Merge pull request #220 from cita-777/codex/webdav-backup-armv7l

Add WebDAV backup sync and armv7 Docker builds

src/server/index.ts

@@ -31,6 +31,7 @@ import { migrateSiteApiKeysToAccounts } from './services/siteApiKeyMigrationServ
 import { ensureDefaultSitesSeeded } from './services/defaultSiteSeedService.js';
 import { startOAuthLoopbackCallbackServers, stopOAuthLoopbackCallbackServers } from './services/oauth/localCallbackServer.js';
 import { startSiteAnnouncementPolling } from './services/siteAnnouncementPollingService.js';
+import { reloadBackupWebdavScheduler } from './services/backupService.js';
 import { ensureRuntimeDatabaseReady } from './runtimeDatabaseBootstrap.js';
 import { isPublicApiRoute, registerDesktopRoutes } from './desktop.js';
 import { existsSync } from 'fs';
@@ -400,6 +401,7 @@ if (existsSync(webDir)) {
 
 // Start scheduler
 await startScheduler();
+await reloadBackupWebdavScheduler();
 startSiteAnnouncementPolling();
 try {
   await startOAuthLoopbackCallbackServers();

src/server/routes/api/settings.backup-webdav.test.ts

@@ -0,0 +1,114 @@
+import Fastify, { type FastifyInstance } from 'fastify';
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+import { mkdtempSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { eq } from 'drizzle-orm';
+
+type DbModule = typeof import('../../db/index.js');
+
+describe('settings backup webdav api', () => {
+  let app: FastifyInstance;
+  let db: DbModule['db'];
+  let schema: DbModule['schema'];
+  let dataDir = '';
+
+  beforeAll(async () => {
+    dataDir = mkdtempSync(join(tmpdir(), 'metapi-settings-backup-webdav-'));
+    process.env.DATA_DIR = dataDir;
+    await import('../../db/migrate.js');
+    const dbModule = await import('../../db/index.js');
+    const settingsRoutesModule = await import('./settings.js');
+
+    db = dbModule.db;
+    schema = dbModule.schema;
+
+    app = Fastify();
+    await app.register(settingsRoutesModule.settingsRoutes);
+  });
+
+  beforeEach(async () => {
+    await db.delete(schema.settings).run();
+    await db.delete(schema.events).run();
+  });
+
+  afterAll(async () => {
+    await app.close();
+    delete process.env.DATA_DIR;
+  });
+
+  it('saves and returns masked webdav config', async () => {
+    const response = await app.inject({
+      method: 'PUT',
+      url: '/api/settings/backup/webdav',
+      payload: {
+        enabled: true,
+        fileUrl: 'https://dav.example.com/backups/metapi.json',
+        username: 'alice',
+        password: 'secret-pass',
+        exportType: 'accounts',
+        autoSyncEnabled: true,
+        autoSyncCron: '0 */6 * * *',
+      },
+    });
+
+    expect(response.statusCode).toBe(200);
+    const body = response.json() as {
+      success?: boolean;
+      config?: {
+        fileUrl?: string;
+        username?: string;
+        exportType?: string;
+        autoSyncEnabled?: boolean;
+        autoSyncCron?: string;
+        hasPassword?: boolean;
+        passwordMasked?: string;
+      };
+    };
+    expect(body.success).toBe(true);
+    expect(body.config).toMatchObject({
+      fileUrl: 'https://dav.example.com/backups/metapi.json',
+      username: 'alice',
+      exportType: 'accounts',
+      autoSyncEnabled: true,
+      autoSyncCron: '0 */6 * * *',
+      hasPassword: true,
+    });
+    expect(body.config?.passwordMasked).toBeTruthy();
+
+    const saved = await db.select().from(schema.settings).where(eq(schema.settings.key, 'backup_webdav_config_v1')).get();
+    expect(saved?.value).toContain('"fileUrl":"https://dav.example.com/backups/metapi.json"');
+    expect(saved?.value).toContain('"password":"secret-pass"');
+  });
+
+  it('exports current backup to webdav through settings route', async () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch');
+    fetchSpy.mockResolvedValue(new Response(null, { status: 201 }));
+
+    await db.insert(schema.settings).values({
+      key: 'backup_webdav_config_v1',
+      value: JSON.stringify({
+        enabled: true,
+        fileUrl: 'https://dav.example.com/backups/metapi.json',
+        username: 'alice',
+        password: 'secret-pass',
+        exportType: 'all',
+        autoSyncEnabled: false,
+        autoSyncCron: '0 * * * *',
+      }),
+    }).run();
+
+    const response = await app.inject({
+      method: 'POST',
+      url: '/api/settings/backup/webdav/export',
+    });
+
+    expect(response.statusCode).toBe(200);
+    const body = response.json() as { success?: boolean; fileUrl?: string };
+    expect(body.success).toBe(true);
+    expect(body.fileUrl).toBe('https://dav.example.com/backups/metapi.json');
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+
+    fetchSpy.mockRestore();
+  });
+});

src/server/routes/api/settings.ts

@@ -7,7 +7,16 @@ import { upsertSetting } from '../../db/upsertSetting.js';
 import { refreshModelsAndRebuildRoutes } from '../../services/modelService.js';
 import { updateBalanceRefreshCron, updateCheckinSchedule, updateLogCleanupSettings } from '../../services/checkinScheduler.js';
 import { sendNotification } from '../../services/notifyService.js';
-import { exportBackup, importBackup, type BackupExportType } from '../../services/backupService.js';
+import {
+  exportBackup,
+  exportBackupToWebdav,
+  getBackupWebdavConfig,
+  importBackup,
+  importBackupFromWebdav,
+  reloadBackupWebdavScheduler,
+  saveBackupWebdavConfig,
+  type BackupExportType,
+} from '../../services/backupService.js';
 import { startBackgroundTask } from '../../services/backgroundTaskService.js';
 import {
   maskConnectionString,
@@ -75,6 +84,17 @@ interface SystemProxyTestBody {
   proxyUrl?: unknown;
 }
 
+interface BackupWebdavConfigBody {
+  enabled?: unknown;
+  fileUrl?: unknown;
+  username?: unknown;
+  password?: unknown;
+  clearPassword?: unknown;
+  exportType?: unknown;
+  autoSyncEnabled?: unknown;
+  autoSyncCron?: unknown;
+}
+
 type RuntimeDatabaseConfig = {
   dialect: MigrationDialect;
   connectionString: string;
@@ -1267,6 +1287,9 @@ export async function settingsRoutes(app: FastifyInstance) {
       for (const item of result.appliedSettings) {
         applyImportedSettingToRuntime(item.key, item.value);
       }
+      if (result.appliedSettings.some((item) => item.key === 'backup_webdav_config_v1')) {
+        await reloadBackupWebdavScheduler();
+      }
       return {
         success: true,
         message: '导入完成',
@@ -1280,6 +1303,65 @@ export async function settingsRoutes(app: FastifyInstance) {
     }
   });
 
