From ab14aa096531da4cd737213a652ec3d2bb303b41 Mon Sep 17 00:00:00 2001
From: Liu Rui <lovearuis@gmail.com>
Date: Fri, 14 Aug 2026 17:33:50 +0800
Subject: [PATCH 1/2] =?UTF-8?q?feat:=20=E6=94=AF=E6=8C=81=E7=A7=9F?=
 =?UTF-8?q?=E6=88=B7=E5=93=81=E7=89=8C=E7=99=BB=E5=BD=95=E5=85=A5=E5=8F=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../topics/identity-permission/WEB_API.md     |  1 +
 .../spring/iam/web/LoginWebController.java    | 19 +++++
 .../iam/web/LoginWebControllerTest.java       | 22 ++++++
 .../spring/iam/tenant/TenantLoginContext.java | 10 +++
 muyun-web/src/app/LoginView.vue               | 79 ++++++++++++++++---
 muyun-web/src/consumer/index.ts               |  1 +
 muyun-web/src/web-contracts/index.ts          |  6 ++
 muyun-web/src/web-core/clients.ts             |  4 +
 .../tests/app/LoginView.component.test.ts     | 54 +++++++++++++
 .../consumer/publicSurfaceContracts.test.ts   |  1 +
 muyun-web/tests/web-core/webCore.test.ts      | 24 ++++++
 11 files changed, 210 insertions(+), 11 deletions(-)
 create mode 100644 muyun-iam/src/main/java/net/ximatai/muyun/spring/iam/tenant/TenantLoginContext.java
 create mode 100644 muyun-web/tests/app/LoginView.component.test.ts

diff --git a/docs/platform/topics/identity-permission/WEB_API.md b/docs/platform/topics/identity-permission/WEB_API.md
index b4e78585..44c35995 100644
--- a/docs/platform/topics/identity-permission/WEB_API.md
+++ b/docs/platform/topics/identity-permission/WEB_API.md
@@ -9,6 +9,7 @@
 | 方法   | URL                 | 功能                                                                                               |
 | ------ | ------------------- | -------------------------------------------------------------------------------------------------- |
 | `POST` | `/iam.auth/login`   | 用户登录。请求包含 `tenantId`、`username`、`password`；返回 Bearer token、当前登录 `sessionId`、签发时间和当前用户信息。 |
+| `GET`  | `/iam.auth/login-context?tenantId={tenantId}` | 匿名读取 URL 锁定租户的公开登录上下文。仅返回锁定租户标识及工作台品牌投影，供标准登录页展示 Logo、主标题和副标题；目标租户必须处于启用状态。 |
 | `POST` | `/iam.auth/logout`  | 当前 Bearer token 登出。token 从 `Authorization: Bearer ...` 读取。                                |
 | `GET`  | `/iam.auth/context` | 返回当前请求解析出的用户上下文，用于前端会话恢复和启动态确认。                                     |
 | `GET`  | `/iam.auth/tenant-branding` | 返回当前租户的工作台品牌投影（`lightLogo`、可选的 `darkLogo`）；Logo 以受限 Base64 图片 data URL 保存。 |
diff --git a/muyun-iam-web/src/main/java/net/ximatai/muyun/spring/iam/web/LoginWebController.java b/muyun-iam-web/src/main/java/net/ximatai/muyun/spring/iam/web/LoginWebController.java
index 3c02c05f..29757c91 100644
--- a/muyun-iam-web/src/main/java/net/ximatai/muyun/spring/iam/web/LoginWebController.java
+++ b/muyun-iam-web/src/main/java/net/ximatai/muyun/spring/iam/web/LoginWebController.java
@@ -13,6 +13,7 @@
 import net.ximatai.muyun.spring.iam.user.UpdateCurrentUserProfileRequest;
 import net.ximatai.muyun.spring.iam.user.UserSessionService;
 import net.ximatai.muyun.spring.iam.tenant.TenantBranding;
+import net.ximatai.muyun.spring.iam.tenant.TenantLoginContext;
 import net.ximatai.muyun.spring.iam.tenant.TenantService;
 import net.ximatai.muyun.spring.platform.web.PlatformStaticActionDeclaration;
 import net.ximatai.muyun.spring.common.platform.ActionAccessMode;
@@ -22,6 +23,7 @@
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.beans.factory.annotation.Autowired;
 
@@ -100,6 +102,16 @@ public TenantBranding tenantBranding() {
                 : tenantService.branding(tenantId);
     }
 
+    /**
+     * Resolves branding for a tenant explicitly selected by the unauthenticated login entry.
+     */
+    @GetMapping("/login-context")
+    public TenantLoginContext loginContext(@RequestParam String tenantId) {
+        TenantService service = requireTenantService();
+        service.requireActiveTenant(tenantId);
+        return new TenantLoginContext(tenantId, service.branding(tenantId));
+    }
+
     private String bearerToken(HttpServletRequest request) {
         String header = request.getHeader("Authorization");
         if (header == null || header.isBlank()) {
@@ -124,6 +136,13 @@ private CurrentUserProfileService requireCurrentUserProfileService() {
         return currentUserProfileService;
     }
 
