Upload 51 files

.dockerignore

@@ -0,0 +1,10 @@
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.env
+.env.*
+data/submissions/
+.git/
+.gitignore
+.vscode/

.env.example

@@ -0,0 +1,11 @@
+ADMIN=superadmin
+PASSWORD=change-me-now
+SQL_PASSWORD=your_mysql_password
+SESSION_SECRET=replace_with_a_long_random_secret
+SQL_USER=avnadmin
+SQL_HOST=mysql-2bace9cd-cacode.i.aivencloud.com
+SQL_PORT=21260
+SQL_DATABASE=CAM
+MYSQL_CA_FILE=ca.pem
+APP_TIMEZONE=Asia/Shanghai
+UPLOAD_ROOT=data/submissions

.gitignore

@@ -0,0 +1,5 @@
+__pycache__/
+*.py[cod]
+.env
+.env.*
+data/submissions/

Dockerfile

@@ -0,0 +1,22 @@
+FROM python:3.11-slim
+
+RUN useradd -m -u 1000 user
+
+USER user
+ENV HOME=/home/user \
+    PATH=/home/user/.local/bin:$PATH \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1
+
+WORKDIR $HOME/app
+
+COPY --chown=user requirements.txt $HOME/app/requirements.txt
+RUN pip install --no-cache-dir --upgrade pip && pip install --no-cache-dir --user -r $HOME/app/requirements.txt
+
+COPY --chown=user . $HOME/app
+RUN mkdir -p $HOME/app/data/submissions
+
+EXPOSE 7860
+
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]

app/__init__.py

@@ -0,0 +1 @@
+"""Spring Check-In Activity Manager package."""

app/auth.py

@@ -0,0 +1,36 @@
+from __future__ import annotations
+
+from typing import Optional
+
+from fastapi import Request
+from sqlalchemy.orm import Session
+
+from app.models import Admin, User
+
+
+def get_current_user(request: Request, db: Session) -> Optional[User]:
+    user_id = request.session.get("user_id")
+    if not user_id:
+        return None
+    return db.get(User, user_id)
+
+
+def get_current_admin(request: Request, db: Session) -> Optional[Admin]:
+    admin_id = request.session.get("admin_id")
+    if not admin_id:
+        return None
+    return db.get(Admin, admin_id)
+
+
+def sign_in_user(request: Request, user: User) -> None:
+    request.session.clear()
+    request.session["user_id"] = user.id
+
+
+def sign_in_admin(request: Request, admin: Admin) -> None:
+    request.session.clear()
+    request.session["admin_id"] = admin.id
+
+
+def sign_out(request: Request) -> None:
+    request.session.clear()

app/config.py

@@ -0,0 +1,51 @@
+from __future__ import annotations
+
+import os
+import secrets
+from dataclasses import dataclass
+from pathlib import Path
+from urllib.parse import quote_plus
+
+
+ROOT_DIR = Path(__file__).resolve().parent.parent
+
+
+@dataclass(slots=True)
+class Settings:
+    app_name: str = "Spring Check-In Activity Manager"
+    timezone: str = os.getenv("APP_TIMEZONE", "Asia/Shanghai")
+    session_secret: str = os.getenv("SESSION_SECRET", secrets.token_urlsafe(32))
+
+    admin_username: str = os.getenv("ADMIN", "superadmin")
+    admin_password: str = os.getenv("PASSWORD", "change-me-now")
+
+    mysql_user: str = os.getenv("SQL_USER", "avnadmin")
+    mysql_password: str = os.getenv("SQL_PASSWORD", "")
+    mysql_host: str = os.getenv(
+        "SQL_HOST", "mysql-2bace9cd-cacode.i.aivencloud.com"
+    )
+    mysql_port: int = int(os.getenv("SQL_PORT", "21260"))
+    mysql_db: str = os.getenv("SQL_DATABASE", "CAM")
+    mysql_ca_file: Path = ROOT_DIR / os.getenv("MYSQL_CA_FILE", "ca.pem")
+
+    upload_root: Path = ROOT_DIR / os.getenv("UPLOAD_ROOT", "data/submissions")
+
+    @property
+    def database_url(self) -> str:
+        if raw_url := os.getenv("DATABASE_URL"):
+            return raw_url
+        user = quote_plus(self.mysql_user)
+        password = quote_plus(self.mysql_password)
+        return (
+            f"mysql+pymysql://{user}:{password}@{self.mysql_host}:"
+            f"{self.mysql_port}/{self.mysql_db}"
+        )
+
+    @property
+    def database_connect_args(self) -> dict:
+        if self.mysql_ca_file.exists():
+            return {"ssl": {"ca": str(self.mysql_ca_file)}}
+        return {}
+
+
+settings = Settings()

app/database.py

@@ -0,0 +1,28 @@
+from __future__ import annotations
+
+from collections.abc import Generator
+
+from sqlalchemy import create_engine
+from sqlalchemy.orm import DeclarativeBase, sessionmaker
+
+from app.config import settings
+
+
+class Base(DeclarativeBase):
+    pass
+
+
+engine = create_engine(
+    settings.database_url,
+    pool_pre_ping=True,
+    connect_args=settings.database_connect_args,
+)
+SessionLocal = sessionmaker(bind=engine, autoflush=False, autocommit=False)
+
+
+def get_db() -> Generator:
+    db = SessionLocal()
+    try:
+        yield db
+    finally:
+        db.close()

app/main.py

@@ -0,0 +1,78 @@
+from __future__ import annotations
+
+from datetime import timedelta
+
+from fastapi import FastAPI, Request
+from fastapi.staticfiles import StaticFiles
+from starlette.middleware.sessions import SessionMiddleware
+
+from app.auth import get_current_admin, get_current_user
+from app.config import ROOT_DIR, settings
+from app.database import SessionLocal
+from app.routes import admin, auth, media, user
+from app.services.bootstrap import initialize_database, seed_super_admin
+from app.web import redirect, templates
+
+
+app = FastAPI(title=settings.app_name)
+app.add_middleware(SessionMiddleware, secret_key=settings.session_secret, same_site="lax")
+app.mount("/static", StaticFiles(directory=str(ROOT_DIR / "app" / "static")), name="static")
+
+
+@app.on_event("startup")
+def on_startup() -> None:
+    initialize_database()
+    db = SessionLocal()
+    try:
+        seed_super_admin(db)
+    finally:
+        db.close()
+
+
+@app.get("/")
+def index(request: Request):
+    db = SessionLocal()
+    try:
+        if get_current_admin(request, db):
+            return redirect("/admin/dashboard")
+        if get_current_user(request, db):
+            return redirect("/dashboard")
+    finally:
+        db.close()
+    return redirect("/login")
+
+
+@app.get("/health")
+def health():
+    return {"status": "ok"}
+
+
+app.include_router(auth.router)
+app.include_router(user.router)
+app.include_router(admin.router)
+app.include_router(media.router)
+
+
+def format_datetime(value):
+    if not value:
+        return "-"
+    return value.strftime("%Y-%m-%d %H:%M")
+
+
+def format_timedelta(value):
+    if value is None:
+        return "-"
+    if isinstance(value, int):
+        minutes = value
+    elif isinstance(value, timedelta):
+        minutes = int(value.total_seconds() // 60)
+    else:
+        return str(value)
+    hours, mins = divmod(minutes, 60)
+    if hours:
+        return f"{hours}小时 {mins}分钟"
+    return f"{mins}分钟"
+
+
+templates.env.filters["datetime_local"] = format_datetime
+templates.env.filters["duration_human"] = format_timedelta

app/models.py

@@ -0,0 +1,128 @@
+from __future__ import annotations
+
+from datetime import datetime
+from typing import Optional
+
+from sqlalchemy import Boolean, DateTime, ForeignKey, Integer, String, Text, UniqueConstraint
+from sqlalchemy.dialects.mysql import LONGBLOB
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from app.database import Base
+
+
+class TimestampMixin:
+    created_at: Mapped[datetime] = mapped_column(DateTime, default=datetime.utcnow)
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime, default=datetime.utcnow, onupdate=datetime.utcnow
+    )
+
+
+class Admin(TimestampMixin, Base):
+    __tablename__ = "admins"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    username: Mapped[str] = mapped_column(String(80), unique=True, index=True)
+    display_name: Mapped[str] = mapped_column(String(120))
+    password_hash: Mapped[str] = mapped_column(String(255))
+    role: Mapped[str] = mapped_column(String(32), default="admin")
+    is_active: Mapped[bool] = mapped_column(Boolean, default=True)
+
+    created_activities: Mapped[list["Activity"]] = relationship(back_populates="created_by")
+    reviewed_submissions: Mapped[list["Submission"]] = relationship(
+        back_populates="reviewed_by"
+    )
+
+
+class Group(TimestampMixin, Base):
+    __tablename__ = "groups"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    name: Mapped[str] = mapped_column(String(120), unique=True)
+    max_members: Mapped[int] = mapped_column(Integer, default=6)
+
+    members: Mapped[list["User"]] = relationship(back_populates="group")
+
+
+class User(TimestampMixin, Base):
+    __tablename__ = "users"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    student_id: Mapped[str] = mapped_column(String(64), unique=True, index=True)
+    full_name: Mapped[str] = mapped_column(String(120))
+    password_hash: Mapped[str] = mapped_column(String(255))
+    is_active: Mapped[bool] = mapped_column(Boolean, default=True)
+    group_id: Mapped[Optional[int]] = mapped_column(ForeignKey("groups.id"), nullable=True)
+
+    group: Mapped[Optional["Group"]] = relationship(back_populates="members")
+    submissions: Mapped[list["Submission"]] = relationship(back_populates="user")
+
+
+class Activity(TimestampMixin, Base):
+    __tablename__ = "activities"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    title: Mapped[str] = mapped_column(String(160))
+    description: Mapped[str] = mapped_column(Text, default="")
+    start_at: Mapped[datetime] = mapped_column(DateTime)
+    deadline_at: Mapped[datetime] = mapped_column(DateTime)
+    leaderboard_visible: Mapped[bool] = mapped_column(Boolean, default=True)
+    clue_interval_minutes: Mapped[Optional[int]] = mapped_column(Integer, nullable=True)
+    created_by_id: Mapped[int] = mapped_column(ForeignKey("admins.id"))
+
+    created_by: Mapped["Admin"] = relationship(back_populates="created_activities")
+    tasks: Mapped[list["Task"]] = relationship(
+        back_populates="activity",
+        order_by="Task.display_order",
+        cascade="all, delete-orphan",
+    )
+
+
+class Task(TimestampMixin, Base):
+    __tablename__ = "tasks"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    activity_id: Mapped[int] = mapped_column(ForeignKey("activities.id"))
+    title: Mapped[str] = mapped_column(String(160))
+    description: Mapped[str] = mapped_column(Text, default="")
+    display_order: Mapped[int] = mapped_column(Integer, default=1)
+
+    image_data: Mapped[bytes] = mapped_column(LONGBLOB, deferred=True)
+    image_mime: Mapped[str] = mapped_column(String(120), default="image/jpeg")
+    image_filename: Mapped[str] = mapped_column(String(255), default="task.jpg")
+
+    clue_image_data: Mapped[Optional[bytes]] = mapped_column(LONGBLOB, deferred=True, nullable=True)
+    clue_image_mime: Mapped[Optional[str]] = mapped_column(String(120), nullable=True)
+    clue_image_filename: Mapped[Optional[str]] = mapped_column(String(255), nullable=True)
+    clue_release_at: Mapped[Optional[datetime]] = mapped_column(DateTime, nullable=True)
+
+    activity: Mapped["Activity"] = relationship(back_populates="tasks")
+    submissions: Mapped[list["Submission"]] = relationship(
+        back_populates="task", cascade="all, delete-orphan"
+    )
+
+
+class Submission(TimestampMixin, Base):
+    __tablename__ = "submissions"
+    __table_args__ = (UniqueConstraint("user_id", "task_id", name="uq_user_task_submission"),)
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    task_id: Mapped[int] = mapped_column(ForeignKey("tasks.id"))
+    user_id: Mapped[int] = mapped_column(ForeignKey("users.id"))
+
+    stored_filename: Mapped[str] = mapped_column(String(255))
+    original_filename: Mapped[str] = mapped_column(String(255))
+    file_path: Mapped[str] = mapped_column(String(600))
+    mime_type: Mapped[str] = mapped_column(String(120), default="image/jpeg")
+    file_size: Mapped[int] = mapped_column(Integer)
+
+    status: Mapped[str] = mapped_column(String(32), default="pending")
+    feedback: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
+    reviewed_by_id: Mapped[Optional[int]] = mapped_column(
+        ForeignKey("admins.id"), nullable=True
+    )
+    reviewed_at: Mapped[Optional[datetime]] = mapped_column(DateTime, nullable=True)
+    approved_at: Mapped[Optional[datetime]] = mapped_column(DateTime, nullable=True)
+
+    task: Mapped["Task"] = relationship(back_populates="submissions")
+    user: Mapped["User"] = relationship(back_populates="submissions")
+    reviewed_by: Mapped[Optional["Admin"]] = relationship(back_populates="reviewed_submissions")

