fix: disable ssl verification for intranet ai writing search

offline-backend-20260512/backend/tests/test_ai_writing_knowledge_base.py

@@ -10,7 +10,9 @@ from types import SimpleNamespace
 import pytest
 
 from deerflow.agents.ai_writing.nodes import researcher as R
+from deerflow.agents.ai_writing.search import get_search_provider
 from deerflow.agents.ai_writing.search.base import SearchResult
+from deerflow.agents.ai_writing.search.intranet_stub import IntranetSearchProvider
 
 
 class _FakeIntranet:
@@ -21,6 +23,7 @@ class _FakeIntranet:
         self.raw_responses = []
         self.calls = []
         self.kw = kw
+        self.verify_ssl = kw.get("verify_ssl", False)
         _FakeIntranet.instances.append(self)
 
     async def search(self, query, max_results=5, **_):
@@ -55,12 +58,24 @@ class _SkillProviderShouldNotRun:
         raise AssertionError("knowledge_base 模式不应调用通用 provider / 技能检索")
 
 
-def _patch(monkeypatch, intranet_url="http://es/api", intranet_cls=_FakeIntranet):
+class _FakeResponse:
+    status_code = 200
+    text = '[{"title":"内网标题","content":"内网正文","url":"https://intranet/doc"}]'
+
+    def raise_for_status(self) -> None:
+        return None
+
+    def json(self):
+        return [{"title": "内网标题", "content": "内网正文", "url": "https://intranet/doc"}]
+
+
+def _patch(monkeypatch, intranet_url="http://es/api", intranet_cls=_FakeIntranet, intranet_verify_ssl=False):
     _FakeIntranet.instances = []
     cfg = {
         "max_materials": 20,
         "intranet_search_url": intranet_url,
         "intranet_knowledge_base": "samples",
+        "intranet_verify_ssl": intranet_verify_ssl,
     }
     monkeypatch.setattr(R, "get_ai_writing_config", lambda: cfg)
     monkeypatch.setattr(R, "use_builtin_agent", lambda *_: False)
@@ -125,6 +140,15 @@ async def test_knowledge_base_no_url_falls_back_to_default_endpoint(monkeypatch)
     assert _FakeIntranet.instances[0].kw.get("base_url") == "", "空地址应原样下传，由 provider 回退默认端点"
 
 
+@pytest.mark.asyncio
+async def test_knowledge_base_passes_verify_ssl_config(monkeypatch):
+    _patch(monkeypatch, intranet_verify_ssl=True)
+    out = await R.researcher_node(_state(), {"configurable": {}})
+
+    assert _FakeIntranet.instances[0].kw.get("verify_ssl") is True
+    assert out["material_package"]["intranet_debug"]["verify_ssl"] is True
+
+
 @pytest.mark.asyncio
 async def test_knowledge_base_does_not_orchestrate_skills(monkeypatch):
     """knowledge_base 不编排技能：通用 provider 一旦被调用就会 raise。"""
@@ -163,3 +187,44 @@ async def test_knowledge_base_failure_is_visible(monkeypatch):
     steps = pkg["skill_search_steps"]
     assert any(step["type"] == "skill_error" for step in steps)
     assert any(event["type"] == "notice" and event.get("raw") for event in out["progress_events"])
+
+
+@pytest.mark.asyncio
+async def test_intranet_search_disables_ssl_verification_for_internal_https(monkeypatch):
+    import httpx
+
+    seen: dict = {}
+
+    class _FakeAsyncClient:
+        def __init__(self, **kwargs):
+            seen.update(kwargs)
+
+        async def __aenter__(self):
+            return self
+
+        async def __aexit__(self, exc_type, exc, tb):
+            return None
+
+        async def post(self, endpoint, json):
+            seen["endpoint"] = endpoint
+            seen["payload"] = json
+            return _FakeResponse()
+
+    monkeypatch.setattr(httpx, "AsyncClient", _FakeAsyncClient)
+
+    provider = IntranetSearchProvider(base_url="https://intranet.example/search", knowledge_base_name="kb", timeout=300)
+    results = await provider.search("测试", max_results=1)
+
+    assert results
+    assert seen["verify"] is False
+    assert seen["trust_env"] is False
+    assert seen["endpoint"] == "https://intranet.example/search"
+    assert seen["payload"]["knowledge_base_name"] == "kb"
+    assert provider.calls[0]["verify_ssl"] is False
+
+
+def test_intranet_verify_ssl_can_be_reenabled_from_config():
+    provider = get_search_provider({"search_provider": "intranet", "intranet_verify_ssl": "true"})
+
+    assert isinstance(provider, IntranetSearchProvider)
+    assert provider.verify_ssl is True