feat: expose image generation to page agents

mindspace-image-generation-routes.test.mjs

@@ -4,7 +4,7 @@ import test from 'node:test';
 import express from 'express';
 import { attachMindSpaceImageGenerationRoutes } from './mindspace-image-generation-routes.mjs';
 
-async function start(service) {
+async function start(service, requireInternal = null) {
   const app = express();
   app.use(express.json());
   app.use((req, _res, next) => {
@@ -12,7 +12,7 @@ async function start(service) {
     req.requestId = 'req-1';
     next();
   });
-  attachMindSpaceImageGenerationRoutes(app, { getService: () => service });
+  attachMindSpaceImageGenerationRoutes(app, { getService: () => service, requireInternal });
   const server = app.listen(0, '127.0.0.1');
   await once(server, 'listening');
   return {
@@ -66,3 +66,29 @@ test('image generation route exposes safe fallback without changing existing flo
     });
   } finally { await fixture.close(); }
 });
+
+test('internal image generation route requires its injected secret guard and explicit user', async () => {
+  const calls = [];
+  const fixture = await start({
+    async generate(input) { calls.push(input); return { ok: true, asset: { id: 'asset-1' } }; },
+  }, (req, res) => {
+    if (req.get('authorization') === 'Bearer internal-secret') return true;
+    res.status(401).json({ message: 'invalid secret' });
+    return false;
+  });
+  try {
+    const denied = await fetch(`${fixture.url}/agent/mindspace_image_generate`, {
+      method: 'POST', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ user_id: 'user-2', purpose: 'hero', prompt: 'x' }),
+    });
+    assert.equal(denied.status, 401);
+    const allowed = await fetch(`${fixture.url}/agent/mindspace_image_generate`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', authorization: 'Bearer internal-secret' },
+      body: JSON.stringify({ user_id: 'user-2', purpose: 'hero', prompt: 'x' }),
+    });
+    assert.equal(allowed.status, 201);
+    assert.equal(calls[0].userId, 'user-2');
+    assert.equal(calls[0].consumerRef, 'mindspace-agent:req-1:hero');
+  } finally { await fixture.close(); }
+});