+  app.get('/api/settings/backup/webdav', async () => {
+    return getBackupWebdavConfig();
+  });
+
+  app.put<{ Body: BackupWebdavConfigBody }>('/api/settings/backup/webdav', async (request, reply) => {
+    try {
+      const body = request.body || {};
+      const result = await saveBackupWebdavConfig({
+        enabled: body.enabled === undefined ? undefined : body.enabled === true,
+        fileUrl: body.fileUrl === undefined ? undefined : String(body.fileUrl || ''),
+        username: body.username === undefined ? undefined : String(body.username || ''),
+        password: body.password === undefined ? undefined : String(body.password),
+        clearPassword: body.clearPassword === true,
+        exportType: body.exportType === undefined ? undefined : String(body.exportType || '') as BackupExportType,
+        autoSyncEnabled: body.autoSyncEnabled === undefined ? undefined : body.autoSyncEnabled === true,
+        autoSyncCron: body.autoSyncCron === undefined ? undefined : String(body.autoSyncCron || ''),
+      });
+      return result;
+    } catch (err: any) {
+      return reply.code(400).send({
+        success: false,
+        message: err?.message || 'WebDAV 配置保存失败',
+      });
+    }
+  });
+
+  app.post<{ Body: { type?: string } }>('/api/settings/backup/webdav/export', async (request, reply) => {
+    try {
+      const rawType = typeof request.body?.type === 'string' ? request.body.type.trim().toLowerCase() : '';
+      const type: BackupExportType | undefined = rawType === 'all' || rawType === 'accounts' || rawType === 'preferences'
+        ? rawType
+        : undefined;
+      return await exportBackupToWebdav(type);
+    } catch (err: any) {
+      return reply.code(400).send({
+        success: false,
+        message: err?.message || 'WebDAV 导出失败',
+      });
+    }
+  });
+
+  app.post('/api/settings/backup/webdav/import', async (_, reply) => {
+    try {
+      const result = await importBackupFromWebdav();
+      for (const item of result.appliedSettings) {
+        applyImportedSettingToRuntime(item.key, item.value);
+      }
+      if (result.appliedSettings.some((item) => item.key === 'backup_webdav_config_v1')) {
+        await reloadBackupWebdavScheduler();
+      }
+      return result;
+    } catch (err: any) {
+      return reply.code(400).send({
+        success: false,
+        message: err?.message || 'WebDAV 导入失败',
+      });
+    }
+  });
+
   app.post('/api/settings/notify/test', async (_, reply) => {
     try {
       const result = await sendNotification(

src/server/services/backupService.test.ts

@@ -596,4 +596,254 @@ describe('backupService', () => {
     expect(restoredAccount?.oauthAccountKey).toBe('oauth-user@example.com');
     expect(restoredAccount?.oauthProjectId).toBe('oauth-project-id');
   });
+
+  it('exports configured backup payload to webdav and records sync state', async () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch');
+    fetchSpy.mockResolvedValue(new Response(null, { status: 201 }));
+
+    await db.insert(schema.settings).values({
+      key: 'backup_webdav_config_v1',
+      value: JSON.stringify({
+        enabled: true,
+        fileUrl: 'https://dav.example.com/backups/metapi-preferences.json',
+        username: 'alice',
+        password: 'secret-pass',
+        exportType: 'preferences',
+        autoSyncEnabled: false,
+        autoSyncCron: '0 * * * *',
+      }),
+    }).run();
+    await db.insert(schema.settings).values({
+      key: 'ui_locale',
+      value: JSON.stringify('zh-CN'),
+    }).run();
+
+    const result = await (backupService as any).exportBackupToWebdav();
+
+    expect(result).toMatchObject({
+      success: true,
+      fileUrl: 'https://dav.example.com/backups/metapi-preferences.json',
+      exportType: 'preferences',
+    });
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+    const [targetUrl, init] = fetchSpy.mock.calls[0] as [string, RequestInit];
+    expect(targetUrl).toBe('https://dav.example.com/backups/metapi-preferences.json');
+    expect(init.method).toBe('PUT');
+    expect(init.headers).toMatchObject({
+      Authorization: `Basic ${Buffer.from('alice:secret-pass').toString('base64')}`,
+      'Content-Type': 'application/json',
+    });
+    const payload = JSON.parse(String(init.body));
+    expect(payload.type).toBe('preferences');
+    expect(payload.preferences.settings).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ key: 'ui_locale', value: 'zh-CN' }),
+      ]),
+    );
+
+    const syncState = await db.select().from(schema.settings).where(eq(schema.settings.key, 'backup_webdav_state_v1')).get();
+    expect(syncState?.value).toContain('"lastSyncAt"');
+    expect(syncState?.value).toContain('"lastError":null');
+
+    fetchSpy.mockRestore();
+  });
+
+  it('imports backup payload from webdav into local data', async () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch');
+    const remotePayload = {
+      version: '2.0',
+      timestamp: Date.now(),
+      accounts: {
+        sites: [
+          {
+            id: 1,
+            name: 'remote-site',
+            url: 'https://remote.example.com',
+            platform: 'new-api',
+            externalCheckinUrl: null,
+            proxyUrl: null,
+            useSystemProxy: false,
+            customHeaders: null,
+            status: 'active',
+            isPinned: false,
+            sortOrder: 0,
+            globalWeight: 1,
+            apiKey: null,
+            createdAt: '2026-03-20T00:00:00.000Z',
+            updatedAt: '2026-03-20T00:00:00.000Z',
+          },
+        ],
+        accounts: [
+          {
+            id: 1,
+            siteId: 1,
+            username: 'remote-user',
+            accessToken: 'remote-session',
+            apiToken: null,
+            oauthProvider: null,
+            oauthAccountKey: null,
+            oauthProjectId: null,
+            balance: 0,
+            balanceUsed: 0,
+            quota: 0,
+            unitCost: null,
+            valueScore: 0,
+            status: 'active',
+            isPinned: false,
+            sortOrder: 0,
+            checkinEnabled: false,
+            lastCheckinAt: null,
+            lastBalanceRefresh: null,
+            extraConfig: null,
+            createdAt: '2026-03-20T00:00:00.000Z',
+            updatedAt: '2026-03-20T00:00:00.000Z',
+          },
+        ],
+        accountTokens: [],
+        tokenRoutes: [],
+        routeChannels: [],
+        routeGroupSources: [],
+      },
+    };
+    fetchSpy.mockResolvedValue(new Response(JSON.stringify(remotePayload), {
+      status: 200,
+      headers: { 'content-type': 'application/json' },
+    }));
+
+    await db.insert(schema.settings).values({
+      key: 'backup_webdav_config_v1',
+      value: JSON.stringify({
+        enabled: true,
+        fileUrl: 'https://dav.example.com/backups/metapi-all.json',
+        username: 'alice',
+        password: 'secret-pass',
+        exportType: 'all',
+        autoSyncEnabled: false,
+        autoSyncCron: '0 * * * *',
+      }),
+    }).run();
+
+    const result = await (backupService as any).importBackupFromWebdav();
+
+    expect(result.success).toBe(true);
+    expect(result.sections.accounts).toBe(true);
+    const sites = await db.select().from(schema.sites).all();
+    const accounts = await db.select().from(schema.accounts).all();
+    expect(sites).toHaveLength(1);
+    expect(accounts).toHaveLength(1);
+    expect(accounts[0].username).toBe('remote-user');
+    expect(fetchSpy).toHaveBeenCalledWith(
+      'https://dav.example.com/backups/metapi-all.json',
+      expect.objectContaining({
+        method: 'GET',
+      }),
+    );
+
+    fetchSpy.mockRestore();
+  });
+
+  it('times out stalled webdav export requests', async () => {
+    vi.useFakeTimers();
+    const fetchSpy = vi.spyOn(globalThis, 'fetch');
+    fetchSpy.mockImplementation((_, init) => {
+      const signal = init?.signal as AbortSignal | undefined;
+      if (!signal) {
+        return Promise.reject(new Error('missing abort signal')) as Promise<Response>;
+      }
+      return new Promise<Response>((_, reject) => {
+        signal.addEventListener('abort', () => {
+          reject(Object.assign(new Error('aborted'), { name: 'AbortError' }));
+        }, { once: true });
+      });
+    });
+
+    try {
+      await db.insert(schema.settings).values({
+        key: 'backup_webdav_config_v1',
+        value: JSON.stringify({
+          enabled: true,
+          fileUrl: 'https://dav.example.com/backups/metapi.json',
+          username: 'alice',
+          password: 'secret-pass',
+          exportType: 'all',
+          autoSyncEnabled: false,
+          autoSyncCron: '0 */6 * * *',
+        }),
+      }).run();
+
+      const exportAssertion = expect(backupService.exportBackupToWebdav()).rejects.toThrow('WebDAV 请求超时');
+      await vi.advanceTimersByTimeAsync(16_000);
+      await exportAssertion;
+    } finally {
+      fetchSpy.mockRestore();
+      vi.useRealTimers();
+    }
+  });
+
+  it('times out stalled webdav import requests', async () => {
+    vi.useFakeTimers();
+    const fetchSpy = vi.spyOn(globalThis, 'fetch');
+    fetchSpy.mockImplementation((_, init) => {
+      const signal = init?.signal as AbortSignal | undefined;
+      if (!signal) {
+        return Promise.reject(new Error('missing abort signal')) as Promise<Response>;
+      }
+      return new Promise<Response>((_, reject) => {
+        signal.addEventListener('abort', () => {
+          reject(Object.assign(new Error('aborted'), { name: 'AbortError' }));
+        }, { once: true });
+      });
+    });
+
+    try {
+      await db.insert(schema.settings).values({
+        key: 'backup_webdav_config_v1',
+        value: JSON.stringify({
+          enabled: true,
+          fileUrl: 'https://dav.example.com/backups/metapi.json',
+          username: 'alice',
+          password: 'secret-pass',
+          exportType: 'all',
+          autoSyncEnabled: false,
+          autoSyncCron: '0 */6 * * *',
+        }),
+      }).run();
+
+      const importAssertion = expect(backupService.importBackupFromWebdav()).rejects.toThrow('WebDAV 请求超时');
+      await vi.advanceTimersByTimeAsync(16_000);
+      await importAssertion;
+    } finally {
+      fetchSpy.mockRestore();
+      vi.useRealTimers();
+    }
+  });
+
+  it('does not schedule malformed imported webdav config', async () => {
+    const cronModule = await import('node-cron');
+    const scheduleSpy = vi.spyOn(cronModule.default, 'schedule');
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => { });
+
+    try {
+      await db.insert(schema.settings).values({
+        key: 'backup_webdav_config_v1',
+        value: JSON.stringify({
+          enabled: true,
+          fileUrl: 'not-a-valid-url',
+          username: 'alice',
+          password: 'secret-pass',
+          exportType: 'all',
+          autoSyncEnabled: true,
+          autoSyncCron: '0 */6 * * *',
+        }),
+      }).run();
+
+      await expect(backupService.reloadBackupWebdavScheduler()).resolves.toBeUndefined();
+      expect(scheduleSpy).not.toHaveBeenCalled();
+      expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('invalid config'));
+    } finally {
+      backupService.__resetBackupWebdavSchedulerForTests();
+      scheduleSpy.mockRestore();
+      warnSpy.mockRestore();
+    }
+  });
 });

src/server/services/backupService.ts

@@ -1,4 +1,4 @@
-import { asc } from 'drizzle-orm';
+import { asc, eq } from 'drizzle-orm';
 import cron from 'node-cron';
 import { db, schema } from '../db/index.js';
 import { upsertSetting } from '../db/upsertSetting.js';
@@ -9,6 +9,32 @@ const BACKUP_VERSION = '2.0';
 
 export type BackupExportType = 'all' | 'accounts' | 'preferences';
 
+export interface BackupWebdavConfig {
+  enabled: boolean;
+  fileUrl: string;
+  username: string;
+  password: string;
+  exportType: BackupExportType;
+  autoSyncEnabled: boolean;
+  autoSyncCron: string;
+}
+
+export interface BackupWebdavConfigView {
+  enabled: boolean;
+  fileUrl: string;
+  username: string;
+  exportType: BackupExportType;
+  autoSyncEnabled: boolean;
+  autoSyncCron: string;
+  hasPassword: boolean;
+  passwordMasked: string;
+}
+
+export interface BackupWebdavState {
+  lastSyncAt: string | null;
+  lastError: string | null;
+}
+
 type SiteRow = typeof schema.sites.$inferSelect;
 type AccountRow = typeof schema.accounts.$inferSelect;
 type AccountTokenRow = typeof schema.accountTokens.$inferSelect;
@@ -76,6 +102,11 @@ const EXCLUDED_SETTING_KEYS = new Set<string>([
   // Keep current admin login credential unchanged to avoid accidental lock-out.
   'auth_token',
 ]);
+const BACKUP_WEBDAV_CONFIG_SETTING_KEY = 'backup_webdav_config_v1';
+const BACKUP_WEBDAV_STATE_SETTING_KEY = 'backup_webdav_state_v1';
+const BACKUP_WEBDAV_DEFAULT_AUTO_SYNC_CRON = '0 */6 * * *';
+const BACKUP_WEBDAV_FETCH_TIMEOUT_MS = 15_000;
+let backupWebdavTask: cron.ScheduledTask | null = null;
 
 const DIRECT_API_PLATFORMS = new Set([
   'openai',
@@ -722,6 +753,131 @@ function stringifySettingValue(value: unknown): string {
   return JSON.stringify(value);
 }
 