app/routes/__init__.py

@@ -0,0 +1 @@
+from __future__ import annotations

app/routes/admin.py

@@ -0,0 +1,571 @@
+from __future__ import annotations
+
+import io
+import zipfile
+from datetime import datetime, timedelta
+from pathlib import Path
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi.responses import StreamingResponse
+from sqlalchemy.orm import Session, joinedload
+
+from app.database import get_db
+from app.models import Activity, Admin, Group, Submission, Task, User
+from app.security import hash_password
+from app.services.images import compress_to_limit, read_and_validate_upload
+from app.web import add_flash, local_now, redirect, render
+
+
+router = APIRouter()
+
+
+def require_admin(request: Request, db: Session) -> Admin | None:
+    admin = db.query(Admin).filter(Admin.id == (request.session.get("admin_id") or 0)).first()
+    if not admin or not admin.is_active:
+        return None
+    return admin
+
+
+def require_super_admin(request: Request, db: Session) -> Admin | None:
+    admin = require_admin(request, db)
+    if not admin or admin.role != "superadmin":
+        return None
+    return admin
+
+
+def parse_optional_group(group_id_value: str | None, db: Session) -> Group | None:
+    if not group_id_value:
+        return None
+    if not str(group_id_value).isdigit():
+        return None
+    return (
+        db.query(Group)
+        .options(joinedload(Group.members))
+        .filter(Group.id == int(group_id_value))
+        .first()
+    )
+
+
+def ensure_group_capacity(group: Group | None, current_user: User | None = None) -> None:
+    if not group:
+        return
+    current_count = len(group.members)
+    if current_user and current_user.group_id == group.id:
+        current_count -= 1
+    if current_count >= group.max_members:
+        raise ValueError(f"{group.name} 已满员，请调整人数上限或选择其他小组。")
+
+
+@router.get("/admin/dashboard")
+def admin_dashboard(request: Request, db: Session = Depends(get_db)):
+    admin = require_admin(request, db)
+    if not admin:
+        return redirect("/admin")
+
+    stats = {
+        "user_count": db.query(User).count(),
+        "group_count": db.query(Group).count(),
+        "activity_count": db.query(Activity).count(),
+        "pending_count": db.query(Submission).filter(Submission.status == "pending").count(),
+        "admin_count": db.query(Admin).count(),
+    }
+    recent_activities = (
+        db.query(Activity)
+        .options(joinedload(Activity.tasks))
+        .order_by(Activity.created_at.desc())
+        .limit(5)
+        .all()
+    )
+    return render(
+        request,
+        "admin_dashboard.html",
+        {
+            "page_title": "管理员总览",
+            "admin": admin,
+            "stats": stats,
+            "recent_activities": recent_activities,
+        },
+    )
+
+
+@router.get("/admin/users")
+def admin_users(request: Request, db: Session = Depends(get_db)):
+    admin = require_admin(request, db)
+    if not admin:
+        return redirect("/admin")
+
+    users = db.query(User).options(joinedload(User.group)).order_by(User.student_id.asc()).all()
+    groups = db.query(Group).options(joinedload(Group.members)).order_by(Group.name.asc()).all()
+    return render(
+        request,
+        "admin_users.html",
+        {"page_title": "用户管理", "admin": admin, "users": users, "groups": groups},
+    )
+
+
+@router.post("/admin/users")
+async def create_user(request: Request, db: Session = Depends(get_db)):
+    admin = require_admin(request, db)
+    if not admin:
+        return redirect("/admin")
+
+    form = await request.form()
+    student_id = str(form.get("student_id", "")).strip()
+    full_name = str(form.get("full_name", "")).strip()
+    password = str(form.get("password", "")).strip()
+    group = parse_optional_group(form.get("group_id"), db)
+
+    if not student_id or not full_name or not password:
+        add_flash(request, "error", "请完整填写学号、姓名和密码。")
+        return redirect("/admin/users")
+    if db.query(User).filter(User.student_id == student_id).first():
+        add_flash(request, "error", "该学号已存在。")
+        return redirect("/admin/users")
+
+    try:
+        ensure_group_capacity(group)
+    except ValueError as exc:
+        add_flash(request, "error", str(exc))
+        return redirect("/admin/users")
+
+    user = User(
+        student_id=student_id,
+        full_name=full_name,
+        password_hash=hash_password(password),
+        group=group,
+    )
+    db.add(user)
+    db.commit()
+    add_flash(request, "success", f"用户 {full_name} 已创建。")
+    return redirect("/admin/users")
+
+
+@router.post("/admin/users/{user_id}/group")
+async def assign_user_group(user_id: int, request: Request, db: Session = Depends(get_db)):
+    admin = require_admin(request, db)
+    if not admin:
+        return redirect("/admin")
+
+    user = db.query(User).options(joinedload(User.group)).filter(User.id == user_id).first()
+    if not user:
+        raise HTTPException(status_code=404, detail="用户不存在")
+
+    form = await request.form()
+    group = parse_optional_group(form.get("group_id"), db)
+    try:
+        ensure_group_capacity(group, current_user=user)
+    except ValueError as exc:
+        add_flash(request, "error", str(exc))
+        return redirect("/admin/users")
+
+    user.group = group
+    db.add(user)
+    db.commit()
+    add_flash(request, "success", f"已更新 {user.full_name} 的小组。")
+    return redirect("/admin/users")
+
+
+@router.get("/admin/admins")
+def admin_admins(request: Request, db: Session = Depends(get_db)):
+    admin = require_super_admin(request, db)
+    if not admin:
+        add_flash(request, "error", "只有超级管理员可以管理管理员账号。")
+        return redirect("/admin/dashboard")
+
+    admins = db.query(Admin).order_by(Admin.created_at.desc()).all()
+    return render(
+        request,
+        "admin_admins.html",
+        {"page_title": "管理员管理", "admin": admin, "admins": admins},
+    )
+
+
+@router.post("/admin/admins")
+async def create_admin(request: Request, db: Session = Depends(get_db)):
+    admin = require_super_admin(request, db)
+    if not admin:
+        add_flash(request, "error", "只有超级管理员可以新增管理员。")
+        return redirect("/admin/dashboard")
+
+    form = await request.form()
+    username = str(form.get("username", "")).strip()
+    display_name = str(form.get("display_name", "")).strip()
+    password = str(form.get("password", "")).strip()
+    role = str(form.get("role", "admin")).strip() or "admin"
+
+    if not username or not display_name or not password:
+        add_flash(request, "error", "请完整填写管理员信息。")
+        return redirect("/admin/admins")
+    if db.query(Admin).filter(Admin.username == username).first():
+        add_flash(request, "error", "管理员账号已存在。")
+        return redirect("/admin/admins")
+
+    new_admin = Admin(
+        username=username,
+        display_name=display_name,
+        password_hash=hash_password(password),
+        role="superadmin" if role == "superadmin" else "admin",
+    )
+    db.add(new_admin)
+    db.commit()
+    add_flash(request, "success", f"管理员 {display_name} 已创建。")
+    return redirect("/admin/admins")
+
+
+@router.get("/admin/groups")
+def admin_groups(request: Request, db: Session = Depends(get_db)):
+    admin = require_admin(request, db)
+    if not admin:
+        return redirect("/admin")
+
+    groups = db.query(Group).options(joinedload(Group.members)).order_by(Group.created_at.asc()).all()
+    ungrouped_users = (
+        db.query(User)
+        .filter(User.group_id.is_(None))
+        .order_by(User.student_id.asc())
+        .all()
+    )
+    return render(
+        request,
+        "admin_groups.html",
+        {
+            "page_title": "小组管理",
+            "admin": admin,
+            "groups": groups,
+            "ungrouped_users": ungrouped_users,
+        },
+    )
+
+
+@router.post("/admin/groups")
+async def create_group(request: Request, db: Session = Depends(get_db)):
+    admin = require_admin(request, db)
+    if not admin:
+        return redirect("/admin")
+
+    form = await request.form()
+    try:
+        max_members = max(1, int(str(form.get("max_members", "1"))))
+    except ValueError:
+        add_flash(request, "error", "小组人数上限需要是数字。")
+        return redirect("/admin/groups")
+
+    name = str(form.get("name", "")).strip()
+    if not name:
+        sequence = db.query(Group).count() + 1
+        name = f"第{sequence}组"
+    if db.query(Group).filter(Group.name == name).first():
+        add_flash(request, "error", "小组名称已存在。")
+        return redirect("/admin/groups")
+
+    group = Group(name=name, max_members=max_members)
+    db.add(group)
+    db.commit()
+    add_flash(request, "success", f"小组 {name} 已创建。")
+    return redirect("/admin/groups")
+
+
+@router.post("/admin/groups/{group_id}/capacity")
+async def update_group_capacity(group_id: int, request: Request, db: Session = Depends(get_db)):
+    admin = require_admin(request, db)
+    if not admin:
+        return redirect("/admin")
+
+    group = db.query(Group).options(joinedload(Group.members)).filter(Group.id == group_id).first()
+    if not group:
+        raise HTTPException(status_code=404, detail="小组不存在")
+
+    form = await request.form()
+    try:
+        max_members = max(1, int(str(form.get("max_members", group.max_members))))
+    except ValueError:
+        add_flash(request, "error", "小组人数上限需要是数字。")
+        return redirect("/admin/groups")
+
+    if max_members < len(group.members):
+        add_flash(request, "error", "人数上限不能小于当前成员数。")
+        return redirect("/admin/groups")
+
+    group.max_members = max_members
+    db.add(group)
+    db.commit()
+    add_flash(request, "success", f"{group.name} 的人数上限已更新。")
+    return redirect("/admin/groups")
+
+
+@router.get("/admin/activities")
+def admin_activities(request: Request, db: Session = Depends(get_db)):
+    admin = require_admin(request, db)
+    if not admin:
+        return redirect("/admin")
+
+    activities = (
+        db.query(Activity)
+        .options(joinedload(Activity.tasks), joinedload(Activity.created_by))
+        .order_by(Activity.start_at.desc())
+        .all()
+    )
+    return render(
+        request,
+        "admin_activities.html",
+        {"page_title": "活动发布", "admin": admin, "activities": activities},
+    )
+
+
+@router.post("/admin/activities")
+async def create_activity(request: Request, db: Session = Depends(get_db)):
+    admin = require_admin(request, db)
+    if not admin:
+        return redirect("/admin")
+
+    form = await request.form()
+    title = str(form.get("title", "")).strip()
+    description = str(form.get("description", "")).strip()
+    start_raw = str(form.get("start_at", "")).strip()
+    deadline_raw = str(form.get("deadline_at", "")).strip()
+    clue_interval_raw = str(form.get("clue_interval_minutes", "")).strip()
+    leaderboard_visible = form.get("leaderboard_visible") == "on"
+
+    if not title or not start_raw or not deadline_raw:
+        add_flash(request, "error", "请完整填写活动标题、开始时间和截止时间。")
+        return redirect("/admin/activities")
+
+    try:
+        start_at = datetime.fromisoformat(start_raw)
+        deadline_at = datetime.fromisoformat(deadline_raw)
+    except ValueError:
+        add_flash(request, "error", "时间格式不正确。")
+        return redirect("/admin/activities")
+
+    if deadline_at <= start_at:
+        add_flash(request, "error", "截止时间必须晚于开始时间。")
+        return redirect("/admin/activities")
+
+    try:
+        clue_interval_minutes = int(clue_interval_raw) if clue_interval_raw else None
+    except ValueError:
+        add_flash(request, "error", "线索发布时间间隔必须是数字。")
+        return redirect("/admin/activities")
+
+    task_titles = form.getlist("task_title")
+    task_descriptions = form.getlist("task_description")
+    task_images = form.getlist("task_image")
+    task_clue_images = form.getlist("task_clue_image")
+
+    tasks_payload = []
+    for index, raw_title in enumerate(task_titles):
+        task_title = str(raw_title).strip()
+        task_description = str(task_descriptions[index]).strip() if index < len(task_descriptions) else ""
+        primary_upload = task_images[index] if index < len(task_images) else None
+        clue_upload = task_clue_images[index] if index < len(task_clue_images) else None
+
+        if not task_title and (not primary_upload or not getattr(primary_upload, "filename", "")):
+            continue
+        if not task_title or not primary_upload or not getattr(primary_upload, "filename", ""):
+            add_flash(request, "error", f"第 {index + 1} 个任务需要完整填写标题并上传主图。")
+            return redirect("/admin/activities")
+
+        try:
+            primary_raw = await read_and_validate_upload(primary_upload)
+            primary_bytes, primary_mime = compress_to_limit(primary_raw, 200 * 1024)
+            clue_bytes = None
+            clue_mime = None
+            clue_name = None
+            if clue_upload and getattr(clue_upload, "filename", ""):
+                clue_raw = await read_and_validate_upload(clue_upload)
+                clue_bytes, clue_mime = compress_to_limit(clue_raw, 200 * 1024)
+                clue_name = clue_upload.filename
+        except ValueError as exc:
+            add_flash(request, "error", str(exc))
+            return redirect("/admin/activities")
+
+        tasks_payload.append(
+            {
+                "title": task_title,
+                "description": task_description,
+                "image_data": primary_bytes,
+                "image_mime": primary_mime,
+                "image_filename": primary_upload.filename,
+                "clue_image_data": clue_bytes,
+                "clue_image_mime": clue_mime,
+                "clue_image_filename": clue_name,
+            }
+        )
+
+    if not tasks_payload:
+        add_flash(request, "error", "至少需要添加一个任务卡片。")
+        return redirect("/admin/activities")
+
+    activity = Activity(
+        title=title,
+        description=description,
+        start_at=start_at,
+        deadline_at=deadline_at,
+        leaderboard_visible=leaderboard_visible,
+        clue_interval_minutes=clue_interval_minutes,
+        created_by_id=admin.id,
+    )
+    db.add(activity)
+    db.flush()
+
+    for index, payload in enumerate(tasks_payload, start=1):
+        release_at = None
+        if payload["clue_image_data"]:
+            if clue_interval_minutes and clue_interval_minutes > 0:
+                release_at = start_at + timedelta(minutes=clue_interval_minutes * index)
+            else:
+                release_at = start_at
+
+        db.add(
+            Task(
+                activity_id=activity.id,
+                title=payload["title"],
+                description=payload["description"],
+                display_order=index,
+                image_data=payload["image_data"],
+                image_mime=payload["image_mime"],
+                image_filename=payload["image_filename"],
+                clue_image_data=payload["clue_image_data"],
+                clue_image_mime=payload["clue_image_mime"],
+                clue_image_filename=payload["clue_image_filename"],
+                clue_release_at=release_at,
+            )
+        )
+
+    db.commit()
+    add_flash(request, "success", f"活动 {title} 已发布。")
+    return redirect("/admin/activities")
+
+
+@router.post("/admin/activities/{activity_id}/visibility")
+async def update_leaderboard_visibility(
+    activity_id: int, request: Request, db: Session = Depends(get_db)
+):
+    admin = require_admin(request, db)
+    if not admin:
+        return redirect("/admin")
+
+    activity = db.get(Activity, activity_id)
+    if not activity:
+        raise HTTPException(status_code=404, detail="活动不存在")
+
+    form = await request.form()
+    activity.leaderboard_visible = form.get("leaderboard_visible") == "on"
+    db.add(activity)
+    db.commit()
+    add_flash(request, "success", f"已更新 {activity.title} 的排行榜可见性。")
+    return redirect("/admin/activities")
+
+
+@router.get("/admin/reviews")
+def admin_reviews(request: Request, db: Session = Depends(get_db)):
+    admin = require_admin(request, db)
+    if not admin:
+        return redirect("/admin")
+
+    status_filter = request.query_params.get("status", "pending")
+    activity_filter = request.query_params.get("activity_id", "")
+
+    query = (
+        db.query(Submission)
+        .options(
+            joinedload(Submission.user),
+            joinedload(Submission.task).joinedload(Task.activity),
+            joinedload(Submission.reviewed_by),
+        )
+        .order_by(Submission.created_at.desc())
+    )
+    if status_filter:
+        query = query.filter(Submission.status == status_filter)
+    if activity_filter.isdigit():
+        query = query.join(Submission.task).filter(Task.activity_id == int(activity_filter))
+
+    submissions = query.all()
+    activities = db.query(Activity).order_by(Activity.start_at.desc()).all()
+    return render(
+        request,
+        "admin_reviews.html",
+        {
+            "page_title": "审核中心",
+            "admin": admin,
+            "submissions": submissions,
+            "activities": activities,
+            "status_filter": status_filter,
+            "activity_filter": activity_filter,
+        },
+    )
+
+
+@router.post("/admin/submissions/{submission_id}/review")
+async def review_submission(submission_id: int, request: Request, db: Session = Depends(get_db)):
+    admin = require_admin(request, db)
+    if not admin:
+        return redirect("/admin")
+
+    submission = db.get(Submission, submission_id)
+    if not submission:
+        raise HTTPException(status_code=404, detail="提交记录不存在")
+
+    form = await request.form()
+    decision = str(form.get("decision", "")).strip()
+    feedback = str(form.get("feedback", "")).strip() or None
+
+    if decision not in {"approved", "rejected"}:
+        add_flash(request, "error", "审核操作无效。")
+        return redirect("/admin/reviews")
+
+    submission.status = decision
+    submission.feedback = feedback
+    submission.reviewed_by_id = admin.id
+    submission.reviewed_at = local_now()
+    submission.approved_at = submission.created_at if decision == "approved" else None
+    db.add(submission)
+    db.commit()
+
+    add_flash(request, "success", "审核结果已保存。")
+    return redirect("/admin/reviews")
+
+
+@router.post("/admin/reviews/download")
+async def download_selected_submissions(request: Request, db: Session = Depends(get_db)):
+    admin = require_admin(request, db)
+    if not admin:
+        return redirect("/admin")
+
+    form = await request.form()
+    selected_ids = [int(value) for value in form.getlist("submission_ids") if str(value).isdigit()]
+    if not selected_ids:
+        add_flash(request, "error", "请先勾选需要下载的图片。")
+        return redirect("/admin/reviews")
+
+    submissions = (
+        db.query(Submission)
+        .options(
+            joinedload(Submission.user),
+            joinedload(Submission.task).joinedload(Task.activity),
+        )
+        .filter(Submission.id.in_(selected_ids))
+        .all()
+    )
+
+    archive = io.BytesIO()
+    with zipfile.ZipFile(archive, mode="w", compression=zipfile.ZIP_DEFLATED) as zip_file:
+        for submission in submissions:
+            file_path = Path(submission.file_path)
+            if not file_path.exists():
+                continue
+            suffix = file_path.suffix or ".jpg"
+            activity_title = submission.task.activity.title.replace("/", "_")
+            task_title = submission.task.title.replace("/", "_")
+            student_id = submission.user.student_id.replace("/", "_")
+            full_name = submission.user.full_name.replace("/", "_")
+            archive_name = f"{activity_title}/{task_title}/{student_id}_{full_name}{suffix}"
+            zip_file.write(file_path, archive_name)
+
+    archive.seek(0)
+    filename = f"checkin_submissions_{local_now().strftime('%Y%m%d_%H%M%S')}.zip"
+    return StreamingResponse(
+        archive,
+        media_type="application/zip",
+        headers={"Content-Disposition": f'attachment; filename="{filename}"'},
+    )

