feat(asr-pipeline): merge PR #1 webauth/CSRF/locking hardening and web_password fallback

servers/tools-pve/asr-pipeline/tests/test_service.py

@@ -235,29 +235,42 @@ class ProviderAndServiceTests(unittest.TestCase):
         q2 = review.enqueue(str(t1), "第一场问题B？", {"kind": "draft_question", "candidates": ["选项B1"]})
         q3 = review.enqueue(str(t2), "第二场问题C？", {"kind": "draft_question", "candidates": ["选项C1"]})
 
+        os.environ["ASR_WEB_PASSWORD"] = "test-web-password"
+        os.environ.pop("ASR_WEB_ALLOW_ANON", None)
         svc_web.AGENT_TOKEN = "test-agent-token"
         server = ThreadingHTTPServer(("127.0.0.1", 0), svc_web.Handler)
         port = server.server_address[1]
         thread = threading.Thread(target=server.serve_forever, daemon=True)
         thread.start()
         try:
+            import http.cookiejar
+            from asrpipe import webauth
+            jar = http.cookiejar.CookieJar()
+            opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar))
+            login_body = urllib.parse.urlencode({"password": "test-web-password"}).encode()
+            opener.open(urllib.request.Request(
+                f"http://127.0.0.1:{port}/login", data=login_body, method="POST",
+            ), timeout=5)
+
             def fetch(path: str, headers: dict[str, str] | None = None) -> tuple[int, str]:
                 req = urllib.request.Request(
                     f"http://127.0.0.1:{port}{path}",
                     headers=headers or {},
                 )
-                with urllib.request.urlopen(req, timeout=5) as resp:
+                with opener.open(req, timeout=5) as resp:
                     return resp.status, resp.read().decode("utf-8")
 
             def post_form(path: str, data: dict[str, str]) -> tuple[int, str]:
-                encoded = urllib.parse.urlencode(data).encode("utf-8")
+                payload = dict(data)
+                payload.setdefault("csrf", webauth.csrf_token())
+                encoded = urllib.parse.urlencode(payload).encode("utf-8")
                 req = urllib.request.Request(
                     f"http://127.0.0.1:{port}{path}",
                     data=encoded,
                     headers={"Content-Type": "application/x-www-form-urlencoded"},
                     method="POST",
                 )
-                with urllib.request.urlopen(req, timeout=5) as resp:
+                with opener.open(req, timeout=5) as resp:
                     return resp.status, resp.read().decode("utf-8")
 
             status, body = fetch("/health")