fix(files): align adaptive tasks with live access

tests/test_documentation.py

@@ -160,6 +160,57 @@ class FilesRuntimeDocumentationTests(unittest.TestCase):
         ):
             self.assertNotIn(secret, payload)
 
+    def test_files_admin_connector_groups_do_not_widen_campaign_membership(self) -> None:
+        usable = ConnectorProfile(
+            id="group-profile",
+            label="Group profile",
+            provider="webdav",
+            scope_type="group",
+            scope_id="admin-visible-group",
+            endpoint_url="https://files.example.invalid",
+            credential_mode="anonymous",
+        )
+
+        def groups_for_actor(_session, *, include_admin_groups, **_kwargs):
+            return ["member-group", "admin-visible-group"] if include_admin_groups else ["member-group"]
+
+        with (
+            patch(
+                "govoplan_files.backend.documentation.user_group_ids",
+                side_effect=groups_for_actor,
+            ),
+            patch(
+                "govoplan_files.backend.documentation._campaign_visibility",
+                return_value=None,
+            ) as campaign_visibility,
+            patch(
+                "govoplan_files.backend.documentation.visible_connector_profiles_for_actor",
+                return_value=[usable],
+            ) as visible,
+        ):
+            topics = {
+                topic.id: topic
+                for topic in documentation_topics(
+                    self.context(
+                        {
+                            "files:file:read",
+                            "files:file:upload",
+                            "files:file:admin",
+                        }
+                    )
+                )
+            }
+
+        self.assertIn("files.workflow.import-managed-snapshot", topics)
+        self.assertEqual(
+            ("member-group", "admin-visible-group"),
+            tuple(visible.call_args.kwargs["group_ids"]),
+        )
+        self.assertEqual(
+            ("member-group",),
+            tuple(campaign_visibility.call_args.kwargs["group_ids"]),
+        )
+
     def test_connector_evaluation_errors_fail_closed_without_error_details(
         self,
     ) -> None: