fix(worker): 保持旧关键点契约并验证内部鉴权

tests/test_ip_access.py

@@ -99,3 +99,22 @@ def test_gateway_does_not_apply_worker_ip_policy(policy, monkeypatch):
     assert client.post('/api/v1/hair/grow').json()['code'] == 0
     assert client.get('/static/test_interface52.html').status_code == 200
     assert calls == ['/api/v1/hairline/generate', '/api/v1/hair/grow']
+
+
+@pytest.mark.parametrize(("path", "expected_code"), [
+    ("/api/v1/hairline/generate-52", 1004),
+    ("/api/v1/face/b-end-points", 1007),
+])
+def test_52_and_72_use_worker_transport_auth_not_client_bearer(policy, monkeypatch, path, expected_code):
+    import app as worker
+
+    policy.write_text('{"allowed_ips": ["49.232.51.171"]}')
+    monkeypatch.setattr(worker, "ACCEPT_PASSWORDS", ["access-test"])
+    client = TestClient(worker.app, client=("49.232.51.171", 50000))
+    try:
+        denied = client.post(path, headers={"Authorization": "Bearer client-access-token"})
+        assert denied.status_code == 401 and denied.json()["code"] == 1009
+        accepted = client.post(path, headers={"X-Internal-Token": "access-test"})
+        assert accepted.status_code == 200 and accepted.json()["code"] == expected_code
+    finally:
+        client.close()