feat(slice-2): platform/session — stdlib HMAC signed cookie tokens (§6.2)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/tests/test_session.py

@@ -0,0 +1,26 @@
+from app.platform import session
+
+SECRET = "test-secret"
+
+
+def test_sign_then_verify_round_trips():
+    token = session.sign({"account_id": 7, "email": "m@example.com"}, SECRET)
+    assert session.verify(token, SECRET) == {"account_id": 7, "email": "m@example.com"}
+
+
+def test_verify_rejects_tampered_payload():
+    token = session.sign({"account_id": 7}, SECRET)
+    payload_b64, _, sig = token.partition(".")
+    # Flip the payload but keep the old signature -> must be rejected.
+    forged = session.sign({"account_id": 8}, SECRET).split(".")[0] + "." + sig
+    assert session.verify(forged, SECRET) is None
+
+
+def test_verify_rejects_wrong_secret():
+    token = session.sign({"account_id": 7}, SECRET)
+    assert session.verify(token, "other-secret") is None
+
+
+def test_verify_rejects_garbage():
+    assert session.verify("not-a-token", SECRET) is None
+    assert session.verify("", SECRET) is None