feat: webhook event-model und shared-secret auth

tests/test_webhook.py

@@ -0,0 +1,31 @@
+import pytest
+from fastapi import HTTPException
+
+from app.webhook.models import NextcloudEvent, EventType
+from app.webhook.auth import verify_secret
+
+
+def test_event_parses_created():
+    evt = NextcloudEvent(event_type="created", file_path="a/b.pdf", file_name="b.pdf")
+    assert evt.event_type == EventType.CREATED
+
+
+def test_event_invalid_type_raises():
+    with pytest.raises(Exception):
+        NextcloudEvent(event_type="exploded", file_path="a", file_name="a")
+
+
+def test_verify_secret_pass():
+    verify_secret(provided="abc", expected="abc")  # no exception
+
+
+def test_verify_secret_fail():
+    with pytest.raises(HTTPException) as exc_info:
+        verify_secret(provided="wrong", expected="abc")
+    assert exc_info.value.status_code == 401
+
+
+def test_verify_secret_missing_fail():
+    with pytest.raises(HTTPException) as exc_info:
+        verify_secret(provided=None, expected="abc")
+    assert exc_info.value.status_code == 401