feat: add secure on-demand HLS playback plugin

tests/Security/OpaqueTokenTest.php

@@ -0,0 +1,40 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Plugin\AzuraCastOnDemandHls\Tests\Security;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\TestCase;
+use Plugin\AzuraCastOnDemandHls\Security\OpaqueToken;
+
+#[CoversClass(OpaqueToken::class)]
+final class OpaqueTokenTest extends TestCase
+{
+    public function testGeneratedTokensAreOpaqueValidAndUnique(): void
+    {
+        $tokens = [];
+        for ($i = 0; $i < 100; ++$i) {
+            $token = OpaqueToken::generate();
+            self::assertTrue(OpaqueToken::isValid($token));
+            self::assertSame(43, strlen($token));
+            $tokens[] = $token;
+        }
+        self::assertCount(100, array_unique($tokens));
+    }
+
+    public function testMalformedTokensAreRejected(): void
+    {
+        foreach (['', 'short', str_repeat('a', 42), str_repeat('a', 44), str_repeat('.', 43), '../' . str_repeat('a', 40), str_repeat('a', 42) . '='] as $token) {
+            self::assertFalse(OpaqueToken::isValid($token), $token);
+        }
+    }
+
+    public function testMutationChangesStoredIdentifier(): void
+    {
+        $token = OpaqueToken::generate();
+        $replacement = 'A' === $token[0] ? 'B' : 'A';
+        $mutated = $replacement . substr($token, 1);
+        self::assertNotSame(OpaqueToken::id($token), OpaqueToken::id($mutated));
+    }
+}