end_date = {self._placeholder('end_date')}, daily_start_time = {self._placeholder('daily_start_time')}, daily_stop_time = {self._placeholder('daily_stop_time')}, last_auto_start_on = {self._placeholder('last_auto_start_on')}, last_auto_stop_on = {self._placeholder('last_auto_stop_on')}, updated_at = {self._placeholder('updated_at')} WHERE id = {self._placeholder('id')}",
+                    payload,
+                )
+
+    def list_enabled_user_schedules(self) -> list[dict[str, Any]]:
+        query = """
+            SELECT s.*, u.student_id, u.display_name, u.is_active AS user_is_active
+            FROM user_schedules s
+            JOIN users u ON u.id = s.user_id
+            WHERE s.is_enabled = 1
+            ORDER BY s.user_id ASC
+        """
+        with self._cursor() as (_connection, cursor):
+            cursor.execute(query)
+            return self._rows_to_dicts(cursor.fetchall())
+
+    def mark_schedule_auto_start(self, user_id: int, day_text: str) -> None:
+        with self._cursor() as (_connection, cursor):
+            cursor.execute(
+                f"UPDATE user_schedules SET last_auto_start_on = {self._placeholder('day_text')}, updated_at = {self._placeholder('updated_at')} WHERE user_id = {self._placeholder('user_id')}",
+                {"day_text": day_text, "updated_at": utc_now(), "user_id": user_id},
+            )
+
+    def mark_schedule_auto_stop(self, user_id: int, day_text: str) -> None:
+        with self._cursor() as (_connection, cursor):
+            cursor.execute(
+                f"UPDATE user_schedules SET last_auto_stop_on = {self._placeholder('day_text')}, updated_at = {self._placeholder('updated_at')} WHERE user_id = {self._placeholder('user_id')}",
+                {"day_text": day_text, "updated_at": utc_now(), "user_id": user_id},
+            )
+    def create_registration_code(
+        self,
+        *,
+        created_by: str,
+        note: str = "",
+        max_uses: int = DEFAULT_REGISTRATION_CODE_MAX_USES,
+    ) -> dict[str, Any]:
+        normalized_max_uses = max(1, int(max_uses or DEFAULT_REGISTRATION_CODE_MAX_USES))
+        now = utc_now()
+        for _ in range(24):
+            code = "SACC-" + "".join(secrets.choice(REGISTRATION_CODE_ALPHABET) for _ in range(8))
+            if self.get_registration_code_by_code(code) is not None:
+                continue
+            with self._cursor() as (_connection, cursor):
+                cursor.execute(
+                    f"INSERT INTO registration_codes (code, note, is_active, max_uses, used_count, created_by, used_by_user_id, used_at, created_at, updated_at) VALUES ({self._placeholder('code')}, {self._placeholder('note')}, {self._placeholder('is_active')}, {self._placeholder('max_uses')}, {self._placeholder('used_count')}, {self._placeholder('created_by')}, {self._placeholder('used_by_user_id')}, {self._placeholder('used_at')}, {self._placeholder('created_at')}, {self._placeholder('updated_at')})",
+                    {
+                        "code": code,
+                        "note": note.strip(),
+                        "is_active": 1,
+                        "max_uses": normalized_max_uses,
+                        "used_count": 0,
+                        "created_by": created_by,
+                        "used_by_user_id": None,
+                        "used_at": None,
+                        "created_at": now,
+                        "updated_at": now,
+                    },
+                )
+                return self.get_registration_code_by_id(int(cursor.lastrowid)) or {"code": code}
+        raise RuntimeError("生成注册码失败，请重试。")
+
+    def get_registration_code_by_code(self, code: str) -> dict[str, Any] | None:
+        with self._cursor() as (_connection, cursor):
+            cursor.execute(
+                f"SELECT * FROM registration_codes WHERE code = {self._placeholder('code')}",
+                {"code": normalize_registration_code(code)},
+            )
+            row = cursor.fetchone()
+            return None if row is None else dict(row)
+
+    def get_registration_code_by_id(self, registration_code_id: int) -> dict[str, Any] | None:
+        with self._cursor() as (_connection, cursor):
+            cursor.execute(
+                f"SELECT * FROM registration_codes WHERE id = {self._placeholder('registration_code_id')}",
+                {"registration_code_id": registration_code_id},
+            )
+            row = cursor.fetchone()
+            return None if row is None else dict(row)
+
+    def list_registration_codes(self, limit: int = 100) -> list[dict[str, Any]]:
+        query = f"""
+            SELECT rc.*, u.student_id AS used_by_student_id, u.display_name AS used_by_display_name
+            FROM registration_codes rc
+            LEFT JOIN users u ON u.id = rc.used_by_user_id
+            ORDER BY rc.created_at DESC
+            LIMIT {self._placeholder('limit')}
+        """
+        with self._cursor() as (_connection, cursor):
+            cursor.execute(query, {"limit": int(limit)})
+            return self._rows_to_dicts(cursor.fetchall())
+
+    def toggle_registration_code_active(self, registration_code_id: int) -> dict[str, Any] | None:
+        code = self.get_registration_code_by_id(registration_code_id)
+        if code is None:
+            return None
+        with self._cursor() as (_connection, cursor):
+            cursor.execute(
+                f"UPDATE registration_codes SET is_active = {self._placeholder('is_active')}, updated_at = {self._placeholder('updated_at')} WHERE id = {self._placeholder('registration_code_id')}",
+                {
+                    "is_active": 0 if bool(code.get('is_active')) else 1,
+                    "updated_at": utc_now(),
+                    "registration_code_id": registration_code_id,
+                },
+            )
+        return self.get_registration_code_by_id(registration_code_id)

core/task_manager.py

@@ -4,6 +4,8 @@ import logging
 import threading
 import time
 from dataclasses import dataclass
+from datetime import datetime
+from zoneinfo import ZoneInfo
 
 from core.course_bot import CourseBot, TaskResult
 from core.db import Database
@@ -32,6 +34,7 @@ class TaskManager:
         self._dispatcher_thread: threading.Thread | None = None
         self._running: dict[int, RunningTask] = {}
         self._last_dispatch_snapshot: tuple[int, int, int] | None = None
+        self._schedule_timezone = ZoneInfo(getattr(self.config, "schedule_timezone", "Asia/Shanghai"))
 
     def start(self) -> None:
         with self._startup_lock:
@@ -39,9 +42,10 @@ class TaskManager:
                 LOGGER.info("Task manager start skipped because it is already running")
                 return
             LOGGER.info(
-                "Task manager starting | db_path=%s default_parallel_limit=%s",
+                "Task manager starting | db_path=%s default_parallel_limit=%s schedule_timezone=%s",
                 self.store.path,
                 getattr(self.config, "default_parallel_limit", "-"),
+                getattr(self.config, "schedule_timezone", "Asia/Shanghai"),
             )
             self.store.reset_inflight_tasks()
             self._dispatcher_thread = threading.Thread(target=self._dispatch_loop, name="task-dispatcher", daemon=True)
@@ -92,10 +96,71 @@ class TaskManager:
                 running_task.stop_event.set()
         return True
 
