Secure send moves into Tech Tools

tests/test_plugins/test_tools.py

@@ -27,11 +27,39 @@ def test_meta_matches_manifest():
     assert meta.core_version == manifest['core_version']
 
 
-def test_no_backend_surface():
-    """Client-side only: no blueprint to register, no tables to migrate."""
+def test_the_only_backend_surface_is_secure_send():
+    """Tech Tools used to have NO backend, and mostly still should.
+
+    This asserted `get_blueprint() is None` until secure send arrived: a link
+    that expires and dies on first read cannot be browser-only, because
+    something has to hold the ciphertext until it is claimed. The guard is kept
+    rather than deleted, narrowed to the one exception - a future tool that
+    quietly grows an endpoint or a table has to change this test, and therefore
+    make the decision on purpose rather than by accident.
+    """
+    from flask import Flask
+
+    from plugins.tools.models import SecureSecret
+
     plugin = ToolsPlugin()
-    assert plugin.get_blueprint() is None
-    assert plugin.get_models() == []
+    assert plugin.get_models() == [SecureSecret]
+
+    probe = Flask(__name__)
+    probe.register_blueprint(plugin.get_blueprint(), url_prefix='/api/tools')
+    served = sorted(
+        (str(rule), sorted(rule.methods - {'HEAD', 'OPTIONS'}))
+        for rule in probe.url_map.iter_rules()
+        if not str(rule).startswith('/static'))
+
+    # Methods are asserted, not just paths: REDEEMING MUST BE POST-ONLY. Chat
+    # and mail clients prefetch GET urls to build previews, and a preview that
+    # could redeem would consume a one-view secret before its recipient ever
+    # opened the link. The GET on the same path reports availability only.
+    assert served == [
+        ('/api/tools/secrets', ['POST']),
+        ('/api/tools/secrets/<token>', ['GET']),
+        ('/api/tools/secrets/<token>', ['POST']),
+    ], served
 
 
 def test_navigation_item():