security: harden connector policy and add dashboard widget

tests/test_connector_policy.py

@@ -0,0 +1,66 @@
+from __future__ import annotations
+
+import unittest
+
+from govoplan_files.backend.storage.connector_policy import (
+    ConnectorAccessRequest,
+    ConnectorPolicySource,
+    connector_policy_decision,
+)
+
+
+class ConnectorPolicyPatternTests(unittest.TestCase):
+    def test_resource_reference_allow_patterns_match(self) -> None:
+        decision = connector_policy_decision(
+            ConnectorAccessRequest(
+                connector_id="dev-smb",
+                credential_id="credential-primary",
+                provider="smb",
+            ),
+            (
+                ConnectorPolicySource(
+                    scope_type="tenant",
+                    scope_id="tenant-1",
+                    label="Tenant",
+                    policy={
+                        "allow": {
+                            "connectors": ["dev-*"],
+                            "credentials": ["credential-*"],
+                            "providers": ["s?b"],
+                        }
+                    },
+                ),
+            ),
+        )
+
+        self.assertTrue(decision.allowed)
+
+    def test_resource_reference_deny_patterns_take_precedence(self) -> None:
+        decision = connector_policy_decision(
+            ConnectorAccessRequest(
+                connector_id="dev-smb",
+                credential_id="credential-legacy",
+                provider="smb",
+            ),
+            (
+                ConnectorPolicySource(
+                    scope_type="tenant",
+                    scope_id="tenant-1",
+                    label="Tenant",
+                    policy={
+                        "allow": {"connectors": ["dev-*"]},
+                        "deny": {"credentials": ["*-legacy"]},
+                    },
+                ),
+            ),
+        )
+
+        self.assertFalse(decision.allowed)
+        self.assertEqual(
+            ("connector_policy_denylist",),
+            decision.requirements,
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()