+    def _current_schedule_now(self) -> datetime:
+        return datetime.now(self._schedule_timezone)
+
+    def _within_schedule_date_window(self, schedule: dict, today_text: str) -> bool:
+        start_date = str(schedule.get("start_date") or "").strip()
+        end_date = str(schedule.get("end_date") or "").strip()
+        if start_date and today_text < start_date:
+            return False
+        if end_date and today_text > end_date:
+            return False
+        return True
+
+    def _apply_user_schedules(self) -> None:
+        now = self._current_schedule_now()
+        today_text = now.date().isoformat()
+        current_time_text = now.strftime("%H:%M")
+
+        for schedule in self.store.list_enabled_user_schedules():
+            if not bool(schedule.get("user_is_active", 0)):
+                continue
+            if not self._within_schedule_date_window(schedule, today_text):
+                continue
+
+            start_time = str(schedule.get("daily_start_time") or "").strip()
+            stop_time = str(schedule.get("daily_stop_time") or "").strip()
+            if not start_time or not stop_time:
+                continue
+
+            user_id = int(schedule["user_id"])
+            active_task = self.store.find_active_task_for_user(user_id)
+
+            if current_time_text >= stop_time and str(schedule.get("last_auto_stop_on") or "") != today_text:
+                if active_task and self.stop_task(int(active_task["id"])):
+                    self._log(int(active_task["id"]), user_id, "SYSTEM", "INFO", "已按管理员定时设置发送停止请求。")
+                else:
+                    self._log(None, user_id, "SYSTEM", "INFO", "已到定时停止时间，当前没有运行中的任务。")
+                self.store.mark_schedule_auto_stop(user_id, today_text)
+                continue
+
+            if not (start_time <= current_time_text < stop_time):
+                continue
+            if str(schedule.get("last_auto_start_on") or "") == today_text:
+                continue
+
+            user = self.store.get_user(user_id)
+            if user is None:
+                self.store.mark_schedule_auto_start(user_id, today_text)
+                continue
+            if not self.store.list_courses_for_user(user_id):
+                self._log(None, user_id, "SYSTEM", "INFO", "已到定时启动时间，但当前没有课程目标，今天不自动启动。")
+                self.store.mark_schedule_auto_start(user_id, today_text)
+                continue
+
+            task, created = self.queue_task(user_id, requested_by="scheduler", requested_by_role="system")
+            if created:
+                self._log(task["id"], user_id, "SYSTEM", "INFO", "已按管理员定时设置自动加入任务队列。")
+            else:
+                self._log(task["id"], user_id, "SYSTEM", "INFO", "已到定时启动时间，但当前已有任务在运行或排队。")
+            self.store.mark_schedule_auto_start(user_id, today_text)
+
     def _dispatch_loop(self) -> None:
         LOGGER.info("Dispatcher loop started")
         while not self._shutdown_event.is_set():
             self._cleanup_running_registry()
+            self._apply_user_schedules()
             parallel_limit = self.store.get_parallel_limit()
             running_count = self._running_count()
             available_slots = max(0, parallel_limit - running_count)
@@ -232,4 +297,4 @@ class TaskManager:
         with self._running_lock:
             removed = self._running.pop(task_id, None)
         if removed is not None:
-            LOGGER.info("Task removed from running registry | task_id=%s", task_id)
+            LOGGER.info("Task removed from running registry | task_id=%s", task_id)

requirements.txt

@@ -1,7 +1,8 @@
-Flask>=3.0.0
-gunicorn>=23.0.0
-selenium>=4.35.0
-onnxruntime>=1.18.0
-numpy>=1.24.0
-Pillow>=10.0.0
-cryptography>=43.0.0
+Flask>=3.0.0
+gunicorn>=23.0.0
+selenium>=4.35.0
+onnxruntime>=1.18.0
+numpy>=1.24.0
+Pillow>=10.0.0
+cryptography>=43.0.0
+PyMySQL>=1.1.1

space_app.py

@@ -1,26 +1,37 @@
-from __future__ import annotations
+from __future__ import annotations
 
 import atexit
 import json
 import re
 import time
+from datetime import date as date_cls, time as time_cls
 from functools import wraps
 from typing import Callable
 
 from flask import Flask, Response, flash, g, jsonify, redirect, render_template, request, session, stream_with_context, url_for
 
 from core.config import AppConfig
-from core.db import Database, MAX_REFRESH_INTERVAL_SECONDS, MIN_REFRESH_INTERVAL_SECONDS
+from core.db import (
+    DEFAULT_REGISTRATION_CODE_MAX_USES,
+    Database,
+    MAX_REFRESH_INTERVAL_SECONDS,
+    MIN_REFRESH_INTERVAL_SECONDS,
+    normalize_registration_code,
+)
+from core.runtime_logging import configure_logging, get_logger
 from core.security import SecretBox, hash_password, verify_password
 from core.task_manager import TaskManager
-from core.runtime_logging import configure_logging, get_logger
 
 
 configure_logging()
 APP_LOGGER = get_logger("sacc.web")
 
 config = AppConfig.load()
-store = Database(config.db_path, default_parallel_limit=config.default_parallel_limit)
+store = Database(
+    config.db_path,
+    default_parallel_limit=config.default_parallel_limit,
+    mysql_ssl_ca_path=config.mysql_ssl_ca_path,
+)
 store.init_db()
 secret_box = SecretBox(config.encryption_key)
 task_manager = TaskManager(config=config, store=store, secret_box=secret_box)
@@ -61,12 +72,14 @@ app = Flask(__name__, template_folder="templates", static_folder="static")
 app.secret_key = config.session_secret
 app.config.update(SESSION_COOKIE_HTTPONLY=True, SESSION_COOKIE_SAMESITE="Lax")
 APP_LOGGER.info(
-    "Application bootstrap complete | data_dir=%s db_path=%s chrome_binary=%s chromedriver_path=%s default_parallel_limit=%s",
+    "Application bootstrap complete | data_dir=%s db_path=%s backend=%s chrome_binary=%s chromedriver_path=%s default_parallel_limit=%s schedule_timezone=%s",
     config.data_dir,
     config.db_path,
+    config.database_backend,
     config.chrome_binary,
     config.chromedriver_path,
     config.default_parallel_limit,
+    config.schedule_timezone,
 )
 
 CATEGORY_LABELS = {
@@ -82,7 +95,6 @@ TASK_LABELS = {
     "failed": "失败",
 }
 
-
 SKIPPED_REQUEST_LOG_PREFIXES = (
     "/static/",
     "/api/",
@@ -90,6 +102,9 @@ SKIPPED_REQUEST_LOG_PREFIXES = (
 SKIPPED_REQUEST_LOG_PATHS = {
     "/favicon.ico",
 }
+COURSE_ID_PATTERN = re.compile(r"^[0-9A-Za-z]{1,32}$")
+COURSE_INDEX_PATTERN = re.compile(r"^[0-9A-Za-z]{1,8}$")
+REGISTRATION_CODE_PATTERN = re.compile(r"^[A-Z0-9-]{6,64}$")
 
 
 def _current_actor_label() -> str:
@@ -137,6 +152,7 @@ def inject_globals() -> dict:
         "refresh_interval_min": MIN_REFRESH_INTERVAL_SECONDS,
         "refresh_interval_max": MAX_REFRESH_INTERVAL_SECONDS,
         "default_refresh_interval_seconds": config.poll_interval_seconds,
+        "default_registration_code_max_uses": DEFAULT_REGISTRATION_CODE_MAX_USES,
     }
 
