From 3bc1d3489ee1d4a0f951935711b5068edc193654 Mon Sep 17 00:00:00 2001
From: Albrecht Degering <albrecht@degering.name>
Date: Tue, 21 Jul 2026 03:16:23 +0200
Subject: [PATCH] Narrow Files backend import surfaces

---
 src/govoplan_files/backend/db/__init__.py     | 26 ++++++++++++++++++-
 .../backend/storage/connector_browse.py       |  2 +-
 .../backend/storage/services.py               | 19 --------------
 tests/test_access_provider.py                 |  8 ++++++
 4 files changed, 34 insertions(+), 21 deletions(-)

diff --git a/src/govoplan_files/backend/db/__init__.py b/src/govoplan_files/backend/db/__init__.py
index a4430b7..5c05e9e 100644
--- a/src/govoplan_files/backend/db/__init__.py
+++ b/src/govoplan_files/backend/db/__init__.py
@@ -1 +1,25 @@
-from govoplan_files.backend.db.models import *
+from govoplan_files.backend.db.models import (
+    CampaignAttachmentUse,
+    FileAsset,
+    FileBlob,
+    FileConnectorCredential,
+    FileConnectorPolicy,
+    FileConnectorProfile,
+    FileConnectorSpace,
+    FileFolder,
+    FileShare,
+    FileVersion,
+)
+
+__all__ = [
+    "CampaignAttachmentUse",
+    "FileAsset",
+    "FileBlob",
+    "FileConnectorCredential",
+    "FileConnectorPolicy",
+    "FileConnectorProfile",
+    "FileConnectorSpace",
+    "FileFolder",
+    "FileShare",
+    "FileVersion",
+]
diff --git a/src/govoplan_files/backend/storage/connector_browse.py b/src/govoplan_files/backend/storage/connector_browse.py
index 0dc85b1..bea83ac 100644
--- a/src/govoplan_files/backend/storage/connector_browse.py
+++ b/src/govoplan_files/backend/storage/connector_browse.py
@@ -9,7 +9,7 @@ from importlib import import_module
 import mimetypes
 from typing import Any
 from urllib.parse import quote, unquote, urljoin, urlsplit
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # nosec B405 - typing/element creation only; parsing uses defusedxml below.
 
 from defusedxml import ElementTree as SafeElementTree
 import httpx
diff --git a/src/govoplan_files/backend/storage/services.py b/src/govoplan_files/backend/storage/services.py
index 080157f..37ccf33 100644
--- a/src/govoplan_files/backend/storage/services.py
+++ b/src/govoplan_files/backend/storage/services.py
@@ -15,21 +15,6 @@ from govoplan_files.backend.storage.common import (
     utcnow,
 )
 from govoplan_files.backend.storage.files import (
-    _active_asset_at_path,
-    _active_asset_exists,
-    _asset_owner_id,
-    _asset_query_for_owner,
-    _candidate_renamed_path,
-    _copy_asset_to_path,
-    _get_or_create_blob,
-    _next_available_logical_path,
-    _normalize_conflict_strategy,
-    _resolution_by_path,
-    _soft_delete_conflicting_asset,
-    _split_logical_path,
-    _storage_backend_name,
-    _storage_bucket_name,
-    _storage_key,
     asset_is_audit_relevant,
     create_file_asset,
     current_version_and_blob,
@@ -42,10 +27,6 @@ from govoplan_files.backend.storage.files import (
     soft_delete_assets,
 )
 from govoplan_files.backend.storage.folders import (
-    _active_folder_exists,
-    _ensure_target_folder_hierarchy,
-    _folder_query_for_owner,
-    _owner_filter,
     create_folder,
     list_folders_for_user,
     soft_delete_folder,
diff --git a/tests/test_access_provider.py b/tests/test_access_provider.py
index e52fb0e..d22e284 100644
--- a/tests/test_access_provider.py
+++ b/tests/test_access_provider.py
@@ -21,6 +21,7 @@ GROUP_ID = "group-1"
 class FilesAccessProviderTests(unittest.TestCase):
     def test_file_access_provider_explains_owner_share_admin_and_missing_resources(self) -> None:
         session = _session()
+        self.addCleanup(_close_session, session)
         _seed_access_subjects(session)
         owned = FileAsset(id="file-owned", tenant_id=TENANT_ID, owner_type="user", owner_user_id=USER_ID, display_path="owned.pdf", filename="owned.pdf")
         shared = FileAsset(id="file-shared", tenant_id=TENANT_ID, owner_type="user", owner_user_id=OTHER_USER_ID, display_path="shared.pdf", filename="shared.pdf")
@@ -46,6 +47,7 @@ class FilesAccessProviderTests(unittest.TestCase):
 
     def test_file_access_provider_explains_persisted_and_virtual_folders(self) -> None:
         session = _session()
+        self.addCleanup(_close_session, session)
         _seed_access_subjects(session)
         persisted = FileFolder(id="folder-persisted", tenant_id=TENANT_ID, owner_type="group", owner_group_id=GROUP_ID, path="records")
         virtual_child = FileAsset(
@@ -80,6 +82,12 @@ def _session():
     return sessionmaker(bind=engine, future=True)()
 
 
+def _close_session(session) -> None:
+    engine = session.get_bind()
+    session.close()
+    engine.dispose()
+
+
 def _seed_access_subjects(session) -> None:
     session.add_all([
         Account(id="account-1", email="one@example.test", normalized_email="one@example.test"),