Move administrator controls into avatar menu

webapp.html

@@ -1614,48 +1614,8 @@ function vOps(m){
         <button class="btn" id="r_go" style="width:100%;justify-content:center">${I('replace',15)} 开始替换</button>
       </div>
     </div>
-    <div>
-    <!-- 🆕 白名单：在这里随时增删，不用改环境变量 -->
-    <div class="ops-c" data-rv>
-      <div class="cmp-t">${I('shield-check')} 访问控制</div>
-      <div class="cmp-s">谁能进这个控制台、谁能用机器人指令</div>
-      <div id="aclBox"><div class="fld-h" style="padding:14px 0">读取中…</div></div>
-      <div id="aclAdd" data-form="${esc(`<div class="sec-t">放行新用户</div>`+fld('Telegram 用户 ID',inp('acl_uid','','例如 88888888'),'让对方把 @userinfobot 的回复截图发你，或在机器人里发 /admin add &lt;ID&gt;')+`<button class="btn btn-acc" id="acl_add" style="width:100%;justify-content:center">${I('user-plus',15)} 加入白名单</button>`)}"></div>
-    </div>
-    </div>
-  </div>
-  <div class="ops-c" data-rv style="margin-top:20px">
-    <div class="cmp-t">${I('key-round')} 获取 Session</div>
-    <div class="cmp-s">仅主人可用 · 登录后自动保存并启用 Userbot，无需复制 Session · 需要服务端配置 API_ID / API_HASH</div>
-    <div id="sessionBox" class="fld-h">读取登录状态…</div>
   </div>
   <div class="foot" data-rv><span>危险操作请二次确认</span><span>OPS MODULE</span></div>`;
-  const sessionBox=$('#sessionBox',m);
-  const drawSession=(j)=>{
-    const stage=j.stage||'phone',st=j.status||{};
-    sessionBox.innerHTML=`<div class="cmp-s">${esc(j.msg|| (st.has?`已保存 · ${st.live?'在线':'未连接'} · ${st.name||''}`:'尚未保存 Session'))}</div>
-      ${stage==='phone'?fld('手机号（含国家码）',inp('session_value','','+8613800138000','tel','autocomplete="off"')):stage==='code'?fld('Telegram 验证码',inp('session_value','','输入验证码','text','autocomplete="one-time-code" inputmode="numeric"')):fld('两步验证密码',inp('session_value','','输入两步验证密码','password','autocomplete="off"'))}
-      <div style="display:flex;gap:8px;flex-wrap:wrap"><button class="btn btn-acc" id="session_submit">${stage==='phone'?'获取验证码':stage==='code'?'验证登录':'提交密码'}</button><button class="btn" id="session_cancel">取消登录</button><button class="btn" id="session_refresh">刷新状态</button></div>`;
-    const run=async(action)=>{
-      const input=$('#session_value',sessionBox),value=input.value;
-      if(action!=='cancel'&&!value.trim())return toast('请填写登录信息','err');
-      $$('button',sessionBox).forEach(b=>b.disabled=true);
-      try{
-        const body={action};if(action!=='cancel')body[stage==='phone'?'phone':stage]=value;
-        const result=await api('/api/userbot/session',{method:'POST',body});
-        input.value='';drawSession(result);toast(result.msg);
-      }catch(e){input.value='';toast(e.message,'err')}
-      finally{$$('button',sessionBox).forEach(b=>b.disabled=false)}
-    };
-    $('#session_submit',sessionBox).onclick=()=>run(stage==='phone'?'start':stage);
-    $('#session_cancel',sessionBox).onclick=()=>run('cancel');
-    $('#session_refresh',sessionBox).onclick=loadSession;
-  };
-  const loadSession=async()=>{
-    if(DEMO){sessionBox.textContent='演示模式不支持登录，请勿输入真实手机号、验证码或密码。';return}
-    try{drawSession(await api('/api/userbot/session'))}catch(e){sessionBox.textContent=e.message}
-  };
-  loadSession();
   bindPicker('b_src',m);bindPicker('r_ch',m);bindPicker('sp_ch',m);
   const backupBox=$('#b_progress',m);
   const refreshBackup=async()=>{
@@ -1731,7 +1691,6 @@ function vOps(m){
     }catch(err){toast(err.message,'err')}
     btn.disabled=false;
   };
-  loadAcl(m);
 }
 
