feat(reviewer-workflow): add hard wall against reviewer mutations through alternate profile or CLI side-channel

tests/test_review_pr.py

@@ -2,6 +2,8 @@
 
 Mocks api_request and credentials.
 """
+import io
+import os
 import sys
 import unittest
 from unittest.mock import patch
@@ -27,6 +29,11 @@ FAKE_PR_DATA = {
 
 class TestArgParsing(unittest.TestCase):
 
+    def setUp(self):
+        self.exists_patcher = patch("os.path.exists", return_value=False)
+        self.exists_patcher.start()
+        self.addCleanup(self.exists_patcher.stop)
+
     @patch("review_pr.get_auth_header", return_value=FAKE_CREDS)
     def test_missing_pr_number_exits(self, _auth):
         with self.assertRaises(SystemExit):
@@ -35,6 +42,11 @@ class TestArgParsing(unittest.TestCase):
 
 class TestAPIPayload(unittest.TestCase):
 
+    def setUp(self):
+        self.exists_patcher = patch("os.path.exists", return_value=False)
+        self.exists_patcher.start()
+        self.addCleanup(self.exists_patcher.stop)
+
     @patch("review_pr.api_request")
     @patch("review_pr.get_auth_header", return_value=FAKE_CREDS)
     def test_payload_fields_and_workflow(self, _auth, mock_api):
@@ -99,5 +111,70 @@ class TestAPIPayload(unittest.TestCase):
         self.assertIn("gitea_merge_pr", msg)
 
 
+class TestMutationAuthorityLock(unittest.TestCase):
+    """Issue #194: verify that the CLI tool rejects profile overrides when mismatched with lock."""
+
+    @patch("review_pr.get_profile")
+    def test_cli_blocked_on_profile_mismatch(self, mock_get_profile):
+        mock_get_profile.return_value = {"profile_name": "prgs-reviewer"}
+
+        original_exists = os.path.exists
+        def conditional_exists(path):
+            if "gitea_mutation_authority.lock" in str(path):
+                return True
+            return original_exists(path)
+
+        original_open = open
+        def conditional_open(file, *args, **kwargs):
+            if "gitea_mutation_authority.lock" in str(file):
+                return io.StringIO('{"current_profile": "prgs-author"}')
+            return original_open(file, *args, **kwargs)
+
+        from _pytest.monkeypatch import MonkeyPatch
+        import io
+        buf = io.StringIO()
+        monkeypatch = MonkeyPatch()
+        monkeypatch.setattr(sys, "stderr", buf)
+
+        with patch("os.path.exists", side_effect=conditional_exists), \
+             patch("builtins.open", side_effect=conditional_open):
+            try:
+                rc = review_pr.main([
+                    "--pr-number", "81", "--event", "APPROVE",
+                ])
+            finally:
+                monkeypatch.undo()
+
+        self.assertEqual(rc, 3)
+        msg = buf.getvalue().lower()
+        self.assertIn("cli override rejected", msg)
+
+    @patch("review_pr.get_profile")
+    @patch("review_pr.api_request")
+    @patch("review_pr.get_auth_header", return_value=FAKE_CREDS)
+    def test_cli_allowed_on_profile_match(self, _auth, mock_api, mock_get_profile):
+        mock_get_profile.return_value = {"profile_name": "prgs-reviewer"}
+        mock_api.side_effect = [FAKE_PR_DATA, {}]
+
+        original_exists = os.path.exists
+        def conditional_exists(path):
+            if "gitea_mutation_authority.lock" in str(path):
+                return True
+            return original_exists(path)
+
+        original_open = open
+        def conditional_open(file, *args, **kwargs):
+            if "gitea_mutation_authority.lock" in str(file):
+                return io.StringIO('{"current_profile": "prgs-reviewer"}')
+            return original_open(file, *args, **kwargs)
+
+        with patch("os.path.exists", side_effect=conditional_exists), \
+             patch("builtins.open", side_effect=conditional_open):
+            rc = review_pr.main([
+                "--pr-number", "81", "--event", "APPROVE",
+            ])
+        self.assertEqual(rc, 0)
+
+
 if __name__ == "__main__":
     unittest.main()