app/routes/auth.py

@@ -0,0 +1,71 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Form, Request
+from sqlalchemy.orm import Session
+
+from app.auth import get_current_admin, get_current_user, sign_in_admin, sign_in_user, sign_out
+from app.database import get_db
+from app.models import Admin, User
+from app.security import verify_password
+from app.web import add_flash, redirect, render
+
+
+router = APIRouter()
+
+
+@router.get("/login")
+def login_page(request: Request, db: Session = Depends(get_db)):
+    if get_current_user(request, db):
+        return redirect("/dashboard")
+    return render(request, "login.html", {"page_title": "用户登录"})
+
+
+@router.post("/login")
+def login_submit(
+    request: Request,
+    student_id: str = Form(...),
+    password: str = Form(...),
+    db: Session = Depends(get_db),
+):
+    user = db.query(User).filter(User.student_id == student_id.strip()).first()
+    if not user or not user.is_active or not verify_password(password, user.password_hash):
+        add_flash(request, "error", "学号或密码错误。")
+        return redirect("/login")
+    sign_in_user(request, user)
+    add_flash(request, "success", f"欢迎回来，{user.full_name}。")
+    return redirect("/dashboard")
+
+
+@router.get("/logout")
+def user_logout(request: Request):
+    sign_out(request)
+    return redirect("/login")
+
+
+@router.get("/admin")
+def admin_login_page(request: Request, db: Session = Depends(get_db)):
+    if get_current_admin(request, db):
+        return redirect("/admin/dashboard")
+    return render(request, "admin_login.html", {"page_title": "管理员登录"})
+
+
+@router.post("/admin")
+def admin_login_submit(
+    request: Request,
+    username: str = Form(...),
+    password: str = Form(...),
+    db: Session = Depends(get_db),
+):
+    admin = db.query(Admin).filter(Admin.username == username.strip()).first()
+    if not admin or not admin.is_active or not verify_password(password, admin.password_hash):
+        add_flash(request, "error", "管理员账号或密码错误。")
+        return redirect("/admin")
+    sign_in_admin(request, admin)
+    add_flash(request, "success", f"管理员 {admin.display_name} 已登录。")
+    return redirect("/admin/dashboard")
+
+
+@router.get("/admin/logout")
+def admin_logout(request: Request):
+    sign_out(request)
+    return redirect("/admin")

app/routes/media.py

@@ -0,0 +1,70 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+from fastapi import APIRouter, Depends, HTTPException, Request, Response
+from fastapi.responses import FileResponse
+from sqlalchemy.orm import Session, joinedload
+
+from app.auth import get_current_admin, get_current_user
+from app.database import get_db
+from app.models import Submission, Task
+from app.web import local_now
+
+
+router = APIRouter()
+
+
+@router.get("/media/tasks/{task_id}/image")
+def task_image(task_id: int, request: Request, db: Session = Depends(get_db)):
+    if not get_current_user(request, db) and not get_current_admin(request, db):
+        raise HTTPException(status_code=401, detail="Unauthorized")
+
+    task = db.get(Task, task_id)
+    if not task or not task.image_data:
+        raise HTTPException(status_code=404, detail="Image not found")
+    return Response(content=task.image_data, media_type=task.image_mime)
+
+
+@router.get("/media/tasks/{task_id}/clue")
+def task_clue(task_id: int, request: Request, db: Session = Depends(get_db)):
+    admin = get_current_admin(request, db)
+    user = get_current_user(request, db)
+    if not admin and not user:
+        raise HTTPException(status_code=401, detail="Unauthorized")
+
+    task = db.get(Task, task_id)
+    if not task or not task.clue_image_data:
+        raise HTTPException(status_code=404, detail="Clue image not found")
+    if not admin and (not task.clue_release_at or local_now() < task.clue_release_at):
+        raise HTTPException(status_code=403, detail="Clue not released")
+    return Response(content=task.clue_image_data, media_type=task.clue_image_mime)
+
+
+@router.get("/media/submissions/{submission_id}")
+def submission_image(submission_id: int, request: Request, db: Session = Depends(get_db)):
+    admin = get_current_admin(request, db)
+    submission = (
+        db.query(Submission)
+        .options(joinedload(Submission.user), joinedload(Submission.task))
+        .filter(Submission.id == submission_id)
+        .first()
+    )
+    if not submission:
+        raise HTTPException(status_code=404, detail="Submission not found")
+
+    user = get_current_user(request, db)
+    if not admin and (not user or user.id != submission.user_id):
+        raise HTTPException(status_code=403, detail="Forbidden")
+
+    file_path = Path(submission.file_path)
+    if not file_path.exists():
+        raise HTTPException(status_code=404, detail="Stored file missing")
+
+    if request.query_params.get("download") == "1":
+        return FileResponse(
+            file_path,
+            media_type=submission.mime_type,
+            filename=submission.original_filename,
+        )
+    return Response(content=file_path.read_bytes(), media_type=submission.mime_type)

