feat: enable automatic web backend sessions

tests/test_production_baseline.py

@@ -31,6 +31,10 @@ class ProductionBaselineTests(unittest.TestCase):
         os.environ["JOBS_DIR"] = str(temp_root / "jobs")
         os.environ["MODELS_DIR"] = str(temp_root / "models")
         os.environ["ORCHESTRATOR_SHARED_SECRET"] = "test-secret"
+        os.environ["WEB_AUTOLOGIN_ENABLED"] = "1"
+        os.environ["WEB_AUTOLOGIN_ACCOUNT_USERNAME"] = ""
+        os.environ["WEB_AUTOLOGIN_USERNAME"] = ""
+        os.environ["WEB_AUTOLOGIN_PASSWORD"] = ""
         os.environ.setdefault("BOOTSTRAP_SUPERADMIN_USERNAME", "")
         os.environ.setdefault("BOOTSTRAP_SUPERADMIN_PASSWORD", "")
 
@@ -97,6 +101,8 @@ class ProductionBaselineTests(unittest.TestCase):
         assistant_id = f"assistant_{tag}"
         token = f"token_{tag}"
         username = f"user_{tag}"
+        login_password = f"pass_{tag}"
+        password_hash, password_salt = self.core.create_password_hash(login_password)
 
         self.core.db.execute(
             """
@@ -108,8 +114,8 @@ class ProductionBaselineTests(unittest.TestCase):
             (
                 account_id,
                 username,
-                "hash",
-                "salt",
+                password_hash,
+                password_salt,
                 f"User {tag}",
                 "super_admin",
                 "approved",
@@ -206,8 +212,22 @@ class ProductionBaselineTests(unittest.TestCase):
             "kb_id": kb_id,
             "assistant_id": assistant_id,
             "token": token,
+            "username": username,
+            "password": login_password,
         }
 
+    def test_auto_session_issues_token_without_manual_credentials(self) -> None:
+        ctx = self._seed_context("auto", exhausted=False)
+        self.core.WEB_AUTOLOGIN_ENABLED = "1"
+        self.core.WEB_AUTOLOGIN_ACCOUNT_USERNAME = ctx["username"]
+        self.core.WEB_AUTOLOGIN_USERNAME = ""
+        self.core.WEB_AUTOLOGIN_PASSWORD = ""
+        response = self.client.post("/v2/auth/auto-session")
+        self.assertEqual(response.status_code, 200, response.text)
+        payload = response.json()
+        self.assertEqual(payload["account"]["username"], ctx["username"])
+        self.assertEqual(payload["mode"], "auto")
+
     def test_database_uses_wal_and_busy_timeout(self) -> None:
         conn = self.core.db.connect()
         try: