Integrate address sources with credential envelopes

tests/test_addresses_service.py

@@ -10,6 +10,10 @@ from govoplan_core.core.change_sequence import ChangeSequenceEntry
 from govoplan_core.core.people import CAPABILITY_ADDRESSES_PEOPLE_SEARCH, PeopleSearchProvider
 from govoplan_core.db.base import Base
 from govoplan_core.db.base import utcnow
+from govoplan_core.security.credential_envelopes import (
+    CredentialEnvelope,
+    create_credential_envelope,
+)
 from govoplan_addresses.backend.carddav import AddressCardDAVObject, AddressCardDAVReportResult, AddressCardDAVWriteResult
 from govoplan_addresses.backend.capabilities import (
     CAPABILITY_ADDRESSES_CONTACT_WRITER,
@@ -88,6 +92,7 @@ from govoplan_addresses.backend.service import (
     finish_sync_attempt,
     update_sync_source,
     resolve_trusted_deployment_carddav_credential_ref,
+    _carddav_client_for_source,
 )
 
 
@@ -181,6 +186,7 @@ class AddressServiceTest(unittest.TestCase):
                 AddressSyncConflict.__table__,
                 AddressSyncDiagnostic.__table__,
                 ChangeSequenceEntry.__table__,
+                CredentialEnvelope.__table__,
             ],
         )
         self.session = sessionmaker(bind=self.engine)()
@@ -845,6 +851,44 @@ END:VCARD
                 ),
             )
 
+    def test_carddav_source_can_use_reusable_core_credential(self) -> None:
+        book = create_address_book(
+            self.session,
+            self.principal,
+            AddressBookCreateRequest(scope_type="user", name="Shared credential"),
+        )
+        credential = create_credential_envelope(
+            self.session,
+            tenant_id="tenant-1",
+            scope_type="tenant",
+            scope_id="tenant-1",
+            name="Shared DAV login",
+            credential_kind="username_password",
+            public_data={"username": "ada"},
+            secret_data={"password": "secret"},
+            allowed_modules=["addresses"],
+            inherit_to_lower_scopes=True,
+        )
+        source = create_carddav_sync_source(
+            self.session,
+            self.principal,
+            book.id,
+            AddressCardDavSourceCreateRequest(
+                collection_url="https://dav.example.test/addressbooks/personal/",
+                auth_type="basic",
+                credential_ref=f"credential-envelope:{credential.id}",
+            ),
+        )
+        self.session.commit()
+
+        client = _carddav_client_for_source(self.session, source)
+        response_auth = _sync_source_response(source).metadata["carddav"]
+
+        self.assertEqual(client.username, "ada")
+        self.assertEqual(client.password, "secret")
+        self.assertEqual(response_auth["credential_envelope_id"], credential.id)
+        self.assertTrue(response_auth["has_credential"])
+
         source = create_carddav_sync_source(
             self.session,
             self.principal,