app/routes/user.py

@@ -0,0 +1,219 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+from fastapi import APIRouter, Depends, File, HTTPException, Request, UploadFile
+from fastapi.responses import JSONResponse
+from sqlalchemy.orm import Session, joinedload
+
+from app.auth import get_current_user
+from app.config import settings
+from app.database import get_db
+from app.models import Activity, Submission, Task, User
+from app.services.images import compress_to_limit, persist_submission_image, read_and_validate_upload
+from app.services.leaderboard import build_leaderboard
+from app.web import add_flash, local_now, redirect, render
+
+
+router = APIRouter()
+
+
+def require_user(request: Request, db: Session) -> User | None:
+    user = (
+        db.query(User)
+        .options(joinedload(User.group), joinedload(User.submissions))
+        .filter(User.id == (request.session.get("user_id") or 0))
+        .first()
+    )
+    if not user or not user.is_active:
+        return None
+    return user
+
+
+@router.get("/dashboard")
+def dashboard(request: Request, db: Session = Depends(get_db)):
+    user = require_user(request, db)
+    if not user:
+        return redirect("/login")
+
+    activities = db.query(Activity).options(joinedload(Activity.tasks)).order_by(Activity.start_at.asc()).all()
+    submission_by_task = {submission.task_id: submission for submission in user.submissions}
+
+    activity_cards = []
+    now = local_now()
+    for activity in activities:
+        total_tasks = len(activity.tasks)
+        approved_count = sum(
+            1
+            for task in activity.tasks
+            if submission_by_task.get(task.id)
+            and submission_by_task[task.id].status == "approved"
+        )
+        pending_count = sum(
+            1
+            for task in activity.tasks
+            if submission_by_task.get(task.id)
+            and submission_by_task[task.id].status == "pending"
+        )
+        activity_cards.append(
+            {
+                "activity": activity,
+                "total_tasks": total_tasks,
+                "approved_count": approved_count,
+                "pending_count": pending_count,
+                "is_active": activity.start_at <= now <= activity.deadline_at,
+                "is_overdue": now > activity.deadline_at,
+            }
+        )
+
+    return render(
+        request,
+        "dashboard.html",
+        {
+            "page_title": "春日打卡",
+            "user": user,
+            "activity_cards": activity_cards,
+        },
+    )
+
+
+@router.get("/activities/{activity_id}")
+def activity_detail(activity_id: int, request: Request, db: Session = Depends(get_db)):
+    user = require_user(request, db)
+    if not user:
+        return redirect("/login")
+
+    activity = (
+        db.query(Activity)
+        .options(joinedload(Activity.tasks).joinedload(Task.submissions))
+        .filter(Activity.id == activity_id)
+        .first()
+    )
+    if not activity:
+        raise HTTPException(status_code=404, detail="活动不存在")
+
+    submission_by_task = {}
+    for task in activity.tasks:
+        for submission in task.submissions:
+            if submission.user_id == user.id:
+                submission_by_task[task.id] = submission
+                break
+
+    now = local_now()
+    leaderboard = build_leaderboard(db, activity.id) if activity.leaderboard_visible else []
+    clue_states = {
+        task.id: bool(task.clue_image_filename and task.clue_release_at and now >= task.clue_release_at)
+        for task in activity.tasks
+    }
+
+    return render(
+        request,
+        "activity_detail.html",
+        {
+            "page_title": activity.title,
+            "user": user,
+            "activity": activity,
+            "submission_by_task": submission_by_task,
+            "leaderboard": leaderboard,
+            "clue_states": clue_states,
+            "now": now,
+        },
+    )
+
+
+@router.post("/activities/{activity_id}/tasks/{task_id}/submit")
+async def submit_task(
+    activity_id: int,
+    task_id: int,
+    request: Request,
+    photo: UploadFile = File(...),
+    db: Session = Depends(get_db),
+):
+    user = require_user(request, db)
+    if not user:
+        return redirect("/login")
+
+    activity = db.query(Activity).filter(Activity.id == activity_id).first()
+    task = db.query(Task).filter(Task.id == task_id, Task.activity_id == activity_id).first()
+    if not activity or not task:
+        raise HTTPException(status_code=404, detail="任务不存在")
+
+    now = local_now()
+    if now < activity.start_at:
+        add_flash(request, "error", "活动尚未开始，暂时不能提交。")
+        return redirect(f"/activities/{activity_id}")
+    if now > activity.deadline_at:
+        add_flash(request, "error", "活动已截止，不能继续上传。")
+        return redirect(f"/activities/{activity_id}")
+
+    try:
+        raw = await read_and_validate_upload(photo)
+        compressed, mime_type = compress_to_limit(raw, 2 * 1024 * 1024)
+    except ValueError as exc:
+        add_flash(request, "error", str(exc))
+        return redirect(f"/activities/{activity_id}")
+
+    submission = (
+        db.query(Submission)
+        .filter(Submission.user_id == user.id, Submission.task_id == task.id)
+        .first()
+    )
+    if submission and submission.status == "approved":
+        add_flash(request, "info", "该打卡点已经审核通过，无需重复提交。")
+        return redirect(f"/activities/{activity_id}")
+
+    if submission and submission.file_path:
+        old_path = Path(submission.file_path)
+        if old_path.exists():
+            old_path.unlink(missing_ok=True)
+
+    stored_filename, file_path, file_size = persist_submission_image(
+        settings.upload_root,
+        user.student_id,
+        activity.id,
+        task.id,
+        compressed,
+    )
+
+    if not submission:
+        submission = Submission(task_id=task.id, user_id=user.id)
+        db.add(submission)
+
+    submission.stored_filename = stored_filename
+    submission.original_filename = photo.filename or stored_filename
+    submission.file_path = file_path
+    submission.mime_type = mime_type
+    submission.file_size = file_size
+    submission.status = "pending"
+    submission.feedback = None
+    submission.reviewed_by_id = None
+    submission.reviewed_at = None
+    submission.approved_at = None
+    submission.created_at = now
+    db.commit()
+
+    add_flash(request, "success", "图片已提交，等待管理员审核。")
+    return redirect(f"/activities/{activity_id}")
+
+
+@router.get("/api/activities/{activity_id}/clues")
+def activity_clues(activity_id: int, request: Request, db: Session = Depends(get_db)):
+    user = get_current_user(request, db)
+    if not user:
+        return JSONResponse({"error": "unauthorized"}, status_code=401)
+
+    activity = db.query(Activity).options(joinedload(Activity.tasks)).filter(Activity.id == activity_id).first()
+    if not activity:
+        return JSONResponse({"error": "not_found"}, status_code=404)
+
+    now = local_now()
+    payload = {
+        "activity_id": activity.id,
+        "released_task_ids": [
+            task.id
+            for task in activity.tasks
+            if task.clue_image_filename and task.clue_release_at and now >= task.clue_release_at
+        ],
+        "server_time": now.isoformat(timespec="seconds"),
+    }
+    return JSONResponse(payload)

app/security.py

@@ -0,0 +1,14 @@
+from __future__ import annotations
+
+from passlib.context import CryptContext
+
+
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+
+def hash_password(password: str) -> str:
+    return pwd_context.hash(password)
+
+
+def verify_password(plain_password: str, password_hash: str) -> bool:
+    return pwd_context.verify(plain_password, password_hash)

app/services/bootstrap.py

@@ -0,0 +1,38 @@
+from __future__ import annotations
+
+from sqlalchemy.orm import Session
+
+from app.config import settings
+from app.database import Base, engine
+from app.models import Admin
+from app.security import hash_password, verify_password
+
+
+def initialize_database() -> None:
+    settings.upload_root.mkdir(parents=True, exist_ok=True)
+    Base.metadata.create_all(bind=engine)
+
+
+def seed_super_admin(db: Session) -> None:
+    admin = db.query(Admin).filter(Admin.username == settings.admin_username).first()
+    if not admin:
+        admin = Admin(
+            username=settings.admin_username,
+            display_name="超级管理员",
+            role="superadmin",
+            password_hash=hash_password(settings.admin_password),
+        )
+        db.add(admin)
+        db.commit()
+        return
+
+    changed = False
+    if admin.role != "superadmin":
+        admin.role = "superadmin"
+        changed = True
+    if not verify_password(settings.admin_password, admin.password_hash):
+        admin.password_hash = hash_password(settings.admin_password)
+        changed = True
+    if changed:
+        db.add(admin)
+        db.commit()

app/services/images.py

@@ -0,0 +1,74 @@
+from __future__ import annotations
+
+import io
+from pathlib import Path
+from uuid import uuid4
+
+from fastapi import UploadFile
+from PIL import Image, ImageOps
+
+
+ALLOWED_MIME_TYPES = {"image/jpeg", "image/png", "image/webp", "image/gif", "image/bmp"}
+
+
+def _load_rgb_image(data: bytes) -> Image.Image:
+    image = Image.open(io.BytesIO(data))
+    image = ImageOps.exif_transpose(image)
+    if image.mode not in ("RGB", "L"):
+        background = Image.new("RGB", image.size, "white")
+        background.paste(image, mask=image.getchannel("A") if "A" in image.getbands() else None)
+        image = background
+    else:
+        image = image.convert("RGB")
+    return image
+
+
+def compress_to_limit(data: bytes, limit_bytes: int) -> tuple[bytes, str]:
+    image = _load_rgb_image(data)
+    scale = 1.0
+    quality = 92
+
+    while scale >= 0.28:
+        resized = image
+        if scale < 1.0:
+            new_size = (
+                max(240, int(image.width * scale)),
+                max(240, int(image.height * scale)),
+            )
+            resized = image.resize(new_size, Image.Resampling.LANCZOS)
+
+        current_quality = quality
+        while current_quality >= 28:
+            buffer = io.BytesIO()
+            resized.save(buffer, format="JPEG", quality=current_quality, optimize=True)
+            payload = buffer.getvalue()
+            if len(payload) <= limit_bytes:
+                return payload, "image/jpeg"
+            current_quality -= 6
+        scale -= 0.08
+
+    raise ValueError(f"图片压缩后仍超过限制，请上传更清晰度适中的图片（限制 {limit_bytes // 1024}KB）。")
+
+
+async def read_and_validate_upload(upload: UploadFile) -> bytes:
+    if upload.content_type not in ALLOWED_MIME_TYPES:
+        raise ValueError("只支持上传图片文件。")
+    data = await upload.read()
+    if not data:
+        raise ValueError("上传文件为空。")
+    return data
+
+
+def persist_submission_image(
+    upload_root: Path,
+    user_identifier: str,
+    activity_id: int,
+    task_id: int,
+    content: bytes,
+) -> tuple[str, str, int]:
+    folder = upload_root / f"activity_{activity_id}" / f"task_{task_id}"
+    folder.mkdir(parents=True, exist_ok=True)
+    filename = f"{user_identifier}_{uuid4().hex}.jpg"
+    file_path = folder / filename
+    file_path.write_bytes(content)
+    return filename, str(file_path), len(content)

app/services/leaderboard.py

@@ -0,0 +1,53 @@
+from __future__ import annotations
+
+from collections import defaultdict
+from datetime import timedelta
+
+from sqlalchemy.orm import Session, joinedload
+
+from app.models import Activity, Submission, Task, User
+
+
+def build_leaderboard(db: Session, activity_id: int) -> list[dict]:
+    activity = (
+        db.query(Activity)
+        .options(
+            joinedload(Activity.tasks)
+            .joinedload(Task.submissions)
+            .joinedload(Submission.user)
+            .joinedload(User.group)
+        )
+        .filter(Activity.id == activity_id)
+        .first()
+    )
+    if not activity:
+        return []
+
+    group_stats: dict[str, dict] = defaultdict(
+        lambda: {"completed_count": 0, "total_elapsed": timedelta(), "members": set()}
+    )
+
+    for task in activity.tasks:
+        for submission in task.submissions:
+            if submission.status != "approved" or not submission.user:
+                continue
+            group_name = submission.user.group.name if submission.user.group else "未分组"
+            elapsed = max(submission.created_at - activity.start_at, timedelta())
+            stats = group_stats[group_name]
+            stats["completed_count"] += 1
+            stats["total_elapsed"] += elapsed
+            stats["members"].add(submission.user.full_name)
+
+    rows = []
+    for group_name, stats in group_stats.items():
+        rows.append(
+            {
+                "group_name": group_name,
+                "completed_count": stats["completed_count"],
+                "total_elapsed": stats["total_elapsed"],
+                "member_count": len(stats["members"]),
+                "total_elapsed_minutes": int(stats["total_elapsed"].total_seconds() // 60),
+            }
+        )
+    rows.sort(key=lambda item: (-item["completed_count"], item["total_elapsed"]))
+    return rows