 
@@ -172,10 +188,6 @@ def _get_admin_identity() -> dict:
     }
 
 
-COURSE_ID_PATTERN = re.compile(r"^[0-9A-Za-z]{1,32}$")
-COURSE_INDEX_PATTERN = re.compile(r"^[0-9A-Za-z]{1,8}$")
-
-
 def _normalize_course_token(raw_value: str) -> str:
     return re.sub(r"\s+", "", str(raw_value or "")).upper()
 
@@ -203,6 +215,72 @@ def _parse_refresh_interval(raw_value: str | None, *, default: int) -> int:
     return interval
 
 
+def _parse_registration_code_max_uses(raw_value: str | None) -> int:
+    raw_text = str(raw_value or "").strip()
+    if not raw_text:
+        return DEFAULT_REGISTRATION_CODE_MAX_USES
+    try:
+        value = int(raw_text)
+    except ValueError as exc:
+        raise ValueError("注册码可用次数必须是 1 到 99 之间的整数。") from exc
+    if value < 1 or value > 99:
+        raise ValueError("注册码可用次数必须在 1 到 99 之间。")
+    return value
+
+
+def _parse_iso_date(raw_value: str | None, label: str) -> str:
+    raw_text = str(raw_value or "").strip()
+    if not raw_text:
+        raise ValueError(f"{label}不能为空。")
+    try:
+        return date_cls.fromisoformat(raw_text).isoformat()
+    except ValueError as exc:
+        raise ValueError(f"{label}格式无效，请使用 YYYY-MM-DD。") from exc
+
+
+def _parse_clock_time(raw_value: str | None, label: str) -> str:
+    raw_text = str(raw_value or "").strip()
+    if not raw_text:
+        raise ValueError(f"{label}不能为空。")
+    try:
+        return time_cls.fromisoformat(raw_text).strftime("%H:%M")
+    except ValueError as exc:
+        raise ValueError(f"{label}格式无效，请使用 HH:MM。") from exc
+
+
+def _parse_schedule_form(form) -> dict:
+    enabled = str(form.get("schedule_enabled", "")).lower() in {"1", "true", "on", "yes"}
+    start_date_raw = form.get("start_date", "")
+    end_date_raw = form.get("end_date", "")
+    daily_start_time_raw = form.get("daily_start_time", "")
+    daily_stop_time_raw = form.get("daily_stop_time", "")
+    has_any_value = enabled or any(str(value or "").strip() for value in (start_date_raw, end_date_raw, daily_start_time_raw, daily_stop_time_raw))
+    if not has_any_value:
+        return {
+            "is_enabled": False,
+            "start_date": None,
+            "end_date": None,
+            "daily_start_time": None,
+            "daily_stop_time": None,
+        }
+
+    start_date = _parse_iso_date(start_date_raw, "开始日期")
+    end_date = _parse_iso_date(end_date_raw, "结束日期")
+    daily_start_time = _parse_clock_time(daily_start_time_raw, "每日启动时间")
+    daily_stop_time = _parse_clock_time(daily_stop_time_raw, "每日停止时间")
+    if end_date < start_date:
+        raise ValueError("结束日期不能早于开始日期。")
+    if daily_stop_time <= daily_start_time:
+        raise ValueError("每日停止时间必须晚于每日启动时间。")
+    return {
+        "is_enabled": enabled,
+        "start_date": start_date,
+        "end_date": end_date,
+        "daily_start_time": daily_start_time,
+        "daily_stop_time": daily_stop_time,
+    }
+
+
 def _user_owns_course(user_id: int, course_target_id: int) -> bool:
     return any(course["id"] == course_target_id for course in store.list_courses_for_user(user_id))
 
@@ -212,6 +290,7 @@ def _build_user_dashboard_context(user: dict) -> dict:
         "current_user": user,
         "courses": store.list_courses_for_user(user["id"]),
         "task": store.get_latest_task_for_user(user["id"]),
+        "schedule": store.get_user_schedule(user["id"]),
         "recent_logs": store.list_recent_logs(user_id=user["id"], limit=config.logs_page_size),
     }
 
@@ -221,10 +300,12 @@ def _build_admin_dashboard_context() -> dict:
     for user in users:
         user["courses"] = store.list_courses_for_user(user["id"])
         user["latest_task"] = store.get_latest_task_for_user(user["id"])
+        user["schedule"] = store.get_user_schedule(user["id"])
     admin_identity = _get_admin_identity()
     return {
         "users": users,
         "admins": store.list_admins(),
+        "registration_codes": store.list_registration_codes(limit=60),
         "stats": store.get_admin_stats(),
         "recent_tasks": store.list_recent_tasks(limit=18),
         "recent_logs": store.list_recent_logs(limit=config.logs_page_size),
@@ -261,7 +342,7 @@ def login():
         password = request.form.get("password", "")
         user = store.get_user_by_student_id(student_id)
         if user is None:
-            flash("没有找到该学号对应的账号，请联系管理员录入。", "danger")
+            flash("没有找到该学号对应的账号。如果你有注册码，请先完成注册。", "danger")
             return render_template("login.html")
         if not user["is_active"]:
             flash("该账号已被管理员禁用。", "danger")
@@ -283,6 +364,39 @@ def login():
     return render_template("login.html")
 
 
+@app.route("/register", methods=["GET", "POST"])
+def register():
+    if request.method == "POST":
+        registration_code = normalize_registration_code(request.form.get("registration_code", ""))
+        student_id = request.form.get("student_id", "").strip()
+        password = request.form.get("password", "").strip()
+        display_name = request.form.get("display_name", "").strip()
+
+        if not REGISTRATION_CODE_PATTERN.fullmatch(registration_code):
+            flash("请输入有效的注册码。", "danger")
+            return render_template("register.html")
+        if not student_id.isdigit() or not password:
+            flash("请填写学号和教务处密码。", "danger")
+            return render_template("register.html")
+
+        try:
+            store.register_user_with_code(
+                registration_code,
+                student_id,
+                secret_box.encrypt(password),
+                display_name,
+                refresh_interval_seconds=config.poll_interval_seconds,
+            )
+        except ValueError as exc:
+            flash(str(exc), "danger")
+            return render_template("register.html")
+
+        flash("注册成功，请使用学号和教务处密码登录。", "success")
+        return redirect(url_for("login"))
+
+    return render_template("register.html")
+
+
 @app.post("/logout")
 def logout():
     session.clear()
@@ -313,8 +427,7 @@ def admin_login():
 @app.post("/admin/logout")
 def admin_logout():
     session.clear()
-    return redirect(url_for("admin_login"))
-
+    return redirect(url_for("admin_login"))
 
