agromatrix: enforce mentor auth and expose shared-memory review via gateway

scripts/node1/agromatrix_regression_smoke.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 import argparse
 import json
+import os
 import sys
 import urllib.error
 import urllib.request
@@ -12,13 +13,13 @@ TINY_PNG_DATA_URL = (
 )
 
 
-def http_json(method: str, url: str, payload=None):
+def http_json(method: str, url: str, payload=None, headers=None):
     data = None
-    headers = {}
+    req_headers = dict(headers or {})
     if payload is not None:
         data = json.dumps(payload).encode("utf-8")
-        headers["Content-Type"] = "application/json"
-    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        req_headers.setdefault("Content-Type", "application/json")
+    req = urllib.request.Request(url, data=data, headers=req_headers, method=method)
     try:
         with urllib.request.urlopen(req, timeout=60) as resp:
             body = resp.read().decode("utf-8", errors="replace")
@@ -46,6 +47,14 @@ def main() -> int:
     parser.add_argument("--chat-id", default="smoke-agromatrix")
     parser.add_argument("--user-id", default="smoke-user")
     parser.add_argument("--skip-review-404", action="store_true")
+    parser.add_argument(
+        "--mentor-token",
+        default=(
+            os.getenv("AGROMATRIX_REVIEW_BEARER_TOKEN")
+            or (os.getenv("AGROMATRIX_REVIEW_BEARER_TOKENS", "").split(",")[0].strip())
+            or ""
+        ),
+    )
     args = parser.parse_args()
 
     ok_all = True
@@ -95,6 +104,9 @@ def main() -> int:
     ok_all &= check(status == 200 and pending_shape, "shared_pending_endpoint", f"total={pending.get('total')}")
 
     if not args.skip_review_404:
+        req_headers = {}
+        if args.mentor_token:
+            req_headers["Authorization"] = f"Bearer {args.mentor_token}"
         status, review = http_json(
             "POST",
             f"{args.base_url}/v1/agromatrix/shared-memory/review",
@@ -104,8 +116,10 @@ def main() -> int:
                 "reviewer": "smoke",
                 "note": "nonexistent id check",
             },
+            headers=req_headers,
         )
-        ok_all &= check(status == 404, "shared_review_not_found_contract", str(review))
+        expected = 404 if args.mentor_token else 401
+        ok_all &= check(status == expected, "shared_review_not_found_contract", str(review))
 
     return 0 if ok_all else 1