app/static/style.css

@@ -0,0 +1,852 @@
+:root {
+  --bg: #eef8ef;
+  --bg-deep: #d7edd7;
+  --surface: rgba(255, 255, 255, 0.75);
+  --surface-strong: rgba(255, 255, 255, 0.9);
+  --border: rgba(98, 146, 104, 0.22);
+  --text: #173622;
+  --muted: #5d7865;
+  --primary: #4e9461;
+  --primary-deep: #2e6a44;
+  --primary-soft: #e6f4e5;
+  --accent: #f6b85b;
+  --danger: #d95b67;
+  --shadow: 0 24px 70px rgba(53, 98, 62, 0.12);
+  --radius-lg: 28px;
+  --radius-md: 20px;
+  --radius-sm: 14px;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+html {
+  scroll-behavior: smooth;
+}
+
+body {
+  margin: 0;
+  font-family: "Segoe UI Variable", "PingFang SC", "Noto Sans SC", "Microsoft YaHei", sans-serif;
+  color: var(--text);
+  background: linear-gradient(180deg, #f5fbf2 0%, #e7f6e8 35%, #e1f0e0 100%);
+  min-height: 100vh;
+}
+
+.page-backdrop {
+  position: fixed;
+  inset: 0;
+  pointer-events: none;
+  background:
+    radial-gradient(circle at 12% 20%, rgba(246, 184, 91, 0.16), transparent 22%),
+    radial-gradient(circle at 82% 14%, rgba(112, 188, 128, 0.18), transparent 20%),
+    radial-gradient(circle at 50% 100%, rgba(120, 180, 139, 0.18), transparent 28%);
+}
+
+img {
+  display: block;
+  max-width: 100%;
+}
+
+.shell {
+  position: relative;
+  width: min(1200px, calc(100% - 32px));
+  margin: 0 auto;
+  padding: 28px 0 44px;
+}
+
+.content-shell {
+  display: flex;
+  flex-direction: column;
+  gap: 24px;
+}
+
+.topbar {
+  position: sticky;
+  top: 18px;
+  z-index: 20;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 20px;
+  padding: 18px 22px;
+  margin-bottom: 24px;
+  border: 1px solid var(--border);
+  border-radius: 999px;
+  background: rgba(255, 255, 255, 0.7);
+  backdrop-filter: blur(14px);
+  box-shadow: var(--shadow);
+}
+
+.brand-block {
+  display: flex;
+  align-items: center;
+  gap: 14px;
+}
+
+.brand-mark {
+  width: 52px;
+  height: 52px;
+  display: grid;
+  place-items: center;
+  border-radius: 18px;
+  background: linear-gradient(135deg, #63b67c, #88ca99);
+  color: white;
+  font-size: 1.4rem;
+  font-weight: 700;
+  box-shadow: 0 18px 26px rgba(76, 134, 91, 0.25);
+}
+
+.eyebrow {
+  margin: 0 0 6px;
+  color: var(--primary);
+  font-size: 0.78rem;
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+}
+
+.brand-title,
+.hero-card h2,
+.glass-card h3,
+.login-copy h1,
+.login-panel h2 {
+  margin: 0;
+  font-family: "Georgia", "STKaiti", "KaiTi", serif;
+  letter-spacing: 0.02em;
+}
+
+.topnav {
+  display: flex;
+  flex-wrap: wrap;
+  justify-content: flex-end;
+  gap: 10px;
+}
+
+.topnav a,
+.ghost-link {
+  color: var(--primary-deep);
+  text-decoration: none;
+  padding: 10px 14px;
+  border-radius: 999px;
+  transition: transform 0.25s ease, background 0.25s ease, color 0.25s ease;
+}
+
+.topnav a:hover,
+.ghost-link:hover {
+  background: rgba(78, 148, 97, 0.12);
+  transform: translateY(-1px);
+}
+
+.hero-card,
+.glass-card,
+.login-panel,
+.login-copy {
+  position: relative;
+  overflow: hidden;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  background: linear-gradient(180deg, var(--surface-strong), var(--surface));
+  backdrop-filter: blur(16px);
+  box-shadow: var(--shadow);
+}
+
+.hero-card {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 24px;
+  padding: 30px;
+  animation: rise-in 0.7s ease both;
+}
+
+.hero-card::after,
+.glass-card::after,
+.login-panel::after,
+.login-copy::after {
+  content: "";
+  position: absolute;
+  inset: auto -12% -50% auto;
+  width: 180px;
+  height: 180px;
+  border-radius: 50%;
+  background: radial-gradient(circle, rgba(246, 184, 91, 0.18), transparent 70%);
+}
+
+.hero-badges,
+.chip-row,
+.feature-list,
+.action-grid,
+.task-status-row {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 10px;
+}
+
+.pill,
+.chip,
+.status-badge {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  padding: 8px 12px;
+  border-radius: 999px;
+  font-size: 0.92rem;
+  background: rgba(255, 255, 255, 0.72);
+  border: 1px solid rgba(78, 148, 97, 0.16);
+}
+
+.status-approved {
+  background: rgba(78, 148, 97, 0.14);
+  color: var(--primary-deep);
+}
+
+.status-rejected {
+  background: rgba(217, 91, 103, 0.14);
+  color: #9b3144;
+}
+
+.lead,
+.muted,
+.mini-note,
+label span,
+.meta-grid span,
+.data-table th {
+  color: var(--muted);
+}
+
+.lead {
+  font-size: 1.02rem;
+  line-height: 1.7;
+}
+
+.muted,
+.mini-note,
+.feedback-box {
+  line-height: 1.6;
+}
+
+.flash-stack {
+  display: grid;
+  gap: 12px;
+  margin-bottom: 20px;
+}
+
+.flash {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 14px 18px;
+  border-radius: 18px;
+  border: 1px solid var(--border);
+  background: rgba(255, 255, 255, 0.85);
+  box-shadow: 0 14px 34px rgba(88, 132, 95, 0.08);
+}
+
+.flash-dot {
+  width: 10px;
+  height: 10px;
+  border-radius: 50%;
+  background: var(--primary);
+}
+
+.flash-error .flash-dot {
+  background: var(--danger);
+}
+
+.flash-success .flash-dot {
+  background: #58a46b;
+}
+
+.flash p {
+  margin: 0;
+}
+
+.card-grid,
+.stats-grid,
+.task-grid,
+.review-grid {
+  display: grid;
+  gap: 20px;
+}
+
+.activity-grid {
+  grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
+}
+
+.group-grid,
+.review-grid {
+  grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
+}
+
+.task-grid {
+  grid-template-columns: repeat(auto-fit, minmax(310px, 1fr));
+}
+
+.stats-grid {
+  grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+}
+
+.page-grid,
+.two-column-layout {
+  display: grid;
+  grid-template-columns: minmax(280px, 360px) 1fr;
+  gap: 22px;
+}
+
+.admin-activity-grid {
+  grid-template-columns: 1.4fr 1fr;
+}
+
+.glass-card,
+.form-panel,
+.table-panel,
+.quick-panel {
+  padding: 24px;
+  animation: rise-in 0.7s ease both;
+}
+
+.activity-card h3,
+.task-card h3,
+.review-card h3,
+.group-card h3,
+.stat-card strong {
+  margin: 0 0 10px;
+}
+
+.meta-grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 12px;
+  margin: 18px 0;
+}
+
+.meta-grid div {
+  padding: 12px 14px;
+  border-radius: var(--radius-sm);
+  background: rgba(255, 255, 255, 0.65);
+}
+
+.meta-grid strong {
+  display: block;
+  margin-top: 6px;
+}
+
+.progress-line {
+  height: 9px;
+  margin: 16px 0 14px;
+  background: rgba(78, 148, 97, 0.12);
+  border-radius: 999px;
+  overflow: hidden;
+}
+
+.progress-line div {
+  height: 100%;
+  border-radius: inherit;
+  background: linear-gradient(90deg, #62b176, #8ac798, #f1c16b);
+}
+
+.card-footer,
+.card-topline,
+.section-head,
+.stack-item,
+.builder-title-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+}
+
+.section-head {
+  margin-bottom: 18px;
+}
+
+.tight-head {
+  margin-top: 8px;
+}
+
+.stack-list {
+  display: grid;
+  gap: 14px;
+}
+
+.stack-item {
+  padding: 14px 16px;
+  border-radius: 18px;
+  background: rgba(255, 255, 255, 0.62);
+  border: 1px solid rgba(78, 148, 97, 0.14);
+}
+
+.stack-item-block {
+  align-items: flex-start;
+}
+
+.form-stack,
+.compact-form {
+  display: grid;
+  gap: 14px;
+}
+
+.form-grid {
+  display: grid;
+  gap: 14px;
+}
+
+.cols-2 {
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+}
+
+.cols-3 {
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+}
+
+.full-span {
+  grid-column: 1 / -1;
+}
+
+label {
+  display: grid;
+  gap: 8px;
+}
+
+input,
+select,
+textarea,
+button {
+  font: inherit;
+}
+
+input,
+select,
+textarea {
+  width: 100%;
+  padding: 14px 16px;
+  border-radius: 16px;
+  border: 1px solid rgba(91, 141, 99, 0.22);
+  background: rgba(255, 255, 255, 0.88);
+  color: var(--text);
+  transition: border-color 0.24s ease, box-shadow 0.24s ease, transform 0.24s ease;
+}
+
+input:focus,
+select:focus,
+textarea:focus {
+  outline: none;
+  border-color: rgba(78, 148, 97, 0.5);
+  box-shadow: 0 0 0 4px rgba(78, 148, 97, 0.12);
+  transform: translateY(-1px);
+}
+
+textarea {
+  resize: vertical;
+  min-height: 120px;
+}
+
+.btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  padding: 12px 18px;
+  border-radius: 999px;
+  border: none;
+  cursor: pointer;
+  text-decoration: none;
+  transition: transform 0.24s ease, box-shadow 0.24s ease, background 0.24s ease;
+}
+
+.btn:hover:not(:disabled) {
+  transform: translateY(-2px);
+}
+
+.btn:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+.btn-primary {
+  color: white;
+  background: linear-gradient(135deg, #4c9460, #70ba80);
+  box-shadow: 0 16px 28px rgba(76, 148, 96, 0.24);
+}
+
+.btn-secondary {
+  color: var(--primary-deep);
+  background: rgba(78, 148, 97, 0.14);
+}
+
+.btn-danger {
+  color: white;
+  background: linear-gradient(135deg, #cf5a68, #e57b84);
+}
+
+.btn-ghost,
+.full-width-btn {
+  color: var(--primary-deep);
+  background: rgba(255, 255, 255, 0.72);
+  border: 1px solid rgba(78, 148, 97, 0.16);
+}
+
+.small-btn {
+  padding: 10px 14px;
+  font-size: 0.92rem;
+}
+
+.full-width-btn {
+  width: 100%;
+}
+
+.login-body {
+  display: grid;
+  place-items: center;
+  padding: 30px 16px;
+}
+
+.login-page {
+  position: relative;
+  display: grid;
+  grid-template-columns: 1.1fr minmax(320px, 420px);
+  width: min(1120px, 100%);
+  gap: 24px;
+}
+
+.compact-login-page {
+  grid-template-columns: 1fr minmax(320px, 420px);
+}
+
+.login-copy,
+.login-panel {
+  padding: 34px;
+}
+
+.spring-copy {
+  min-height: 520px;
+  background:
+    radial-gradient(circle at 16% 20%, rgba(255, 255, 255, 0.88), transparent 42%),
+    linear-gradient(145deg, rgba(125, 195, 137, 0.22), rgba(246, 184, 91, 0.18));
+}
+
+.admin-copy {
+  min-height: 420px;
+}
+
+.feature-list {
+  margin-top: 26px;
+}
+
+.feature-list span,
+.info-box,
+.feedback-box {
+  padding: 10px 14px;
+  border-radius: 16px;
+  background: rgba(255, 255, 255, 0.62);
+  border: 1px solid rgba(78, 148, 97, 0.12);
+}
+
+.panel-glow {
+  position: absolute;
+  inset: auto auto -50px -30px;
+  width: 140px;
+  height: 140px;
+  border-radius: 50%;
+  background: radial-gradient(circle, rgba(246, 184, 91, 0.25), transparent 68%);
+}
+
+.task-card {
+  display: flex;
+  flex-direction: column;
+  gap: 14px;
+}
+
+.task-card-head {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 14px;
+}
+
+.task-description {
+  min-height: 50px;
+}
+
+.task-media-wrap,
+.submission-preview {
+  display: grid;
+  gap: 10px;
+}
+
+.task-media,
+.submission-preview img,
+.review-image {
+  width: 100%;
+  aspect-ratio: 4 / 3;
+  object-fit: cover;
+  border-radius: 22px;
+  border: 1px solid rgba(78, 148, 97, 0.16);
+  box-shadow: 0 12px 30px rgba(86, 127, 93, 0.12);
+}
+
+.clue-toggle {
+  width: 48px;
+  height: 48px;
+  display: grid;
+  place-items: center;
+  border: none;
+  border-radius: 18px;
+  font-size: 1.2rem;
+  background: rgba(246, 184, 91, 0.14);
+  color: #c88929;
+  transition: transform 0.25s ease, background 0.25s ease, box-shadow 0.25s ease;
+}
+
+.clue-toggle.is-ready {
+  background: rgba(246, 184, 91, 0.26);
+  box-shadow: 0 14px 26px rgba(233, 173, 75, 0.22);
+}
+
+.clue-toggle.is-clue-view {
+  transform: rotate(-10deg) scale(1.04);
+}
+
+.release-note {
+  font-size: 0.88rem;
+  color: var(--muted);
+}
+
+.upload-form,
+.inline-form {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 12px;
+  align-items: end;
+}
+
+.inline-form-wide {
+  flex-direction: column;
+  align-items: stretch;
+}
+
+.visibility-form {
+  justify-content: flex-end;
+}
+
+.upload-label {
+  flex: 1 1 220px;
+}
+
+.feedback-box {
+  color: var(--text);
+}
+
+.leaderboard-card {
+  padding: 26px;
+}
+
+.rank-table-wrap,
+.table-shell {
+  overflow-x: auto;
+}
+
+.rank-table,
+.data-table {
+  width: 100%;
+  border-collapse: collapse;
+}
+
+.rank-table th,
+.rank-table td,
+.data-table th,
+.data-table td {
+  padding: 14px 12px;
+  border-bottom: 1px solid rgba(78, 148, 97, 0.12);
+  text-align: left;
+}
+
+.rank-table tbody tr:hover,
+.data-table tbody tr:hover {
+  background: rgba(78, 148, 97, 0.05);
+}
+
+.stat-card {
+  min-height: 130px;
+  display: flex;
+  flex-direction: column;
+  justify-content: space-between;
+}
+
+.stat-card strong {
+  font-size: 2rem;
+  color: var(--primary-deep);
+}
+
+.info-box {
+  margin-top: 18px;
+  display: grid;
+  gap: 12px;
+}
+
+.member-list {
+  display: grid;
+  gap: 10px;
+  margin: 16px 0;
+}
+
+.member-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  padding: 12px 14px;
+  border-radius: 16px;
+  background: rgba(255, 255, 255, 0.62);
+}
+
+.checkbox-row {
+  display: inline-flex;
+  align-items: center;
+  gap: 10px;
+}
+
+.checkbox-row input {
+  width: 18px;
+  height: 18px;
+  padding: 0;
+}
+
+.compact-checkbox {
+  padding: 0;
+}
+
+.task-builder {
+  display: grid;
+  gap: 16px;
+}
+
+.task-builder-card {
+  padding: 18px;
+  border-radius: 22px;
+  background: rgba(255, 255, 255, 0.64);
+  border: 1px dashed rgba(78, 148, 97, 0.24);
+  display: grid;
+  gap: 14px;
+}
+
+.review-card {
+  display: grid;
+  gap: 14px;
+}
+
+.review-filter-form {
+  align-items: end;
+}
+
+.review-filter-action {
+  justify-content: end;
+}
+
+.empty-state {
+  padding: 32px;
+  border-radius: var(--radius-lg);
+  background: rgba(255, 255, 255, 0.68);
+  border: 1px dashed rgba(78, 148, 97, 0.24);
+  text-align: center;
+}
+
+.pulse-highlight {
+  animation: pulse-glow 1.8s ease;
+}
+
+@keyframes rise-in {
+  from {
+    opacity: 0;
+    transform: translateY(18px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
+}
+
+@keyframes pulse-glow {
+  0% {
+    box-shadow: var(--shadow);
+  }
+  35% {
+    box-shadow: 0 0 0 8px rgba(246, 184, 91, 0.18), var(--shadow);
+  }
+  100% {
+    box-shadow: var(--shadow);
+  }
+}
+
+@media (max-width: 980px) {
+  .topbar,
+  .hero-card,
+  .page-grid,
+  .two-column-layout,
+  .login-page,
+  .compact-login-page,
+  .admin-activity-grid {
+    grid-template-columns: 1fr;
+    flex-direction: column;
+  }
+
+  .topbar {
+    border-radius: 28px;
+    align-items: flex-start;
+  }
+
+  .topnav {
+    width: 100%;
+    justify-content: flex-start;
+  }
+
+  .login-copy {
+    min-height: auto;
+  }
+}
+
+@media (max-width: 720px) {
+  .shell {
+    width: min(100% - 20px, 1200px);
+    padding-top: 18px;
+  }
+
+  .topbar,
+  .hero-card,
+  .glass-card,
+  .login-copy,
+  .login-panel {
+    padding: 20px;
+  }
+
+  .cols-2,
+  .cols-3,
+  .meta-grid {
+    grid-template-columns: 1fr;
+  }
+
+  .activity-grid,
+  .task-grid,
+  .group-grid,
+  .review-grid,
+  .stats-grid {
+    grid-template-columns: 1fr;
+  }
+
+  .upload-form,
+  .inline-form,
+  .card-footer,
+  .section-head,
+  .stack-item,
+  .builder-title-row,
+  .task-card-head,
+  .task-status-row {
+    flex-direction: column;
+    align-items: stretch;
+  }
+
+  .btn,
+  .full-width-btn {
+    width: 100%;
+  }
+}