+function isValidBackupExportType(value: unknown): value is BackupExportType {
+  return value === 'all' || value === 'accounts' || value === 'preferences';
+}
+
+function maskSecret(value: string): string {
+  if (!value) return '';
+  if (value.length <= 4) return '****';
+  return `${value.slice(0, 2)}****${value.slice(-2)}`;
+}
+
+function isValidHttpUrl(raw: string): boolean {
+  if (!raw.trim()) return false;
+  try {
+    const parsed = new URL(raw);
+    return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+  } catch {
+    return false;
+  }
+}
+
+function normalizeBackupWebdavConfig(raw: unknown): BackupWebdavConfig {
+  const source = isRecord(raw) ? raw : {};
+  const exportType = isValidBackupExportType(source.exportType) ? source.exportType : 'all';
+  const autoSyncCron = typeof source.autoSyncCron === 'string' && cron.validate(source.autoSyncCron)
+    ? source.autoSyncCron
+    : BACKUP_WEBDAV_DEFAULT_AUTO_SYNC_CRON;
+
+  return {
+    enabled: source.enabled === true,
+    fileUrl: asString(source.fileUrl),
+    username: asString(source.username),
+    password: typeof source.password === 'string' ? source.password : '',
+    exportType,
+    autoSyncEnabled: source.autoSyncEnabled === true,
+    autoSyncCron,
+  };
+}
+
+function normalizeBackupWebdavState(raw: unknown): BackupWebdavState {
+  const source = isRecord(raw) ? raw : {};
+  return {
+    lastSyncAt: typeof source.lastSyncAt === 'string' && source.lastSyncAt.trim() ? source.lastSyncAt : null,
+    lastError: typeof source.lastError === 'string' && source.lastError.trim() ? source.lastError : null,
+  };
+}
+
+function toBackupWebdavConfigView(config: BackupWebdavConfig): BackupWebdavConfigView {
+  return {
+    enabled: config.enabled,
+    fileUrl: config.fileUrl,
+    username: config.username,
+    exportType: config.exportType,
+    autoSyncEnabled: config.autoSyncEnabled,
+    autoSyncCron: config.autoSyncCron,
+    hasPassword: config.password.length > 0,
+    passwordMasked: maskSecret(config.password),
+  };
+}
+
+async function readSettingValue(key: string): Promise<unknown> {
+  const row = await db.select({ value: schema.settings.value }).from(schema.settings).where(eq(schema.settings.key, key)).get();
+  return parseSettingValue(row?.value ?? null);
+}
+
+async function loadBackupWebdavConfig(): Promise<BackupWebdavConfig> {
+  return normalizeBackupWebdavConfig(await readSettingValue(BACKUP_WEBDAV_CONFIG_SETTING_KEY));
+}
+
+async function loadBackupWebdavState(): Promise<BackupWebdavState> {
+  return normalizeBackupWebdavState(await readSettingValue(BACKUP_WEBDAV_STATE_SETTING_KEY));
+}
+
+async function writeBackupWebdavState(next: BackupWebdavState) {
+  await upsertSetting(BACKUP_WEBDAV_STATE_SETTING_KEY, next);
+}
+
+function resolveBackupWebdavAuthHeader(config: BackupWebdavConfig): string | null {
+  if (!config.username && !config.password) return null;
+  return `Basic ${Buffer.from(`${config.username}:${config.password}`).toString('base64')}`;
+}
+
+function validateBackupWebdavConfig(config: BackupWebdavConfig) {
+  if (config.enabled && !isValidHttpUrl(config.fileUrl)) {
+    throw new Error('WebDAV 文件地址无效，请填写 http/https 文件 URL');
+  }
+  if (!isValidBackupExportType(config.exportType)) {
+    throw new Error('WebDAV 导出类型无效，仅支持 all/accounts/preferences');
+  }
+  if (!cron.validate(config.autoSyncCron)) {
+    throw new Error('WebDAV 自动同步 Cron 表达式无效');
+  }
+  if (config.autoSyncEnabled && !config.enabled) {
+    throw new Error('启用自动同步前请先启用 WebDAV 备份');
+  }
+}
+
+async function fetchBackupWebdav(url: string, init: RequestInit): Promise<Response> {
+  const controller = new AbortController();
+  let timeoutHandle: ReturnType<typeof setTimeout> | null = setTimeout(() => {
+    controller.abort();
+  }, BACKUP_WEBDAV_FETCH_TIMEOUT_MS);
+
+  try {
+    return await fetch(url, {
+      ...init,
+      signal: controller.signal,
+    });
+  } catch (error: any) {
+    if (error?.name === 'AbortError') {
+      throw new Error(`WebDAV 请求超时（${Math.max(1, Math.round(BACKUP_WEBDAV_FETCH_TIMEOUT_MS / 1000))}s）`);
+    }
+    throw error;
+  } finally {
+    if (timeoutHandle) {
+      clearTimeout(timeoutHandle);
+      timeoutHandle = null;
+    }
+  }
+}
+
+function stopBackupWebdavScheduler() {
+  backupWebdavTask?.stop();
+  backupWebdavTask = null;
+}
+
 function isFiniteNumber(value: unknown): value is number {
   return typeof value === 'number' && Number.isFinite(value);
 }
@@ -1103,3 +1259,169 @@ export async function importBackup(data: RawBackupData): Promise<BackupImportRes
     warnings: importMetadata.warnings,
   };
 }
+
+export async function getBackupWebdavConfig() {
+  const [config, state] = await Promise.all([
+    loadBackupWebdavConfig(),
+    loadBackupWebdavState(),
+  ]);
+  return {
+    success: true,
+    config: toBackupWebdavConfigView(config),
+    state,
+  };
+}
+
+export async function saveBackupWebdavConfig(input: Partial<BackupWebdavConfig> & { password?: string; clearPassword?: boolean }) {
+  const existing = await loadBackupWebdavConfig();
+  const next: BackupWebdavConfig = {
+    enabled: input.enabled !== undefined ? input.enabled === true : existing.enabled,
+    fileUrl: input.fileUrl !== undefined ? asString(input.fileUrl) : existing.fileUrl,
+    username: input.username !== undefined ? asString(input.username) : existing.username,
+    password: input.clearPassword
+      ? ''
+      : (input.password !== undefined
+        ? String(input.password)
+        : existing.password),
+    exportType: isValidBackupExportType(input.exportType) ? input.exportType : existing.exportType,
+    autoSyncEnabled: input.autoSyncEnabled !== undefined ? input.autoSyncEnabled === true : existing.autoSyncEnabled,
+    autoSyncCron: typeof input.autoSyncCron === 'string' && input.autoSyncCron.trim()
+      ? input.autoSyncCron.trim()
+      : existing.autoSyncCron,
+  };
+
+  if (!next.enabled) {
+    next.autoSyncEnabled = false;
+  }
+  validateBackupWebdavConfig(next);
+
+  await upsertSetting(BACKUP_WEBDAV_CONFIG_SETTING_KEY, next);
+  await reloadBackupWebdavScheduler();
+  return getBackupWebdavConfig();
+}
+
+export async function exportBackupToWebdav(type?: BackupExportType) {
+  const config = await loadBackupWebdavConfig();
+  validateBackupWebdavConfig(config);
+  if (!config.enabled) {
+    throw new Error('WebDAV 备份未启用');
+  }
+  if (!config.fileUrl) {
+    throw new Error('WebDAV 文件地址不能为空');
+  }
+
+  const exportType = type && isValidBackupExportType(type) ? type : config.exportType;
+  const payload = await exportBackup(exportType);
+  const headers: Record<string, string> = {
+    'Content-Type': 'application/json',
+  };
+  const authHeader = resolveBackupWebdavAuthHeader(config);
+  if (authHeader) headers.Authorization = authHeader;
+
+  try {
+    const response = await fetchBackupWebdav(config.fileUrl, {
+      method: 'PUT',
+      headers,
+      body: JSON.stringify(payload, null, 2),
+    });
+    if (!response.ok) {
+      const text = await response.text().catch(() => '');
+      throw new Error(`WebDAV 导出失败：HTTP ${response.status}${text ? ` ${text.slice(0, 120)}` : ''}`);
+    }
+
+    const syncedAt = new Date().toISOString();
+    await writeBackupWebdavState({
+      lastSyncAt: syncedAt,
+      lastError: null,
+    });
+    return {
+      success: true,
+      fileUrl: config.fileUrl,
+      exportType,
+      syncedAt,
+      lastSyncAt: syncedAt,
+      lastError: null,
+    };
+  } catch (error: any) {
+    const previousState = await loadBackupWebdavState();
+    await writeBackupWebdavState({
+      lastSyncAt: previousState.lastSyncAt,
+      lastError: error?.message || 'WebDAV 导出失败',
+    });
+    throw error;
+  }
+}
+
+export async function importBackupFromWebdav() {
+  const config = await loadBackupWebdavConfig();
+  validateBackupWebdavConfig(config);
+  if (!config.enabled) {
+    throw new Error('WebDAV 备份未启用');
+  }
+  if (!config.fileUrl) {
+    throw new Error('WebDAV 文件地址不能为空');
+  }
+
+  const headers: Record<string, string> = {};
+  const authHeader = resolveBackupWebdavAuthHeader(config);
+  if (authHeader) headers.Authorization = authHeader;
+
+  try {
+    const response = await fetchBackupWebdav(config.fileUrl, {
+      method: 'GET',
+      headers,
+    });
+    if (!response.ok) {
+      const text = await response.text().catch(() => '');
+      throw new Error(`WebDAV 导入失败：HTTP ${response.status}${text ? ` ${text.slice(0, 120)}` : ''}`);
+    }
+
+    const raw = await response.text();
+    const parsed = JSON.parse(raw) as RawBackupData;
+    const result = await importBackup(parsed);
+    const syncedAt = new Date().toISOString();
+    await writeBackupWebdavState({
+      lastSyncAt: syncedAt,
+      lastError: null,
+    });
+
+    return {
+      success: true,
+      fileUrl: config.fileUrl,
+      syncedAt,
+      lastSyncAt: syncedAt,
+      lastError: null,
+      ...result,
+    };
+  } catch (error: any) {
+    const previousState = await loadBackupWebdavState();
+    await writeBackupWebdavState({
+      lastSyncAt: previousState.lastSyncAt,
+      lastError: error?.message || 'WebDAV 导入失败',
+    });
+    throw error;
+  }
+}
+
+export async function reloadBackupWebdavScheduler() {
+  stopBackupWebdavScheduler();
+  const config = await loadBackupWebdavConfig();
+  if (!config.enabled || !config.autoSyncEnabled) return;
+
+  try {
+    validateBackupWebdavConfig(config);
+  } catch (error: any) {
+    console.warn(`[backup/webdav] invalid config: ${error?.message || 'unknown error'}`);
+    return;
+  }
+
+  backupWebdavTask = cron.schedule(config.autoSyncCron, () => {
+    void exportBackupToWebdav(config.exportType).catch((error) => {
+      console.warn(`[backup/webdav] auto sync failed: ${(error as Error)?.message || 'unknown error'}`);
+    });
+  });
+}
+
+export function __resetBackupWebdavSchedulerForTests() {
+  stopBackupWebdavScheduler();
+}