+    private TenantService requireTenantService() {
+        if (tenantService == null) {
+            throw new IllegalStateException("tenant service is not available");
+        }
+        return tenantService;
+    }
+
     private String clientIp(HttpServletRequest request) {
         String forwardedFor = request.getHeader("X-Forwarded-For");
         if (forwardedFor != null && !forwardedFor.isBlank()) {
diff --git a/muyun-iam-web/src/test/java/net/ximatai/muyun/spring/iam/web/LoginWebControllerTest.java b/muyun-iam-web/src/test/java/net/ximatai/muyun/spring/iam/web/LoginWebControllerTest.java
index 1cc71b38..ad4a4e3c 100644
--- a/muyun-iam-web/src/test/java/net/ximatai/muyun/spring/iam/web/LoginWebControllerTest.java
+++ b/muyun-iam-web/src/test/java/net/ximatai/muyun/spring/iam/web/LoginWebControllerTest.java
@@ -11,6 +11,7 @@
 import net.ximatai.muyun.spring.iam.user.CurrentUserProfile;
 import net.ximatai.muyun.spring.iam.user.CurrentUserProfileService;
 import net.ximatai.muyun.spring.iam.tenant.TenantBranding;
+import net.ximatai.muyun.spring.iam.tenant.Tenant;
 import net.ximatai.muyun.spring.iam.tenant.TenantService;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
@@ -92,6 +93,27 @@ void shouldExposeOnlyTheCurrentTenantBrandingToWorkbenchStartup() throws Excepti
         verify(tenantService).branding("tenant-a");
     }
 
+    @Test
+    void shouldExposeActiveLockedTenantBrandingBeforeAuthentication() throws Exception {
+        TenantService tenantService = mock(TenantService.class);
+        when(tenantService.requireActiveTenant("tenant-a")).thenReturn(mock(Tenant.class));
+        when(tenantService.branding("tenant-a"))
+                .thenReturn(new TenantBranding("data:image/png;base64,bGlnaHQ=", null,
+                        "logoWithTitle", "租户 A", "租户专属工作台"));
+        LoginWebController controller = new LoginWebController(mock(UserSessionService.class), tenantService);
+        MockMvc mvc = MockMvcBuilders.standaloneSetup(controller).build();
+
+        mvc.perform(get("/iam.auth/login-context").param("tenantId", "tenant-a"))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.tenantId").value("tenant-a"))
+                .andExpect(jsonPath("$.branding.lightLogo").value("data:image/png;base64,bGlnaHQ="))
+                .andExpect(jsonPath("$.branding.title").value("租户 A"))
+                .andExpect(jsonPath("$.branding.subtitle").value("租户专属工作台"));
+
+        verify(tenantService).requireActiveTenant("tenant-a");
+        verify(tenantService).branding("tenant-a");
+    }
+
     @Test
     void shouldReturnUnauthorizedWhenLoginCredentialsAreInvalid() throws Exception {
         UserSessionService userSessionService = mock(UserSessionService.class);
diff --git a/muyun-iam/src/main/java/net/ximatai/muyun/spring/iam/tenant/TenantLoginContext.java b/muyun-iam/src/main/java/net/ximatai/muyun/spring/iam/tenant/TenantLoginContext.java
new file mode 100644
index 00000000..c4423f1d
--- /dev/null
+++ b/muyun-iam/src/main/java/net/ximatai/muyun/spring/iam/tenant/TenantLoginContext.java
@@ -0,0 +1,10 @@
+package net.ximatai.muyun.spring.iam.tenant;
+
+/**
+ * Public, unauthenticated login-entry facts for a tenant selected by the login URL.
+ *
+ * <p>This projection deliberately contains only the locked tenant identity and its
+ * decorative branding. It is not a tenant-management or current-session projection.</p>
+ */
+public record TenantLoginContext(String tenantId, TenantBranding branding) {
+}
diff --git a/muyun-web/src/app/LoginView.vue b/muyun-web/src/app/LoginView.vue
index 5abf9e15..49a56849 100644
--- a/muyun-web/src/app/LoginView.vue
+++ b/muyun-web/src/app/LoginView.vue
@@ -1,7 +1,7 @@
 <script setup lang="ts">
-import { ref } from 'vue';
+import { computed, onMounted, ref } from 'vue';
 import type { AuthClient } from '@muyun/web-core';
-import type { LoginResult } from '@muyun/web-contracts';
+import type { LoginResult, TenantBranding } from '@muyun/web-contracts';
 import { UiButton, UiInput } from '@muyun/vue-ui-antdv';
 import { normalizeInitialValue, resolveLoginTenantDefaults } from './loginTenant';
 
@@ -11,6 +11,8 @@ const props = defineProps<{
   authClient: AuthClient;
   loading?: boolean;
   error?: string;
+  /** Used only when the form is first created; URL-locked tenants always take precedence. */
+  initialUsername?: string;
 }>();
 
 const emit = defineEmits<{
@@ -20,7 +22,10 @@ const emit = defineEmits<{
 const loginTenantDefaults = resolveLoginTenantDefaults(import.meta.env.VITE_MUYUN_LOGIN_TENANT_ID);
 const tenantId = ref(loginTenantDefaults.tenantId);
 const tenantLocked = loginTenantDefaults.tenantLocked;
-const username = ref(normalizeInitialValue(import.meta.env.VITE_MUYUN_LOGIN_USERNAME));
+const username = ref(
+  normalizeInitialValue(props.initialUsername) ||
+    normalizeInitialValue(import.meta.env.VITE_MUYUN_LOGIN_USERNAME),
+);
 const password = ref(normalizeInitialValue(import.meta.env.VITE_MUYUN_LOGIN_PASSWORD));
 const submitting = ref(false);
 const formError = ref<string>();
@@ -28,6 +33,27 @@ const passwordChangeRequired = ref(false);
 const pendingToken = ref<string>();
 const newPassword = ref('');
 const confirmPassword = ref('');
+const tenantBranding = ref<TenantBranding>();
+const loginContextLoading = ref(false);
+const loginContextError = ref<string>();
+const canSubmit = computed(() => !tenantLocked || (!loginContextLoading.value && !loginContextError.value));
+const loginTitle = computed(() => tenantBranding.value?.title || '平台登录');
+const loginSubtitle = computed(() => tenantBranding.value?.subtitle);
+
+onMounted(async () => {
+  if (!tenantLocked || !tenantId.value) {
+    return;
+  }
+  loginContextLoading.value = true;
+  try {
+    const context = await props.authClient.loginContext(tenantId.value);
+    tenantBranding.value = context.branding;
+  } catch {
+    loginContextError.value = '无法打开该租户的登录入口';
+  } finally {
+    loginContextLoading.value = false;
+  }
+});
 
 async function submit() {
   formError.value = undefined;
@@ -91,17 +117,22 @@ async function submitPasswordChange() {
   <main class="login-page">
     <section class="login-panel">
       <header>
-        <p>MuYun Platform</p>
-        <h1>平台登录</h1>
+        <div class="login-brand">
+          <img v-if="tenantBranding?.lightLogo" class="login-logo" :src="tenantBranding.lightLogo" alt="" />
+          <div>
+            <p v-if="!tenantBranding?.lightLogo">MuYun Platform</p>
+            <h1>{{ loginTitle }}</h1>
+            <p v-if="loginSubtitle" class="login-subtitle">{{ loginSubtitle }}</p>
+          </div>
+        </div>
       </header>
 
-      <p v-if="formError || error" class="login-error">
-        {{ formError || error }}
+      <p v-if="formError || error || loginContextError" class="login-error">
+        {{ formError || error || loginContextError }}
       </p>
 
       <form v-if="!passwordChangeRequired" class="login-form" @submit.prevent="submit">
-        <p v-if="tenantLocked" class="login-context">租户：{{ tenantId }}</p>
-        <label v-else>
+        <label v-if="!tenantLocked">
           <span>租户 ID</span>
           <UiInput v-model:value="tenantId" autocomplete="organization" placeholder="留空进入系统工作区" />
         </label>
@@ -113,7 +144,13 @@ async function submitPasswordChange() {
           <span>密码</span>
           <UiInput v-model:value="password" type="password" autocomplete="current-password" required />
         </label>
-        <UiButton class="login-submit" html-type="submit" type="primary" :loading="submitting || loading">
+        <UiButton
+          class="login-submit"
+          html-type="submit"
+          type="primary"
+          :disabled="!canSubmit"
+          :loading="submitting || loading || loginContextLoading"
+        >
           {{ submitting || loading ? '登录中' : '登录' }}
         </UiButton>
       </form>
@@ -167,10 +204,30 @@ header p {
 header h1 {
   margin: 0;
   color: var(--muyun-support-text);
-  font-size: 22px;
+  font-size: 26px;
   line-height: 1.25;
 }
 
+.login-logo {
+  display: block;
+  width: 56px;
+  height: 56px;
+  object-fit: contain;
+}
+
+.login-brand {
+  display: flex;
+  align-items: flex-start;
+  gap: 14px;
+}
+
+.login-subtitle {
+  margin: 5px 0 0;
+  color: var(--muyun-support-text-muted);
+  font-size: 14px;
+  line-height: 1.5;
+}
+
 .login-error {
   margin: 0;
   padding: 10px 12px;
diff --git a/muyun-web/src/consumer/index.ts b/muyun-web/src/consumer/index.ts
index afb59740..d5e42029 100644
--- a/muyun-web/src/consumer/index.ts
+++ b/muyun-web/src/consumer/index.ts
@@ -67,6 +67,7 @@ export {
 } from '../vue-ui-antdv/index';
 export { default as PlatformAdminOutlet } from './PlatformAdminOutlet.vue';
 export { default as AppWorkbenchShell } from './AppWorkbenchShell.vue';
+export { default as LoginView } from '../app/LoginView.vue';
 export type { AppWorkbenchNavigation } from './workbenchNavigation';
 export { configureUserPreferencePersistence } from './userPreferencePersistence';
 export { default as ChangeOwnPasswordDialog } from '../app/ChangeOwnPasswordDialog.vue';
diff --git a/muyun-web/src/web-contracts/index.ts b/muyun-web/src/web-contracts/index.ts
index c434eb70..d6e47d79 100644
--- a/muyun-web/src/web-contracts/index.ts
+++ b/muyun-web/src/web-contracts/index.ts
@@ -192,6 +192,12 @@ export interface TenantBranding {
   subtitle?: string;
 }
 
+/** Public branding facts for a tenant locked by the unauthenticated login URL. */
+export interface TenantLoginContext {
+  tenantId: string;
+  branding?: TenantBranding;
+}
+
 export interface LoginRequest {
   tenantId?: string;
   username: string;
diff --git a/muyun-web/src/web-core/clients.ts b/muyun-web/src/web-core/clients.ts
index 998245d1..ba903dbb 100644
--- a/muyun-web/src/web-core/clients.ts
+++ b/muyun-web/src/web-core/clients.ts
@@ -10,6 +10,7 @@ import type {
   MenuTreeNode,
   PageBootstrap,
   TenantBranding,
+  TenantLoginContext,
 } from '@muyun/web-contracts';
 import type { HttpClient } from './http';
 
