diff --git a/wwwroot/api/login.dspy b/wwwroot/api/login.dspy
new file mode 100644
index 0000000..5c5c611
--- /dev/null
+++ b/wwwroot/api/login.dspy
@@ -0,0 +1,33 @@
+# pccs login — 独立登录端点, 不依赖 rbac dspy 注入函数
+import hashlib, datetime
+from sqlor.dbpools import DBPools
+from appPublic.uniqueID import getID
+
+username = params_kw.get('username', '')
+password = params_kw.get('password', '') or params_kw.get('passwd', '')
+
+if not username or not password:
+    return {'status': 'error', 'message': '请输入用户名和密码'}
+
+dbname = 'pccs'
+db = DBPools()
+async with db.sqlorContext(dbname) as sor:
+    # 先查用户
+    recs = await sor.R('users', {'username': username})
+    if not recs:
+        return {'status': 'error', 'message': '用户名或密码错误'}
+
+    user = recs[0]
+    # 密码验证: 对比 sha256 哈希
+    pw_hash = hashlib.sha256(password.encode()).hexdigest()
+    stored_pw = user.password or ''
+
+    if pw_hash != stored_pw:
+        return {'status': 'error', 'message': '用户名或密码错误'}
+
+    # 更新最后登录
+    now = datetime.datetime.now().isoformat()
+    await sor.U('users', {'id': user.id}, {'last_login': now, 'login_fail_count': 0})
+
+    return {'status': 'ok', 'message': '登录成功',
+            'user': {'id': user.id, 'username': user.username, 'nick_name': user.nick_name or user.username}}
diff --git a/wwwroot/index.html b/wwwroot/index.html
index e90f4d1..fb1bffd 100644
--- a/wwwroot/index.html
+++ b/wwwroot/index.html
@@ -155,7 +155,7 @@ async function doLogin(){
     if(!u||!p){document.getElementById('login-msg').textContent='请输入用户名和密码';return}
     var fd=new FormData();fd.append('username',u);fd.append('passwd',p);
     try{
-        var r=await fetch('/rbac/user/up_login.dspy',{method:'POST',body:fd});
+        var r=await fetch('/pccs/api/login.dspy',{method:'POST',body:fd});
         var d=await r.json();
         if(d.status==='ok'){closeLogin();checkLogin();document.getElementById('login-msg').textContent=''}
         else document.getElementById('login-msg').textContent=d.message||'登录失败';