Add A2A agent access token auth

tests/test_template_agent_contract.py

@@ -66,3 +66,30 @@ def test_integration_doc_mentions_template_agent_runtime_contract():
     assert "| `GET` | `/agents/{agent_name}` | 查询模板 Agent 生命周期状态；返回平铺 `status` / `runtime_status` / `state` |" in doc_source
     assert "| `POST` | `/agents/{agent_name}/stop` | 幂等停止模板 Agent；停止运行 Pod，但保留数据库记录 |" in doc_source
     assert "删除接口当前已修复模板 Agent 场景下的数据库变量引用问题" in doc_source
+
+
+def test_a2a_servers_enforce_agent_access_token_contract():
+    """A2A servers should support local X-Agent-Access-Token validation."""
+    coding_server_source = _read("agent_templates/agents/coding_a2a_agent/a2a_server.py")
+    litellm_server_source = _read("agent_templates/agents/a2a_litellm_agent/a2a_server.py")
+
+    for source in (coding_server_source, litellm_server_source):
+        assert 'AGENT_ACCESS_TOKEN = os.getenv("AGENT_ACCESS_TOKEN", "")' in source
+        assert 'AGENT_ACCESS_HEADER = "X-Agent-Access-Token"' in source
+        assert "secrets.compare_digest" in source
+        assert 'status_code=401' in source
+        assert 'status_code=403' in source
+        assert 'request.headers.get(AGENT_ACCESS_HEADER, "")' in source
+
+
+def test_a2a_docs_describe_agent_access_token_header():
+    """Template-agent docs should explain the local access-token authentication flow."""
+    coding_doc_source = _read("docs/CODING_A2A_AGENT_CREATE_AND_INVOKE.md")
+    integration_doc_source = _read("docs/HEICODE_API_INTEGRATION.md")
+
+    assert "AGENT_ACCESS_TOKEN" in coding_doc_source
+    assert "X-Agent-Access-Token" in coding_doc_source
+    assert "缺少请求头时返回 `401`" in coding_doc_source
+    assert "请求头不匹配时返回 `403`" in coding_doc_source
+    assert "客户端直连鉴权" in integration_doc_source
+    assert "X-Agent-Access-Token == AGENT_ACCESS_TOKEN" in integration_doc_source