intermittent commit

src/govoplan_files/backend/storage/connector_profiles.py

@@ -12,8 +12,17 @@ from govoplan_files.backend.storage.connector_policy import ConnectorPolicySourc
 
 _ENV_JSON_KEYS = ("GOVOPLAN_FILES_CONNECTOR_PROFILES_JSON", "FILES_CONNECTOR_PROFILES_JSON")
 _ENV_FILE_KEYS = ("GOVOPLAN_FILES_CONNECTOR_PROFILES_FILE", "FILES_CONNECTOR_PROFILES_FILE")
-_SUPPORTED_PROVIDERS = {"seafile", "nextcloud", "webdav", "smb", "nfs", "dms", "generic"}
-_INLINE_SECRET_FIELDS = ("password", "token", "api_key", "access_key", "secret_key")
+_SUPPORTED_PROVIDERS = {"seafile", "nextcloud", "webdav", "smb", "s3", "sharepoint", "onedrive", "nfs", "dms", "generic"}
+_INLINE_SECRET_FIELDS = (
+    "password",
+    "token",
+    "api_key",
+    "access_key",
+    "access_key_id",
+    "secret_key",
+    "secret_access_key",
+    "session_token",
+)
 
 
 def supported_connector_providers() -> set[str]:
@@ -123,43 +132,19 @@ def connector_profiles_from_payload(value: object) -> list[ConnectorProfile]:
 
 
 def _profile_from_mapping(value: Mapping[str, Any]) -> ConnectorProfile:
-    profile_id = _clean(value.get("id") or value.get("connector_id") or value.get("name"))
-    if not profile_id:
-        raise ValueError("Connector profiles require id")
-    provider = (_clean(value.get("provider") or value.get("type")) or "generic").casefold()
-    if provider not in _SUPPORTED_PROVIDERS:
-        raise ValueError(f"Unsupported connector provider: {provider}")
-    scope_type = normalize_policy_scope_type(str(value.get("scope_type") or "system"))
-    scope_id = _clean(value.get("scope_id"))
-    if scope_type == "system":
-        scope_id = None
-    elif not scope_id:
-        raise ValueError(f"{scope_type} connector profiles require scope_id")
-
-    credentials = value.get("credentials")
-    credentials = credentials if isinstance(credentials, Mapping) else {}
+    profile_id = _profile_id_from_mapping(value)
+    provider = _provider_from_mapping(value)
+    scope_type, scope_id = _scope_from_mapping(value)
+    credentials = _credentials_from_mapping(value)
     mode = _clean(value.get("credential_mode") or value.get("auth_type") or credentials.get("mode") or credentials.get("type")) or "none"
-    profile = ConnectorProfile(
-        id=profile_id,
-        label=_clean(value.get("label") or value.get("name")) or profile_id,
+    profile = _profile_from_normalized_mapping(
+        value,
+        profile_id=profile_id,
         provider=provider,
-        endpoint_url=_clean(value.get("endpoint_url") or value.get("base_url") or value.get("url")),
-        base_path=_clean(value.get("base_path") or value.get("path") or value.get("root")),
-        enabled=_bool(value.get("enabled"), default=True),
         scope_type=scope_type,
         scope_id=scope_id,
-        credential_profile_id=_clean(value.get("credential_profile_id") or value.get("credential_id")),
-        credential_profile_label=_clean(value.get("credential_profile_label") or value.get("credential_label")),
         credential_mode=mode,
-        username=_clean(value.get("username") or credentials.get("username")),
-        password_env=_clean(value.get("password_env") or credentials.get("password_env")),
-        token_env=_clean(value.get("token_env") or credentials.get("token_env")),
-        secret_ref=_clean(value.get("secret_ref") or credentials.get("secret_ref")),
-        password_value=_clean(value.get("password") or credentials.get("password")),
-        token_value=_clean(value.get("token") or credentials.get("token")),
-        has_inline_secret=any(_clean(value.get(field) or credentials.get(field)) for field in _INLINE_SECRET_FIELDS),
-        capabilities=tuple(_string_list(value.get("capabilities"))),
-        metadata=_public_metadata(value.get("metadata")),
+        credentials=credentials,
     )
     return ConnectorProfile(
         id=profile.id,
@@ -187,6 +172,69 @@ def _profile_from_mapping(value: Mapping[str, Any]) -> ConnectorProfile:
     )
 
 
+def _profile_id_from_mapping(value: Mapping[str, Any]) -> str:
+    profile_id = _clean(value.get("id") or value.get("connector_id") or value.get("name"))
+    if not profile_id:
+        raise ValueError("Connector profiles require id")
+    return profile_id
+
+
+def _provider_from_mapping(value: Mapping[str, Any]) -> str:
+    provider = (_clean(value.get("provider") or value.get("type")) or "generic").casefold()
+    if provider not in _SUPPORTED_PROVIDERS:
+        raise ValueError(f"Unsupported connector provider: {provider}")
+    return provider
+
+
+def _scope_from_mapping(value: Mapping[str, Any]) -> tuple[str, str | None]:
+    scope_type = normalize_policy_scope_type(str(value.get("scope_type") or "system"))
+    scope_id = _clean(value.get("scope_id"))
+    if scope_type == "system":
+        return scope_type, None
+    if not scope_id:
+        raise ValueError(f"{scope_type} connector profiles require scope_id")
+    return scope_type, scope_id
+
+
+def _credentials_from_mapping(value: Mapping[str, Any]) -> Mapping[str, Any]:
+    credentials = value.get("credentials")
+    return credentials if isinstance(credentials, Mapping) else {}
+
+
+def _profile_from_normalized_mapping(
+    value: Mapping[str, Any],
+    *,
+    profile_id: str,
+    provider: str,
+    scope_type: str,
+    scope_id: str | None,
+    credential_mode: str,
+    credentials: Mapping[str, Any],
+) -> ConnectorProfile:
+    return ConnectorProfile(
+        id=profile_id,
+        label=_clean(value.get("label") or value.get("name")) or profile_id,
+        provider=provider,
+        endpoint_url=_clean(value.get("endpoint_url") or value.get("base_url") or value.get("url")),
+        base_path=_clean(value.get("base_path") or value.get("path") or value.get("root")),
+        enabled=_bool(value.get("enabled"), default=True),
+        scope_type=scope_type,
+        scope_id=scope_id,
+        credential_profile_id=_clean(value.get("credential_profile_id") or value.get("credential_id")),
+        credential_profile_label=_clean(value.get("credential_profile_label") or value.get("credential_label")),
+        credential_mode=credential_mode,
+        username=_clean(value.get("username") or credentials.get("username")),
+        password_env=_clean(value.get("password_env") or credentials.get("password_env")),
+        token_env=_clean(value.get("token_env") or credentials.get("token_env")),
+        secret_ref=_clean(value.get("secret_ref") or credentials.get("secret_ref")),
+        password_value=_clean(value.get("password") or credentials.get("password")),
+        token_value=_clean(value.get("token") or credentials.get("token")),
+        has_inline_secret=any(_clean(value.get(field) or credentials.get(field)) for field in _INLINE_SECRET_FIELDS),
+        capabilities=tuple(_string_list(value.get("capabilities"))),
+        metadata=_public_metadata(value.get("metadata")),
+    )
+
+
 def _raw_profiles_payload(settings: object | None) -> object:
     for key in _ENV_JSON_KEYS:
         value = os.environ.get(key)