feat: add authenticated tlsync token endpoint

routers/tlsync.py

@@ -0,0 +1,44 @@
+import os
+from typing import Dict
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+
+from modules.auth.supabase_bearer import verify_supabase_jwt_str
+
+router = APIRouter()
+security = HTTPBearer(auto_error=False)
+
+
+async def require_supabase_user(
+    credentials: HTTPAuthorizationCredentials | None = Depends(security),
+) -> Dict:
+    """Validate a Supabase bearer token and return the decoded session claims."""
+    if credentials is None or not credentials.credentials:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Authentication required",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    try:
+        return verify_supabase_jwt_str(credentials.credentials)
+    except HTTPException as exc:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=exc.detail,
+            headers={"WWW-Authenticate": "Bearer"},
+        ) from exc
+
+
+@router.get("/token")
+async def get_tlsync_token(_claims: Dict = Depends(require_supabase_user)) -> Dict[str, str]:
+    """Return the API-side TLSync shared secret for authenticated clients."""
+    tlsync_secret = os.getenv("TLSYNC_SECRET")
+    if not tlsync_secret:
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="TLSync secret is not configured",
+        )
+
+    return {"token": tlsync_secret}