Add shared automation and WebUI editing primitives

tests/test_secrets.py

@@ -0,0 +1,48 @@
+from __future__ import annotations
+
+import unittest
+
+from govoplan_core.security.secrets import (
+    TransientPayloadError,
+    open_transient_payload,
+    seal_transient_payload,
+)
+
+
+class TransientPayloadTests(unittest.TestCase):
+    def test_round_trip_preserves_json_object(self) -> None:
+        token = seal_transient_payload(
+            {
+                "purpose": "test",
+                "tenant_id": "tenant-1",
+                "selected": ["one", "two"],
+            }
+        )
+
+        self.assertEqual(
+            {
+                "purpose": "test",
+                "tenant_id": "tenant-1",
+                "selected": ["one", "two"],
+            },
+            open_transient_payload(token, ttl_seconds=60),
+        )
+
+    def test_tampered_payload_is_rejected(self) -> None:
+        token = seal_transient_payload({"purpose": "test"})
+        replacement = "A" if token[-1] != "A" else "B"
+
+        with self.assertRaisesRegex(
+            TransientPayloadError, "invalid or expired"
+        ):
+            open_transient_payload(f"{token[:-1]}{replacement}", ttl_seconds=60)
+
+    def test_non_positive_ttl_is_rejected(self) -> None:
+        token = seal_transient_payload({"purpose": "test"})
+
+        with self.assertRaisesRegex(ValueError, "TTL must be positive"):
+            open_transient_payload(token, ttl_seconds=0)
+
+
+if __name__ == "__main__":
+    unittest.main()