app/templates/activity_detail.html

@@ -0,0 +1,190 @@
+{% extends 'base.html' %}
+
+{% block content %}
+  <section class="hero-card activity-hero">
+    <div>
+      <a class="ghost-link" href="/dashboard">返回活动列表</a>
+      <p class="eyebrow">Activity Detail</p>
+      <h2>{{ activity.title }}</h2>
+      <p class="lead">{{ activity.description or '管理员暂未填写活动说明。' }}</p>
+    </div>
+    <div class="hero-badges">
+      <span class="pill">开始 {{ activity.start_at|datetime_local }}</span>
+      <span class="pill">截止 {{ activity.deadline_at|datetime_local }}</span>
+      <span class="pill">{{ activity.tasks|length }} 个任务</span>
+    </div>
+  </section>
+
+  <section class="task-grid">
+    {% for task in activity.tasks %}
+      {% set submission = submission_by_task.get(task.id) %}
+      {% set clue_ready = clue_states.get(task.id) %}
+      <article class="glass-card task-card" data-task-card data-task-id="{{ task.id }}" data-clue-released="{{ 'true' if clue_ready else 'false' }}">
+        <div class="task-card-head">
+          <div>
+            <p class="eyebrow">Task {{ loop.index }}</p>
+            <h3>{{ task.title }}</h3>
+          </div>
+          <button
+            class="clue-toggle {% if clue_ready %}is-ready{% endif %}"
+            type="button"
+            data-clue-toggle
+            data-primary-url="/media/tasks/{{ task.id }}/image"
+            data-clue-url="/media/tasks/{{ task.id }}/clue"
+            {% if not task.clue_image_filename %}disabled{% endif %}
+            title="{% if clue_ready %}点击查看线索{% elif task.clue_image_filename %}线索尚未发布{% else %}未设置线索图{% endif %}"
+          >
+            💡
+          </button>
+        </div>
+        <p class="muted task-description">{{ task.description or '到达对应打卡点后上传一张清晰照片。' }}</p>
+
+        <div class="task-media-wrap">
+          <img
+            src="/media/tasks/{{ task.id }}/image"
+            alt="{{ task.title }}"
+            class="task-media"
+            data-task-image
+          />
+          {% if task.clue_release_at %}
+            <div class="release-note">线索发布时间：{{ task.clue_release_at|datetime_local }}</div>
+          {% endif %}
+        </div>
+
+        <div class="task-status-row">
+          {% if submission %}
+            {% if submission.status == 'approved' %}
+              <span class="status-badge status-approved">打卡成功</span>
+            {% elif submission.status == 'rejected' %}
+              <span class="status-badge status-rejected">打卡失败</span>
+            {% else %}
+              <span class="status-badge">等待审核</span>
+            {% endif %}
+            <span class="mini-note">最近提交：{{ submission.created_at|datetime_local }}</span>
+          {% else %}
+            <span class="status-badge">尚未上传</span>
+          {% endif %}
+        </div>
+
+        {% if submission and submission.feedback %}
+          <p class="feedback-box">审核备注：{{ submission.feedback }}</p>
+        {% endif %}
+
+        {% if submission %}
+          <div class="submission-preview">
+            <span class="mini-note">我的提交预览</span>
+            <img src="/media/submissions/{{ submission.id }}" alt="{{ task.title }} 提交预览" />
+          </div>
+        {% endif %}
+
+        <form action="/activities/{{ activity.id }}/tasks/{{ task.id }}/submit" method="post" enctype="multipart/form-data" class="upload-form">
+          <label class="upload-label">
+            <span>上传打卡照片</span>
+            <input type="file" name="photo" accept="image/*" {% if submission and submission.status == 'approved' %}disabled{% endif %} required />
+          </label>
+          <button class="btn btn-primary" type="submit" {% if submission and submission.status == 'approved' %}disabled{% endif %}>提交审核</button>
+        </form>
+      </article>
+    {% endfor %}
+  </section>
+
+  <section class="glass-card leaderboard-card">
+    <div class="section-head">
+      <div>
+        <p class="eyebrow">Live Ranking</p>
+        <h3>实时排行榜</h3>
+      </div>
+      {% if not activity.leaderboard_visible %}
+        <span class="status-badge">管理员已隐藏</span>
+      {% endif %}
+    </div>
+
+    {% if activity.leaderboard_visible %}
+      <div class="rank-table-wrap">
+        <table class="rank-table">
+          <thead>
+            <tr>
+              <th>排名</th>
+              <th>小组</th>
+              <th>完成打卡点</th>
+              <th>成员数</th>
+              <th>总耗时</th>
+            </tr>
+          </thead>
+          <tbody>
+            {% for row in leaderboard %}
+              <tr>
+                <td>#{{ loop.index }}</td>
+                <td>{{ row.group_name }}</td>
+                <td>{{ row.completed_count }}</td>
+                <td>{{ row.member_count }}</td>
+                <td>{{ row.total_elapsed|duration_human }}</td>
+              </tr>
+            {% else %}
+              <tr>
+                <td colspan="5">还没有通过审核的打卡记录，排行榜会在成功打卡后自动更新。</td>
+              </tr>
+            {% endfor %}
+          </tbody>
+        </table>
+      </div>
+    {% else %}
+      <p class="muted">当前活动的排行榜暂不对用户开放。</p>
+    {% endif %}
+  </section>
+
+  <script>
+    (() => {
+      const cards = Array.from(document.querySelectorAll('[data-task-card]'));
+      const seenReleased = new Set(
+        cards.filter((card) => card.dataset.clueReleased === 'true').map((card) => card.dataset.taskId)
+      );
+
+      cards.forEach((card) => {
+        const button = card.querySelector('[data-clue-toggle]');
+        const image = card.querySelector('[data-task-image]');
+        if (!button || !image) return;
+
+        button.addEventListener('click', () => {
+          if (!button.classList.contains('is-ready')) return;
+          const showingClue = button.dataset.mode === 'clue';
+          image.src = showingClue ? button.dataset.primaryUrl : button.dataset.clueUrl;
+          button.dataset.mode = showingClue ? 'primary' : 'clue';
+          button.classList.toggle('is-clue-view', !showingClue);
+        });
+      });
+
+      const isMobileLike = window.matchMedia('(pointer: coarse)').matches;
+
+      const poll = async () => {
+        try {
+          const response = await fetch('/api/activities/{{ activity.id }}/clues', { headers: { 'X-Requested-With': 'fetch' } });
+          if (!response.ok) return;
+          const payload = await response.json();
+          (payload.released_task_ids || []).forEach((taskId) => {
+            const stringId = String(taskId);
+            const card = cards.find((item) => item.dataset.taskId === stringId);
+            if (!card) return;
+            const button = card.querySelector('[data-clue-toggle]');
+            if (!button) return;
+            button.classList.add('is-ready');
+            card.dataset.clueReleased = 'true';
+            if (!seenReleased.has(stringId)) {
+              seenReleased.add(stringId);
+              card.classList.add('pulse-highlight');
+              setTimeout(() => card.classList.remove('pulse-highlight'), 1800);
+              if (isMobileLike && navigator.vibrate) {
+                navigator.vibrate([220, 80, 220]);
+              }
+            }
+          });
+        } catch (error) {
+          console.debug('clue polling skipped', error);
+        }
+      };
+
+      window.setInterval(poll, 20000);
+    })();
+  </script>
+{% endblock %}
+

app/templates/admin_activities.html

@@ -0,0 +1,149 @@
+{% extends 'base.html' %}
+
+{% block content %}
+  <section class="page-grid admin-page-grid admin-activity-grid">
+    <article class="glass-card form-panel wide-panel">
+      <div class="section-head">
+        <div>
+          <p class="eyebrow">Create Activity</p>
+          <h3>发布活动与打卡任务</h3>
+        </div>
+      </div>
+      <form method="post" action="/admin/activities" enctype="multipart/form-data" class="form-stack" id="activity-form">
+        <div class="form-grid cols-2">
+          <label>
+            <span>活动标题</span>
+            <input type="text" name="title" required />
+          </label>
+          <label>
+            <span>线索发布时间间隔（分钟）</span>
+            <input type="number" name="clue_interval_minutes" min="0" placeholder="留空表示与活动开始同步" />
+          </label>
+          <label>
+            <span>开始时间</span>
+            <input type="datetime-local" name="start_at" required />
+          </label>
+          <label>
+            <span>截止时间</span>
+            <input type="datetime-local" name="deadline_at" required />
+          </label>
+        </div>
+        <label>
+          <span>活动说明</span>
+          <textarea name="description" rows="3" placeholder="介绍活动安排、打卡要求和注意事项"></textarea>
+        </label>
+        <label class="checkbox-row">
+          <input type="checkbox" name="leaderboard_visible" checked />
+          <span>允许用户查看实时排行榜</span>
+        </label>
+
+        <div class="section-head tight-head">
+          <div>
+            <p class="eyebrow">Tasks</p>
+            <h3>任务卡片</h3>
+          </div>
+          <button class="btn btn-secondary" type="button" id="add-task-btn">新增任务卡片</button>
+        </div>
+
+        <div class="task-builder" id="task-builder">
+          <article class="task-builder-card" data-task-template>
+            <div class="builder-title-row">
+              <strong>任务 1</strong>
+              <button type="button" class="btn btn-ghost small-btn" data-remove-task>删除</button>
+            </div>
+            <div class="form-grid cols-2">
+              <label>
+                <span>任务标题</span>
+                <input type="text" name="task_title" required />
+              </label>
+              <label>
+                <span>主图</span>
+                <input type="file" name="task_image" accept="image/*" required />
+              </label>
+              <label class="full-span">
+                <span>任务描述</span>
+                <textarea name="task_description" rows="2"></textarea>
+              </label>
+              <label class="full-span">
+                <span>线索图</span>
+                <input type="file" name="task_clue_image" accept="image/*" />
+              </label>
+            </div>
+          </article>
+        </div>
+        <button class="btn btn-primary" type="submit">发布活动</button>
+      </form>
+    </article>
+
+    <article class="glass-card table-panel">
+      <div class="section-head">
+        <div>
+          <p class="eyebrow">Published Activities</p>
+          <h3>已发布活动</h3>
+        </div>
+      </div>
+      <div class="stack-list">
+        {% for activity in activities %}
+          <article class="stack-item stack-item-block">
+            <div>
+              <strong>{{ activity.title }}</strong>
+              <p class="muted">{{ activity.start_at|datetime_local }} 至 {{ activity.deadline_at|datetime_local }}</p>
+              <p class="muted">{{ activity.tasks|length }} 个任务 · 创建人 {{ activity.created_by.display_name }}</p>
+            </div>
+            <form method="post" action="/admin/activities/{{ activity.id }}/visibility" class="inline-form visibility-form">
+              <label class="checkbox-row compact-checkbox">
+                <input type="checkbox" name="leaderboard_visible" {% if activity.leaderboard_visible %}checked{% endif %} />
+                <span>用户可见排行榜</span>
+              </label>
+              <button class="btn btn-secondary small-btn" type="submit">保存</button>
+            </form>
+          </article>
+        {% else %}
+          <p class="muted">还没有活动，先发布一个吧。</p>
+        {% endfor %}
+      </div>
+    </article>
+  </section>
+
+  <script>
+    (() => {
+      const builder = document.getElementById('task-builder');
+      const addBtn = document.getElementById('add-task-btn');
+      if (!builder || !addBtn) return;
+
+      const renumber = () => {
+        builder.querySelectorAll('[data-task-template]').forEach((card, index) => {
+          const title = card.querySelector('.builder-title-row strong');
+          if (title) title.textContent = `任务 ${index + 1}`;
+        });
+      };
+
+      const attachRemove = (card) => {
+        const removeBtn = card.querySelector('[data-remove-task]');
+        if (!removeBtn) return;
+        removeBtn.addEventListener('click', () => {
+          if (builder.querySelectorAll('[data-task-template]').length === 1) return;
+          card.remove();
+          renumber();
+        });
+      };
+
+      builder.querySelectorAll('[data-task-template]').forEach(attachRemove);
+
+      addBtn.addEventListener('click', () => {
+        const template = builder.querySelector('[data-task-template]');
+        const clone = template.cloneNode(true);
+        clone.querySelectorAll('input, textarea').forEach((field) => {
+          if (field.type === 'file' || field.type === 'text' || field.type === 'number' || field.type === 'datetime-local') {
+            field.value = '';
+          } else {
+            field.value = '';
+          }
+        });
+        attachRemove(clone);
+        builder.appendChild(clone);
+        renumber();
+      });
+    })();
+  </script>
+{% endblock %}

app/templates/admin_admins.html

@@ -0,0 +1,62 @@
+{% extends 'base.html' %}
+
+{% block content %}
+  <section class="page-grid admin-page-grid">
+    <article class="glass-card form-panel">
+      <div class="section-head">
+        <div>
+          <p class="eyebrow">Create Admin</p>
+          <h3>新增管理员</h3>
+        </div>
+      </div>
+      <form method="post" action="/admin/admins" class="form-stack">
+        <div class="form-grid cols-2">
+          <label>
+            <span>登录账号</span>
+            <input type="text" name="username" required />
+          </label>
+          <label>
+            <span>显示名称</span>
+            <input type="text" name="display_name" required />
+          </label>
+          <label>
+            <span>登录密码</span>
+            <input type="text" name="password" required />
+          </label>
+          <label>
+            <span>角色</span>
+            <select name="role">
+              <option value="admin">管理员</option>
+              <option value="superadmin">超级管理员</option>
+            </select>
+          </label>
+        </div>
+        <button class="btn btn-primary" type="submit">创建管理员</button>
+      </form>
+    </article>
+
+    <article class="glass-card table-panel">
+      <div class="section-head">
+        <div>
+          <p class="eyebrow">Admins</p>
+          <h3>管理员列表</h3>
+        </div>
+      </div>
+      <div class="stack-list">
+        {% for admin_item in admins %}
+          <div class="stack-item">
+            <div>
+              <strong>{{ admin_item.display_name }}</strong>
+              <p class="muted">{{ admin_item.username }} · 创建于 {{ admin_item.created_at|datetime_local }}</p>
+            </div>
+            <span class="status-badge {% if admin_item.role == 'superadmin' %}status-approved{% endif %}">
+              {{ '超级管理员' if admin_item.role == 'superadmin' else '管理员' }}
+            </span>
+          </div>
+        {% else %}
+          <p class="muted">暂无管理员记录。</p>
+        {% endfor %}
+      </div>
+    </article>
+  </section>
+{% endblock %}

app/templates/admin_dashboard.html

@@ -0,0 +1,73 @@
+{% extends 'base.html' %}
+
+{% block content %}
+  <section class="hero-card admin-hero">
+    <div>
+      <p class="eyebrow">Admin Overview</p>
+      <h2>{{ admin.display_name }}，欢迎来到春日行动指挥台</h2>
+      <p class="lead">你可以在这里维护用户、分组、活动任务和图片审核流程。</p>
+    </div>
+    <div class="hero-badges">
+      <span class="pill">角色 {{ '超级管理员' if admin.role == 'superadmin' else '管理员' }}</span>
+      <span class="pill">待审核 {{ stats.pending_count }} 项</span>
+    </div>
+  </section>
+
+  <section class="stats-grid">
+    <article class="glass-card stat-card">
+      <span>用户总数</span>
+      <strong>{{ stats.user_count }}</strong>
+    </article>
+    <article class="glass-card stat-card">
+      <span>小组数量</span>
+      <strong>{{ stats.group_count }}</strong>
+    </article>
+    <article class="glass-card stat-card">
+      <span>活动数量</span>
+      <strong>{{ stats.activity_count }}</strong>
+    </article>
+    <article class="glass-card stat-card">
+      <span>管理员数量</span>
+      <strong>{{ stats.admin_count }}</strong>
+    </article>
+  </section>
+
+  <section class="two-column-layout">
+    <article class="glass-card quick-panel">
+      <div class="section-head">
+        <div>
+          <p class="eyebrow">Quick Links</p>
+          <h3>常用入口</h3>
+        </div>
+      </div>
+      <div class="action-grid">
+        <a class="btn btn-secondary" href="/admin/users">录入用户</a>
+        <a class="btn btn-secondary" href="/admin/groups">管理小组</a>
+        <a class="btn btn-secondary" href="/admin/activities">发布活动</a>
+        <a class="btn btn-primary" href="/admin/reviews">进入审核中心</a>
+      </div>
+    </article>
+
+    <article class="glass-card quick-panel">
+      <div class="section-head">
+        <div>
+          <p class="eyebrow">Recent Activities</p>
+          <h3>最近创建的活动</h3>
+        </div>
+      </div>
+      <div class="stack-list">
+        {% for activity in recent_activities %}
+          <div class="stack-item">
+            <div>
+              <strong>{{ activity.title }}</strong>
+              <p class="muted">{{ activity.tasks|length }} 个任务 · {{ activity.start_at|datetime_local }}</p>
+            </div>
+            <span class="status-badge">{{ '排行榜可见' if activity.leaderboard_visible else '排行榜隐藏' }}</span>
+          </div>
+        {% else %}
+          <p class="muted">还没有发布活动。</p>
+        {% endfor %}
+      </div>
+    </article>
+  </section>
+{% endblock %}

app/templates/admin_groups.html

@@ -0,0 +1,71 @@
+{% extends 'base.html' %}
+
+{% block content %}
+  <section class="page-grid admin-page-grid">
+    <article class="glass-card form-panel">
+      <div class="section-head">
+        <div>
+          <p class="eyebrow">Create Group</p>
+          <h3>新建小组</h3>
+        </div>
+      </div>
+      <form method="post" action="/admin/groups" class="form-stack">
+        <div class="form-grid cols-2">
+          <label>
+            <span>小组名称</span>
+            <input type="text" name="name" placeholder="留空自动生成第N组" />
+          </label>
+          <label>
+            <span>人数上限</span>
+            <input type="number" name="max_members" min="1" value="6" required />
+          </label>
+        </div>
+        <button class="btn btn-primary" type="submit">创建小组</button>
+      </form>
+      <div class="info-box">
+        <strong>未分组成员</strong>
+        <div class="chip-row">
+          {% for user in ungrouped_users %}
+            <span class="chip">{{ user.full_name }} · {{ user.student_id }}</span>
+          {% else %}
+            <span class="chip">所有成员都已分组</span>
+          {% endfor %}
+        </div>
+      </div>
+    </article>
+
+    <section class="card-grid group-grid">
+      {% for group in groups %}
+        <article class="glass-card group-card">
+          <div class="card-topline">
+            <span class="eyebrow">Group {{ loop.index }}</span>
+            <span class="status-badge">{{ group.members|length }}/{{ group.max_members }}</span>
+          </div>
+          <h3>{{ group.name }}</h3>
+          <div class="member-list">
+            {% for member in group.members %}
+              <div class="member-row">
+                <strong>{{ member.full_name }}</strong>
+                <span>{{ member.student_id }}</span>
+              </div>
+            {% else %}
+              <p class="muted">该小组暂时还没有成员。</p>
+            {% endfor %}
+          </div>
+          <form method="post" action="/admin/groups/{{ group.id }}/capacity" class="inline-form inline-form-wide">
+            <label>
+              <span>调整人数上限</span>
+              <input type="number" name="max_members" min="1" value="{{ group.max_members }}" required />
+            </label>
+            <button class="btn btn-secondary small-btn" type="submit">更新</button>
+          </form>
+        </article>
+      {% else %}
+        <article class="empty-state">
+          <h3>还没有小组</h3>
+          <p>创建后这里会以卡片方式展示每个小组和成员。</p>
+        </article>
+      {% endfor %}
+    </section>
+  </section>
+{% endblock %}

app/templates/admin_login.html

@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>管理员登录 · {{ app_name }}</title>
+    <link rel="stylesheet" href="/static/style.css" />
+  </head>
+  <body class="login-body admin-login-body">
+    <div class="page-backdrop"></div>
+    <main class="login-page compact-login-page">
+      <section class="login-copy admin-copy">
+        <p class="eyebrow">Admin Console</p>
+        <h1>活动管理后台</h1>
+        <p class="lead">
+          在这里完成用户录入、小组配置、任务发布、线索管理和图片审核。
+        </p>
+      </section>
+
+      <section class="login-panel admin-panel">
+        <div class="panel-glow"></div>
+        <p class="eyebrow">Secure Access</p>
+        <h2>管理员登录</h2>
+        {% include 'partials/flash.html' %}
+        <form method="post" action="/admin" class="form-stack">
+          <label>
+            <span>账号</span>
+            <input type="text" name="username" placeholder="请输入管理员账号" required />
+          </label>
+          <label>
+            <span>密码</span>
+            <input type="password" name="password" placeholder="请输入密码" required />
+          </label>
+          <button class="btn btn-primary" type="submit">进入后台</button>
+        </form>
+      </section>
+    </main>
+  </body>
+</html>

app/templates/admin_reviews.html

@@ -0,0 +1,85 @@
+{% extends 'base.html' %}
+
+{% block content %}
+  <section class="glass-card form-panel wide-panel">
+    <div class="section-head">
+      <div>
+        <p class="eyebrow">Review Center</p>
+        <h3>图片审核与批量下载</h3>
+      </div>
+      <form id="download-form" method="post" action="/admin/reviews/download" class="inline-form">
+        <button class="btn btn-primary" type="submit">下载已勾选图片</button>
+      </form>
+    </div>
+
+    <form method="get" action="/admin/reviews" class="form-grid cols-3 review-filter-form">
+      <label>
+        <span>审核状态</span>
+        <select name="status">
+          <option value="pending" {% if status_filter == 'pending' %}selected{% endif %}>待审核</option>
+          <option value="approved" {% if status_filter == 'approved' %}selected{% endif %}>已通过</option>
+          <option value="rejected" {% if status_filter == 'rejected' %}selected{% endif %}>已驳回</option>
+        </select>
+      </label>
+      <label>
+        <span>活动筛选</span>
+        <select name="activity_id">
+          <option value="">全部活动</option>
+          {% for activity in activities %}
+            <option value="{{ activity.id }}" {% if activity_filter == activity.id ~ '' %}selected{% endif %}>{{ activity.title }}</option>
+          {% endfor %}
+        </select>
+      </label>
+      <label class="review-filter-action">
+        <span>&nbsp;</span>
+        <button class="btn btn-secondary" type="submit">应用筛选</button>
+      </label>
+    </form>
+  </section>
+
+  <section class="review-grid">
+    {% for submission in submissions %}
+      <article class="glass-card review-card">
+        <div class="card-topline">
+          <label class="checkbox-row compact-checkbox">
+            <input type="checkbox" name="submission_ids" value="{{ submission.id }}" form="download-form" />
+            <span>加入下载</span>
+          </label>
+          {% if submission.status == 'approved' %}
+            <span class="status-badge status-approved">打卡成功</span>
+          {% elif submission.status == 'rejected' %}
+            <span class="status-badge status-rejected">打卡失败</span>
+          {% else %}
+            <span class="status-badge">待审核</span>
+          {% endif %}
+        </div>
+        <h3>{{ submission.task.title }}</h3>
+        <p class="muted">{{ submission.task.activity.title }}</p>
+        <p class="muted">{{ submission.user.full_name }} · {{ submission.user.student_id }}</p>
+        <img class="review-image" src="/media/submissions/{{ submission.id }}" alt="{{ submission.task.title }}" />
+        <p class="mini-note">提交时间：{{ submission.created_at|datetime_local }}</p>
+        {% if submission.feedback %}
+          <p class="feedback-box">当前备注：{{ submission.feedback }}</p>
+        {% endif %}
+        <a class="btn btn-ghost full-width-btn" href="/media/submissions/{{ submission.id }}?download=1">单张下载</a>
+        <form method="post" action="/admin/submissions/{{ submission.id }}/review" class="form-stack compact-form">
+          <label>
+            <span>审核备注</span>
+            <textarea name="feedback" rows="2" placeholder="可填写通过说明或驳回原因">{{ submission.feedback or '' }}</textarea>
+          </label>
+          <div class="action-grid two-actions">
+            <button class="btn btn-primary" type="submit" name="decision" value="approved">审核通过</button>
+            <button class="btn btn-danger" type="submit" name="decision" value="rejected">审核驳回</button>
+          </div>
+        </form>
+      </article>
+    {% else %}
+      <article class="empty-state">
+        <h3>当前没有符合条件的提交记录</h3>
+        <p>切换筛选条件后再看看，或者等待用户上传打卡照片。</p>
+      </article>
+    {% endfor %}
+  </section>
+{% endblock %}
+
+

