fix: 修复 CSRF token 导入错误并豁免临时邮箱 API

- 在 csrf.py 添加模块级别 generate_csrf() 函数，解决 /api/csrf-token 端点导入错误
- 为临时邮箱 API 路由添加 CSRF 豁免，避免 Session 认证下的 CSRF token 缺失错误
- 重构 temp_emails.py 路由注册逻辑，支持统一应用 csrf_exempt 装饰器

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

outlook_web/app.py

@@ -97,7 +97,7 @@ def create_app(*, autostart_scheduler: Optional[bool] = None):
         app.register_blueprint(tags.create_blueprint())
         app.register_blueprint(accounts.create_blueprint())
         app.register_blueprint(emails.create_blueprint())
-        app.register_blueprint(temp_emails.create_blueprint())
+        app.register_blueprint(temp_emails.create_blueprint(csrf_exempt=csrf_exempt))
         app.register_blueprint(oauth.create_blueprint())
         app.register_blueprint(settings.create_blueprint())
         app.register_blueprint(scheduler.create_blueprint())

outlook_web/routes/temp_emails.py

@@ -5,24 +5,26 @@ from flask import Blueprint
 from outlook_web.controllers import temp_emails as temp_emails_controller
 
 
-def create_blueprint() -> Blueprint:
-    """创建 temp_emails Blueprint"""
+def create_blueprint(csrf_exempt=None) -> Blueprint:
+    """创建 temp_emails Blueprint（支持 CSRF 豁免）"""
     bp = Blueprint("temp_emails", __name__)
-    bp.add_url_rule("/api/temp-emails", view_func=temp_emails_controller.api_get_temp_emails, methods=["GET"])
-    bp.add_url_rule("/api/temp-emails/generate", view_func=temp_emails_controller.api_generate_temp_email, methods=["POST"])
-    bp.add_url_rule("/api/temp-emails/<path:email_addr>", view_func=temp_emails_controller.api_delete_temp_email, methods=["DELETE"])
-    bp.add_url_rule("/api/temp-emails/<path:email_addr>/messages", view_func=temp_emails_controller.api_get_temp_email_messages, methods=["GET"])
-    bp.add_url_rule(
-        "/api/temp-emails/<path:email_addr>/messages/<path:message_id>",
-        view_func=temp_emails_controller.api_get_temp_email_message_detail,
-        methods=["GET"],
-    )
-    bp.add_url_rule(
-        "/api/temp-emails/<path:email_addr>/messages/<path:message_id>",
-        view_func=temp_emails_controller.api_delete_temp_email_message,
-        methods=["DELETE"],
-    )
-    bp.add_url_rule("/api/temp-emails/<path:email_addr>/clear", view_func=temp_emails_controller.api_clear_temp_email_messages, methods=["DELETE"])
-    bp.add_url_rule("/api/temp-emails/<path:email_addr>/refresh", view_func=temp_emails_controller.api_refresh_temp_email_messages, methods=["POST"])
+
+    # 定义路由处理函数
+    handlers = [
+        ("/api/temp-emails", temp_emails_controller.api_get_temp_emails, ["GET"]),
+        ("/api/temp-emails/generate", temp_emails_controller.api_generate_temp_email, ["POST"]),
+        ("/api/temp-emails/<path:email_addr>", temp_emails_controller.api_delete_temp_email, ["DELETE"]),
+        ("/api/temp-emails/<path:email_addr>/messages", temp_emails_controller.api_get_temp_email_messages, ["GET"]),
+        ("/api/temp-emails/<path:email_addr>/messages/<path:message_id>", temp_emails_controller.api_get_temp_email_message_detail, ["GET"]),
+        ("/api/temp-emails/<path:email_addr>/messages/<path:message_id>", temp_emails_controller.api_delete_temp_email_message, ["DELETE"]),
+        ("/api/temp-emails/<path:email_addr>/clear", temp_emails_controller.api_clear_temp_email_messages, ["DELETE"]),
+        ("/api/temp-emails/<path:email_addr>/refresh", temp_emails_controller.api_refresh_temp_email_messages, ["POST"]),
+    ]
+
+    # 注册路由，如果提供了 csrf_exempt 则应用到所有路由
+    for path, handler, methods in handlers:
+        view_func = csrf_exempt(handler) if csrf_exempt else handler
+        bp.add_url_rule(path, view_func=view_func, methods=methods)
+
     return bp
 

outlook_web/security/csrf.py

@@ -14,6 +14,13 @@ except ImportError:  # pragma: no cover
     print("Warning: flask-wtf not installed. CSRF protection is disabled. Install with: pip install flask-wtf")
 
 
+def generate_csrf():
+    """生成 CSRF token（模块级别导出）"""
+    if _generate_csrf is not None:
+        return _generate_csrf()
+    return None
+
+
 def init_csrf(app) -> Tuple[Optional[object], Callable, Optional[Callable]]:
     """
     初始化 CSRF 保护（如果可用）