diff --git a/src/views/common/login.vue b/src/views/common/login.vue
index ffc5174..9c415ee 100644
--- a/src/views/common/login.vue
+++ b/src/views/common/login.vue
@@ -38,7 +38,6 @@
 </template>
 
 <script>
-  import { getUUID } from '@/utils'
   import {getConfigParams} from '@/api/sysConfig.js'
   import {
     getSiteDataActive,
@@ -52,7 +51,8 @@
           password: '',
           uuid: '',
           captcha: '',
-          site:''
+          site:'',
+          deviceId: ''
         },
         siteList:[],
         dataRule: {
@@ -64,6 +64,14 @@
           ]
         },
         captchaPath: ''
+        ,
+        localBindConfig: {
+          // 本地小程序接口（可在 static/config/index*.js 里通过 SITE_CONFIG 覆盖）
+          enabled: !(window.SITE_CONFIG && window.SITE_CONFIG.localBindCheck === false),
+          endpoint: (window.SITE_CONFIG && window.SITE_CONFIG.localBindApiUrl) || 'http://127.0.0.1:18181/api/device/bind-user',
+          // 本地接口不可用时快速降级，避免影响正常登录
+          timeout: (window.SITE_CONFIG && window.SITE_CONFIG.localBindTimeout) || 800
+        }
       }
     },
     computed: {
@@ -106,32 +114,120 @@
       dataFormSubmit () {
         this.$refs['dataForm'].validate((valid) => {
           if (valid) {
-            this.$http({
-              url: this.$http.adornUrl('/sys/login'),
-              method: 'post',
-              data: this.$http.adornData({
-                'username': this.dataForm.userName,
-                'password': this.dataForm.password,
-                'uuid': this.dataForm.uuid,
-                'site': this.dataForm.site,
-              })
-            }).then(({data}) => {
-              if (data && data.code === 0) {
-                this.$cookie.set('token_plm', data.token)
-                this.$router.replace({ name: 'home' })
-                this.$i18n.locale=data.language
-                localStorage.setItem('locale', data.language)
-                localStorage.setItem('refresh', "0")
-                localStorage.setItem('userName', this.dataForm.userName)
-                localStorage.setItem('accessSite', this.dataForm.site)
-                this.getConfigParams()
-              } else {
-                this.$message.error(data.msg)
+            this.checkLocalBindUser().then((allowLogin) => {
+              if (!allowLogin) {
+                return
               }
+              this.$http({
+                url: this.$http.adornUrl('/sys/login'),
+                method: 'post',
+                data: this.$http.adornData({
+                  'username': this.dataForm.userName,
+                  'password': this.dataForm.password,
+                  'uuid': this.dataForm.uuid,
+                  'site': this.dataForm.site,
+                  'deviceId': this.dataForm.deviceId,
+                })
+              }).then(({data}) => {
+                if (data && data.code === 0) {
+                  this.$cookie.set('token_plm', data.token)
+                  this.$router.replace({ name: 'home' })
+                  this.$i18n.locale=data.language
+                  localStorage.setItem('locale', data.language)
+                  localStorage.setItem('refresh', "0")
+                  localStorage.setItem('userName', this.dataForm.userName)
+                  localStorage.setItem('accessSite', this.dataForm.site)
+                  this.getConfigParams()
+                } else {
+                  this.$message.error(data.msg)
+                }
+              })
             })
           }
         })
       },
+      checkLocalBindUser () {
+        if (!this.localBindConfig.enabled) {
+          this.dataForm.deviceId = ''
+          return Promise.resolve(true)
+        }
+        return this.fetchBoundUserFromLocalAgent().then((bindInfo) => {
+          this.dataForm.deviceId = (bindInfo.deviceId || '').trim()
+          return true
+        }).catch(() => {
+          // 后端会根据用户“单机登录限制”开关决定是否必须校验 deviceId
+          this.dataForm.deviceId = ''
+          return true
+        })
+      },
+      fetchBoundUserFromLocalAgent () {
+        if (!window.fetch) {
+          return Promise.reject(new Error('FETCH_UNSUPPORTED'))
+        }
+        const timeout = Number(this.localBindConfig.timeout) || 3000
+        const timeoutPromise = new Promise((resolve, reject) => {
+          setTimeout(() => {
+            reject(new Error('LOCAL_AGENT_TIMEOUT'))
+          }, timeout)
+        })
+        const requestPromise = window.fetch(this.localBindConfig.endpoint, {
+          method: 'GET',
+          credentials: 'omit'
+        }).then((response) => {
+          if (!response || !response.ok) {
+            throw new Error('LOCAL_AGENT_HTTP_ERROR')
+          }
+          return response.text()
+        }).then((rawData) => {
+          let payload = rawData
+          try {
+            payload = JSON.parse(rawData)
+          } catch (e) {
+            // 本地小程序返回纯文本时，直接将响应文本作为设备标识
+          }
+          return this.resolveLocalBindInfo(payload)
+        })
+        return Promise.race([requestPromise, timeoutPromise])
+      },
+      resolveLocalBindInfo (payload) {
+        const result = {
+          deviceId: ''
+        }
+        if (!payload) {
+          return result
+        }
+        if (typeof payload === 'string') {
+          // 兼容本地小程序直接返回设备标识字符串
+          result.deviceId = payload.trim()
+          return result
+        }
+        result.deviceId = this.extractDeviceId(payload)
+        if (!result.deviceId && payload.data) {
+          result.deviceId = this.extractDeviceId(payload.data)
+        }
+        return result
+      },
+      extractDeviceId (payload) {
+        if (!payload || typeof payload !== 'object') {
+          return ''
+        }
+        if (typeof payload.deviceId === 'string') {
+          return payload.deviceId.trim()
+        }
+        if (typeof payload.machineCode === 'string') {
+          return payload.machineCode.trim()
+        }
+        if (typeof payload.machineId === 'string') {
+          return payload.machineId.trim()
+        }
+        if (typeof payload.clientId === 'string') {
+          return payload.clientId.trim()
+        }
+        if (typeof payload.deviceCode === 'string') {
+          return payload.deviceCode.trim()
+        }
+        return ''
+      },
       // 获取全局参数变量
       getConfigParams() {
         getConfigParams().then(({data}) => {
diff --git a/src/views/modules/sys/user-add-or-update.vue b/src/views/modules/sys/user-add-or-update.vue
index e6e515a..4c8a6d9 100644
--- a/src/views/modules/sys/user-add-or-update.vue
+++ b/src/views/modules/sys/user-add-or-update.vue
@@ -107,6 +107,12 @@
               <el-radio :label="1">{{buttons.normal||'正常'}}</el-radio>
             </el-radio-group>
           </el-form-item>
+          <el-form-item label="单机登录限制" size="mini" prop="singleComputerLimit">
+            <el-radio-group v-model="dataForm.singleComputerLimit">
+              <el-radio :label="0">否</el-radio>
+              <el-radio :label="1">是</el-radio>
+            </el-radio-group>
+          </el-form-item>
         </el-form>
       </el-form>
       <span slot="footer" class="dialog-footer">
@@ -164,6 +170,7 @@ export default {
         postName:'',
         roleIdList: [],
         status: 1,
+        singleComputerLimit: 0,
         site: '',
         siteID: '',
         bu:'',
@@ -328,6 +335,7 @@ export default {
               this.dataForm.domainControlAccount = data.user.domainControlAccount
               this.dataForm.ifsUsername = data.user.ifsUsername
               this.dataForm.ifsPassword = data.user.ifsPassword
+              this.dataForm.singleComputerLimit = data.user.singleComputerLimit == null ? 0 : data.user.singleComputerLimit
               this.getBDPList()
             }
           })
@@ -351,6 +359,7 @@ export default {
             postName: '',
             roleIdList: [],
             status: 1,
+            singleComputerLimit: 0,
             site: '',
             siteID: '',
             siteName: '',
@@ -391,6 +400,7 @@ export default {
               'domainControlAccount': this.dataForm.domainControlAccount,
               'ifsUsername': this.dataForm.ifsUsername,
               'ifsPassword': this.dataForm.ifsPassword,
+              'singleComputerLimit': this.dataForm.singleComputerLimit,
             })
           }).then(({data}) => {
             if (data && data.code === 0) {
@@ -426,6 +436,7 @@ export default {
         postName:'',
         roleIdList: [],
         status: 1,
+        singleComputerLimit: 0,
         site: '',
         siteID: '',
         siteName:'',
diff --git a/src/views/modules/sys/user.vue b/src/views/modules/sys/user.vue
index 7774194..df77933 100644
--- a/src/views/modules/sys/user.vue
+++ b/src/views/modules/sys/user.vue
@@ -119,6 +119,16 @@
           <el-link v-else type="danger">{{ buttons.normal || '正常' }}</el-link>
         </template>
       </el-table-column>
+      <el-table-column
+        prop="singleComputerLimit"
+        header-align="center"
+        align="center"
+        label="单机限制">
+        <template slot-scope="scope">
+          <el-link v-if="scope.row.singleComputerLimit === 1" type="danger">开启</el-link>
+          <el-link v-else type="info">关闭</el-link>
+        </template>
+      </el-table-column>
       <el-table-column
         prop="createTime"
         header-align="center"