Harden CardDAV credential and network boundaries

src/govoplan_addresses/backend/service.py

@@ -1,8 +1,10 @@
 from __future__ import annotations
 
+import copy
 from collections.abc import Iterable
 from dataclasses import dataclass, field
 import os
+import re
 import urllib.parse
 from typing import Any
 
@@ -256,6 +258,8 @@ def create_sync_source(
     principal: ApiPrincipal,
     address_book_id: str,
     payload: AddressSyncSourceCreateRequest,
+    *,
+    trusted_connector_metadata: bool = False,
 ) -> AddressSyncSource:
     book = get_visible_address_book(session, principal, address_book_id)
     if book.deleted_at is not None:
@@ -266,6 +270,8 @@ def create_sync_source(
         raise AddressBookError("Sync connector type is required.")
     if not display_name:
         raise AddressBookError("Sync source display name is required.")
+    if connector_type.casefold() == "carddav" and not trusted_connector_metadata:
+        _assert_api_carddav_metadata_safe(payload.metadata)
     read_only = _read_only_from_sync_direction(payload.sync_direction, payload.read_only)
     sync_source = AddressSyncSource(
         tenant_id=book.tenant_id,
@@ -325,7 +331,11 @@ def update_sync_source(
     if "remote_revision" in payload.model_fields_set:
         sync_source.remote_revision = _trim(payload.remote_revision)
     if "metadata" in payload.model_fields_set:
-        sync_source.metadata_ = payload.metadata or {}
+        metadata = payload.metadata or {}
+        if sync_source.connector_type.casefold() == "carddav":
+            _assert_api_carddav_metadata_safe(metadata)
+            metadata = _merge_server_owned_carddav_metadata(sync_source.metadata_, metadata)
+        sync_source.metadata_ = metadata
     sync_source.updated_by_account_id = _account_id(principal)
     _apply_sync_source_to_book(sync_source.address_book, sync_source)
     return sync_source
@@ -588,6 +598,7 @@ def discover_carddav_address_books(
     principal: ApiPrincipal,
     payload: AddressCardDavDiscoveryRequest,
 ) -> list[AddressCardDAVAddressBook]:
+    _assert_no_caller_carddav_credential_ref(payload.credential_ref)
     source = get_visible_sync_source(session, principal, payload.source_id) if payload.source_id else None
     client = _carddav_client_from_payload(session, principal, payload, source=source)
     return client.discover_addressbooks()
@@ -599,6 +610,7 @@ def create_carddav_sync_source(
     address_book_id: str,
     payload: AddressCardDavSourceCreateRequest,
 ) -> AddressSyncSource:
+    _assert_no_caller_carddav_credential_ref(payload.credential_ref)
     collection_url = ensure_collection_url(payload.collection_url)
     display_name = _trim(payload.display_name) or "CardDAV address book"
     metadata = _carddav_metadata(
@@ -606,7 +618,7 @@ def create_carddav_sync_source(
         username=payload.username,
         password=_secret_value(payload.password),
         bearer_token=_secret_value(payload.bearer_token),
-        credential_ref=payload.credential_ref,
+        credential_ref=None,
         collection_url=collection_url,
     )
     return create_sync_source(
@@ -624,6 +636,7 @@ def create_carddav_sync_source(
             remote_revision=payload.remote_revision,
             metadata=metadata,
         ),
+        trusted_connector_metadata=True,
     )
 
 
@@ -1308,6 +1321,7 @@ def _carddav_client_from_payload(
     *,
     source: AddressSyncSource | None = None,
 ) -> AddressCardDAVClient:
+    _assert_no_caller_carddav_credential_ref(payload.credential_ref)
     url = payload.url or (source.external_address_book_ref if source else "")
     metadata = dict(source.metadata_ or {}) if source else {}
     auth = dict(metadata.get("carddav") or {})
@@ -1391,13 +1405,83 @@ def _resolve_carddav_secret(
         return password
     if auth_type == "bearer" and bearer_token:
         return bearer_token
-    if credential_ref and credential_ref.startswith(CARDDAV_SECRET_ENV_PREFIX):
-        return os.environ.get(credential_ref.removeprefix(CARDDAV_SECRET_ENV_PREFIX))
+    if credential_ref:
+        raise AddressBookError(
+            "The CardDAV credential reference is not a server-owned credential; provide a replacement password or token"
+        )
     if encrypted:
         return decrypt_secret(encrypted)
     return None
 
 
+def resolve_trusted_deployment_carddav_credential_ref(credential_ref: str) -> str | None:
+    """Resolve env-backed credentials only for trusted deployment code.
+
+    API-managed discovery and sync-source paths deliberately never call this
+    function, so a tenant user cannot select arbitrary process environment
+    variables as connector credentials.
+    """
+
+    if not credential_ref.startswith(CARDDAV_SECRET_ENV_PREFIX):
+        raise AddressBookError("Trusted deployment credential references must use the env: prefix")
+    env_name = credential_ref.removeprefix(CARDDAV_SECRET_ENV_PREFIX)
+    if not re.fullmatch(r"[A-Za-z_][A-Za-z0-9_]*", env_name):
+        raise AddressBookError("Trusted deployment credential reference contains an invalid environment variable name")
+    return os.environ.get(env_name)
+
+
+def public_address_sync_metadata(metadata: object) -> dict[str, Any]:
+    payload = copy.deepcopy(metadata) if isinstance(metadata, dict) else {}
+    auth = payload.get("carddav")
+    if not isinstance(auth, dict):
+        return payload
+    had_credential = bool(auth.get("secret_encrypted") or auth.get("credential_ref"))
+    auth.pop("secret_encrypted", None)
+    auth.pop("credential_ref", None)
+    auth["has_credential"] = had_credential
+    return payload
+
+
+def _assert_no_caller_carddav_credential_ref(credential_ref: str | None) -> None:
+    if _trim(credential_ref):
+        raise AddressBookError(
+            "Caller-supplied credential references are not accepted; provide a password or bearer token"
+        )
+
+
+def _carddav_auth_metadata(metadata: object) -> dict[str, Any]:
+    if not isinstance(metadata, dict):
+        return {}
+    carddav = metadata.get("carddav")
+    return carddav if isinstance(carddav, dict) else {}
+
+
+def _assert_api_carddav_metadata_safe(metadata: object) -> None:
+    auth = _carddav_auth_metadata(metadata)
+    if auth.get("credential_ref") or auth.get("secret_encrypted"):
+        raise AddressBookError(
+            "CardDAV credential references and encrypted secrets are server-managed; provide credentials through the CardDAV source endpoint"
+        )
+
+
+def _merge_server_owned_carddav_metadata(existing: object, incoming: dict[str, Any]) -> dict[str, Any]:
+    merged = copy.deepcopy(incoming)
+    existing_auth = _carddav_auth_metadata(existing)
+    server_owned = {
+        key: existing_auth[key]
+        for key in ("credential_ref", "secret_encrypted")
+        if existing_auth.get(key)
+    }
+    if not server_owned:
+        return merged
+    auth = merged.get("carddav")
+    if not isinstance(auth, dict):
+        auth = {}
+        merged["carddav"] = auth
+    auth.update(server_owned)
+    return merged
+
+
 def _secret_value(value: Any | None) -> str | None:
     if value is None:
         return None