feat: 支持通过粘贴 StringSession 字符串直接登录

新增第三种 Telegram 登录方式：用户可在登录页「Session 导入」tab 粘贴
Telethon StringSession 字符串，后端用临时 client 验证有效性后才写入
session.key 并重连主 client，无效 session 不会落盘。

Author: zzf2333

frontend/src/pages/Login.tsx

@@ -1,7 +1,7 @@
 import { useState } from 'react';
 import { useNavigate, useLocation } from 'react-router-dom';
 import { setApiKey, getApiKey, api } from '../api/client';
-import { KeyRound, QrCode, Smartphone, ShieldCheck } from 'lucide-react';
+import { KeyRound, QrCode, Smartphone, ShieldCheck, FileKey } from 'lucide-react';
 
 export default function Login() {
     const location = useLocation();
@@ -12,7 +12,7 @@ export default function Login() {
     const [authed, setAuthed] = useState(skipKey);
     const navigate = useNavigate();
 
-    const [loginMethod, setLoginMethod] = useState<'qr' | 'phone'>('qr');
+    const [loginMethod, setLoginMethod] = useState<'qr' | 'phone' | 'session'>('qr');
 
     const [qrImage, setQrImage] = useState('');
     const [qrStatus, setQrStatus] = useState('');
@@ -23,6 +23,9 @@ export default function Login() {
 
     const [password, setPassword] = useState('');
 
+    const [sessionString, setSessionString] = useState('');
+    const [sessionLoading, setSessionLoading] = useState(false);
+
     async function handleKeySubmit(e: React.FormEvent) {
         e.preventDefault();
         setApiKey(key);
@@ -124,6 +127,24 @@ export default function Login() {
         }
     }
 
+    async function handleSessionImport(e: React.FormEvent) {
+        e.preventDefault();
+        setError('');
+        setSessionLoading(true);
+        try {
+            const data = await api<{ status: string; error?: string }>(
+                '/api/auth/session-login',
+                { method: 'POST', body: JSON.stringify({ session_string: sessionString }) },
+            );
+            if (data.status === 'success') navigate('/');
+            else if (data.error) setError(data.error);
+        } catch (e: unknown) {
+            setError(String(e));
+        } finally {
+            setSessionLoading(false);
+        }
+    }
+
     const show2fa = qrStatus === '2fa_required' || phoneStatus === '2fa_required';
 
     const inputClass = 'w-full px-3 py-2 bg-slate-800 border border-slate-600 rounded-lg text-slate-200 placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-cyan-500/50 focus:border-cyan-500 transition-colors';
@@ -181,6 +202,17 @@ export default function Login() {
                                         <Smartphone className="w-4 h-4" />
                                         手机号登录
                                     </button>
+                                    <button
+                                        onClick={() => { setLoginMethod('session'); setError(''); }}
+                                        className={`flex-1 py-2 text-sm font-medium border-b-2 transition-colors flex items-center justify-center gap-1.5 ${
+                                            loginMethod === 'session'
+                                                ? 'border-cyan-400 text-cyan-400'
+                                                : 'border-transparent text-slate-500 hover:text-slate-300'
+                                        }`}
+                                    >
+                                        <FileKey className="w-4 h-4" />
+                                        Session 导入
+                                    </button>
                                 </div>
 
                                 {loginMethod === 'qr' && (
@@ -273,6 +305,32 @@ export default function Login() {
                                     </>
                                 )}
 
+                                {loginMethod === 'session' && (
+                                    <form onSubmit={handleSessionImport} className="space-y-3">
+                                        <div>
+                                            <label className="block text-sm font-medium text-slate-400 mb-1">
+                                                StringSession 字符串
+                                            </label>
+                                            <textarea
+                                                value={sessionString}
+                                                onChange={(e) => setSessionString(e.target.value)}
+                                                className={inputClass + ' resize-none h-24 font-mono text-xs'}
+                                                placeholder="粘贴 Telethon StringSession 字符串..."
+                                            />
+                                            <p className="text-xs text-slate-500 mt-1">
+                                                通过 Telethon 生成的 Session 字符串
+                                            </p>
+                                        </div>
+                                        <button
+                                            type="submit"
+                                            disabled={!sessionString.trim() || sessionLoading}
+                                            className={primaryBtn + ((!sessionString.trim() || sessionLoading) ? ' opacity-60 cursor-not-allowed' : '')}
+                                        >
+                                            {sessionLoading ? '验证中...' : '导入 Session'}
+                                        </button>
+                                    </form>
+                                )}
+
                                 <button
                                     onClick={() => navigate('/')}
                                     className="w-full py-2 border border-slate-600 rounded-lg text-slate-400 hover:bg-slate-700 hover:text-slate-200 transition-colors"

