test: add pytest suite + CI workflow (21 tests)

tests/test_auth.py

@@ -0,0 +1,46 @@
+"""Tests for token-based auth (Bearer header validation)."""
+import pytest
+
+
+pytestmark = pytest.mark.asyncio
+
+
+async def test_no_auth_header_returns_401(app_client):
+    """GET /api/agents without Authorization header -> 401."""
+    resp = await app_client.get("/api/agents")
+    assert resp.status_code == 401
+
+
+async def test_invalid_bearer_returns_401(app_client):
+    """GET /api/agents with wrong Bearer token -> 401."""
+    resp = await app_client.get("/api/agents", headers={"Authorization": "Bearer wrongtoken"})
+    assert resp.status_code == 401
+
+
+async def test_valid_bearer_returns_200(app_client, auth_headers, seed_agent):
+    """GET /api/agents with correct Bearer -> 200 and list payload."""
+    resp = await app_client.get("/api/agents", headers=auth_headers)
+    assert resp.status_code == 200, resp.text
+    body = resp.json()
+    assert isinstance(body, list)
+    assert any(a["id"] == "test_agent" for a in body)
+
+
+async def test_health_endpoint_no_auth(app_client):
+    """The /health endpoint is open: no auth header needed, returns 200."""
+    resp = await app_client.get("/health")
+    assert resp.status_code == 200
+
+
+@pytest.mark.xfail(
+    reason="C3 regression: auth.py uses .replace('Bearer ', '') which is case-sensitive. "
+           "Lowercase 'bearer <token>' currently fails. Fix: use a case-insensitive prefix match.",
+    strict=False,
+)
+async def test_case_insensitive_bearer(app_client, auth_headers, seed_agent):
+    """C3 regression: lowercase 'bearer change-me-in-production' must work."""
+    lower = {"Authorization": auth_headers["Authorization"].replace("Bearer ", "bearer ")}
+    resp = await app_client.get("/api/agents", headers=lower)
+    assert resp.status_code == 200, (
+        f"expected 200 with lowercase 'bearer' prefix, got {resp.status_code}: {resp.text}"
+    )