From d64de5080272c62d8cfb85cb2a9b7d3bcedf0531 Mon Sep 17 00:00:00 2001
From: Albrecht Degering <albrecht@degering.name>
Date: Tue, 21 Jul 2026 15:47:50 +0200
Subject: [PATCH] fix(secrets): redact provider failure details

---
 src/govoplan_calendar/backend/service.py | 12 ++++++------
 tests/test_caldav.py                     | 12 ++++++++++++
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/src/govoplan_calendar/backend/service.py b/src/govoplan_calendar/backend/service.py
index 33dfd36..e34061e 100644
--- a/src/govoplan_calendar/backend/service.py
+++ b/src/govoplan_calendar/backend/service.py
@@ -1512,14 +1512,14 @@ def store_caldav_credential(
                     value=secret,
                 )
             ).strip()
-        except Exception as exc:
-            raise CalendarError("Stored sync credential could not be written to its secret provider") from exc
+        except Exception:
+            raise CalendarError("Stored sync credential could not be written to its secret provider") from None
         if not provider_ref:
             raise CalendarError("Secret provider returned an empty credential reference")
         if old_provider_ref and old_provider_ref != provider_ref:
             try:
                 provider.delete_secret(old_provider_ref)
-            except Exception as exc:
+            except Exception:
                 if not _provider_secret_is_absent(provider, old_provider_ref):
                     compensation_failed = False
                     try:
@@ -1534,7 +1534,7 @@ def store_caldav_credential(
                     raise CalendarError(
                         "Previous sync credential could not be deleted from its secret provider; "
                         f"the replacement was not activated{compensation_detail}"
-                    ) from exc
+                    ) from None
         existing.secret_encrypted = None
         existing.metadata_ = {"source_id": source.id, "provider_ref": provider_ref}
     else:
@@ -1619,12 +1619,12 @@ def _delete_calendar_owned_credential(
             )
         try:
             provider.delete_secret(provider_ref)
-        except Exception as exc:
+        except Exception:
             if not _provider_secret_is_absent(provider, provider_ref):
                 raise CalendarError(
                     "Stored sync credential could not be deleted from its secret provider; "
                     "the requested deletion was not completed"
-                ) from exc
+                ) from None
         storage_backend = "external_secret_provider"
     credential.secret_encrypted = None
     credential.metadata_ = {"source_id": source_id} if source_id else {}
diff --git a/tests/test_caldav.py b/tests/test_caldav.py
index 3b4879d..7bacdf5 100644
--- a/tests/test_caldav.py
+++ b/tests/test_caldav.py
@@ -593,6 +593,18 @@ class CalDAVSyncTests(unittest.TestCase):
         self.assertEqual((credential.metadata_ or {})["provider_ref"], provider_ref)
         self.assertIn(provider_ref, provider.values)
 
+        with patch("govoplan_calendar.backend.service.secret_provider", return_value=provider), patch.object(
+            provider,
+            "delete_secret",
+            side_effect=RuntimeError(f"provider failed for {provider_ref}"),
+        ):
+            with self.assertRaises(CalendarError) as raised:
+                delete_caldav_source(session, tenant_id="tenant-1", source_id=source.id)
+        self.assertNotIn(provider_ref, str(raised.exception))
+        session.rollback()
+        self.assertIsNone(source.deleted_at)
+        self.assertIsNone(credential.deleted_at)
+
     def test_disabling_auth_immediately_scrubs_and_audits_database_credential(self) -> None:
         session = self.session()
         session.add(Tenant(id="tenant-1", slug="tenant-1", name="Tenant"))