src/web/api.ts

@@ -635,6 +635,33 @@ export const api = {
       method: 'POST',
       body: JSON.stringify({ data }),
     }),
+  getBackupWebdavConfig: () => request('/api/settings/backup/webdav'),
+  saveBackupWebdavConfig: (data: {
+    enabled: boolean;
+    fileUrl: string;
+    username: string;
+    password?: string;
+    clearPassword?: boolean;
+    exportType: 'all' | 'accounts' | 'preferences';
+    autoSyncEnabled: boolean;
+    autoSyncCron: string;
+  }) =>
+    request('/api/settings/backup/webdav', {
+      method: 'PUT',
+      body: JSON.stringify(data),
+    }),
+  exportBackupToWebdav: (type?: 'all' | 'accounts' | 'preferences') =>
+    request('/api/settings/backup/webdav/export', {
+      method: 'POST',
+      body: JSON.stringify(type ? { type } : {}),
+      timeoutMs: 60_000,
+    }),
+  importBackupFromWebdav: () =>
+    request('/api/settings/backup/webdav/import', {
+      method: 'POST',
+      body: JSON.stringify({}),
+      timeoutMs: 60_000,
+    }),
   clearRuntimeCache: () => request('/api/settings/maintenance/clear-cache', { method: 'POST' }),
   clearUsageData: () => request('/api/settings/maintenance/clear-usage', { method: 'POST' }),
   factoryReset: () => request('/api/settings/maintenance/factory-reset', { method: 'POST' }),

