feat(asr-pipeline): merge PR #1 webauth/CSRF/locking hardening and web_password fallback

servers/tools-pve/asr-pipeline/asrpipe/review.py

@@ -323,6 +323,7 @@ def answer(question_id: int, value: str, *, allow_update: bool = False) -> dict:
         return result
     payload = json.loads(row["payload"] or "{}")
     recording = row["recording"]
+    previous = str(row["answer"] or "")
     con.execute(
         "UPDATE review_question SET status='answered',answer=?,answered_at=? WHERE id=?",
         (value, time.time(), question_id))
@@ -343,9 +344,14 @@ def answer(question_id: int, value: str, *, allow_update: bool = False) -> dict:
                                    confidence=1.0, confirmed=1)
     saved = False
     voiceprint_enrolled = False
-    if payload.get("kind") == "voiceprint":
-        voiceprint_enrolled = _confirm_voiceprint(
-            payload.get("draft_path", ""), payload.get("speaker_id", ""), value)
+    if payload.get("kind") == "voiceprint" and not (allow_update and value == previous):
+        try:
+            voiceprint_enrolled = _confirm_voiceprint(
+                payload.get("draft_path", ""), payload.get("speaker_id", ""), value)
+        except Exception as exc:
+            from .log import log
+            log(f"voiceprint enroll failed after answer saved: {exc}", level="WARN")
+            voiceprint_enrolled = False
     if payload.get("draft_path"):
         try:
             saved = _persist_draft_feedback(recording, payload["draft_path"])
@@ -401,17 +407,32 @@ def reopen_question(question_id: int) -> bool:
     return ok
 
 
+def _question_matches(row, transcript_path: str, draft_path: str, job_id: str) -> bool:
+    payload = json.loads(row["payload"] or "{}")
+    return bool(
+        (transcript_path and row["recording"] == transcript_path)
+        or (draft_path and payload.get("draft_path") == draft_path)
+        or (job_id and payload.get("job_id") == job_id)
+    )
+
+
 def delete_for_job(transcript_path: str = "", draft_path: str = "", job_id: str = "") -> int:
+    return _delete_questions(transcript_path, draft_path, job_id, pending_only=False)
+
+
+def delete_pending_for_job(transcript_path: str = "", draft_path: str = "", job_id: str = "") -> int:
+    """Drop unanswered questions. Answered rows stay so a failed refine can be retried."""
+    return _delete_questions(transcript_path, draft_path, job_id, pending_only=True)
+
+
+def _delete_questions(transcript_path: str, draft_path: str, job_id: str, *, pending_only: bool) -> int:
     con = lexicon.connect()
-    rows = con.execute("SELECT id, recording, payload FROM review_question").fetchall()
+    rows = con.execute("SELECT id, recording, payload, status FROM review_question").fetchall()
     to_delete: list[int] = []
     for r in rows:
-        payload = json.loads(r["payload"] or "{}")
-        if (
-            (transcript_path and r["recording"] == transcript_path)
-            or (draft_path and payload.get("draft_path") == draft_path)
-            or (job_id and payload.get("job_id") == job_id)
-        ):
+        if pending_only and r["status"] != "pending":
+            continue
+        if _question_matches(r, transcript_path, draft_path, job_id):
             to_delete.append(int(r["id"]))
     if to_delete:
         marks = ",".join("?" for _ in to_delete)