 @app.get("/dashboard")
 @_login_required("user")
@@ -441,7 +554,7 @@ def admin_dashboard():
 @_login_required("admin")
 def update_parallel_limit():
     try:
-        parallel_limit = max(1, min(8, int(request.form.get("parallel_limit", "2"))))
+        parallel_limit = max(1, min(8, int(request.form.get("parallel_limit", str(config.default_parallel_limit)))))
     except ValueError:
         flash("并行数必须是 1 到 8 的整数。", "danger")
         return redirect(url_for("admin_dashboard"))
@@ -521,6 +634,38 @@ def toggle_user(user_id: int):
     return redirect(url_for("admin_dashboard"))
 
 
+@app.post("/admin/users/<int:user_id>/delete")
+@_login_required("admin")
+def delete_user_by_admin(user_id: int):
+    user = store.get_user(user_id)
+    if user is None:
+        flash("用户不存在。", "danger")
+        return redirect(url_for("admin_dashboard"))
+    active_task = store.find_active_task_for_user(user_id)
+    if active_task is not None:
+        flash("请先停止该用户当前任务，再删除用户。", "danger")
+        return redirect(url_for("admin_dashboard"))
+    store.delete_user(user_id)
+    flash("用户及其课程、日志、定时设置已删除。", "success")
+    return redirect(url_for("admin_dashboard"))
+
+
+@app.post("/admin/users/<int:user_id>/schedule")
+@_login_required("admin")
+def update_user_schedule(user_id: int):
+    if store.get_user(user_id) is None:
+        flash("用户不存在。", "danger")
+        return redirect(url_for("admin_dashboard"))
+    try:
+        schedule_payload = _parse_schedule_form(request.form)
+    except ValueError as exc:
+        flash(str(exc), "danger")
+        return redirect(url_for("admin_dashboard"))
+    store.upsert_user_schedule(user_id, **schedule_payload)
+    flash("定时启动终止设置已更新。", "success")
+    return redirect(url_for("admin_dashboard"))
+
+
 @app.post("/admin/users/<int:user_id>/courses")
 @_login_required("admin")
 def admin_add_course(user_id: int):
@@ -591,6 +736,31 @@ def create_admin():
     return redirect(url_for("admin_dashboard"))
 
 
+@app.post("/admin/registration-codes")
+@_login_required("admin")
+def create_registration_code():
+    note = request.form.get("note", "").strip()
+    try:
+        max_uses = _parse_registration_code_max_uses(request.form.get("max_uses"))
+    except ValueError as exc:
+        flash(str(exc), "danger")
+        return redirect(url_for("admin_dashboard"))
+    admin_identity = _get_admin_identity()
+    created = store.create_registration_code(created_by=admin_identity["username"], note=note, max_uses=max_uses)
+    flash(f"注册码已创建：{created['code']}", "success")
+    return redirect(url_for("admin_dashboard"))
+
+
+@app.post("/admin/registration-codes/<int:registration_code_id>/toggle")
+@_login_required("admin")
+def toggle_registration_code(registration_code_id: int):
+    updated = store.toggle_registration_code_active(registration_code_id)
+    if updated is None:
+        flash("注册码不存在。", "danger")
+    else:
+        flash("注册码状态已更新。", "success")
+    return redirect(url_for("admin_dashboard"))
+
 @app.get("/api/user/status")
 @_login_required("user")
 def user_status():
@@ -671,4 +841,4 @@ def stream_admin_logs():
     response = Response(generate(), mimetype="text/event-stream")
     response.headers["Cache-Control"] = "no-cache"
     response.headers["X-Accel-Buffering"] = "no"
-    return response
+    return response