src/web/pages/ImportExport.test.tsx

@@ -7,6 +7,10 @@ const { apiMock, toastMock } = vi.hoisted(() => ({
   apiMock: {
     exportBackup: vi.fn(),
     importBackup: vi.fn(),
+    getBackupWebdavConfig: vi.fn(),
+    saveBackupWebdavConfig: vi.fn(),
+    exportBackupToWebdav: vi.fn(),
+    importBackupFromWebdav: vi.fn(),
   },
   toastMock: {
     success: vi.fn(),
@@ -185,6 +189,53 @@ describe('ImportExport', () => {
     vi.stubGlobal('window', {
       confirm: vi.fn(() => true),
     });
+    apiMock.getBackupWebdavConfig.mockResolvedValue({
+      success: true,
+      config: {
+        enabled: true,
+        fileUrl: 'https://dav.example.com/backups/metapi.json',
+        username: 'alice',
+        exportType: 'all',
+        autoSyncEnabled: true,
+        autoSyncCron: '0 */6 * * *',
+        hasPassword: true,
+        passwordMasked: 'se****ss',
+      },
+      state: {
+        lastSyncAt: null,
+        lastError: null,
+      },
+    });
+    apiMock.saveBackupWebdavConfig.mockResolvedValue({
+      success: true,
+      config: {
+        enabled: true,
+        fileUrl: 'https://dav.example.com/backups/metapi.json',
+        username: 'alice',
+        exportType: 'all',
+        autoSyncEnabled: true,
+        autoSyncCron: '0 */6 * * *',
+        hasPassword: true,
+        passwordMasked: 'se****ss',
+      },
+      state: {
+        lastSyncAt: null,
+        lastError: null,
+      },
+    });
+    apiMock.exportBackupToWebdav.mockResolvedValue({
+      success: true,
+      fileUrl: 'https://dav.example.com/backups/metapi.json',
+      exportType: 'all',
+    });
+    apiMock.importBackupFromWebdav.mockResolvedValue({
+      success: true,
+      sections: {
+        accounts: true,
+        preferences: true,
+      },
+      appliedSettings: [],
+    });
     apiMock.importBackup.mockResolvedValue({
       allImported: true,
       sections: {
@@ -305,4 +356,147 @@ describe('ImportExport', () => {
       root?.unmount();
     }
   });
+
+  it('loads webdav config and saves updates from the import/export page', async () => {
+    let root: ReturnType<typeof create> | null = null;
+
+    try {
+      await act(async () => {
+        root = create(
+          <MemoryRouter>
+            <ImportExport />
+          </MemoryRouter>,
+        );
+      });
+      await flushMicrotasks();
+
+      const rendered = collectText(root!.root);
+      expect(apiMock.getBackupWebdavConfig).toHaveBeenCalledTimes(1);
+      expect(rendered).toContain('WebDAV');
+      expect(rendered).toContain('自动同步');
+
+      const saveButton = root!.root.findAll((node) => (
+        node.type === 'button'
+        && typeof node.props.onClick === 'function'
+        && collectText(node).includes('保存 WebDAV 配置')
+      )).at(-1);
+
+      expect(saveButton).toBeTruthy();
+
+      await act(async () => {
+        saveButton!.props.onClick();
+      });
+      await flushMicrotasks();
+
+      expect(apiMock.saveBackupWebdavConfig).toHaveBeenCalledTimes(1);
+    } finally {
+      root?.unmount();
+    }
+  });
+
+  it('disables webdav actions while config has unsaved changes', async () => {
+    let root: ReturnType<typeof create> | null = null;
+
+    try {
+      await act(async () => {
+        root = create(
+          <MemoryRouter>
+            <ImportExport />
+          </MemoryRouter>,
+        );
+      });
+      await flushMicrotasks();
+
+      const fileUrlInput = root!.root.findAll((node) => (
+        node.type === 'input'
+        && node.props.placeholder === 'https://dav.example.com/backups/metapi.json'
+      )).at(-1);
+
+      expect(fileUrlInput).toBeTruthy();
+
+      await act(async () => {
+        fileUrlInput!.props.onChange({ target: { value: 'https://dav.example.com/backups/changed.json' } });
+      });
+      await flushMicrotasks();
+
+      const exportButton = root!.root.findAll((node) => (
+        node.type === 'button'
+        && collectText(node).includes('立即导出到 WebDAV')
+      )).at(-1);
+      const importButton = root!.root.findAll((node) => (
+        node.type === 'button'
+        && collectText(node).includes('从 WebDAV 拉取')
+      )).at(-1);
+
+      expect(exportButton?.props.disabled).toBe(true);
+      expect(importButton?.props.disabled).toBe(true);
+    } finally {
+      root?.unmount();
+    }
+  });
+
+  it('can clear a saved webdav password', async () => {
+    apiMock.saveBackupWebdavConfig.mockResolvedValueOnce({
+      success: true,
+      config: {
+        enabled: true,
+        fileUrl: 'https://dav.example.com/backups/metapi.json',
+        username: 'alice',
+        exportType: 'all',
+        autoSyncEnabled: true,
+        autoSyncCron: '0 */6 * * *',
+        hasPassword: false,
+        passwordMasked: '',
+      },
+      state: {
+        lastSyncAt: null,
+        lastError: null,
+      },
+    });
+
+    let root: ReturnType<typeof create> | null = null;
+
+    try {
+      await act(async () => {
+        root = create(
+          <MemoryRouter>
+            <ImportExport />
+          </MemoryRouter>,
+        );
+      });
+      await flushMicrotasks();
+
+      const clearPasswordToggle = root!.root.findAll((node) => (
+        node.type === 'label'
+        && collectText(node).includes('清空已保存密码')
+      )).at(-1);
+
+      expect(clearPasswordToggle).toBeTruthy();
+
+      const checkbox = clearPasswordToggle!.findByType('input');
+      await act(async () => {
+        checkbox.props.onChange({ target: { checked: true } });
+      });
+      await flushMicrotasks();
+
+      const saveButton = root!.root.findAll((node) => (
+        node.type === 'button'
+        && typeof node.props.onClick === 'function'
+        && collectText(node).includes('保存 WebDAV 配置')
+      )).at(-1);
+
+      expect(saveButton).toBeTruthy();
+
+      await act(async () => {
+        saveButton!.props.onClick();
+      });
+      await flushMicrotasks();
+
+      expect(apiMock.saveBackupWebdavConfig).toHaveBeenCalledWith(expect.objectContaining({
+        clearPassword: true,
+      }));
+    } finally {
+      root?.unmount();
+    }
+  });
 });

src/web/pages/ImportExport.tsx

@@ -1,4 +1,4 @@
-import React, { useMemo, useRef, useState } from 'react';
+import React, { useEffect, useMemo, useRef, useState } from 'react';
 import { api } from '../api.js';
 import { useToast } from '../components/Toast.js';
 import { tr } from '../i18n.js';
@@ -24,6 +24,55 @@ type ParsedSummary = {
   ignoredSections: string[];
 };
 
+type WebdavConfigForm = {
+  enabled: boolean;
+  fileUrl: string;
+  username: string;
+  password: string;
+  exportType: BackupType;
+  autoSyncEnabled: boolean;
+  autoSyncCron: string;
+  hasPassword: boolean;
+  passwordMasked: string;
+};
+
+type WebdavSyncState = {
+  lastSyncAt: string | null;
+  lastError: string | null;
+};
+
+type WebdavConfigSnapshot = {
+  enabled: boolean;
+  fileUrl: string;
+  username: string;
+  exportType: BackupType;
+  autoSyncEnabled: boolean;
+  autoSyncCron: string;
+  hasPassword: boolean;
+};
+
+const DEFAULT_WEBDAV_CONFIG: WebdavConfigForm = {
+  enabled: false,
+  fileUrl: '',
+  username: '',
+  password: '',
+  exportType: 'all',
+  autoSyncEnabled: false,
+  autoSyncCron: '0 */6 * * *',
+  hasPassword: false,
+  passwordMasked: '',
+};
+
+const DEFAULT_WEBDAV_SNAPSHOT: WebdavConfigSnapshot = {
+  enabled: false,
+  fileUrl: '',
+  username: '',
+  exportType: 'all',
+  autoSyncEnabled: false,
+  autoSyncCron: '0 */6 * * *',
+  hasPassword: false,
+};
+
 function downloadJsonFile(data: unknown, filename: string) {
   const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
   const url = URL.createObjectURL(blob);
@@ -188,10 +237,82 @@ export default function ImportExport() {
   const [importData, setImportData] = useState('');
   const [selectedFileName, setSelectedFileName] = useState('');
   const [dragOver, setDragOver] = useState(false);
+  const [webdavConfig, setWebdavConfig] = useState<WebdavConfigForm>(DEFAULT_WEBDAV_CONFIG);
+  const [savedWebdavConfig, setSavedWebdavConfig] = useState<WebdavConfigSnapshot>(DEFAULT_WEBDAV_SNAPSHOT);
+  const [webdavState, setWebdavState] = useState<WebdavSyncState>({ lastSyncAt: null, lastError: null });
+  const [webdavSaving, setWebdavSaving] = useState(false);
+  const [webdavAction, setWebdavAction] = useState<'export' | 'import' | ''>('');
+  const [clearWebdavPassword, setClearWebdavPassword] = useState(false);
   const fileInputRef = useRef<HTMLInputElement>(null);
 
