test: validate signed media URL capability

tests/test_media_url_signer.py

@@ -0,0 +1,26 @@
+from __future__ import annotations
+
+from app.services.media_url_signer import MediaURLSigner
+
+
+def test_signed_media_url_round_trip(settings) -> None:
+    settings.media_signing_secret = "a" * 32
+    settings.base_url = "https://media.example"
+    signer = MediaURLSigner(settings)
+    url = signer.sign("123e4567-e89b-12d3-a456-426614174000", "clip.mp4", ttl=3600)
+    assert url is not None
+    from urllib.parse import parse_qs, urlparse
+    parsed = urlparse(url)
+    params = parse_qs(parsed.query)
+    assert signer.verify(
+        "123e4567-e89b-12d3-a456-426614174000",
+        "clip.mp4",
+        int(params["expires"][0]),
+        params["signature"][0],
+    )
+    assert not signer.verify(
+        "123e4567-e89b-12d3-a456-426614174000",
+        "other.mp4",
+        int(params["expires"][0]),
+        params["signature"][0],
+    )