templates/admin_dashboard.html

@@ -1,279 +1,377 @@
-{% extends "base.html" %}
-{% block title %}管理后台 | SCU 选课控制台{% endblock %}
-{% block body_class %}admin-theme{% endblock %}
-{% block content %}
-<section class="dashboard-shell admin-dashboard" data-log-stream-url="{{ url_for('stream_admin_logs', last_id=recent_logs[-1].id if recent_logs else 0) }}" data-status-url="{{ url_for('admin_status') }}">
-    <header class="topbar reveal-up">
-        <div>
-            <span class="eyebrow">Admin Console</span>
-            <h1>管理员后台</h1>
-            <p>当前管理员：{{ admin_identity.username }}{% if is_super_admin %} · 超级管理员{% endif %}</p>
-        </div>
-        <form method="post" action="{{ url_for('admin_logout') }}">
-            <button type="submit" class="btn btn-ghost">退出后台</button>
-        </form>
-    </header>
-
-    <section class="metric-grid reveal-up delay-1">
-        <article class="metric-card">
-            <span>用户数</span>
-            <strong id="stat-users">{{ stats.users_count }}</strong>
-            <small>已录入的学生账号</small>
-        </article>
-        <article class="metric-card">
-            <span>运行中任务</span>
-            <strong id="stat-running">{{ stats.running_count }}</strong>
-            <small>排队中：<span id="stat-pending">{{ stats.pending_count }}</span></small>
-        </article>
-        <article class="metric-card">
-            <span>总课程目标</span>
-            <strong>{{ stats.courses_count }}</strong>
-            <small>管理员可见全部课程号与课序号</small>
-        </article>
-        <article class="metric-card">
-            <span>管理员总数</span>
-            <strong>{{ stats.admins_count }}</strong>
-            <small>包含 1 位超级管理员</small>
-        </article>
-    </section>
-
-    <section class="content-grid admin-grid">
-        <article class="card reveal-up delay-2">
-            <div class="card-head">
-                <span class="kicker">调度设置</span>
-                <h2>并行数</h2>
-                <p>建议根据 Hugging Face Space 的 CPU 与内存情况控制在较低范围。</p>
-            </div>
-            <form method="post" action="{{ url_for('update_parallel_limit') }}" class="form-grid form-grid-compact">
-                <label class="field">
-                    <span>当前并行数</span>
-                    <input type="number" id="parallel-limit-input" name="parallel_limit" min="1" max="8" value="{{ parallel_limit }}" required>
-                </label>
-                <button type="submit" class="btn btn-primary">更新并行数</button>
-            </form>
-        </article>
-
-        <article class="card reveal-up delay-2">
-            <div class="card-head">
-                <span class="kicker">新增用户</span>
-                <h2>手动录入用户信息</h2>
-                <p>管理员可以直接创建学生账号，普通用户随后即可用学号和密码登录。</p>
-            </div>
-            <form method="post" action="{{ url_for('create_user') }}" class="form-grid form-grid-compact">
-                <label class="field">
-                    <span>学号</span>
-                    <input type="text" name="student_id" inputmode="numeric" placeholder="13 位学号" required>
-                </label>
-                <label class="field">
-                    <span>显示名称</span>
-                    <input type="text" name="display_name" placeholder="可选备注">
-                </label>
-                <label class="field">
-                    <span>刷新间隔</span>
-                    <input type="number" name="refresh_interval_seconds" min="{{ refresh_interval_min }}" max="{{ refresh_interval_max }}" value="{{ default_refresh_interval_seconds }}" required>
-                </label>
-                <label class="field span-2">
-                    <span>密码</span>
-                    <input type="password" name="password" placeholder="教务系统密码" required>
-                </label>
-                <button type="submit" class="btn btn-secondary">创建用户</button>
-            </form>
-        </article>
-
-        {% if is_super_admin %}
-        <article class="card reveal-up delay-2">
-            <div class="card-head">
-                <span class="kicker">管理员管理</span>
-                <h2>新增管理员</h2>
-                <p>只有超级管理员可以继续创建普通管理员。</p>
-            </div>
-            <form method="post" action="{{ url_for('create_admin') }}" class="form-grid form-grid-compact">
-                <label class="field">
-                    <span>管理员账号</span>
-                    <input type="text" name="username" placeholder="输入管理员账号" required>
-                </label>
-                <label class="field">
-                    <span>管理员密码</span>
-                    <input type="password" name="password" placeholder="输入管理员密码" required>
-                </label>
-                <button type="submit" class="btn btn-ghost">创建管理员</button>
-            </form>
-            <div class="chip-row">
-                <span class="chip highlight">超级管理员：{{ admin_identity.username }}</span>
-                {% for admin in admins %}
-                    <span class="chip">{{ admin.username }}</span>
-                {% endfor %}
-            </div>
-        </article>
-        {% endif %}
-
-        <article class="card reveal-up delay-3 span-2">
-            <div class="card-head split">
-                <div>
-                    <span class="kicker">任务总览</span>
-                    <h2>最近任务</h2>
-                    <p>用于快速确认任务是否正在排队、执行、停止或失败。</p>
-                </div>
-                <span class="status-pill status-running">实时刷新</span>
-            </div>
-            <div class="course-table-wrap">
-                <table class="data-table">
-                    <thead>
-                        <tr>
-                            <th>任务</th>
-                            <th>学号</th>
-                            <th>状态</th>
-                            <th>尝试</th>
-                            <th>错误</th>
-                            <th>刷新间隔</th>
-                            <th>触发者</th>
-                            <th>更新时间</th>
-                        </tr>
-                    </thead>
-                    <tbody>
-                        {% if recent_tasks %}
-                            {% for task in recent_tasks %}
-                                <tr>
-                                    <td>#{{ task.id }}</td>
-                                    <td>{{ task.student_id }}</td>
-                                    <td><span class="status-pill status-{{ task.status }}">{{ task_labels.get(task.status, task.status) }}</span></td>
-                                    <td>{{ task.total_attempts }}</td>
-                                    <td>{{ task.total_errors }}</td>
-                                    <td>{{ task.refresh_interval_seconds or default_refresh_interval_seconds }} 秒</td>
-                                    <td>{{ task.requested_by_role }}:{{ task.requested_by }}</td>
-                                    <td>{{ task.updated_at }}</td>
-                                </tr>
-                            {% endfor %}
-                        {% else %}
-                            <tr>
-                                <td colspan="8" class="empty-cell">还没有任务记录。</td>
-                            </tr>
-                        {% endif %}
-                    </tbody>
-                </table>
-            </div>
-        </article>
-
-        <article class="card reveal-up delay-3 span-2">
-            <div class="card-head split">
-                <div>
-                    <span class="kicker">全局日志</span>
-                    <h2>所有用户的运行日志</h2>
-                    <p>日志会持续流入，便于管理员确认浏览器登录、查课、提交结果与错误信息。</p>
-                </div>
-                <span class="live-dot">LIVE</span>
-            </div>
-            <div class="log-console" id="log-console">
-                {% if recent_logs %}
-                    {% for log in recent_logs %}
-                        <div class="log-line level-{{ log.level|lower }}">
-                            <span class="log-meta">{{ log.created_at }} · {{ log.student_id or 'system' }} · {{ log.scope }} · {{ log.level }}</span>
-                            <span>{{ log.message }}</span>
-                        </div>
-                    {% endfor %}
-                {% else %}
-                    <div class="log-line level-info muted">暂无日志，用户启动任务后这里会自动刷新。</div>
-                {% endif %}
-            </div>
-        </article>
-
-        <article class="card reveal-up delay-4 span-2">
-            <div class="card-head">
-                <span class="kicker">用户清单</span>
-                <h2>所有用户与课程详情</h2>
-                <p>可以直接修改用户信息、增减课程，或代替用户启动和停止任务。</p>
-            </div>
-            <div class="user-card-grid">
-                {% for user in users %}
-                    <section class="user-card">
-                        <div class="user-card-head">
-                            <div>
-                                <h3>{{ user.display_name or user.student_id }}</h3>
-                                <p>{{ user.student_id }}</p>
-                            </div>
-                            <span class="status-pill status-{{ user.latest_task.status if user.latest_task else 'idle' }}">
-                                {{ task_labels.get(user.latest_task.status, '未��动') if user.latest_task else '未启动' }}
-                            </span>
-                        </div>
-
-                        <div class="chip-row tight">
-                            <span class="chip {% if user.is_active %}highlight{% endif %}">{{ '启用中' if user.is_active else '已禁用' }}</span>
-                            <span class="chip">课程 {{ user.course_count }}</span>
-                            <span class="chip">最近任务 {{ user.latest_task.id if user.latest_task else '--' }}</span>
-                            <span class="chip">刷新 {{ user.refresh_interval_seconds or default_refresh_interval_seconds }} 秒</span>
-                            <span class="chip">尝试 {{ user.latest_task.total_attempts if user.latest_task else 0 }}</span>
-                            <span class="chip">错误 {{ user.latest_task.total_errors if user.latest_task else 0 }}</span>
-                        </div>
-
-                        <form method="post" action="{{ url_for('update_user', user_id=user.id) }}" class="form-grid form-grid-compact slim-form">
-                            <label class="field span-2">
-                                <span>显示名称</span>
-                                <input type="text" name="display_name" value="{{ user.display_name }}" placeholder="备注名称">
-                            </label>
-                            <label class="field">
-                                <span>刷新间隔</span>
-                                <input type="number" name="refresh_interval_seconds" min="{{ refresh_interval_min }}" max="{{ refresh_interval_max }}" value="{{ user.refresh_interval_seconds or default_refresh_interval_seconds }}" required>
-                            </label>
-                            <label class="field span-2">
-                                <span>重置密码</span>
-                                <input type="password" name="password" placeholder="留空表示不修改">
-                            </label>
-                            <button type="submit" class="btn btn-ghost">保存用户</button>
-                        </form>
-
-                        <div class="button-row wrap-row">
-                            <form method="post" action="{{ url_for('toggle_user', user_id=user.id) }}">
