security(files): filter connectors before secret resolution

src/govoplan_files/backend/storage/connector_profile_store.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from collections.abc import Mapping
+from collections.abc import Callable, Mapping
 from typing import Any
 
 from sqlalchemy.orm import Session
@@ -20,7 +20,26 @@ def list_database_connector_profiles(
     *,
     tenant_id: str,
     include_disabled: bool = False,
+    row_visible: Callable[[FileConnectorProfile], bool] | None = None,
 ) -> list[ConnectorProfile]:
+    profiles, _profile_ids = select_database_connector_profiles(
+        session,
+        tenant_id=tenant_id,
+        include_disabled=include_disabled,
+        row_visible=row_visible,
+    )
+    return profiles
+
+
+def select_database_connector_profiles(
+    session: Session,
+    *,
+    tenant_id: str,
+    include_disabled: bool = False,
+    row_visible: Callable[[FileConnectorProfile], bool] | None = None,
+) -> tuple[list[ConnectorProfile], set[str]]:
+    """Return visible profiles and every database id that shadows settings."""
+
     query = session.query(FileConnectorProfile).filter(
         (FileConnectorProfile.scope_type == "system")
         | (FileConnectorProfile.tenant_id == tenant_id)
@@ -28,9 +47,15 @@ def list_database_connector_profiles(
     if not include_disabled:
         query = query.filter(FileConnectorProfile.enabled.is_(True))
     rows = query.order_by(FileConnectorProfile.scope_type.asc(), FileConnectorProfile.label.asc()).all()
+    profile_ids = {row.id for row in rows}
+    if row_visible is not None:
+        rows = [row for row in rows if row_visible(row)]
     credential_ids = {_clean(row.credential_profile_id) for row in rows if _clean(row.credential_profile_id)}
     credentials = credential_rows_by_id(session, tenant_id=tenant_id, credential_ids={item for item in credential_ids if item}, include_disabled=include_disabled)
-    return [connector_profile_from_row(row, credential_row=credentials.get(row.credential_profile_id or "")) for row in rows]
+    return (
+        [connector_profile_from_row(row, credential_row=credentials.get(row.credential_profile_id or "")) for row in rows],
+        profile_ids,
+    )
 
 
 def list_connector_profile_rows(

src/govoplan_files/backend/storage/connector_visibility.py

@@ -9,7 +9,7 @@ from govoplan_files.backend.storage.connector_deployment import (
     connector_effective_endpoint_url,
 )
 from govoplan_files.backend.storage.connector_profile_store import (
-    list_database_connector_profiles,
+    select_database_connector_profiles,
 )
 from govoplan_files.backend.storage.connector_profiles import (
     ConnectorProfile,
@@ -48,16 +48,31 @@ def visible_connector_profiles_for_actor(
 
     provider_norm = provider.strip().casefold() if provider else None
     actor_group_ids = {str(group_id) for group_id in group_ids if str(group_id)}
-    database_profiles = list_database_connector_profiles(
+    database_profiles, database_profile_ids = select_database_connector_profiles(
         session,
         tenant_id=tenant_id,
         include_disabled=include_disabled,
+        row_visible=lambda row: (
+            include_admin_scopes
+            and row.scope_type in {"user", "group", "campaign"}
+        ) or _scope_visible_to_actor(
+            scope_type=row.scope_type,
+            scope_id=row.scope_id,
+            tenant_id=tenant_id,
+            user_id=user_id,
+            group_ids=actor_group_ids,
+            campaign_id=campaign_id,
+            campaign_visible=campaign_visible,
+        ),
     )
     configured_profiles = connector_profiles_from_settings(settings)
     profiles_by_id: dict[str, ConnectorProfile] = {}
-    for profile in [*database_profiles, *configured_profiles]:
+    for profile in database_profiles:
         if profile.id not in profiles_by_id:
             profiles_by_id[profile.id] = profile
+    for profile in configured_profiles:
+        if profile.id not in database_profile_ids and profile.id not in profiles_by_id:
+            profiles_by_id[profile.id] = profile
 
     visible: list[ConnectorProfile] = []
     for profile in profiles_by_id.values():
@@ -92,10 +107,16 @@ def visible_connector_profiles_for_actor(
 def connector_profile_usable_for_import(profile: ConnectorProfile) -> bool:
     """Whether a visible profile can safely offer the current live browse/import task."""
 
+    effective_endpoint_url = connector_effective_endpoint_url(
+        provider=profile.provider,
+        endpoint_url=profile.endpoint_url,
+        metadata=profile.metadata,
+    )
     if (
         not profile.enabled
-        or not profile.endpoint_url
+        or not effective_endpoint_url
         or not profile.credentials_configured
+        or bool(profile.secret_ref)
     ):
         return False
     descriptor = next(
@@ -128,11 +149,7 @@ def connector_profile_usable_for_import(profile: ConnectorProfile) -> bool:
             credential_id=profile.credential_profile_id,
             provider=profile.provider,
             external_path="",
-            external_url=connector_effective_endpoint_url(
-                provider=profile.provider,
-                endpoint_url=profile.endpoint_url,
-                metadata=profile.metadata,
-            ),
+            external_url=effective_endpoint_url,
             operation="import",
         ),
         profile.policy_sources,
@@ -148,19 +165,40 @@ def _profile_visible_to_actor(
     campaign_id: str | None,
     campaign_visible: CampaignVisibility | None,
 ) -> bool:
-    if profile.scope_type == "system":
+    return _scope_visible_to_actor(
+        scope_type=profile.scope_type,
+        scope_id=profile.scope_id,
+        tenant_id=tenant_id,
+        user_id=user_id,
+        group_ids=group_ids,
+        campaign_id=campaign_id,
+        campaign_visible=campaign_visible,
+    )
+
+
+def _scope_visible_to_actor(
+    *,
+    scope_type: str,
+    scope_id: str | None,
+    tenant_id: str,
+    user_id: str,
+    group_ids: set[str],
+    campaign_id: str | None,
+    campaign_visible: CampaignVisibility | None,
+) -> bool:
+    if scope_type == "system":
         return True
-    if profile.scope_type == "tenant":
-        return profile.scope_id == tenant_id
-    if profile.scope_type == "user":
-        return profile.scope_id == user_id
-    if profile.scope_type == "group":
-        return bool(profile.scope_id and profile.scope_id in group_ids)
-    if profile.scope_type != "campaign" or not profile.scope_id:
+    if scope_type == "tenant":
+        return scope_id == tenant_id
+    if scope_type == "user":
+        return scope_id == user_id
+    if scope_type == "group":
+        return bool(scope_id and scope_id in group_ids)
+    if scope_type != "campaign" or not scope_id:
         return False
-    if campaign_id and profile.scope_id != campaign_id:
+    if campaign_id and scope_id != campaign_id:
         return False
-    return bool(campaign_visible and campaign_visible(profile.scope_id))
+    return bool(campaign_visible and campaign_visible(scope_id))
 
 
 def _with_effective_connector_policy(