Add CalDAV outbox recovery UI

tests/test_http_security.py

@@ -7,6 +7,8 @@ from collections.abc import Iterator
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 
 from govoplan_calendar.backend.service import CalendarError, http_request
+from govoplan_calendar.backend.router import _require_worker_principal
+from fastapi import HTTPException
 
 
 @contextlib.contextmanager
@@ -24,6 +26,17 @@ def running_http_server(handler: type[BaseHTTPRequestHandler]) -> Iterator[str]:
 
 
 class CalendarHttpSecurityTests(unittest.TestCase):
+    def test_worker_routes_reject_interactive_principals(self) -> None:
+        class Principal:
+            auth_method = "session"
+
+        with self.assertRaises(HTTPException) as raised:
+            _require_worker_principal(Principal())  # type: ignore[arg-type]
+        self.assertEqual(403, raised.exception.status_code)
+
+        Principal.auth_method = "service_account"
+        _require_worker_principal(Principal())  # type: ignore[arg-type]
+
     def test_cross_origin_redirect_does_not_forward_authorization(self) -> None:
         forwarded_authorization: list[str | None] = []