fix: prefer direct login browser access with proxy fallback

DouYinSparkFlow/tests/test_deployment_contract.py

@@ -72,9 +72,9 @@ class DeploymentContractTests(unittest.TestCase):
         compose = (REPO_ROOT / "docker-compose.yml").read_text(encoding="utf-8")
         self.assertIn("# Build proxies must never leak", dockerfile)
         self.assertIn("http_proxy=", dockerfile)
-        self.assertGreaterEqual(compose.count("http_proxy: http://proxy:7890"), 4)
-        self.assertGreaterEqual(compose.count("https_proxy: http://proxy:7890"), 4)
-        self.assertGreaterEqual(compose.count("no_proxy:"), 4)
+        self.assertGreaterEqual(compose.count("http_proxy: http://proxy:7890"), 3)
+        self.assertGreaterEqual(compose.count("https_proxy: http://proxy:7890"), 3)
+        self.assertGreaterEqual(compose.count("no_proxy:"), 3)
 
     def test_sensitive_ports_bind_to_loopback_by_default(self):
         text = (REPO_ROOT / "docker-compose.yml").read_text(encoding="utf-8")
@@ -114,6 +114,20 @@ class DeploymentContractTests(unittest.TestCase):
         for entry in ("logs/", "config.json", "usersData.json", "webui_settings.json"):
             self.assertIn(entry, dockerignore)
 
+    def test_login_desktop_uses_direct_first_network_route(self):
+        compose = (REPO_ROOT / "docker-compose.yml").read_text(encoding="utf-8")
+        env_example = (REPO_ROOT / ".env.example").read_text(encoding="utf-8")
+        server = (SOURCE_ROOT / "login_desktop_server.py").read_text(encoding="utf-8")
+        login_block = compose.split("  login-desktop:", 1)[1].split("  scheduler:", 1)[0]
+        self.assertIn("LOGIN_DESKTOP_PROXY_MODE: ${LOGIN_DESKTOP_PROXY_MODE:-auto}", login_block)
+        self.assertIn("LOGIN_DESKTOP_PROXY: ${LOGIN_DESKTOP_PROXY:-http://proxy:7890}", login_block)
+        self.assertNotIn("HTTP_PROXY: http://proxy:7890", login_block)
+        self.assertIn("LOGIN_DESKTOP_PROXY_MODE=auto", env_example)
+        self.assertIn('candidates.append(("direct", None))', server)
+        self.assertIn('candidates.append(("proxy", LOGIN_PROXY_SERVER))', server)
+        self.assertIn('"--no-proxy-server"', server)
+        self.assertIn('"/preflight"', server)
+
     def test_login_desktop_resource_controls_are_configured(self):
         compose = (REPO_ROOT / "docker-compose.yml").read_text(encoding="utf-8")
         start_script = (SOURCE_ROOT / "scripts" / "start_login_desktop.sh").read_text(encoding="utf-8")

DouYinSparkFlow/tests/test_login_network.py

@@ -0,0 +1,76 @@
+from unittest import IsolatedAsyncioTestCase
+from unittest.mock import patch
+
+from login_desktop_server import LoginDesktopManager, LoginNetworkError
+
+
+class LoginNetworkTests(IsolatedAsyncioTestCase):
+    async def test_auto_mode_prefers_direct_route(self):
+        manager = LoginDesktopManager()
+        with (
+            patch("login_desktop_server.LOGIN_NETWORK_MODE", "auto"),
+            patch("login_desktop_server.LOGIN_PROXY_SERVER", "http://proxy:7890"),
+            patch(
+                "login_desktop_server._probe_login_target",
+                return_value={"ok": True, "status": 200, "latency_ms": 10},
+            ) as probe,
+        ):
+            route = await manager._select_network_route(force=True)
+
+        self.assertEqual("direct", route["mode"])
+        probe.assert_called_once_with(None, 15)
+
+    async def test_auto_mode_falls_back_to_proxy(self):
+        manager = LoginDesktopManager()
+        with (
+            patch("login_desktop_server.LOGIN_NETWORK_MODE", "auto"),
+            patch("login_desktop_server.LOGIN_PROXY_SERVER", "http://proxy:7890"),
+            patch(
+                "login_desktop_server._probe_login_target",
+                side_effect=[
+                    {"ok": False, "error": "direct failed"},
+                    {"ok": True, "status": 200, "latency_ms": 20},
+                ],
+            ) as probe,
+        ):
+            route = await manager._select_network_route(force=True)
+
+        self.assertEqual("proxy", route["mode"])
+        self.assertIsNone(probe.call_args_list[0].args[0])
+        self.assertEqual("http://proxy:7890", probe.call_args_list[1].args[0])
+
+    async def test_auto_mode_reports_both_failures(self):
+        manager = LoginDesktopManager()
+        with (
+            patch("login_desktop_server.LOGIN_NETWORK_MODE", "auto"),
+            patch("login_desktop_server.LOGIN_PROXY_SERVER", "http://proxy:7890"),
+            patch(
+                "login_desktop_server._probe_login_target",
+                side_effect=[
+                    {"ok": False, "error": "direct failed"},
+                    {"ok": False, "error": "proxy failed"},
+                ],
+            ),
+        ):
+            with self.assertRaises(LoginNetworkError) as caught:
+                await manager._select_network_route(force=True)
+
+        self.assertIn("直连和代理", str(caught.exception))
+        self.assertEqual({"direct", "proxy"}, set(caught.exception.checks))
+
+    async def test_network_preflight_exposes_selected_route_without_credentials(self):
+        manager = LoginDesktopManager()
+        with (
+            patch("login_desktop_server.LOGIN_NETWORK_MODE", "proxy"),
+            patch("login_desktop_server.LOGIN_PROXY_SERVER", "http://user:secret@proxy:7890"),
+            patch(
+                "login_desktop_server._probe_login_target",
+                return_value={"ok": True, "status": 200, "latency_ms": 5},
+            ),
+        ):
+            result = await manager.network_preflight(force=True)
+
+        self.assertTrue(result["ok"])
+        self.assertEqual("proxy", result["route"]["mode"])
+        self.assertEqual("proxy:7890", result["network"]["proxy"])
+        self.assertNotIn("secret", repr(result))