src/teleapi/api/auth_routes.py

@@ -112,6 +112,20 @@ async def submit_2fa(request: Request):
     return resp
 
 
+@router.post("/session-login")
+async def session_login(request: Request):
+    body = await request.json()
+    session_string = body.get("session_string", "").strip()
+    if not session_string:
+        return JSONResponse({"error": "session_string is required"}, status_code=400)
+    cm = _get_client_manager(request)
+    try:
+        user_info = await cm.import_session(session_string)
+        return {"status": "success", "user": user_info}
+    except ValueError as e:
+        return JSONResponse({"status": "error", "error": str(e)}, status_code=400)
+
+
 @router.get("/status")
 async def auth_status(request: Request):
     cm = _get_client_manager(request)

src/teleapi/telegram/client.py

@@ -84,3 +84,43 @@ async def logout(self):
         if SESSION_FILE.exists():
             SESSION_FILE.unlink()
         logger.info("Telegram session cleared")
+
+    async def import_session(self, session_string: str) -> dict:
+        try:
+            StringSession(session_string)
+        except Exception as e:
+            raise ValueError(f"Session 字符串格式无效: {e}")
+
+        temp_client = TelegramClient(
+            StringSession(session_string),
+            self._api_id,
+            self._api_hash,
+        )
+        try:
+            await temp_client.connect()
+            if not await temp_client.is_user_authorized():
+                raise ValueError("Session 已失效或未授权，请提供有效的 Session")
+            me = await temp_client.get_me()
+            user_info = {
+                "id": me.id,
+                "first_name": me.first_name or "",
+                "last_name": me.last_name or "",
+                "username": me.username or "",
+                "phone": me.phone or "",
+            }
+        except ValueError:
+            raise
+        except Exception as e:
+            raise ValueError(f"无法验证 Session: {e}")
+        finally:
+            await temp_client.disconnect()
+
+        await self.disconnect()
+
+        tmp = SESSION_FILE.with_suffix(".tmp")
+        tmp.write_text(session_string)
+        tmp.rename(SESSION_FILE)
+        logger.info("Imported external session, saved to %s", SESSION_FILE)
+
+        await self.connect()
+        return user_info

tests/api/test_auth_routes.py

@@ -105,6 +105,30 @@ async def test_logout(self, client, test_app, tmp_path, monkeypatch):
         assert resp.json()["status"] == "logged_out"
 
 
+class TestSessionLoginAPI:
+    async def test_success(self, client, test_app):
+        test_app.state.telegram_client.import_session = AsyncMock(
+            return_value={"id": 123, "first_name": "Test", "last_name": "", "username": "test", "phone": "+1234567890"}
+        )
+        resp = await client.post("/api/auth/session-login", json={"session_string": "valid_session"})
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["status"] == "success"
+        assert data["user"]["id"] == 123
+
+    async def test_empty_string(self, client):
+        resp = await client.post("/api/auth/session-login", json={"session_string": ""})
+        assert resp.status_code == 400
+
+    async def test_invalid_session(self, client, test_app):
+        test_app.state.telegram_client.import_session = AsyncMock(
+            side_effect=ValueError("Session 已失效或未授权，请提供有效的 Session")
+        )
+        resp = await client.post("/api/auth/session-login", json={"session_string": "bad_session"})
+        assert resp.status_code == 400
+        assert "error" in resp.json()
+
+
 class TestAuthRequired:
     async def test_all_routes_need_auth(self, unauthed_client):
         routes = [
@@ -113,6 +137,7 @@ async def test_all_routes_need_auth(self, unauthed_client):
             ("POST", "/api/auth/qr-login/refresh"),
             ("POST", "/api/auth/phone-login/send-code"),
             ("GET", "/api/auth/phone-login/status"),
+            ("POST", "/api/auth/session-login"),
             ("GET", "/api/auth/status"),
             ("POST", "/api/auth/logout"),
         ]