Confine calendar connectors to configured origins

tests/test_caldav.py

@@ -246,12 +246,21 @@ class CalDAVSyncTests(unittest.TestCase):
         create_scope_tables(self.engine)
         Base.metadata.create_all(bind=self.engine)
         self.Session = sessionmaker(bind=self.engine)
+        self.sessions = []
 
     def tearDown(self) -> None:
+        for session in reversed(self.sessions):
+            session.close()
         Base.metadata.drop_all(bind=self.engine)
+        self.engine.dispose()
+
+    def session(self):
+        session = self.Session()
+        self.sessions.append(session)
+        return session
 
     def test_source_creation_encrypts_credential_and_resolves_client_secret(self) -> None:
-        session = self.Session()
+        session = self.session()
         session.add(Tenant(id="tenant-1", slug="tenant-1", name="Tenant"))
         calendar = create_calendar(session, tenant_id="tenant-1", user_id=None, payload=CalendarCollectionCreateRequest(name="Remote"))
 
@@ -278,7 +287,7 @@ class CalDAVSyncTests(unittest.TestCase):
         self.assertEqual(client.password, "secret")
 
     def test_delete_calendar_retires_caldav_source_and_credential(self) -> None:
-        session = self.Session()
+        session = self.session()
         session.add(Tenant(id="tenant-1", slug="tenant-1", name="Tenant"))
         calendar = create_calendar(session, tenant_id="tenant-1", user_id=None, payload=CalendarCollectionCreateRequest(name="Remote"))
         source = create_caldav_source(
@@ -304,7 +313,7 @@ class CalDAVSyncTests(unittest.TestCase):
         self.assertEqual(list_caldav_sources(session, tenant_id="tenant-1"), [])
 
     def test_create_source_retires_orphaned_source_for_deleted_calendar(self) -> None:
-        session = self.Session()
+        session = self.session()
         session.add(Tenant(id="tenant-1", slug="tenant-1", name="Tenant"))
         old_calendar = create_calendar(session, tenant_id="tenant-1", user_id=None, payload=CalendarCollectionCreateRequest(name="Old"))
         old_source = create_caldav_source(
@@ -330,7 +339,7 @@ class CalDAVSyncTests(unittest.TestCase):
         self.assertEqual([source.id for source in list_caldav_sources(session, tenant_id="tenant-1")], [new_source.id])
 
     def test_create_source_reports_active_duplicate_as_calendar_error(self) -> None:
-        session = self.Session()
+        session = self.session()
         session.add(Tenant(id="tenant-1", slug="tenant-1", name="Tenant"))
         first = create_calendar(session, tenant_id="tenant-1", user_id=None, payload=CalendarCollectionCreateRequest(name="First"))
         second = create_calendar(session, tenant_id="tenant-1", user_id=None, payload=CalendarCollectionCreateRequest(name="Second"))
@@ -351,7 +360,7 @@ class CalDAVSyncTests(unittest.TestCase):
             )
 
     def test_due_sync_runs_due_sources_and_reschedules(self) -> None:
-        session = self.Session()
+        session = self.session()
         session.add(Tenant(id="tenant-1", slug="tenant-1", name="Tenant"))
         calendar = create_calendar(session, tenant_id="tenant-1", user_id=None, payload=CalendarCollectionCreateRequest(name="Remote"))
         source = create_caldav_source(
@@ -378,7 +387,7 @@ class CalDAVSyncTests(unittest.TestCase):
         self.assertGreater(next_sync_at, datetime(2026, 7, 7, 8, 1, tzinfo=timezone.utc))
 
     def test_due_sync_emits_recovery_notification_after_previous_error(self) -> None:
-        session = self.Session()
+        session = self.session()
         session.add(Tenant(id="tenant-1", slug="tenant-1", name="Tenant"))
         calendar = create_calendar(session, tenant_id="tenant-1", user_id=None, payload=CalendarCollectionCreateRequest(name="Remote"))
         source = create_caldav_source(
@@ -406,7 +415,7 @@ class CalDAVSyncTests(unittest.TestCase):
         self.assertEqual(provider.requests[0].event_kind, "calendar.sync.ok")
 
     def test_create_and_update_event_coalesce_to_committed_outbox_state(self) -> None:
-        session = self.Session()
+        session = self.session()
         session.add(Tenant(id="tenant-1", slug="tenant-1", name="Tenant"))
         calendar = create_calendar(session, tenant_id="tenant-1", user_id=None, payload=CalendarCollectionCreateRequest(name="Remote"))
         create_caldav_source(session, tenant_id="tenant-1", user_id=None, payload=CalendarCalDavSourceCreateRequest(calendar_id=calendar.id, collection_url="https://dav.example.test/cal"))
@@ -441,7 +450,7 @@ class CalDAVSyncTests(unittest.TestCase):
         self.assertIn("SUMMARY:Updated", event.raw_ics or "")
 
     def test_update_event_reports_remote_etag_conflict(self) -> None:
-        session = self.Session()
+        session = self.session()
         session.add(Tenant(id="tenant-1", slug="tenant-1", name="Tenant"))
         calendar = create_calendar(session, tenant_id="tenant-1", user_id=None, payload=CalendarCollectionCreateRequest(name="Remote"))
         create_caldav_source(session, tenant_id="tenant-1", user_id=None, payload=CalendarCalDavSourceCreateRequest(calendar_id=calendar.id, collection_url="https://dav.example.test/cal"))
@@ -467,7 +476,7 @@ class CalDAVSyncTests(unittest.TestCase):
         self.assertIn("changed remotely", operation.last_error or "")
 
     def test_delete_one_component_puts_remaining_resource_instead_of_deleting_object(self) -> None:
-        session = self.Session()
+        session = self.session()
         session.add(Tenant(id="tenant-1", slug="tenant-1", name="Tenant"))
         calendar = create_calendar(session, tenant_id="tenant-1", user_id=None, payload=CalendarCollectionCreateRequest(name="Remote"))
         create_caldav_source(session, tenant_id="tenant-1", user_id=None, payload=CalendarCalDavSourceCreateRequest(calendar_id=calendar.id, collection_url="https://dav.example.test/cal"))
@@ -490,7 +499,7 @@ class CalDAVSyncTests(unittest.TestCase):
         self.assertIsNotNone(override.deleted_at)
 
     def test_freebusy_expands_recurring_events_and_skips_transparent_items(self) -> None:
-        session = self.Session()
+        session = self.session()
         session.add(Tenant(id="tenant-1", slug="tenant-1", name="Tenant"))
         calendar = create_calendar(session, tenant_id="tenant-1", user_id=None, payload=CalendarCollectionCreateRequest(name="Local"))
         create_event(
@@ -532,7 +541,7 @@ class CalDAVSyncTests(unittest.TestCase):
         self.assertEqual(busy[0]["start_at"], datetime(2026, 7, 8, 9, 0, tzinfo=timezone.utc))
 
     def test_full_sync_imports_multi_vevent_resource_and_fetches_missing_calendar_data(self) -> None:
-        session = self.Session()
+        session = self.session()
         tenant = Tenant(id="tenant-1", slug="tenant-1", name="Tenant")
         session.add(tenant)
         calendar = create_calendar(
@@ -573,7 +582,7 @@ class CalDAVSyncTests(unittest.TestCase):
         self.assertEqual(calendar.metadata_["source_kind"], "caldav")
 
     def test_sync_token_deletion_soft_deletes_remote_resource_events(self) -> None:
-        session = self.Session()
+        session = self.session()
         tenant = Tenant(id="tenant-1", slug="tenant-1", name="Tenant")
         session.add(tenant)
         calendar = create_calendar(session, tenant_id="tenant-1", user_id=None, payload=CalendarCollectionCreateRequest(name="Remote"))
@@ -622,7 +631,7 @@ class CalDAVSyncTests(unittest.TestCase):
         self.assertIsNotNone(event.deleted_at)
 
     def test_missing_resource_during_fetch_is_treated_as_remote_delete(self) -> None:
-        session = self.Session()
+        session = self.session()
         tenant = Tenant(id="tenant-1", slug="tenant-1", name="Tenant")
         session.add(tenant)
         calendar = create_calendar(session, tenant_id="tenant-1", user_id=None, payload=CalendarCollectionCreateRequest(name="Remote"))