feat: govern file lifecycle and connector writes

tests/test_connector_space_deletion.py

@@ -5,7 +5,11 @@ from types import SimpleNamespace
 from unittest.mock import Mock, patch
 
 from govoplan_files.backend.storage.common import FileStorageError
-from govoplan_files.backend.storage.connector_spaces import soft_delete_connector_space
+from govoplan_files.backend.storage.connector_profiles import ConnectorProfile
+from govoplan_files.backend.storage.connector_spaces import (
+    soft_delete_connector_space,
+    validate_connector_space_write_mode,
+)
 
 
 class ConnectorSpaceDeletionTests(unittest.TestCase):
@@ -63,6 +67,35 @@ class ConnectorSpaceDeletionTests(unittest.TestCase):
         self.session.add.assert_not_called()
         self.session.flush.assert_not_called()
 
+    def test_read_only_mode_does_not_require_remote_write_capability(self) -> None:
+        profile = ConnectorProfile(
+            id="webdav-read",
+            label="Read only",
+            provider="webdav",
+            capabilities=("browse", "import"),
+        )
+
+        validate_connector_space_write_mode(profile, read_only=True)
+
+    def test_two_way_mode_requires_explicit_supported_write_capability(self) -> None:
+        missing_capability = ConnectorProfile(
+            id="s3-read",
+            label="S3 read only",
+            provider="s3",
+            capabilities=("browse",),
+        )
+        unsupported_provider = ConnectorProfile(
+            id="webdav-write",
+            label="WebDAV write",
+            provider="webdav",
+            capabilities=("write",),
+        )
+
+        for profile in (missing_capability, unsupported_provider):
+            with self.subTest(profile=profile.id):
+                with self.assertRaisesRegex(FileStorageError, "requires an S3"):
+                    validate_connector_space_write_mode(profile, read_only=False)
+
 
 if __name__ == "__main__":
     unittest.main()