feat: add authenticated tlsync token endpoint

tests/test_tlsync_token.py

@@ -0,0 +1,64 @@
+import importlib
+import time
+
+import jwt
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+
+def _client(monkeypatch, jwt_secret="test-jwt-secret-with-at-least-32-bytes", tlsync_secret="test-tlsync-secret"):
+    monkeypatch.setenv("JWT_SECRET", jwt_secret)
+    if tlsync_secret is None:
+        monkeypatch.delenv("TLSYNC_SECRET", raising=False)
+    else:
+        monkeypatch.setenv("TLSYNC_SECRET", tlsync_secret)
+
+    tlsync = importlib.import_module("routers.tlsync")
+    app = FastAPI()
+    app.include_router(tlsync.router, prefix="/tlsync")
+    return TestClient(app), jwt_secret
+
+
+def _token(jwt_secret: str) -> str:
+    now = int(time.time())
+    return jwt.encode(
+        {
+            "sub": "user-123",
+            "aud": "authenticated",
+            "iat": now,
+            "exp": now + 3600,
+        },
+        jwt_secret,
+        algorithm="HS256",
+    )
+
+
+def test_tlsync_token_requires_bearer_auth(monkeypatch):
+    client, _ = _client(monkeypatch)
+
+    response = client.get("/tlsync/token")
+
+    assert response.status_code == 401
+
+
+def test_tlsync_token_returns_configured_secret(monkeypatch):
+    client, jwt_secret = _client(monkeypatch, tlsync_secret="runtime-secret")
+
+    response = client.get(
+        "/tlsync/token",
+        headers={"Authorization": f"Bearer {_token(jwt_secret)}"},
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"token": "runtime-secret"}
+
+
+def test_tlsync_token_500_when_secret_missing(monkeypatch):
+    client, jwt_secret = _client(monkeypatch, tlsync_secret=None)
+
+    response = client.get(
+        "/tlsync/token",
+        headers={"Authorization": f"Bearer {_token(jwt_secret)}"},
+    )
+
+    assert response.status_code == 500