feat: govern shared campaign artifact storage

2026-08-01 17:48:24 +02:00
parent 82ddc0c34c
commit cec3d17bff
15 changed files with 518 additions and 159 deletions
@@ -79,13 +79,13 @@ class ServerCampaignPathSecurityTests(unittest.TestCase):
                "govoplan_campaign.backend.persistence.campaigns.files_integration",
                return_value=SimpleNamespace(available=True),
            ),
-            patch("govoplan_campaign.backend.persistence.campaigns._write_campaign_snapshot") as write_snapshot,
+            patch("govoplan_campaign.backend.persistence.campaigns._campaign_reference_path") as reference_path,
            patch("govoplan_campaign.backend.persistence.campaigns.load_campaign_config_from_json") as load_config,
        ):
            with self.assertRaisesRegex(CampaignPathSecurityError, "template source paths"):
                load_version_config(session, "version-1")  # type: ignore[arg-type]

-        write_snapshot.assert_not_called()
+        reference_path.assert_not_called()
        load_config.assert_not_called()

    def test_source_base_symlink_escape_is_rejected(self) -> None: