chore: prepare the demo for public release (license, tests, CI)

.github/workflows/ci.yml

@@ -0,0 +1,22 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  crm-api-tests:
+    name: crm_api smoke tests
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: crm_api
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install dependencies
+        run: pip install -r requirements-dev.txt
+      - name: Run smoke tests
+        run: pytest -q

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026, Arcade AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -58,7 +58,9 @@ Full diagrams of both layers: [docs/architecture.md](docs/architecture.md).
 - [How it works](#how-it-works)
 - [Troubleshooting](#troubleshooting)
 - [Production notes](#production-notes)
+- [Tests](#tests)
 - [Arcade documentation](#arcade-documentation)
+- [License](#license)
 
 ---
 
@@ -294,6 +296,18 @@ CRM_API_BASE_URL=https://<your-public-host>   # the ngrok https URL of the CRM
 
 ---
 
+## Tests
+
+A dev-mode smoke suite exercises both authorization layers without contacting Duo. Token validation runs in `DEV_ALLOW_INSECURE` mode and the step-up is simulated with `STEPUP_DEV_MODE`, so the tests cover the per-tool 403 and the step-up approve and deny paths offline.
+
+```bash
+cd crm_api
+uv venv .venv && uv pip install --python .venv/bin/python -r requirements-dev.txt
+.venv/bin/pytest
+```
+
+---
+
 ## Arcade documentation
 
 - Auth providers (overview): <https://docs.arcade.dev/en/references/auth-providers>
@@ -308,9 +322,6 @@ CRM_API_BASE_URL=https://<your-public-host>   # the ngrok https URL of the CRM
 
 ---
 
-## Create the repo
+## License
 
-```bash
-git init && git add . && git commit -m "Arcade x Cisco Duo agent authorization demo"
-```
-(`.gitignore` excludes `.venv/`, `__pycache__/`, and `.env`.)
+This project is released under the MIT License. See [LICENSE](LICENSE).

crm_api/README.md

@@ -15,4 +15,6 @@ cp .env.example .env        # fill in Duo OIDC + Auth API creds (see root README
 
 Expose port 8000 over HTTPS (e.g. `ngrok http 8000`) so Arcade Cloud can reach both the CRM and `/hooks/pre`.
 
+Smoke tests live in `tests/`; see the [Tests](../README.md#tests) section of the root README to run them.
+
 See the root [README](../README.md) for the full, end-to-end setup.

crm_api/requirements-dev.txt

@@ -0,0 +1,2 @@
+-r requirements.txt
+pytest>=8,<9

crm_api/tests/test_smoke.py

@@ -0,0 +1,82 @@
+"""Smoke tests for the Duo-protected CRM, runnable without a Duo account.
+
+These exercise both authorization layers in local dev mode:
+
+- Layer 1: per-tool Duo scope enforcement (a missing scope returns 403).
+- Layer 2: the Arcade pre-execution hook that triggers contextual step-up,
+  on both the approved and the denied path.
+
+Run from the crm_api directory:
+
+    uv pip install --python .venv/bin/python -r requirements-dev.txt
+    .venv/bin/pytest
+"""
+import os
+
+# Configure local dev mode before importing the app. DEV_ALLOW_INSECURE swaps
+# Duo token introspection for a fake principal; DEV_SCOPES omits crm.deals.read
+# so the per-tool 403 path is exercised; SENSITIVE_QUERY_TERMS drives step-up.
+os.environ.setdefault("DEV_ALLOW_INSECURE", "true")
+os.environ.setdefault("DEV_SCOPES", "openid profile email crm.contacts.read crm.contacts.write")
+os.environ.setdefault("SENSITIVE_QUERY_TERMS", "defence,classified")
+os.environ.setdefault("HOOK_BEARER_TOKEN", "")
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+
+from fastapi.testclient import TestClient
+
+import main
+
+client = TestClient(main.app)
+AUTH = {"Authorization": "Bearer dev-token"}
+
+
+def test_healthz_is_open():
+    assert client.get("/healthz").json() == {"status": "ok"}
+
+
+def test_me_returns_only_granted_scopes():
+    body = client.get("/me", headers=AUTH).json()
+    assert "crm.contacts.read" in body["granted_scopes"]
+    assert "crm.deals.read" not in body["granted_scopes"]
+
+
+def test_contacts_read_is_allowed():
+    resp = client.get("/contacts", headers=AUTH)
+    assert resp.status_code == 200
+    assert resp.json()["total"] >= 1
+
+
+def test_deals_denied_without_scope():
+    # Layer 1: the Duo token lacks crm.deals.read, so the CRM returns 403.
+    assert client.get("/deals", headers=AUTH).status_code == 403
+
+
+def test_hook_allows_benign_request():
+    # Layer 2: a non-sensitive query clears the pre-execution hook with no push.
+    resp = client.post(
+        "/hooks/pre",
+        json={"tool": {"name": "list_contacts"}, "inputs": {"query": "ada"}},
+    )
+    assert resp.json() == {"code": "OK"}
+
+
+def test_hook_allows_sensitive_request_when_push_approved(monkeypatch):
+    monkeypatch.setenv("STEPUP_DEV_MODE", "allow")
+    resp = client.post(
+        "/hooks/pre",
+        json={"tool": {"name": "list_contacts"}, "inputs": {"query": "defence"}},
+    )
+    assert resp.json() == {"code": "OK"}
+
+
+def test_hook_blocks_sensitive_request_when_push_denied(monkeypatch):
+    monkeypatch.setenv("STEPUP_DEV_MODE", "deny")
+    resp = client.post(
+        "/hooks/pre",
+        json={"tool": {"name": "list_contacts"}, "inputs": {"query": "defence"}},
+    )
+    assert resp.json()["code"] == "CHECK_FAILED"