Fail closed for unpinned connector transports

src/govoplan_core/security/outbound_http.py

@@ -84,12 +84,10 @@ def validate_unpinned_sdk_http_url(
     """Fail closed when an SDK cannot connect to a prevalidated DNS answer."""
 
     active_policy = policy or outbound_http_policy()
-    validated = validate_outbound_http_url(value, label=label, policy=active_policy)
-    if active_policy.allow_private_networks:
-        return validated
+    validate_outbound_http_url(value, label=label, policy=active_policy)
     raise OutboundHttpBlocked(
         f"{label} uses an SDK that cannot pin connection peers or revalidate every SDK-managed redirect; "
-        "it is disabled while application-enforced public-only egress is required"
+        "it is disabled until that transport supports connection-time DNS/IP pinning"
     )
 
 
@@ -163,10 +161,26 @@ def pinned_outbound_hostname(
     label: str = "Connector host",
     policy: OutboundHttpPolicy | None = None,
 ) -> str:
-    """Return the original allowed host or a public numeric connection target."""
+    """Return a validated numeric target for a transport without socket injection.
+
+    Public-only deployments may safely replace a DNS name with its validated
+    numeric answer. Private-network deployments fail closed for DNS names: a
+    protocol SDK may need the original name for authentication, so silently
+    replacing it would not be a generally safe pinning strategy. Explicit IP
+    endpoints remain usable after the normal address checks.
+    """
 
     active_policy = policy or outbound_http_policy()
     host = str(hostname).strip().rstrip(".")
+    if active_policy.allow_private_networks:
+        try:
+            ipaddress.ip_address(host.split("%", 1)[0])
+        except ValueError as exc:
+            raise OutboundHttpBlocked(
+                f"{label} uses a hostname with a transport that cannot pin DNS resolution while private-network "
+                "access is enabled; use an explicit IP endpoint or a connector transport with connection-time "
+                "DNS/IP pinning"
+            ) from exc
     records = _resolved_address_records(host, port=port, label=label, policy=active_policy)
     if active_policy.allow_private_networks:
         return host