@@ -29,6 +30,7 @@ export interface PageBootstrapClient {
 
 export interface AuthClient {
   login(request: LoginRequest): Promise<LoginResult>;
+  loginContext(tenantId: string): Promise<TenantLoginContext>;
   changeOwnPassword(request: ChangeOwnPasswordRequest, token: string): Promise<void>;
   currentProfile(token: string): Promise<CurrentUserProfile>;
   updateCurrentProfile(request: UpdateCurrentUserProfileRequest, token: string): Promise<CurrentUserProfile>;
@@ -109,6 +111,8 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 export function createAuthClient(http: HttpClient): AuthClient {
   return {
     login: (request) => http.request<LoginResult>({ method: 'POST', path: '/iam.auth/login', body: request }),
+    loginContext: (tenantId) =>
+      http.request<TenantLoginContext>({ path: '/iam.auth/login-context', query: { tenantId } }),
     changeOwnPassword: (request, token) =>
       http.request<void>({
         method: 'POST',
diff --git a/muyun-web/tests/app/LoginView.component.test.ts b/muyun-web/tests/app/LoginView.component.test.ts
new file mode 100644
index 00000000..1ec8884c
--- /dev/null
+++ b/muyun-web/tests/app/LoginView.component.test.ts
@@ -0,0 +1,54 @@
+import { flushPromises, mount } from '@vue/test-utils';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import LoginView from '@/app/LoginView.vue';
+import type { AuthClient } from '@/web-core/clients';
+
+describe('LoginView', () => {
+  afterEach(() => {
+    window.history.replaceState({}, '', '/');
+  });
+
+  it('uses an initial consumer username without requiring consumer-owned login markup', () => {
+    const wrapper = mount(LoginView, {
+      props: {
+        authClient: authClient(),
+        initialUsername: 'xcmg',
+      },
+    });
+
+    expect((wrapper.find('input[autocomplete="username"]').element as HTMLInputElement).value).toBe('xcmg');
+  });
+
+  it('uses locked tenant branding from the platform login context', async () => {
+    window.history.replaceState({}, '', '/?tenant=tenant-a');
+    const wrapper = mount(LoginView, {
+      props: { authClient: authClient() },
+    });
+
+    await flushPromises();
+
+    expect(wrapper.text()).toContain('租户 A');
+    expect(wrapper.text()).toContain('租户专属工作台');
+    expect(wrapper.text()).not.toContain('租户：tenant-a');
+    expect(wrapper.find('input[placeholder="留空进入系统工作区"]').exists()).toBe(false);
+    expect(wrapper.find('.login-brand > .login-logo').exists()).toBe(true);
+  });
+});
+
+function authClient(): AuthClient {
+  return {
+    login: vi.fn(),
+    loginContext: vi.fn().mockResolvedValue({
+      tenantId: 'tenant-a',
+      branding: {
+        lightLogo: 'data:image/png;base64,bGlnaHQ=',
+        title: '租户 A',
+        subtitle: '租户专属工作台',
+      },
+    }),
+    changeOwnPassword: vi.fn(),
+    currentProfile: vi.fn(),
+    updateCurrentProfile: vi.fn(),
+    logout: vi.fn(),
+  };
+}
diff --git a/muyun-web/tests/consumer/publicSurfaceContracts.test.ts b/muyun-web/tests/consumer/publicSurfaceContracts.test.ts
index 63b72cc4..de3610f7 100644
--- a/muyun-web/tests/consumer/publicSurfaceContracts.test.ts
+++ b/muyun-web/tests/consumer/publicSurfaceContracts.test.ts
@@ -25,6 +25,7 @@ it('consumer surface exposes the stable app-shell feedback and lifecycle facades
   assert.match(runtimeSource, /AppRealtimeConnection/);
   assert.ok(!/createAppRealtimeClient,/.test(runtimeSource));
   assert.match(consumerSource, /AppWorkbenchShell/);
+  assert.match(consumerSource, /LoginView/);
   assert.match(consumerSource, /AppWorkbenchNavigation/);
   assert.ok(!/workbenchRouteSync/.test(consumerSource));
   assert.ok(!/openDirectTab|openMenuTab|closeMenuTab/.test(consumerSource));
diff --git a/muyun-web/tests/web-core/webCore.test.ts b/muyun-web/tests/web-core/webCore.test.ts
index fe341a40..398d7963 100644
--- a/muyun-web/tests/web-core/webCore.test.ts
+++ b/muyun-web/tests/web-core/webCore.test.ts
@@ -170,6 +170,30 @@ it('auth logout posts bearer token to backend logout endpoint', async () => {
   }
 });
 
+it('auth client resolves the public login context for a URL-locked tenant', async () => {
+  const requests: Request[] = [];
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async (input, init) => {
+    requests.push(new Request(input, init));
+    return Response.json({
+      tenantId: 'tenant-a',
+      branding: { title: '租户 A', subtitle: '租户专属工作台' },
+    });
+  };
+
+  try {
+    const context = await createAuthClient(createHttpClient({ baseUrl: 'http://api.local' })).loginContext(
+      'tenant-a',
+    );
+
+    assert.equal(requests.length, 1);
+    assert.equal(requests[0].url, 'http://api.local/iam.auth/login-context?tenantId=tenant-a');
+    assert.equal(context.branding?.title, '租户 A');
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
 it('auth change own password posts bearer token to backend endpoint', async () => {
   const requests: Request[] = [];
   const originalFetch = globalThis.fetch;

From fb2a30fbceda2ce93e0f05ffb7686be8715189c9 Mon Sep 17 00:00:00 2001
From: Liu Rui <lovearuis@gmail.com>
Date: Fri, 14 Aug 2026 17:47:31 +0800
Subject: [PATCH 2/2] =?UTF-8?q?fix:=20=E6=94=B6=E6=95=9B=E7=A7=9F=E6=88=B7?=
 =?UTF-8?q?=E7=99=BB=E5=BD=95=E5=85=A5=E5=8F=A3=E5=A5=91=E7=BA=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../topics/identity-permission/WEB_API.md     |  2 +-
 .../spring/iam/web/LoginWebController.java    |  2 +
 .../iam/web/LoginWebControllerTest.java       | 35 +++++++++++++
 .../StaticModuleDefinitionScannerTest.java    |  9 +++-
 muyun-web/src/App.vue                         |  6 ++-
 muyun-web/src/app/LoginView.vue               | 11 ++--
 muyun-web/src/web-core/clients.ts             | 15 ++++--
 .../tests/app/LoginView.component.test.ts     | 51 +++++++++++++++----
 muyun-web/tests/web-core/webCore.test.ts      |  7 +--
 9 files changed, 116 insertions(+), 22 deletions(-)

diff --git a/docs/platform/topics/identity-permission/WEB_API.md b/docs/platform/topics/identity-permission/WEB_API.md
index 44c35995..69a4b5a3 100644
--- a/docs/platform/topics/identity-permission/WEB_API.md
+++ b/docs/platform/topics/identity-permission/WEB_API.md
@@ -9,7 +9,7 @@
 | 方法   | URL                 | 功能                                                                                               |
 | ------ | ------------------- | -------------------------------------------------------------------------------------------------- |
 | `POST` | `/iam.auth/login`   | 用户登录。请求包含 `tenantId`、`username`、`password`；返回 Bearer token、当前登录 `sessionId`、签发时间和当前用户信息。 |
-| `GET`  | `/iam.auth/login-context?tenantId={tenantId}` | 匿名读取 URL 锁定租户的公开登录上下文。仅返回锁定租户标识及工作台品牌投影，供标准登录页展示 Logo、主标题和副标题；目标租户必须处于启用状态。 |
+| `GET`  | `/iam.auth/login-context?tenantId={tenantId}` | 匿名读取 URL 锁定租户的公开登录上下文。该端点以平台 `ANONYMOUS_ALLOWED` 动作登记并经统一策略链路执行；仅返回锁定租户标识及工作台品牌投影，供标准登录页展示 Logo、主标题和副标题；目标租户必须处于启用状态。 |
 | `POST` | `/iam.auth/logout`  | 当前 Bearer token 登出。token 从 `Authorization: Bearer ...` 读取。                                |
 | `GET`  | `/iam.auth/context` | 返回当前请求解析出的用户上下文，用于前端会话恢复和启动态确认。                                     |
 | `GET`  | `/iam.auth/tenant-branding` | 返回当前租户的工作台品牌投影（`lightLogo`、可选的 `darkLogo`）；Logo 以受限 Base64 图片 data URL 保存。 |
diff --git a/muyun-iam-web/src/main/java/net/ximatai/muyun/spring/iam/web/LoginWebController.java b/muyun-iam-web/src/main/java/net/ximatai/muyun/spring/iam/web/LoginWebController.java
index 29757c91..398c7258 100644
--- a/muyun-iam-web/src/main/java/net/ximatai/muyun/spring/iam/web/LoginWebController.java
+++ b/muyun-iam-web/src/main/java/net/ximatai/muyun/spring/iam/web/LoginWebController.java
@@ -106,6 +106,8 @@ public TenantBranding tenantBranding() {
      * Resolves branding for a tenant explicitly selected by the unauthenticated login entry.
      */
     @GetMapping("/login-context")
+    @CustomActionEndpoint(value = "loginContext", title = "获取登录入口上下文",
+            accessMode = ActionAccessMode.ANONYMOUS_ALLOWED, actionAuth = false, dataAuth = false)
     public TenantLoginContext loginContext(@RequestParam String tenantId) {
         TenantService service = requireTenantService();
         service.requireActiveTenant(tenantId);
diff --git a/muyun-iam-web/src/test/java/net/ximatai/muyun/spring/iam/web/LoginWebControllerTest.java b/muyun-iam-web/src/test/java/net/ximatai/muyun/spring/iam/web/LoginWebControllerTest.java
index ad4a4e3c..fd810f4f 100644
--- a/muyun-iam-web/src/test/java/net/ximatai/muyun/spring/iam/web/LoginWebControllerTest.java
+++ b/muyun-iam-web/src/test/java/net/ximatai/muyun/spring/iam/web/LoginWebControllerTest.java
@@ -6,6 +6,9 @@
 import net.ximatai.muyun.spring.common.exception.PlatformErrorCodes;
 import net.ximatai.muyun.spring.common.identity.CurrentUser;
 import net.ximatai.muyun.spring.common.identity.CurrentUserContext;
+import net.ximatai.muyun.spring.common.platform.ActionAuthorizationResult;
+import net.ximatai.muyun.spring.common.platform.ActionExecutionContext;
+import net.ximatai.muyun.spring.common.platform.ActionExecutionPolicyService;
 import net.ximatai.muyun.spring.common.tenant.TenantContext;
 import net.ximatai.muyun.spring.iam.user.UserSessionService;
 import net.ximatai.muyun.spring.iam.user.CurrentUserProfile;
@@ -13,6 +16,8 @@
 import net.ximatai.muyun.spring.iam.tenant.TenantBranding;
 import net.ximatai.muyun.spring.iam.tenant.Tenant;
 import net.ximatai.muyun.spring.iam.tenant.TenantService;
+import net.ximatai.muyun.spring.platform.web.ActionEndpointContextResolver;
+import net.ximatai.muyun.spring.platform.web.ActionEndpointInterceptor;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.test.web.servlet.MockMvc;
@@ -21,6 +26,7 @@
 import java.util.Optional;
 
 import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.nullable;
 import static org.mockito.ArgumentMatchers.isNull;
 import static org.mockito.Mockito.verify;
@@ -114,6 +120,35 @@ void shouldExposeActiveLockedTenantBrandingBeforeAuthentication() throws Excepti
         verify(tenantService).branding("tenant-a");
     }
 
+    @Test
+    void shouldAuthorizePublicLoginContextThroughThePlatformActionChain() throws Exception {
+        TenantService tenantService = mock(TenantService.class);
+        when(tenantService.requireActiveTenant("tenant-a")).thenReturn(mock(Tenant.class));
+        when(tenantService.branding("tenant-a")).thenReturn(TenantBranding.empty());
+        ActionExecutionPolicyService policyService = mock(ActionExecutionPolicyService.class);
+        when(policyService.authorize(any(ActionExecutionContext.class)))
+                .thenAnswer(invocation -> ActionAuthorizationResult.allowed(invocation.getArgument(0)));
+        LoginWebController controller = new LoginWebController(mock(UserSessionService.class), tenantService);
+        MockMvc mvc = MockMvcBuilders.standaloneSetup(controller)
+                .addInterceptors(new ActionEndpointInterceptor(policyService, new ActionEndpointContextResolver()))
+                .build();
+
+        mvc.perform(get("/iam.auth/login-context").param("tenantId", "tenant-a"))
+                .andExpect(status().isOk());
+
+        org.mockito.ArgumentCaptor<ActionExecutionContext> context =
+                org.mockito.ArgumentCaptor.forClass(ActionExecutionContext.class);
+        verify(policyService).authorize(context.capture());
+        org.assertj.core.api.Assertions.assertThat(context.getValue()).satisfies(value -> {
+            org.assertj.core.api.Assertions.assertThat(value.moduleAlias()).isEqualTo("iam.user");
+            org.assertj.core.api.Assertions.assertThat(value.actionCode()).isEqualTo("loginContext");
+            org.assertj.core.api.Assertions.assertThat(value.actionPolicy().accessMode().name())
+                    .isEqualTo("ANONYMOUS_ALLOWED");
+            org.assertj.core.api.Assertions.assertThat(value.actionPolicy().actionAuth()).isFalse();
+            org.assertj.core.api.Assertions.assertThat(value.actionPolicy().dataAuth()).isFalse();
+        });
+    }
+
     @Test
     void shouldReturnUnauthorizedWhenLoginCredentialsAreInvalid() throws Exception {
         UserSessionService userSessionService = mock(UserSessionService.class);
diff --git a/muyun-platform-web/src/test/java/net/ximatai/muyun/spring/platform/web/StaticModuleDefinitionScannerTest.java b/muyun-platform-web/src/test/java/net/ximatai/muyun/spring/platform/web/StaticModuleDefinitionScannerTest.java
index e2d5be79..544ef806 100644
--- a/muyun-platform-web/src/test/java/net/ximatai/muyun/spring/platform/web/StaticModuleDefinitionScannerTest.java
+++ b/muyun-platform-web/src/test/java/net/ximatai/muyun/spring/platform/web/StaticModuleDefinitionScannerTest.java
@@ -348,13 +348,20 @@ void shouldScanIamStaticModulesAndActionsFromControllerAnnotations() {
                         .containsExactlyInAnyOrder("menu", "create", "view", "update", "delete", "query",
                                 "enable", "disable", "userSelector", "changePassword", "resetPassword",
                                 "forceLogout", "sessions", "sessionStatuses", "revokeSession", "revokeSessions",
-                                "employeeBinding", "selfProfile");
+                                "employeeBinding", "selfProfile", "loginContext");
                 assertThat(definition.actions()).filteredOn(action -> action.actionCode().equals("selfProfile"))
                         .singleElement()
                         .satisfies(action -> {
                             assertThat(action.accessMode()).isEqualTo(EntityActionAccessMode.LOGIN_REQUIRED);
                             assertThat(action.actionAuth()).isFalse();
                         });
+                assertThat(definition.actions()).filteredOn(action -> action.actionCode().equals("loginContext"))
+                        .singleElement()
+                        .satisfies(action -> {
+                            assertThat(action.accessMode()).isEqualTo(EntityActionAccessMode.ANONYMOUS_ALLOWED);
+                            assertThat(action.actionAuth()).isFalse();
+                            assertThat(action.dataAuth()).isFalse();
+                        });
                 assertThat(definition.actions()).filteredOn(action -> action.actionCode().equals("userSelector"))
                         .singleElement()
                         .satisfies(action -> {
diff --git a/muyun-web/src/App.vue b/muyun-web/src/App.vue
index 059e4937..643e9e8d 100644
--- a/muyun-web/src/App.vue
+++ b/muyun-web/src/App.vue
@@ -22,6 +22,7 @@ import {
   configureModuleContext,
   createModuleContext,
   createAuthClient,
+  createLoginContextClient,
   provideModuleContextConfig,
   userPreferences,
   type AppError,
@@ -166,7 +167,9 @@ provideCurrentUserContext(currentUser);
 providePlatformTimeZoneContext(currentTimeZone);
 provideWorkbenchNavigation({ openPage: handleOpenPage, replacePage: handleReplacePage });
 
-const authClient = createAuthClient(createBackendHttpClient({ withAuth: false }));
+const anonymousHttpClient = createBackendHttpClient({ withAuth: false });
+const authClient = createAuthClient(anonymousHttpClient);
+const loginContextClient = createLoginContextClient(anonymousHttpClient);
 
 configureAuthenticationRecovery((error, token) => {
   if (!isCurrentAuthToken(token)) {
@@ -820,6 +823,7 @@ function requiresLogin(cause: unknown) {
     <LoginView
       v-if="loginRequired"
       :auth-client="authClient"
+      :login-context-client="loginContextClient"
       :loading="loginLoading"
       :error="error"
       @authenticated="handleAuthenticated"
diff --git a/muyun-web/src/app/LoginView.vue b/muyun-web/src/app/LoginView.vue
index 49a56849..246c00a7 100644
--- a/muyun-web/src/app/LoginView.vue
+++ b/muyun-web/src/app/LoginView.vue
@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import { computed, onMounted, ref } from 'vue';
-import type { AuthClient } from '@muyun/web-core';
+import type { AuthClient, LoginContextClient } from '@muyun/web-core';
 import type { LoginResult, TenantBranding } from '@muyun/web-contracts';
 import { UiButton, UiInput } from '@muyun/vue-ui-antdv';
 import { normalizeInitialValue, resolveLoginTenantDefaults } from './loginTenant';
@@ -9,6 +9,7 @@ defineOptions({ name: 'LoginView' });
 
 const props = defineProps<{
   authClient: AuthClient;
+  loginContextClient?: LoginContextClient;
   loading?: boolean;
   error?: string;
   /** Used only when the form is first created; URL-locked tenants always take precedence. */
@@ -37,6 +38,7 @@ const tenantBranding = ref<TenantBranding>();
 const loginContextLoading = ref(false);
 const loginContextError = ref<string>();
 const canSubmit = computed(() => !tenantLocked || (!loginContextLoading.value && !loginContextError.value));
+const showLoginTitleArea = computed(() => tenantBranding.value?.mode !== 'logoOnly');
 const loginTitle = computed(() => tenantBranding.value?.title || '平台登录');
 const loginSubtitle = computed(() => tenantBranding.value?.subtitle);
 
@@ -46,7 +48,10 @@ onMounted(async () => {
   }
   loginContextLoading.value = true;
   try {
-    const context = await props.authClient.loginContext(tenantId.value);
+    if (!props.loginContextClient) {
+      throw new Error('login context client is unavailable');
+    }
+    const context = await props.loginContextClient.loginContext(tenantId.value);
     tenantBranding.value = context.branding;
   } catch {
     loginContextError.value = '无法打开该租户的登录入口';
@@ -119,7 +124,7 @@ async function submitPasswordChange() {
       <header>
         <div class="login-brand">
           <img v-if="tenantBranding?.lightLogo" class="login-logo" :src="tenantBranding.lightLogo" alt="" />
-          <div>
+          <div v-if="showLoginTitleArea">
             <p v-if="!tenantBranding?.lightLogo">MuYun Platform</p>
             <h1>{{ loginTitle }}</h1>
             <p v-if="loginSubtitle" class="login-subtitle">{{ loginSubtitle }}</p>
diff --git a/muyun-web/src/web-core/clients.ts b/muyun-web/src/web-core/clients.ts
index ba903dbb..4d026fd4 100644
--- a/muyun-web/src/web-core/clients.ts
+++ b/muyun-web/src/web-core/clients.ts
@@ -30,13 +30,17 @@ export interface PageBootstrapClient {
 
 export interface AuthClient {
   login(request: LoginRequest): Promise<LoginResult>;
-  loginContext(tenantId: string): Promise<TenantLoginContext>;
   changeOwnPassword(request: ChangeOwnPasswordRequest, token: string): Promise<void>;
   currentProfile(token: string): Promise<CurrentUserProfile>;
   updateCurrentProfile(request: UpdateCurrentUserProfileRequest, token: string): Promise<CurrentUserProfile>;
   logout(token?: string): Promise<void>;
 }
 
+/** Resolves the public context used by a tenant-locked login entry. */
+export interface LoginContextClient {
+  loginContext(tenantId: string): Promise<TenantLoginContext>;
+}
+
 export function createSessionClient(http: HttpClient): SessionClient {
   return {
     current: () => http.request<CurrentUser>({ path: '/iam.auth/context' }),
@@ -44,6 +48,13 @@ export function createSessionClient(http: HttpClient): SessionClient {
   };
 }
 
+export function createLoginContextClient(http: HttpClient): LoginContextClient {
+  return {
+    loginContext: (tenantId) =>
+      http.request<TenantLoginContext>({ path: '/iam.auth/login-context', query: { tenantId } }),
+  };
+}
+
 export function createMenuClient(http: HttpClient): MenuClient {
   return {
     mine: async () => normalizeMenuMineResponse(await http.request<unknown>({ path: '/platform.menu/mine' })),
@@ -111,8 +122,6 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 export function createAuthClient(http: HttpClient): AuthClient {
   return {
     login: (request) => http.request<LoginResult>({ method: 'POST', path: '/iam.auth/login', body: request }),
-    loginContext: (tenantId) =>
-      http.request<TenantLoginContext>({ path: '/iam.auth/login-context', query: { tenantId } }),
     changeOwnPassword: (request, token) =>
       http.request<void>({
         method: 'POST',
diff --git a/muyun-web/tests/app/LoginView.component.test.ts b/muyun-web/tests/app/LoginView.component.test.ts
index 1ec8884c..54ac5bbb 100644
--- a/muyun-web/tests/app/LoginView.component.test.ts
+++ b/muyun-web/tests/app/LoginView.component.test.ts
@@ -1,7 +1,8 @@
 import { flushPromises, mount } from '@vue/test-utils';
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import LoginView from '@/app/LoginView.vue';
-import type { AuthClient } from '@/web-core/clients';
+import type { AuthClient, LoginContextClient } from '@/web-core/clients';
+import type { TenantBranding } from '@/web-contracts';
 
 describe('LoginView', () => {
   afterEach(() => {
@@ -12,6 +13,7 @@ describe('LoginView', () => {
     const wrapper = mount(LoginView, {
       props: {
         authClient: authClient(),
+        loginContextClient: loginContextClient(),
         initialUsername: 'xcmg',
       },
     });
@@ -22,7 +24,7 @@ describe('LoginView', () => {
   it('uses locked tenant branding from the platform login context', async () => {
     window.history.replaceState({}, '', '/?tenant=tenant-a');
     const wrapper = mount(LoginView, {
-      props: { authClient: authClient() },
+      props: { authClient: authClient(), loginContextClient: loginContextClient() },
     });
 
     await flushPromises();
@@ -33,22 +35,51 @@ describe('LoginView', () => {
     expect(wrapper.find('input[placeholder="留空进入系统工作区"]').exists()).toBe(false);
     expect(wrapper.find('.login-brand > .login-logo').exists()).toBe(true);
   });
+
+  it('keeps logo-only branding consistent with the workbench', async () => {
+    window.history.replaceState({}, '', '/?tenant=tenant-a');
+    const wrapper = mount(LoginView, {
+      props: {
+        authClient: authClient(),
+        loginContextClient: loginContextClient({
+          lightLogo: 'data:image/png;base64,bGlnaHQ=',
+          mode: 'logoOnly',
+          title: '租户 A',
+          subtitle: '租户专属工作台',
+        }),
+      },
+    });
+
+    await flushPromises();
+
+    expect(wrapper.find('.login-logo').exists()).toBe(true);
+    expect(wrapper.text()).not.toContain('租户 A');
+    expect(wrapper.text()).not.toContain('租户专属工作台');
+    expect(wrapper.text()).not.toContain('平台登录');
+  });
 });
 
 function authClient(): AuthClient {
   return {
     login: vi.fn(),
-    loginContext: vi.fn().mockResolvedValue({
-      tenantId: 'tenant-a',
-      branding: {
-        lightLogo: 'data:image/png;base64,bGlnaHQ=',
-        title: '租户 A',
-        subtitle: '租户专属工作台',
-      },
-    }),
     changeOwnPassword: vi.fn(),
     currentProfile: vi.fn(),
     updateCurrentProfile: vi.fn(),
     logout: vi.fn(),
   };
 }
+
+function loginContextClient(
+  branding: TenantBranding = {
+    lightLogo: 'data:image/png;base64,bGlnaHQ=',
+    title: '租户 A',
+    subtitle: '租户专属工作台',
+  },
+): LoginContextClient {
+  return {
+    loginContext: vi.fn().mockResolvedValue({
+      tenantId: 'tenant-a',
+      branding,
+    }),
+  };
+}
diff --git a/muyun-web/tests/web-core/webCore.test.ts b/muyun-web/tests/web-core/webCore.test.ts
index 398d7963..a4d7fcf2 100644
--- a/muyun-web/tests/web-core/webCore.test.ts
+++ b/muyun-web/tests/web-core/webCore.test.ts
@@ -5,6 +5,7 @@ import {
   AppError,
   configureModuleContext,
   createAuthClient,
+  createLoginContextClient,
   createHttpClient,
   createMenuClient,
   createPageBootstrapClient,
@@ -182,9 +183,9 @@ it('auth client resolves the public login context for a URL-locked tenant', asyn
   };
 
   try {
-    const context = await createAuthClient(createHttpClient({ baseUrl: 'http://api.local' })).loginContext(
-      'tenant-a',
-    );
+    const context = await createLoginContextClient(
+      createHttpClient({ baseUrl: 'http://api.local' }),
+    ).loginContext('tenant-a');
 
     assert.equal(requests.length, 1);
     assert.equal(requests[0].url, 'http://api.local/iam.auth/login-context?tenantId=tenant-a');