   const summary = useMemo(() => parseImportSummary(importData), [importData]);
 
+  const buildWebdavForm = (config: any): WebdavConfigForm => ({
+    enabled: config.enabled === true,
+    fileUrl: String(config.fileUrl || ''),
+    username: String(config.username || ''),
+    password: '',
+    exportType: config.exportType === 'accounts' || config.exportType === 'preferences' ? config.exportType : 'all',
+    autoSyncEnabled: config.autoSyncEnabled === true,
+    autoSyncCron: String(config.autoSyncCron || DEFAULT_WEBDAV_CONFIG.autoSyncCron),
+    hasPassword: config.hasPassword === true,
+    passwordMasked: String(config.passwordMasked || ''),
+  });
+
+  const buildWebdavSnapshot = (config: any): WebdavConfigSnapshot => ({
+    enabled: config.enabled === true,
+    fileUrl: String(config.fileUrl || ''),
+    username: String(config.username || ''),
+    exportType: config.exportType === 'accounts' || config.exportType === 'preferences' ? config.exportType : 'all',
+    autoSyncEnabled: config.autoSyncEnabled === true,
+    autoSyncCron: String(config.autoSyncCron || DEFAULT_WEBDAV_CONFIG.autoSyncCron),
+    hasPassword: config.hasPassword === true,
+  });
+
+  const applyWebdavResponse = (result: any) => {
+    const config = result?.config;
+    if (config) {
+      setWebdavConfig(buildWebdavForm(config));
+      setSavedWebdavConfig(buildWebdavSnapshot(config));
+      setClearWebdavPassword(false);
+    }
+    const state = result?.state || result;
+    setWebdavState((prev) => ({
+      lastSyncAt: typeof state?.lastSyncAt === 'string' ? state.lastSyncAt : prev.lastSyncAt,
+      lastError: typeof state?.lastError === 'string'
+        ? state.lastError
+        : (state?.lastError === null ? null : prev.lastError),
+    }));
+  };
+
+  const webdavConfigDirty = (
+    webdavConfig.enabled !== savedWebdavConfig.enabled
+    || webdavConfig.fileUrl !== savedWebdavConfig.fileUrl
+    || webdavConfig.username !== savedWebdavConfig.username
+    || webdavConfig.exportType !== savedWebdavConfig.exportType
+    || webdavConfig.autoSyncEnabled !== savedWebdavConfig.autoSyncEnabled
+    || webdavConfig.autoSyncCron !== savedWebdavConfig.autoSyncCron
+    || webdavConfig.hasPassword !== savedWebdavConfig.hasPassword
+    || webdavConfig.password.trim().length > 0
+    || clearWebdavPassword
+  );
+
+  useEffect(() => {
+    let alive = true;
+    void api.getBackupWebdavConfig()
+      .then((result: any) => {
+        if (!alive) return;
+        applyWebdavResponse(result);
+      })
+      .catch((err: any) => {
+        if (!alive) return;
+        toast.error(err?.message || '加载 WebDAV 配置失败');
+      });
+    return () => {
+      alive = false;
+    };
+  }, [toast]);
+
   const handleExport = async (type: BackupType) => {
     setExportingType(type);
     try {
@@ -281,6 +402,63 @@ export default function ImportExport() {
     }
   };
 
+  const handleSaveWebdavConfig = async () => {
+    setWebdavSaving(true);
+    try {
+      const nextPassword = webdavConfig.password.trim();
+      const payload: Record<string, unknown> = {
+        enabled: webdavConfig.enabled,
+        fileUrl: webdavConfig.fileUrl,
+        username: webdavConfig.username,
+        exportType: webdavConfig.exportType,
+        autoSyncEnabled: webdavConfig.autoSyncEnabled,
+        autoSyncCron: webdavConfig.autoSyncCron,
+      };
+      if (nextPassword) {
+        payload.password = webdavConfig.password;
+      } else if (clearWebdavPassword) {
+        payload.clearPassword = true;
+      }
+      const result = await api.saveBackupWebdavConfig(payload as any);
+      applyWebdavResponse(result);
+      toast.success('WebDAV 配置已保存');
+    } catch (err: any) {
+      toast.error(err?.message || '保存 WebDAV 配置失败');
+    } finally {
+      setWebdavSaving(false);
+    }
+  };
+
+  const handleExportToWebdav = async () => {
+    setWebdavAction('export');
+    try {
+      const result = await api.exportBackupToWebdav(webdavConfig.exportType);
+      applyWebdavResponse(result);
+      toast.success(`已导出到 WebDAV：${result?.fileUrl || webdavConfig.fileUrl}`);
+    } catch (err: any) {
+      toast.error(err?.message || '导出到 WebDAV 失败');
+    } finally {
+      setWebdavAction('');
+    }
+  };
+
+  const handleImportFromWebdav = async () => {
+    const confirmed = typeof window === 'undefined' || typeof window.confirm !== 'function'
+      ? true
+      : window.confirm('从 WebDAV 导入会覆盖本地账号/路由或系统设置，确认继续？');
+    if (!confirmed) return;
+    setWebdavAction('import');
+    try {
+      const result = await api.importBackupFromWebdav();
+      applyWebdavResponse(result);
+      toast.success(buildImportSuccessMessage(result));
+    } catch (err: any) {
+      toast.error(err?.message || '从 WebDAV 导入失败');
+    } finally {
+      setWebdavAction('');
+    }
+  };
+
   return (
     <div className="animate-fade-in">
       <div className="page-header" style={{ alignItems: 'flex-end', marginBottom: 18 }}>
@@ -483,7 +661,150 @@ export default function ImportExport() {
         </div>
       </div>
 
