Integrate calendar sources with credential envelopes

tests/test_caldav.py

@@ -42,6 +42,7 @@ from govoplan_calendar.backend.service import (
     update_event,
 )
 from govoplan_core.db.base import Base
+from govoplan_core.security.credential_envelopes import create_credential_envelope
 from govoplan_core.tenancy.scope import create_scope_tables
 from govoplan_tenancy.backend.db.models import Tenant
 
@@ -300,6 +301,49 @@ class CalDAVSyncTests(unittest.TestCase):
         self.assertEqual(client.username, "ada")
         self.assertEqual(client.password, "secret")
 
+    def test_source_can_resolve_reusable_core_credential(self) -> None:
+        session = self.session()
+        session.add(Tenant(id="tenant-1", slug="tenant-1", name="Tenant"))
+        calendar = create_calendar(
+            session,
+            tenant_id="tenant-1",
+            user_id=None,
+            payload=CalendarCollectionCreateRequest(name="Remote"),
+        )
+        credential = create_credential_envelope(
+            session,
+            tenant_id="tenant-1",
+            scope_type="tenant",
+            scope_id="tenant-1",
+            name="Shared DAV login",
+            credential_kind="username_password",
+            public_data={"username": "ada"},
+            secret_data={"password": "secret"},
+            allowed_modules=["calendar"],
+            inherit_to_lower_scopes=True,
+        )
+
+        source = create_caldav_source(
+            session,
+            tenant_id="tenant-1",
+            user_id=None,
+            payload=CalendarCalDavSourceCreateRequest(
+                calendar_id=calendar.id,
+                collection_url="https://dav.example.test/cal",
+                auth_type="basic",
+                credential_ref=f"credential-envelope:{credential.id}",
+            ),
+        )
+        session.commit()
+
+        client = caldav_client_for_source(session, source)
+        response = caldav_source_response(source)
+
+        self.assertEqual(client.username, "ada")
+        self.assertEqual(client.password, "secret")
+        self.assertEqual(response["credential_envelope_id"], credential.id)
+        self.assertEqual(session.query(CalendarSyncCredential).count(), 0)
+
     def test_api_source_and_discovery_reject_caller_selected_credential_references(self) -> None:
         session = self.session()
         session.add(Tenant(id="tenant-1", slug="tenant-1", name="Tenant"))