app/templates/admin_users.html

@@ -0,0 +1,85 @@
+{% extends 'base.html' %}
+
+{% block content %}
+  <section class="page-grid admin-page-grid">
+    <article class="glass-card form-panel">
+      <div class="section-head">
+        <div>
+          <p class="eyebrow">Create User</p>
+          <h3>手动录入用户</h3>
+        </div>
+      </div>
+      <form method="post" action="/admin/users" class="form-stack">
+        <div class="form-grid cols-2">
+          <label>
+            <span>学号</span>
+            <input type="text" name="student_id" required />
+          </label>
+          <label>
+            <span>姓名</span>
+            <input type="text" name="full_name" required />
+          </label>
+          <label>
+            <span>登录密码</span>
+            <input type="text" name="password" required />
+          </label>
+          <label>
+            <span>所属小组</span>
+            <select name="group_id">
+              <option value="">暂不分组</option>
+              {% for group in groups %}
+                <option value="{{ group.id }}">{{ group.name }}（{{ group.members|length }}/{{ group.max_members }}）</option>
+              {% endfor %}
+            </select>
+          </label>
+        </div>
+        <button class="btn btn-primary" type="submit">保存用户</button>
+      </form>
+    </article>
+
+    <article class="glass-card table-panel">
+      <div class="section-head">
+        <div>
+          <p class="eyebrow">Users</p>
+          <h3>用户列表</h3>
+        </div>
+      </div>
+      <div class="table-shell">
+        <table class="data-table">
+          <thead>
+            <tr>
+              <th>学号</th>
+              <th>姓名</th>
+              <th>当前小组</th>
+              <th>调整小组</th>
+            </tr>
+          </thead>
+          <tbody>
+            {% for user_item in users %}
+              <tr>
+                <td>{{ user_item.student_id }}</td>
+                <td>{{ user_item.full_name }}</td>
+                <td>{{ user_item.group.name if user_item.group else '未分组' }}</td>
+                <td>
+                  <form method="post" action="/admin/users/{{ user_item.id }}/group" class="inline-form">
+                    <select name="group_id">
+                      <option value="">未分组</option>
+                      {% for group in groups %}
+                        <option value="{{ group.id }}" {% if user_item.group_id == group.id %}selected{% endif %}>{{ group.name }}</option>
+                      {% endfor %}
+                    </select>
+                    <button class="btn btn-secondary small-btn" type="submit">保存</button>
+                  </form>
+                </td>
+              </tr>
+            {% else %}
+              <tr>
+                <td colspan="4">还没有用户，请先录入。</td>
+              </tr>
+            {% endfor %}
+          </tbody>
+        </table>
+      </div>
+    </article>
+  </section>
+{% endblock %}

app/templates/base.html

@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>{{ page_title or app_name }} · {{ app_name }}</title>
+    <link rel="stylesheet" href="/static/style.css" />
+  </head>
+  <body class="{% if admin %}admin-mode{% else %}user-mode{% endif %}">
+    <div class="page-backdrop"></div>
+    <div class="shell">
+      <header class="topbar">
+        <div class="brand-block">
+          <div class="brand-mark">春</div>
+          <div>
+            <p class="eyebrow">Spring Check-In</p>
+            <h1 class="brand-title">{{ app_name }}</h1>
+          </div>
+        </div>
+        <nav class="topnav">
+          {% if user %}
+            <a href="/dashboard">活动广场</a>
+            <a href="/logout">退出登录</a>
+          {% elif admin %}
+            <a href="/admin/dashboard">总览</a>
+            <a href="/admin/users">用户</a>
+            <a href="/admin/groups">小组</a>
+            <a href="/admin/activities">活动</a>
+            <a href="/admin/reviews">审核</a>
+            {% if admin.role == 'superadmin' %}
+              <a href="/admin/admins">管理员</a>
+            {% endif %}
+            <a href="/admin/logout">退出</a>
+          {% endif %}
+        </nav>
+      </header>
+
+      {% include 'partials/flash.html' %}
+
+      <main class="content-shell">
+        {% block content %}{% endblock %}
+      </main>
+    </div>
+  </body>
+</html>

app/templates/dashboard.html

@@ -0,0 +1,66 @@
+{% extends 'base.html' %}
+
+{% block content %}
+  <section class="hero-card">
+    <div>
+      <p class="eyebrow">Welcome Back</p>
+      <h2>{{ user.full_name }}，今天也一起去打卡吧</h2>
+      <p class="lead">
+        当前小组：<strong>{{ user.group.name if user.group else '暂未分组' }}</strong>
+      </p>
+    </div>
+    <div class="hero-badges">
+      <span class="pill">学号 {{ user.student_id }}</span>
+      <span class="pill">{{ activity_cards|length }} 个活动</span>
+    </div>
+  </section>
+
+  <section class="card-grid activity-grid">
+    {% for card in activity_cards %}
+      <article class="glass-card activity-card">
+        <div class="card-topline">
+          <span class="eyebrow">Activity {{ loop.index }}</span>
+          {% if card.is_overdue %}
+            <span class="status-badge status-rejected">已截止</span>
+          {% elif card.is_active %}
+            <span class="status-badge status-approved">进行中</span>
+          {% else %}
+            <span class="status-badge">未开始</span>
+          {% endif %}
+        </div>
+        <h3>{{ card.activity.title }}</h3>
+        <p class="muted">{{ card.activity.description or '管理员暂未填写活动说明。' }}</p>
+        <div class="meta-grid">
+          <div>
+            <span>开始时间</span>
+            <strong>{{ card.activity.start_at|datetime_local }}</strong>
+          </div>
+          <div>
+            <span>截止时间</span>
+            <strong>{{ card.activity.deadline_at|datetime_local }}</strong>
+          </div>
+          <div>
+            <span>任务数量</span>
+            <strong>{{ card.total_tasks }}</strong>
+          </div>
+          <div>
+            <span>已通过</span>
+            <strong>{{ card.approved_count }}</strong>
+          </div>
+        </div>
+        <div class="progress-line">
+          <div style="width: {{ 0 if card.total_tasks == 0 else (card.approved_count / card.total_tasks * 100)|round(0) }}%"></div>
+        </div>
+        <div class="card-footer">
+          <span class="mini-note">待审核 {{ card.pending_count }} 项</span>
+          <a class="btn btn-primary" href="/activities/{{ card.activity.id }}">查看任务</a>
+        </div>
+      </article>
+    {% else %}
+      <article class="empty-state">
+        <h3>还没有活动</h3>
+        <p>管理员发布活动后，这里会展示你的任务卡片与打卡进度。</p>
+      </article>
+    {% endfor %}
+  </section>
+{% endblock %}

app/templates/login.html

@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>用户登录 · {{ app_name }}</title>
+    <link rel="stylesheet" href="/static/style.css" />
+  </head>
+  <body class="login-body">
+    <div class="page-backdrop"></div>
+    <main class="login-page">
+      <section class="login-copy spring-copy">
+        <p class="eyebrow">Spring Breeze</p>
+        <h1>春日打卡行动</h1>
+        <p class="lead">
+          用一张张照片记录任务进展、团队节奏与春天里的线索。登录后即可查看所属小组、活动任务和实时状态。
+        </p>
+        <div class="feature-list">
+          <span>任务卡片式浏览</span>
+          <span>移动端适配</span>
+          <span>审核结果实时反馈</span>
+        </div>
+      </section>
+
+      <section class="login-panel">
+        <div class="panel-glow"></div>
+        <p class="eyebrow">User Login</p>
+        <h2>同学登录</h2>
+        {% include 'partials/flash.html' %}
+        <form method="post" action="/login" class="form-stack">
+          <label>
+            <span>学号</span>
+            <input type="text" name="student_id" placeholder="请输入学号" required />
+          </label>
+          <label>
+            <span>密码</span>
+            <input type="password" name="password" placeholder="请输入密码" required />
+          </label>
+          <button class="btn btn-primary" type="submit">进入活动</button>
+        </form>
+      </section>
+    </main>
+  </body>
+</html>

app/templates/partials/flash.html

@@ -0,0 +1,10 @@
+{% if flashes %}
+  <section class="flash-stack" aria-live="polite">
+    {% for flash in flashes %}
+      <article class="flash flash-{{ flash.level }}">
+        <span class="flash-dot"></span>
+        <p>{{ flash.message }}</p>
+      </article>
+    {% endfor %}
+  </section>
+{% endif %}

app/web.py

@@ -0,0 +1,42 @@
+from __future__ import annotations
+
+from datetime import datetime
+from zoneinfo import ZoneInfo
+
+from fastapi import Request
+from fastapi.responses import RedirectResponse
+from fastapi.templating import Jinja2Templates
+
+from app.config import ROOT_DIR, settings
+
+
+templates = Jinja2Templates(directory=str(ROOT_DIR / "app" / "templates"))
+
+
+def local_now() -> datetime:
+    return datetime.now(ZoneInfo(settings.timezone)).replace(tzinfo=None)
+
+
+def add_flash(request: Request, level: str, message: str) -> None:
+    flashes = request.session.setdefault("_flashes", [])
+    flashes.append({"level": level, "message": message})
+    request.session["_flashes"] = flashes
+
+
+def pop_flashes(request: Request) -> list[dict]:
+    flashes = request.session.pop("_flashes", [])
+    return flashes
+
+
+def render(request: Request, template_name: str, context: dict, status_code: int = 200):
+    payload = {
+        "request": request,
+        "flashes": pop_flashes(request),
+        "app_name": settings.app_name,
+        **context,
+    }
+    return templates.TemplateResponse(template_name, payload, status_code=status_code)
+
+
+def redirect(url: str, status_code: int = 303) -> RedirectResponse:
+    return RedirectResponse(url=url, status_code=status_code)

ca.pem

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIERDCCAqygAwIBAgIUIZeUQD0xvEAJNu72uWDNezVfx/cwDQYJKoZIhvcNAQEM
+BQAwOjE4MDYGA1UEAwwvOTYzMmFjZDktZjBhOC00NjQ4LTg3M2QtNTRkYTAxNWEz
+NzllIFByb2plY3QgQ0EwHhcNMjYwMzA1MDgzMTU3WhcNMzYwMzAyMDgzMTU3WjA6
+MTgwNgYDVQQDDC85NjMyYWNkOS1mMGE4LTQ2NDgtODczZC01NGRhMDE1YTM3OWUg
+UHJvamVjdCBDQTCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAMSAckGu
+d3mDTOTdgrL/mCfF7WkNWx6CKNGU/R5WaKdJ0Ub0Fbsu3erzQ7Qi877qcPSQg06G
+qH9umxOvq6hZG2lrNXg+8AJihezMME1zmODu+OEOX96jsUn5Pr8OSa68zzRkoiOl
+fXtVDYwTaIhexLJT/U6ELKqUxkBIVHTSmY/hp0SFOuEtMdra6dbJdMOXrGhI+IQK
+KmbRh9H208NpfzjQBos1g27D4YHBe1p55CfihDFEso22i98Wxu2kRqv6hz2n35Qi
+PNdJEi38ascZCGjx24VuuhXGcghHC1GxuIcArxWExNt880HtGztSIu6mBeSW+k9m
+HQiORu9TGuaErD/Xa33wM+sLKFbjBspCjkejwWWp7Kz4T+yup1lOxBDZlqaBgUdD
+MqIcIwBlG/kEUqTPHHKiTcGzg/8KUVDtTTofEAEi5MSiu/7EBQkN/jcAmEfwm4E4
+eOCINwkv53IL5ZRKVg7+sPg0a3mFe2nC0jpO8SskAe00ny3glN+uVzG+2wIDAQAB
+o0IwQDAdBgNVHQ4EFgQUecg1zbigo7JiWmgY17t7E4L8cFIwEgYDVR0TAQH/BAgw
+BgEB/wIBADALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEMBQADggGBAFSdhJQ5fCO7
+FC4I7ri5Gh93iBzjFplqTpbKYZft1RCRZy/ddvwSh4RMylb4MAQbDNs5D/c45E0u
+CUSc449KkVmoZsrtRwQY7Z9BLGaSDlWNca8FO+cGNqrM7vhXOeMYiGADIeg2M/yU
+QMmNxR+Y6nQO6wHP9r3BG1rNMBrjNcOjIXoo65qXv3PGLmNnjlLWyHwTmkfm6E4o
+RIPPWQNo7zVzUnxNiGEDUOpMpeA/JxK4BY44JZTRy4TNVCoM+Qn6PoY4IYyFVjFo
+CG0dBZPHdSeeJGgqJjOVhQQj2hq7BMVdgMSIv1jhUezHQeyfW8XF42C80qG09psI
+CLuxu2geZC/4Y+I5NR21EecUf8nDHNcBHObAOsrPM7oOd7iPpiEMKh2s6kRa4yGt
+LWOL391h5HgNnNcancVe8fXuZ4q7ul4NmQYYt8vtj9e82VpppKPwCPtIZGi4XEv5
+qrYctjxBQUnw+Wp/aV+Q4MN1CD188XEJyo0re0n5Lzi/VBj8suXzcg==
+-----END CERTIFICATE-----