fix(ci): harden community image smoke

tests/unit/test_authenticated_product_smoke.py

@@ -17,6 +17,48 @@ def load_smoke_module():
 
 
 class AuthenticatedProductSmokeTests(unittest.TestCase):
+    def test_client_attaches_csrf_only_to_browser_api_mutations(self) -> None:
+        smoke = load_smoke_module()
+
+        class Response:
+            status = 200
+            headers = {}
+
+            def read(self, _limit):
+                return b"{}"
+
+        class Opener:
+            def __init__(self):
+                self.requests = []
+
+            def open(self, request, timeout):
+                self.requests.append((request, timeout))
+                return Response()
+
+        client = smoke.Client("http://crank.test", 5)
+        opener = Opener()
+        client.opener = opener
+        client.csrf_token = "a" * 32
+
+        client.request_json("POST", "/api/admin/workspaces/ws/operations", {})
+        client.request_json("POST", "http://mcp.test/v1/ws/agent", {})
+
+        self.assertEqual(opener.requests[0][0].get_header("X-csrf-token"), "a" * 32)
+        self.assertIsNone(opener.requests[1][0].get_header("X-csrf-token"))
+
+    def test_login_keeps_server_issued_csrf_token(self) -> None:
+        smoke = load_smoke_module()
+
+        class FakeClient:
+            csrf_token = None
+
+            def request_json(self, *args, **kwargs):
+                return smoke.JsonResponse(200, {}, {"csrf_token": "b" * 32})
+
+        client = FakeClient()
+        smoke.login(client, "owner@crank.test", "safe-password")
+        self.assertEqual(client.csrf_token, "b" * 32)
+
     def test_operation_payload_uses_internal_upstream(self) -> None:
         smoke = load_smoke_module()
 
@@ -136,6 +178,8 @@ class AuthenticatedProductSmokeTests(unittest.TestCase):
                     return smoke.JsonResponse(200, {}, {"operation_id": "op_safe", "version": 7})
                 if path.endswith("/operations/op_safe"):
                     return smoke.JsonResponse(200, {"ETag": '"safe-etag"'}, {"id": "op_safe"})
+                if path.endswith("/agents/agent_safe"):
+                    return smoke.JsonResponse(200, {"ETag": '"safe-agent-etag"'}, {"id": "agent_safe"})
                 if path.endswith("/publish") and "/operations/" in path:
                     return smoke.JsonResponse(200, {}, {"published_version": 7})
                 if path.endswith("/agents"):
@@ -158,6 +202,8 @@ class AuthenticatedProductSmokeTests(unittest.TestCase):
         self.assertEqual((agent_id, agent_version, published_agent_version), ("agent_safe", 3, 3))
         binding = next(payload for _, path, payload, _ in client.requests if path.endswith("/bindings"))[0]
         self.assertEqual(binding["operation_version"], 7)
+        binding_request = next(request for request in client.requests if request[1].endswith("/bindings"))
+        self.assertEqual(binding_request[3]["headers"], {"If-Match": '"safe-agent-etag"'})
         publish = next(request for request in client.requests if request[1].endswith("/operations/op_safe/publish"))
         self.assertEqual(publish[3]["headers"], {"If-Match": '"safe-etag"'})