-      <div className="card animate-slide-up stagger-3" style={{ marginTop: 14, padding: 16 }}>
+      <div className="card animate-slide-up stagger-3" style={{ marginTop: 14, padding: 18 }}>
+        <div style={{ display: 'flex', alignItems: 'center', gap: 8, marginBottom: 6 }}>
+          <svg width="18" height="18" fill="none" viewBox="0 0 24 24" stroke="var(--color-primary)">
+            <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M3 15a4 4 0 004 4h9a5 5 0 10-.1-9.999A5.002 5.002 0 006 9a4 4 0 00-3 6z" />
+          </svg>
+          <span style={{ fontSize: 15, fontWeight: 700 }}>WebDAV 同步</span>
+        </div>
+        <div style={{ fontSize: 12, color: 'var(--color-text-muted)', marginBottom: 14 }}>
+          支持手动推送、手动拉取，以及定时自动导出到 WebDAV。
+        </div>
+
+        <div style={{ display: 'grid', gridTemplateColumns: 'repeat(auto-fit,minmax(220px,1fr))', gap: 10 }}>
+          <label style={{ display: 'grid', gap: 6 }}>
+            <span style={{ fontSize: 12, color: 'var(--color-text-secondary)' }}>文件 URL</span>
+            <input
+              value={webdavConfig.fileUrl}
+              onChange={(e) => setWebdavConfig((prev) => ({ ...prev, fileUrl: e.target.value }))}
+              placeholder="https://dav.example.com/backups/metapi.json"
+              style={{ width: '100%' }}
+            />
+          </label>
+          <label style={{ display: 'grid', gap: 6 }}>
+            <span style={{ fontSize: 12, color: 'var(--color-text-secondary)' }}>用户名</span>
+            <input
+              value={webdavConfig.username}
+              onChange={(e) => setWebdavConfig((prev) => ({ ...prev, username: e.target.value }))}
+              placeholder="可留空"
+              style={{ width: '100%' }}
+            />
+          </label>
+          <label style={{ display: 'grid', gap: 6 }}>
+            <span style={{ fontSize: 12, color: 'var(--color-text-secondary)' }}>密码</span>
+            <input
+              type="password"
+              value={webdavConfig.password}
+              onChange={(e) => {
+                const nextPassword = e.target.value;
+                setWebdavConfig((prev) => ({ ...prev, password: nextPassword }));
+                if (nextPassword.trim()) {
+                  setClearWebdavPassword(false);
+                }
+              }}
+              placeholder={clearWebdavPassword
+                ? '保存后将清空已存密码'
+                : (webdavConfig.hasPassword ? `已保存 ${webdavConfig.passwordMasked}，留空则保持不变` : '请输入密码')}
+              disabled={clearWebdavPassword}
+              style={{ width: '100%' }}
+            />
+            {webdavConfig.hasPassword ? (
+              <label style={{ display: 'flex', alignItems: 'center', gap: 8, fontSize: 12, color: 'var(--color-text-secondary)' }}>
+                <input
+                  type="checkbox"
+                  checked={clearWebdavPassword}
+                  onChange={(e) => {
+                    const checked = e.target.checked === true;
+                    setClearWebdavPassword(checked);
+                    if (checked) {
+                      setWebdavConfig((prev) => ({ ...prev, password: '' }));
+                    }
+                  }}
+                />
+                清空已保存密码
+              </label>
+            ) : null}
+          </label>
+          <label style={{ display: 'grid', gap: 6 }}>
+            <span style={{ fontSize: 12, color: 'var(--color-text-secondary)' }}>导出分区</span>
+            <select
+              value={webdavConfig.exportType}
+              onChange={(e) => setWebdavConfig((prev) => ({ ...prev, exportType: e.target.value as BackupType }))}
+            >
+              <option value="all">全部</option>
+              <option value="accounts">账号与路由</option>
+              <option value="preferences">系统设置</option>
+            </select>
+          </label>
+          <label style={{ display: 'grid', gap: 6 }}>
+            <span style={{ fontSize: 12, color: 'var(--color-text-secondary)' }}>自动同步 Cron</span>
+            <input
+              value={webdavConfig.autoSyncCron}
+              onChange={(e) => setWebdavConfig((prev) => ({ ...prev, autoSyncCron: e.target.value }))}
+              placeholder="0 */6 * * *"
+              style={{ width: '100%' }}
+            />
+          </label>
+          <div style={{ display: 'grid', gap: 8, alignContent: 'center' }}>
+            <label style={{ display: 'flex', alignItems: 'center', gap: 8, fontSize: 13 }}>
+              <input
+                type="checkbox"
+                checked={webdavConfig.enabled}
+                onChange={(e) => setWebdavConfig((prev) => ({ ...prev, enabled: e.target.checked }))}
+              />
+              启用 WebDAV
+            </label>
+            <label style={{ display: 'flex', alignItems: 'center', gap: 8, fontSize: 13 }}>
+              <input
+                type="checkbox"
+                checked={webdavConfig.autoSyncEnabled}
+                onChange={(e) => setWebdavConfig((prev) => ({ ...prev, autoSyncEnabled: e.target.checked }))}
+              />
+              自动同步
+            </label>
+          </div>
+        </div>
+
+        <div style={{ display: 'flex', gap: 8, flexWrap: 'wrap', marginTop: 14 }}>
+          <button
+            onClick={handleSaveWebdavConfig}
+            disabled={webdavSaving}
+            className="btn btn-primary"
+          >
+            {webdavSaving ? '保存中...' : '保存 WebDAV 配置'}
+          </button>
+          <button
+            onClick={handleExportToWebdav}
+            disabled={webdavAction !== '' || webdavSaving || webdavConfigDirty}
+            className="btn btn-ghost"
+            style={{ border: '1px solid var(--color-border)' }}
+          >
+            {webdavAction === 'export' ? '导出中...' : '立即导出到 WebDAV'}
+          </button>
+          <button
+            onClick={handleImportFromWebdav}
+            disabled={webdavAction !== '' || webdavSaving || webdavConfigDirty}
+            className="btn btn-ghost"
+            style={{ border: '1px solid var(--color-border)' }}
+          >
+            {webdavAction === 'import' ? '拉取中...' : '从 WebDAV 拉取'}
+          </button>
+        </div>
+
+        {webdavConfigDirty ? (
+          <div style={{ marginTop: 10, fontSize: 12, color: 'var(--color-warning)' }}>
+            当前 WebDAV 配置有未保存改动，请先保存后再执行导入或导出。
+          </div>
+        ) : null}
+
+        <div style={{ marginTop: 12, fontSize: 12, color: 'var(--color-text-secondary)', lineHeight: 1.7 }}>
+          <div>上次同步：{webdavState.lastSyncAt ? new Date(webdavState.lastSyncAt).toLocaleString() : '尚未同步'}</div>
+          <div>最近错误：{webdavState.lastError || '无'}</div>
+        </div>
+      </div>
+
+      <div className="card animate-slide-up stagger-4" style={{ marginTop: 14, padding: 16 }}>
         <div style={{ fontSize: 14, fontWeight: 700, marginBottom: 8 }}>注意事项</div>
         <div style={{ fontSize: 12, color: 'var(--color-text-secondary)', lineHeight: 1.75 }}>
           <div>1. 导入账号分区会覆盖现有站点、账号、令牌和路由配置。</div>