diff --git a/wwwroot/api/a1b2c3d4e5.dspy b/wwwroot/api/a1b2c3d4e5.dspy
new file mode 100644
index 0000000..c388448
--- /dev/null
+++ b/wwwroot/api/a1b2c3d4e5.dspy
@@ -0,0 +1,15 @@
+username = params_kw.get('username', '')
+password = params_kw.get('password', '') or params_kw.get('passwd', '')
+if not username or not password:
+    return {'status': 'error', 'message': '请输入用户名和密码'}
+pw_encoded = password_encode(password)
+db = DBPools()
+async with db.sqlorContext('pccs') as sor:
+    recs = await sor.sqlExe("SELECT id,username,password,nick_name FROM users WHERE username=${un}$", {'un': username})
+    if not recs:
+        return {'status': 'error', 'message': '用户名或密码错误'}
+    user = recs[0]
+    if pw_encoded != (user.password or ''):
+        return {'status': 'error', 'message': '用户名或密码错误'}
+    await sor.sqlExe("UPDATE users SET last_login=NOW(),login_fail_count=0 WHERE id=${id}$", {'id': user.id})
+    return {'status': 'ok', 'message': '登录成功', 'user': {'id': user.id, 'username': user.username, 'nick_name': user.nick_name or user.username}}
diff --git a/wwwroot/api/get_user_info.dspy b/wwwroot/api/get_user_info.dspy
deleted file mode 100644
index 0174d9e..0000000
--- a/wwwroot/api/get_user_info.dspy
+++ /dev/null
@@ -1,9 +0,0 @@
-# 返回当前登录用户信息
-from aiohttp_session import get_session
-
-async def handler(request):
-    session = await get_session(request)
-    user = session.get('user')
-    if user:
-        return {'username': user.get('username', ''), 'userid': user.get('id', '')}
-    return {}
diff --git a/wwwroot/api/login.dspy b/wwwroot/api/login.dspy
deleted file mode 100644
index 5c5c611..0000000
--- a/wwwroot/api/login.dspy
+++ /dev/null
@@ -1,33 +0,0 @@
-# pccs login — 独立登录端点, 不依赖 rbac dspy 注入函数
-import hashlib, datetime
-from sqlor.dbpools import DBPools
-from appPublic.uniqueID import getID
-
-username = params_kw.get('username', '')
-password = params_kw.get('password', '') or params_kw.get('passwd', '')
-
-if not username or not password:
-    return {'status': 'error', 'message': '请输入用户名和密码'}
-
-dbname = 'pccs'
-db = DBPools()
-async with db.sqlorContext(dbname) as sor:
-    # 先查用户
-    recs = await sor.R('users', {'username': username})
-    if not recs:
-        return {'status': 'error', 'message': '用户名或密码错误'}
-
-    user = recs[0]
-    # 密码验证: 对比 sha256 哈希
-    pw_hash = hashlib.sha256(password.encode()).hexdigest()
-    stored_pw = user.password or ''
-
-    if pw_hash != stored_pw:
-        return {'status': 'error', 'message': '用户名或密码错误'}
-
-    # 更新最后登录
-    now = datetime.datetime.now().isoformat()
-    await sor.U('users', {'id': user.id}, {'last_login': now, 'login_fail_count': 0})
-
-    return {'status': 'ok', 'message': '登录成功',
-            'user': {'id': user.id, 'username': user.username, 'nick_name': user.nick_name or user.username}}