Move secure send into Tech Tools, where somebody would look for it

9845867 gave it its own plugin because Tech Tools is browser-only and this needs
storage. That was the right reading of the code and the wrong answer for the
person using it: Tech Tools is where you go for a utility, and a tool nobody can
find is a tool nobody uses.

So Tech Tools now has a blueprint, a table and a migration chain where it had
none. Its docstring and manifest say why, because "every tool here runs in the
browser" was load-bearing documentation and is no longer true.

WHAT MOVED
  /api/securesend       -> /api/tools/secrets
  securesend.create     -> tools.secrets
  securesend0001baseline -> tools0001securesend
  PLUGIN_TABLE_OWNERS, EXPECTED_HEAD_REVISION, EXEMPT_ENDPOINTS, the universal
  profile and the api-inventory surface all follow it.

THE OLD "NO BACKEND" TEST IS NARROWED, NOT DELETED. It asserted
get_blueprint() is None, which is the sort of guard that gets removed when it
becomes inconvenient. It now asserts the blueprint serves EXACTLY the three
secret routes, with their methods - so a future tool that quietly grows an
endpoint or a table has to edit this test, and therefore make the decision on
purpose rather than by drift.

Asserting methods rather than paths also pins the detail this design turns on:
redeeming is POST-ONLY. Chat and mail clients prefetch GET urls to build
previews, and a preview that could redeem would consume a one-view secret before
its recipient opened the link. Previously that was a comment; now it fails a
test.

UNINSTALLING THE OLD PLUGIN COULD NOT BE DONE WITH THE PLUGIN TOOLING. `flask
plugin uninstall securesend` loads a plugin before uninstalling it, so a plugin
whose directory has been deleted cannot be removed by the command that manages
plugins - the registry entry had to be edited by hand. Worth fixing separately;
it is the same registry-versus-code divergence the device work hit from the
other side.

MIGRATING A CHAIN THAT HAS ALREADY RUN needs the old table and its version row
dropped first, because the relocated chain has no stamp and tries to create a
table that exists. Only relevant to anyone who installed securesend during the
hour it existed - it did reach the publication repo in 4242028 - and the fix is
DROP TABLE securesendsecrets plus DROP TABLE alembic_version_securesend before
running plugin upgrade-all.

1829 tests green. Still backend only: there are no pages yet, so nothing here is
reachable by a person.

plugins/tools/api/__init__.py

@@ -0,0 +1,5 @@
+"""Tech Tools API package."""
+
+from .routes import tools_bp
+
+__all__ = ['tools_bp']

plugins/tools/api/routes.py

@@ -0,0 +1,176 @@
+"""Secure send: create a one-view link for a credential, and redeem it.
+
+Lives in Tech Tools because that is where somebody looks for a utility. It is
+the one tool here that is NOT purely browser-side: a link that expires and dies
+on first read needs somewhere to keep the ciphertext until then.
+
+TWO DIFFERENT DOORS, on purpose.
+
+CREATE needs a login and a permission. Anonymous creation would be an
+untraceable way to move data out of a system that otherwise records who did
+what, and the creator is the only person these rows can ever name.
+
+READ needs neither, because the recipient usually has no account here and the
+link is normally handed over in a call or a chat. The unguessable token IS the
+authorisation - which is why it is 128 bits of randomness and why the row is
+spent on the first successful read.
+
+WHAT KEEPS THIS FROM BECOMING A DOCUMENT TRANSFER. The key never reaches the
+server, so the server cannot look at what it holds and cannot tell a password
+from a page of a drawing. The only lever it has is SIZE, and MAX_CIPHERTEXT is
+therefore not a tuning knob - it is the whole enforcement. Everything else (line
+counts, file signatures, refusing a pasted file) runs in the browser, guides an
+honest person, and is bypassable by anyone willing to POST directly.
+"""
+
+import secrets as pysecrets
+from datetime import datetime, timedelta, timezone
+
+from flask import Blueprint, request
+from flask_jwt_extended import jwt_required, get_jwt_identity
+
+from shopdb.api import (
+    db,
+    success_response, error_response, ErrorCodes,
+    require_permission,
+)
+
+from ..models import SecureSecret
+
+tools_bp = Blueprint('tools', __name__)
+
+# Base64 of an encrypted credential. A password is well under a hundred
+# characters; this is generous for a connection string and useless for a
+# document. See the module docstring: this limit is the only server-side control
+# that a zero-knowledge design leaves available.
+MAX_CIPHERTEXT = 4096
+
+# Hours. The default is short because the normal case is "read it while we are
+# on this call"; the maximum exists so nothing lingers for a week.
+DEFAULT_EXPIRY_HOURS = 24
+MAX_EXPIRY_HOURS = 168
+
+MAX_VIEWS = 5
+
+
+def _utcnow():
+    return datetime.now(timezone.utc).replace(tzinfo=None)
+
+
+@tools_bp.route('/secrets', methods=['POST'])
+@jwt_required()
+@require_permission('tools.secrets')
+def create_secret():
+    """Store an already-encrypted secret and return its token."""
+    data = request.get_json(silent=True) or {}
+    ciphertext = (data.get('ciphertext') or '').strip()
+    iv = (data.get('iv') or '').strip()
+
+    if not ciphertext or not iv:
+        return error_response(ErrorCodes.VALIDATION_ERROR,
+                              'ciphertext and iv are required')
+
+    if len(ciphertext) > MAX_CIPHERTEXT:
+        # Say what the limit is FOR, not just that it exists. Somebody hitting
+        # it is usually trying to send a file, and the answer to that is a
+        # different tool rather than a bigger number here.
+        return error_response(
+            ErrorCodes.VALIDATION_ERROR,
+            'Secret is too large ({} of {} characters). This is for passwords '
+            'and short text, not documents - the server cannot read what it '
+            'holds, so size is the only limit it can enforce.'.format(
+                len(ciphertext), MAX_CIPHERTEXT))
+
+    # `is None`, not `or`: an explicit 0 is falsy, so `or DEFAULT` silently
+    # turned "expire immediately" into "expire in a day" instead of refusing it.
+    # A caller who sends a number should be told when it is not allowed, not
+    # quietly given a different one.
+    rawhours = data.get('expiryhours')
+    rawviews = data.get('views')
+    try:
+        hours = int(DEFAULT_EXPIRY_HOURS if rawhours is None else rawhours)
+        views = int(1 if rawviews is None else rawviews)
+    except (TypeError, ValueError):
+        return error_response(ErrorCodes.VALIDATION_ERROR,
+                              'expiryhours and views must be whole numbers')
+
+    if not 1 <= hours <= MAX_EXPIRY_HOURS:
+        return error_response(
+            ErrorCodes.VALIDATION_ERROR,
+            'expiryhours must be between 1 and {}'.format(MAX_EXPIRY_HOURS))
+    if not 1 <= views <= MAX_VIEWS:
+        return error_response(
+            ErrorCodes.VALIDATION_ERROR,
+            'views must be between 1 and {}'.format(MAX_VIEWS))
+
+    try:
+        userid = int(get_jwt_identity())
+    except (TypeError, ValueError):
+        userid = None
+
+    secret = SecureSecret(
+        token=pysecrets.token_hex(16),   # 128 bits; the link is the credential
+        ciphertext=ciphertext,
+        iv=iv,
+        expiresat=_utcnow() + timedelta(hours=hours),
+        viewsremaining=views,
+        createdbyuserid=userid,
+    )
+    db.session.add(secret)
+    db.session.commit()
+
+    return success_response(secret.to_dict(), http_code=201)
+
+
+@tools_bp.route('/secrets/<token>', methods=['POST'])
+def redeem_secret(token):
+    """Hand over the ciphertext once, then spend the view.
+
+    POST rather than GET on purpose. A GET is prefetched by link previews in
+    chat and mail clients, and a one-view secret consumed by a preview window is
+    a secret the recipient never gets to see.
+
+    A missing, expired and spent secret all answer the SAME way. Distinguishing
+    them would confirm to anyone holding a guessed token whether it ever named
+    anything.
+    """
+    gone = error_response(
+        ErrorCodes.NOT_FOUND,
+        'This link is not valid. It may have been opened already, or expired.',
+        http_code=404)
+
+    secret = SecureSecret.query.filter_by(token=(token or '').strip()).first()
+    if secret is None:
+        return gone
+
+    now = _utcnow()
+    if secret.is_expired(now) or secret.is_spent():
+        # Tidy up on the way past rather than waiting for a sweeper: a spent
+        # secret has no reason to keep its ciphertext.
+        db.session.delete(secret)
+        db.session.commit()
+        return gone
+
+    payload = {'ciphertext': secret.ciphertext, 'iv': secret.iv}
+
+    secret.viewsremaining -= 1
+    secret.viewcount += 1
+    secret.lastviewedat = now
+    if secret.viewsremaining <= 0:
+        db.session.delete(secret)
+    db.session.commit()
+
+    return success_response(payload)
+
+
+@tools_bp.route('/secrets/<token>', methods=['GET'])
+def peek_secret(token):
+    """Whether a link is still live, WITHOUT spending it.
+
+    The read page asks this first so it can render "this secret is waiting, and
+    opening it will destroy it" rather than consuming the only view to find out
+    there was something there.
+    """
+    secret = SecureSecret.query.filter_by(token=(token or '').strip()).first()
+    live = bool(secret and not secret.is_expired() and not secret.is_spent())
+    return success_response({'available': live})