Handle Seerr CSRF on request creation

backend/tests/test_backend_quality.py

@@ -423,6 +423,42 @@ class RequestCreationFlowTests(unittest.IsolatedAsyncioTestCase):
             },
         )
 
+    async def test_seerr_write_completes_csrf_cookie_handshake(self) -> None:
+        observed: list[httpx.Request] = []
+
+        def handler(request: httpx.Request) -> httpx.Response:
+            observed.append(request)
+            if request.method == "GET":
+                return httpx.Response(
+                    200,
+                    headers=[
+                        ("set-cookie", "_csrf=secret-value; Path=/; Secure; HttpOnly; SameSite=Strict"),
+                        ("set-cookie", "XSRF-TOKEN=csrf%2Etoken; Path=/; Secure; SameSite=Strict"),
+                    ],
+                    json={"id": 1},
+                )
+            return httpx.Response(201, json={"id": 42})
+
+        transport = httpx.MockTransport(handler)
+        seerr = requests_router.JellyseerrClient("https://seerr.test", "api-key")
+        async with httpx.AsyncClient(transport=transport) as client:
+            response = await seerr._send_request(
+                client,
+                "POST",
+                "https://seerr.test/api/v1/request",
+                headers=seerr.headers(),
+                params=None,
+                payload={"mediaType": "movie", "mediaId": 209112},
+            )
+
+        self.assertEqual(response.status_code, 201)
+        self.assertEqual([request.method for request in observed], ["GET", "POST"])
+        write_request = observed[1]
+        self.assertEqual(write_request.headers.get("XSRF-TOKEN"), "csrf.token")
+        self.assertEqual(write_request.headers.get("Origin"), "https://seerr.test")
+        self.assertIn("_csrf=secret-value", write_request.headers.get("Cookie", ""))
+        self.assertIn("XSRF-TOKEN=csrf%2Etoken", write_request.headers.get("Cookie", ""))
+
     async def test_request_destination_only_offers_live_sonarr_profiles(self) -> None:
         runtime = SimpleNamespace(
             sonarr_base_url="http://sonarr.test",