 function vMembers(m){
@@ -1927,6 +1886,47 @@ async function memSheet(cid){
   };
   draw();
 }
+function adminMenu(){
+  const w=sheet({title:'管理员',body:`<div style="display:grid;gap:12px"><button class="btn" id="admin_acl">${I('shield-check',16)} 访问控制</button><button class="btn" id="admin_session">${I('key-round',16)} 获取 Session</button></div>`});
+  icons();
+  $('#admin_acl',w).onclick=()=>{w._close();openAccessControl()};
+  $('#admin_session',w).onclick=()=>{w._close();openSessionControl()};
+}
+function openAccessControl(){
+  const m=sheet({title:'访问控制',body:`      <div id="aclBox"><div class="fld-h" style="padding:14px 0">读取中…</div></div>
+      <div id="aclAdd" data-form="${esc(`<div class="sec-t">放行新用户</div>`+fld('Telegram 用户 ID',inp('acl_uid','','例如 88888888'),'让对方把 @userinfobot 的回复截图发你，或在机器人里发 /admin add &lt;ID&gt;')+`<button class="btn btn-acc" id="acl_add" style="width:100%;justify-content:center">${I('user-plus',15)} 加入白名单</button>`)}"></div>`});
+  loadAcl(m);
+}
+function openSessionControl(){
+  const m=sheet({title:'获取 Session',body:'<div id="sessionBox" class="fld-h">读取登录状态…</div>'});
+  const sessionBox=$('#sessionBox',m);
+  const drawSession=(j)=>{
+    const stage=j.stage||'phone',st=j.status||{};
+    sessionBox.innerHTML=`<div class="cmp-s">${esc(j.msg|| (st.has?`已保存 · ${st.live?'在线':'未连接'} · ${st.name||''}`:'尚未保存 Session'))}</div>
+      ${stage==='phone'?fld('手机号（含国家码）',inp('session_value','','+8613800138000','tel','autocomplete="off"')):stage==='code'?fld('Telegram 验证码',inp('session_value','','输入验证码','text','autocomplete="one-time-code" inputmode="numeric"')):fld('两步验证密码',inp('session_value','','输入两步验证密码','password','autocomplete="off"'))}
+      <div style="display:flex;gap:8px;flex-wrap:wrap"><button class="btn btn-acc" id="session_submit">${stage==='phone'?'获取验证码':stage==='code'?'验证登录':'提交密码'}</button><button class="btn" id="session_cancel">取消登录</button><button class="btn" id="session_refresh">刷新状态</button></div>`;
+    const run=async(action)=>{
+      const input=$('#session_value',sessionBox),value=input.value;
+      if(action!=='cancel'&&!value.trim())return toast('请填写登录信息','err');
+      $$('button',sessionBox).forEach(b=>b.disabled=true);
+      try{
+        const body={action};if(action!=='cancel')body[stage==='phone'?'phone':stage]=value;
+        const result=await api('/api/userbot/session',{method:'POST',body});
+        input.value='';drawSession(result);toast(result.msg);
+      }catch(e){input.value='';toast(e.message,'err')}
+      finally{$$('button',sessionBox).forEach(b=>b.disabled=false)}
+    };
+    $('#session_submit',sessionBox).onclick=()=>run(stage==='phone'?'start':stage);
+    $('#session_cancel',sessionBox).onclick=()=>run('cancel');
+    $('#session_refresh',sessionBox).onclick=loadSession;
+  };
+  const loadSession=async()=>{
+    if(DEMO){sessionBox.textContent='演示模式不支持登录，请勿输入真实手机号、验证码或密码。';return}
+    try{drawSession(await api('/api/userbot/session'))}catch(e){sessionBox.textContent=e.message}
+  };
+  loadSession();
+}
+
 /* 🆕 白名单面板 */
 async function loadAcl(m,retry=0){
   try{
@@ -2029,6 +2029,10 @@ function renderMe(){
   const img=$('img.av',box);
   if(img){let i=0;img.onerror=()=>{i++;if(srcs[i])img.src=srcs[i];else img.outerHTML=`<span class="av">${initials}</span>`}}
   box.style.display='flex';
+  box.setAttribute('role','button');box.setAttribute('tabindex','0');
+  box.setAttribute('aria-label','管理员设置');box.style.cursor='pointer';
+  box.onclick=adminMenu;
+  box.onkeydown=e=>{if(e.key==='Enter'||e.key===' '){e.preventDefault();adminMenu()}};
 }
 
 /* ================= 🆕 09 榜单完整名单（在 Telegram 内打开） ================= */