security(files): scrub connector credentials on deletion

src/govoplan_files/backend/storage/connector_deployment.py

@@ -17,6 +17,22 @@ _SECRET_ENV_METADATA_KEYS = frozenset(
         "session_token_env",
     }
 )
+_SECRET_VALUE_METADATA_KEYS = frozenset(
+    {
+        "password",
+        "token",
+        "access_token",
+        "auth_token",
+        "bearer_token",
+        "refresh_token",
+        "api_key",
+        "access_key",
+        "access_key_id",
+        "secret_key",
+        "secret_access_key",
+        "session_token",
+    }
+)
 _DEVELOPMENT_ENVIRONMENTS = frozenset({"dev", "development", "local", "test", "testing"})
 
 
@@ -65,6 +81,7 @@ def reject_api_controlled_deployment_references(
     *,
     password_env: str | None = None,
     token_env: str | None = None,
+    secret_ref: str | None = None,
     metadata: Mapping[str, Any] | None = None,
 ) -> None:
     """Reject process-secret selectors controlled through tenant-facing APIs."""
@@ -73,14 +90,39 @@ def reject_api_controlled_deployment_references(
         raise ConnectorDeploymentConfigurationError(
             "Environment-backed credentials may only be declared in deployment-owned connector configuration"
         )
-    for key, value in (metadata or {}).items():
-        if _clean(value) and (str(key).strip().casefold() in _SECRET_ENV_METADATA_KEYS or str(key).strip().casefold().endswith("_env")):
+    if _clean(secret_ref):
+        raise ConnectorDeploymentConfigurationError(
+            "External secret references cannot be managed through the Files API until Files can prove "
+            "provider ownership and confirm provider-side deletion"
+        )
+    for key, value in _metadata_entries(metadata or {}):
+        clean_key = str(key).strip().casefold()
+        if _clean(value) and (clean_key in _SECRET_ENV_METADATA_KEYS or clean_key.endswith("_env")):
             raise ConnectorDeploymentConfigurationError(
                 "Environment-backed credentials may only be declared in deployment-owned connector configuration"
             )
+        if _clean(value) and (
+            clean_key in _SECRET_VALUE_METADATA_KEYS
+            or clean_key.endswith(("_password", "_secret", "_api_key"))
+        ):
+            raise ConnectorDeploymentConfigurationError(
+                "Connector credential values must use the dedicated encrypted credential fields, not metadata"
+            )
     validate_connector_tls_metadata(metadata)
 
 
+def _metadata_entries(value: object) -> list[tuple[str, object]]:
+    entries: list[tuple[str, object]] = []
+    if isinstance(value, Mapping):
+        for key, item in value.items():
+            entries.append((str(key), item))
+            entries.extend(_metadata_entries(item))
+    elif isinstance(value, (list, tuple)):
+        for item in value:
+            entries.extend(_metadata_entries(item))
+    return entries
+
+
 def connector_ca_bundle_path(value: str) -> str:
     clean_value = _clean(value)
     if not clean_value: