Fail closed for SMB referral transports

src/govoplan_files/backend/storage/connector_browse.py

@@ -15,7 +15,7 @@ from defusedxml import ElementTree as SafeElementTree
 
 from govoplan_core.security.outbound_http import (
     OutboundHttpError,
-    pinned_outbound_hostname,
+    validate_unpinned_sdk_host,
     validate_unpinned_sdk_http_url,
 )
 
@@ -783,7 +783,7 @@ def _smb_location(profile: ConnectorProfile) -> _SmbLocation:
         raise ConnectorBrowseError("SMB connector endpoint_url must include a server")
     port = parsed.port or _int(profile.metadata.get("port")) or 445
     try:
-        server = pinned_outbound_hostname(server, port=port, label="SMB connector endpoint")
+        validate_unpinned_sdk_host(server, port=port, label="SMB connector endpoint")
     except OutboundHttpError as exc:
         raise ConnectorBrowseError(str(exc)) from exc
     path_parts = [part for part in unquote(parsed.path or "").strip("/").split("/") if part]

src/govoplan_files/backend/storage/connector_imports.py

@@ -194,12 +194,12 @@ def _read_webdav_file(profile: ConnectorProfile, *, path: str, max_bytes: int) -
 
 
 def _read_smb_file(profile: ConnectorProfile, *, path: str, max_bytes: int) -> ConnectorDownloadedFile:
-    location = _smb_location(profile)
     file_path = normalize_connector_browse_path(path)
     if not file_path:
         raise ConnectorImportError("SMB import requires a file path")
-    unc_path = _smb_unc_path(location, file_path)
     try:
+        location = _smb_location(profile)
+        unc_path = _smb_unc_path(location, file_path)
         smbclient = _smbclient_module()
         kwargs = _smb_client_kwargs(profile, location)
         stat_result = smbclient.stat(unc_path, **kwargs)

src/govoplan_files/backend/storage/connector_providers.py

@@ -110,7 +110,7 @@ def connector_provider_descriptors() -> tuple[ConnectorProviderDescriptor, ...]:
             conflict_strategy="Managed import/sync uses existing files conflict_strategy handling after download.",
             preview_strategy="Previews are generated from the frozen managed file after import or sync, not directly from the share.",
             audit_events=("files.connector.imported", "files.connector.synced", "files.connector.accessed"),
-            notes="Requires the optional smbprotocol dependency and an smb://server[:port]/share[/path] profile endpoint. Private-network mode requires an explicit IP endpoint until the transport supports connection-time DNS pinning.",
+            notes="Browse/import logic is implemented, but live smbprotocol access fails closed until the SDK supports connection-time DNS/IP pinning for initial connections and DFS referrals.",
         ),
         ConnectorProviderDescriptor(
             provider="s3",