-                                <button type="submit" class="btn btn-ghost {% if not user.is_active %}danger{% endif %}">{{ '禁用' if user.is_active else '启用' }}</button>
-                            </form>
-                            <form method="post" action="{{ url_for('admin_start_user_task', user_id=user.id) }}">
-                                <button type="submit" class="btn btn-primary">代启动任务</button>
-                            </form>
-                            <form method="post" action="{{ url_for('admin_stop_user_task', user_id=user.id) }}">
-                                <button type="submit" class="btn btn-ghost danger">代停止任务</button>
-                            </form>
-                        </div>
-
-                        <form method="post" action="{{ url_for('admin_add_course', user_id=user.id) }}" class="form-grid form-grid-compact slim-form">
-                            <label class="field">
-                                <span>类型</span>
-                                <select name="category">
-                                    <option value="free">自由选课</option>
-                                    <option value="plan">方案选课</option>
-                                </select>
-                            </label>
-                            <label class="field">
-                                <span>课程号</span>
-                                <input type="text" name="course_id" placeholder="例如 888005010A59" autocapitalize="characters" required>
-                            </label>
-                            <label class="field">
-                                <span>课序号</span>
-                                <input type="text" name="course_index" placeholder="例如 01 或 666" autocapitalize="characters" required>
-                            </label>
-                            <button type="submit" class="btn btn-secondary">为该用户加课</button>
-                        </form>
-
-                        <div class="course-list">
-                            {% if user.courses %}
-                                {% for course in user.courses %}
-                                    <div class="course-chip-row">
-                                        <span>{{ category_labels.get(course.category, course.category) }} · {{ course.course_id }}_{{ course.course_index }}</span>
-                                        <form method="post" action="{{ url_for('admin_delete_course', course_target_id=course.id) }}">
-                                            <button type="submit" class="inline-action">删除</button>
-                                        </form>
-                                    </div>
-                                {% endfor %}
-                            {% else %}
-                                <div class="empty-mini">当前没有课程目标。</div>
-                            {% endif %}
-                        </div>
-                    </section>
-                {% else %}
-                    <div class="empty-state-card">
-                        还没有录入任何用户，请先通过上方表单创建。
-                    </div>
-                {% endfor %}
-            </div>
-        </article>
-    </section>
-</section>
+{% extends "base.html" %}
+{% block title %}管理后台 | SCU 选课控制台{% endblock %}
+{% block body_class %}admin-theme{% endblock %}
+{% block content %}
+<section class="dashboard-shell admin-dashboard" data-log-stream-url="{{ url_for('stream_admin_logs', last_id=recent_logs[-1].id if recent_logs else 0) }}" data-status-url="{{ url_for('admin_status') }}">
+    <header class="topbar reveal-up">
+        <div>
+            <span class="eyebrow">Admin Console</span>
+            <h1>管理员后台</h1>
+            <p>当前管理员：{{ admin_identity.username }}{% if is_super_admin %} · 超级管理员{% endif %}</p>
+        </div>
+        <form method="post" action="{{ url_for('admin_logout') }}">
+            <button type="submit" class="btn btn-ghost">退出后台</button>
+        </form>
+    </header>
+
+    <section class="metric-grid reveal-up delay-1">
+        <article class="metric-card">
+            <span>用户数</span>
+            <strong id="stat-users">{{ stats.users_count }}</strong>
+            <small>已录入的学生账号</small>
+        </article>
+        <article class="metric-card">
+            <span>运行中任务</span>
+            <strong id="stat-running">{{ stats.running_count }}</strong>
+            <small>排队中：<span id="stat-pending">{{ stats.pending_count }}</span></small>
+        </article>
+        <article class="metric-card">
+            <span>总课程目标</span>
+            <strong>{{ stats.courses_count }}</strong>
+            <small>管理员可见全部课程号与课序号</small>
+        </article>
+        <article class="metric-card">
+            <span>有效定时任务</span>
+            <strong>{{ stats.active_schedule_count }}</strong>
+            <small>管理员配置的每日自动启动与停止</small>
+        </article>
+        <article class="metric-card">
+            <span>注册码总数</span>
+            <strong>{{ stats.registration_code_count }}</strong>
+            <small>支持用户按注册码自助注册</small>
+        </article>
+    </section>
+
+    <section class="content-grid admin-grid">
+        <article class="card reveal-up delay-2">
+            <div class="card-head">
+                <span class="kicker">调度设置</span>
+                <h2>并行数</h2>
+                <p>默认并行数已调整为 4，建议根据 Hugging Face Space 的资源情况适当调节。</p>
+            </div>
+            <form method="post" action="{{ url_for('update_parallel_limit') }}" class="form-grid form-grid-compact">
+                <label class="field">
+                    <span>当前并行数</span>
+                    <input type="number" id="parallel-limit-input" name="parallel_limit" min="1" max="8" value="{{ parallel_limit }}" required>
+                </label>
+                <button type="submit" class="btn btn-primary">更新并行数</button>
+            </form>
+        </article>
+
+        <article class="card reveal-up delay-2">
+            <div class="card-head">
+                <span class="kicker">新增用户</span>
+                <h2>手动录入用户信息</h2>
+                <p>管理员可以直接录入学生账号，也可以只发注册码让学生自行注册。</p>
+            </div>
+            <form method="post" action="{{ url_for('create_user') }}" class="form-grid form-grid-compact">
+                <label class="field">
+                    <span>学号</span>
+                    <input type="text" name="student_id" inputmode="numeric" placeholder="13 位学号" required>
+                </label>
+                <label class="field">
+                    <span>显示名称</span>
+                    <input type="text" name="display_name" placeholder="可选备注">
+                </label>
+                <label class="field">
+                    <span>刷新间隔</span>
+                    <input type="number" name="refresh_interval_seconds" min="{{ refresh_interval_min }}" max="{{ refresh_interval_max }}" value="{{ default_refresh_interval_seconds }}" required>
+                </label>
+                <label class="field span-2">
+                    <span>密码</span>
+                    <input type="password" name="password" placeholder="教务处密码" required>
+                </label>
+                <button type="submit" class="btn btn-secondary">创建用户</button>
+            </form>
+        </article>
+
+        <article class="card reveal-up delay-2">
+            <div class="card-head">
+                <span class="kicker">注册码</span>
+                <h2>创建注册码</h2>
+                <p>学生拿到注册码后即可在 <code>/register</code> 页面使用学号和教务处密码完成注册。</p>
+            </div>
+            <form method="post" action="{{ url_for('create_registration_code') }}" class="form-grid form-grid-compact">
+                <label class="field span-2">
+                    <span>备注</span>
+                    <input type="text" name="note" placeholder="例如 2025 春季新用户批次">
+                </label>
+                <label class="field">
+                    <span>可用次数</span>
+                    <input type="number" name="max_uses" min="1" max="99" value="{{ default_registration_code_max_uses }}" required>
+                </label>
+                <button type="submit" class="btn btn-secondary">生成注册码</button>
+            </form>
+        </article>
+
+        {% if is_super_admin %}
+        <article class="card reveal-up delay-2">
+            <div class="card-head">
+                <span class="kicker">管理员管理</span>
+                <h2>新增管理员</h2>
+                <p>只有超级管理员可以继续创建普通管理员。</p>
+            </div>
+            <form method="post" action="{{ url_for('create_admin') }}" class="form-grid form-grid-compact">
+                <label class="field">
+                    <span>管理员账号</span>
+                    <input type="text" name="username" placeholder="输入管理员账号" required>
+                </label>
+                <label class="field">
+                    <span>管理员密码</span>
+                    <input type="password" name="password" placeholder="输入管理员密码" required>
+                </label>
+                <button type="submit" class="btn btn-ghost">创建管理员</button>
+            </form>
+            <div class="chip-row">
+                <span class="chip highlight">超级管理员：{{ admin_identity.username }}</span>
+                {% for admin in admins %}
+                    <span class="chip">{{ admin.username }}</span>
+                {% endfor %}
+            </div>
+        </article>
+        {% endif %}
+
+        <article class="card reveal-up delay-3 span-2">
+            <div class="card-head split">
+                <div>
+                    <span class="kicker">任务总览</span>
+                    <h2>最近任务</h2>
+                    <p>用于快速确认任务是否正在排队、执行、停止或失败。</p>
+                </div>
+                <span class="status-pill status-running">实时刷新</span>
+            </div>
+            <div class="course-table-wrap">
+                <table class="data-table">
+                    <thead>
+                        <tr>
+                            <th>任务</th>
+                            <th>学号</th>
+                            <th>状态</th>
+                            <th>尝试</th>
+                            <th>错误</th>
+                            <th>刷新间隔</th>
+                            <th>触发者</th>
+                            <th>更新时间</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% if recent_tasks %}
+                            {% for task in recent_tasks %}
+                                <tr>
+                                    <td>#{{ task.id }}</td>
+                                    <td>{{ task.student_id }}</td>
+                                    <td><span class="status-pill status-{{ task.status }}">{{ task_labels.get(task.status, task.status) }}</span></td>
+                                    <td>{{ task.total_attempts }}</td>
+                                    <td>{{ task.total_errors }}</td>
+                                    <td>{{ task.refresh_interval_seconds or default_refresh_interval_seconds }} 秒</td>
+                                    <td>{{ task.requested_by_role }}:{{ task.requested_by }}</td>
+                                    <td>{{ task.updated_at }}</td>
+                                </tr>
+                            {% endfor %}
+                        {% else %}
+                            <tr>
+                                <td colspan="8" class="empty-cell">还没有任务记录。</td>
+                            </tr>
+                        {% endif %}
+                    </tbody>
+                </table>
+            </div>
+        </article>
+
+        <article class="card reveal-up delay-3 span-2">
+            <div class="card-head split">
+                <div>
+                    <span class="kicker">注册码清单</span>
+                    <h2>注册码状态</h2>
+                    <p>可以查看注册码是否启用、可用次数、已用次数以及最近一次使用情况。</p>
+                </div>
+            </div>
+            <div class="course-table-wrap">
+                <table class="data-table">
+                    <thead>
+                        <tr>
+                            <th>注册码</th>
+                            <th>备注</th>
+                            <th>状态</th>
+                            <th>使用</th>
+                            <th>最近使用者</th>
+                            <th>操作</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {% if registration_codes %}
+                            {% for code in registration_codes %}
+                                <tr>
+                                    <td><code>{{ code.code }}</code></td>
+                                    <td>{{ code.note or '无' }}</td>
+                                    <td>{{ '启用' if code.is_active else '停用' }}</td>
+                                    <td>{{ code.used_count }}/{{ code.max_uses }}</td>
+                                    <td>{{ code.used_by_student_id or '暂无' }}</td>
+                                    <td>
+                                        <form method="post" action="{{ url_for('toggle_registration_code', registration_code_id=code.id) }}">
+                                            <button type="submit" class="inline-action">{{ '停用' if code.is_active else '启用' }}</button>
+                                        </form>
+                                    </td>
+                                </tr>
+                            {% endfor %}
+                        {% else %}
+                            <tr>
+                                <td colspan="6" class="empty-cell">还没有创建注册码。</td>
+                            </tr>
+                        {% endif %}
+                    </tbody>
+                </table>
+            </div>
+        </article>
+
+        <article class="card reveal-up delay-3 span-2">
+            <div class="card-head split">
+                <div>
+                    <span class="kicker">全局日志</span>
+                    <h2>所有用户的运行日志</h2>
+                    <p>日志会持续流入，便于管理员确认登录、查课、提交结果、定时启动终止与错误信息。</p>
+                </div>
+                <span class="live-dot">LIVE</span>
+            </div>
+            <div class="log-console" id="log-console">
+                {% if recent_logs %}
+                    {% for log in recent_logs %}
+                        <div class="log-line level-{{ log.level|lower }}">
+                            <span class="log-meta">{{ log.created_at }} · {{ log.student_id or 'system' }} · {{ log.scope }} · {{ log.level }}</span>
+                            <span>{{ log.message }}</span>
+                        </div>
+                    {% endfor %}
+                {% else %}
+                    <div class="log-line level-info muted">暂无日志，用户启动任务后这里会自动刷新。</div>
+                {% endif %}
+            </div>
+        </article>
+
+        <article class="card reveal-up delay-4 span-2">
+            <div class="card-head">
+                <span class="kicker">用户管理</span>
+                <h2>所有用户与课程详情</h2>
+                <p>可以直接修改用户信息、配置定时任务、增减课程，或代替用户启动和停止任务。</p>
+            </div>
+            <div class="user-card-grid">
+                {% for user in users %}
+                    <section class="user-card">
+                        <div class="user-card-head">
+                            <div>
+                                <h3>{{ user.display_name or user.student_id }}</h3>
+                                <p>{{ user.student_id }}</p>
+                            </div>
+                            <span class="status-pill status-{{ user.latest_task.status if user.latest_task else 'idle' }}">
+                                {{ task_labels.get(user.latest_task.status, '未启动') if user.latest_task else '未启动' }}
+                            </span>
+                        </div>
+
+                        <div class="chip-row tight">
+                            <span class="chip {% if user.is_active %}highlight{% endif %}">{{ '启用中' if user.is_active else '已禁用' }}</span>
+                            <span class="chip">课程 {{ user.course_count }}</span>
+                            <span class="chip">最近任务 {{ user.latest_task.id if user.latest_task else '--' }}</span>
+                            <span class="chip">刷新 {{ user.refresh_interval_seconds or default_refresh_interval_seconds }} 秒</span>
+                            <span class="chip">尝试 {{ user.latest_task.total_attempts if user.latest_task else 0 }}</span>
+                            <span class="chip">错误 {{ user.latest_task.total_errors if user.latest_task else 0 }}</span>
+                            <span class="chip">定时 {{ '开启' if user.schedule and user.schedule.is_enabled else '关闭' }}</span>
+                        </div>
+
+                        <form method="post" action="{{ url_for('update_user', user_id=user.id) }}" class="form-grid form-grid-compact slim-form">
+                            <label class="field span-2">
+                                <span>显示名称</span>
+                                <input type="text" name="display_name" value="{{ user.display_name }}" placeholder="备注名称">
+                            </label>
+                            <label class="field">
+                                <span>刷新间隔</span>
+                                <input type="number" name="refresh_interval_seconds" min="{{ refresh_interval_min }}" max="{{ refresh_interval_max }}" value="{{ user.refresh_interval_seconds or default_refresh_interval_seconds }}" required>
+                            </label>
+                            <label class="field span-2">
+                                <span>重置密码</span>
+                                <input type="password" name="password" placeholder="留空表示不修改">
+                            </label>
+                            <button type="submit" class="btn btn-ghost">保存用户</button>
+                        </form>
+
+                        <form method="post" action="{{ url_for('update_user_schedule', user_id=user.id) }}" class="form-grid form-grid-compact slim-form">
+                            <label class="field">
+                                <span>启用定时</span>
+                                <input type="checkbox" name="schedule_enabled" value="1" {% if user.schedule and user.schedule.is_enabled %}checked{% endif %}>
+                            </label>
+                            <label class="field">
+                                <span>开始日期</span>
+                                <input type="date" name="start_date" value="{{ user.schedule.start_date if user.schedule else '' }}">
+                            </label>
+                            <label class="field">
+                                <span>结束日期</span>
+                                <input type="date" name="end_date" value="{{ user.schedule.end_date if user.schedule else '' }}">
+                            </label>
+                            <label class="field">
+                                <span>每日启动</span>
+                                <input type="time" name="daily_start_time" value="{{ user.schedule.daily_start_time if user.schedule else '' }}">
+                            </label>
+                            <label class="field">
+                                <span>每日停止</span>
+                                <input type="time" name="daily_stop_time" value="{{ user.schedule.daily_stop_time if user.schedule else '' }}">
+                            </label>
+                            <button type="submit" class="btn btn-secondary">保存定时设置</button>
+                        </form>
+
+                        <div class="button-row wrap-row">
+                            <form method="post" action="{{ url_for('toggle_user', user_id=user.id) }}">
+                                <button type="submit" class="btn btn-ghost {% if not user.is_active %}danger{% endif %}">{{ '禁用' if user.is_active else '启用' }}</button>
+                            </form>
+                            <form method="post" action="{{ url_for('admin_start_user_task', user_id=user.id) }}">
+                                <button type="submit" class="btn btn-primary">代启动任务</button>
+                            </form>
+                            <form method="post" action="{{ url_for('admin_stop_user_task', user_id=user.id) }}">
+                                <button type="submit" class="btn btn-ghost danger">代停止任务</button>
+                            </form>
+                            <form method="post" action="{{ url_for('delete_user_by_admin', user_id=user.id) }}">
+                                <button type="submit" class="btn btn-ghost danger">删除用户</button>
+                            </form>
+                        </div>
+
+                        <form method="post" action="{{ url_for('admin_add_course', user_id=user.id) }}" class="form-grid form-grid-compact slim-form">
+                            <label class="field">
+                                <span>类型</span>
+                                <select name="category">
+                                    <option value="free">自由选课</option>
+                                    <option value="plan">方案选课</option>
+                                </select>
+                            </label>
+                            <label class="field">
+                                <span>课程号</span>
+                                <input type="text" name="course_id" placeholder="例如 888005010A59" autocapitalize="characters" required>
+                            </label>
+                            <label class="field">
+                                <span>课序号</span>
+                                <input type="text" name="course_index" placeholder="例如 01 或 666" autocapitalize="characters" required>
+                            </label>
+                            <button type="submit" class="btn btn-secondary">为该用户加课</button>
+                        </form>
+
+                        <div class="course-list">
+                            {% if user.courses %}
+                                {% for course in user.courses %}
+                                    <div class="course-chip-row">
+                                        <span>{{ category_labels.get(course.category, course.category) }} · {{ course.course_id }}_{{ course.course_index }}</span>
+                                        <form method="post" action="{{ url_for('admin_delete_course', course_target_id=course.id) }}">
+                                            <button type="submit" class="inline-action">删除</button>
+                                        </form>
+                                    </div>
+                                {% endfor %}
+                            {% else %}
+                                <div class="empty-mini">当前没有课程目标。</div>
+                            {% endif %}
+                        </div>
+                    </section>
+                {% else %}
+                    <div class="empty-state-card">
+                        还没有录入任何用户，请先通过上方表单创建或发放注册码。
+                    </div>
+                {% endfor %}
+            </div>
+        </article>
+    </section>
+</section>
 {% endblock %}

templates/login.html

@@ -15,12 +15,12 @@
                 <span>每位用户独立队列与日志流</span>
             </article>
             <article>
-                <strong>实时可见</strong>
-                <span>浏览器执行日志会持续推送</span>
+                <strong>定时启动终止</strong>
+                <span>管理员可配置每日自动开始与停止</span>
             </article>
             <article>
-                <strong>HF Space 友好</strong>
-                <span>无头浏览器任务可直接部署</span>
+                <strong>远程持久化</strong>
+                <span>用户、课程与定时配置会保存在数据库中</span>
             </article>
         </div>
     </div>
@@ -34,16 +34,16 @@
         <form method="post" class="form-grid">
             <label class="field">
                 <span>学号</span>
-                <input type="text" name="student_id" inputmode="numeric" autocomplete="username" placeholder="例如 2023XXXXXXXXX" required>
+                <input type="text" name="student_id" inputmode="numeric" autocomplete="username" placeholder="例如 2025XXXXXXXXX" required>
             </label>
             <label class="field">
                 <span>密码</span>
-                <input type="password" name="password" autocomplete="current-password" placeholder="输入教务系统密码" required>
+                <input type="password" name="password" autocomplete="current-password" placeholder="输入教务处密码" required>
             </label>
             <button type="submit" class="btn btn-primary btn-lg">进入用户控制台</button>
         </form>
         <div class="auth-footnote">
-            管理员可以在后台手动录入用户信息，普通用户登录后只会看到自己的课程数据与日志。
+            如果你已经拿到注册码，请先前往 <a href="{{ url_for('register') }}">用户注册</a>，注册时请使用学号和教务处密码。
         </div>
     </div>
 </section>

templates/register.html

@@ -0,0 +1,58 @@
+{% extends "base.html" %}
+{% block title %}用户注册 | SCU 选课控制台{% endblock %}
+{% block body_class %}auth-body{% endblock %}
+{% block content %}
+<section class="auth-layout">
+    <div class="hero-panel reveal-up">
+        <span class="eyebrow">Registration</span>
+        <h1>使用注册码创建你的抢课账号。</h1>
+        <p>
+            注册成功后，后续就可以直接使用学号和教务处密码登录，不需要重复输入注册码。
+        </p>
+        <div class="hero-metrics">
+            <article>
+                <strong>注册码校验</strong>
+                <span>注册码由管理员在后台创建和管理</span>
+            </article>
+            <article>
+                <strong>使用学号注册</strong>
+                <span>请填写你的学号和教务处密码</span>
+            </article>
+            <article>
+                <strong>自动进入用户体系</strong>
+                <span>注册后即可管理课程目标与查看日志</span>
+            </article>
+        </div>
+    </div>
+
+    <div class="auth-card reveal-up delay-1">
+        <div class="card-head compact">
+            <span class="kicker">学生注册</span>
+            <h2>注册新账号</h2>
+            <p>请使用管理员发放的注册码，并填写学号与教务处密码。</p>
+        </div>
+        <form method="post" class="form-grid">
+            <label class="field">
+                <span>注册码</span>
+                <input type="text" name="registration_code" placeholder="例如 SACC-AB12CD34" autocapitalize="characters" required>
+            </label>
+            <label class="field">
+                <span>显示名称</span>
+                <input type="text" name="display_name" placeholder="可选昵称或备注">
+            </label>
+            <label class="field">
+                <span>学号</span>
+                <input type="text" name="student_id" inputmode="numeric" placeholder="请输入学号" required>
+            </label>
+            <label class="field">
+                <span>教务处密码</span>
+                <input type="password" name="password" placeholder="请输入教务处密码" required>
+            </label>
+            <button type="submit" class="btn btn-primary btn-lg">完成注册</button>
+        </form>
+        <div class="auth-footnote">
+            已有账号？直接返回 <a href="{{ url_for('login') }}">用户登录</a>。
+        </div>
+    </div>
+</section>
+{% endblock %}