Harden live mail OAuth and immutable releases

apps/sources/services/fetcher.py

@@ -74,14 +74,19 @@ def _validate_connected_peer(
     *,
     before: ValidatedUrl,
     after: ValidatedUrl,
+    require_peer: bool,
 ) -> None:
     peer_ip = _connected_peer_ip(response)
     if peer_ip is not None:
         if not peer_ip.is_global:
             raise FetchError(f"Niet-publiek verbonden IP-adres geblokkeerd: {peer_ip}")
         return
+    if require_peer:
+        raise FetchError(
+            "Verbonden IP-adres kon niet veilig worden vastgesteld; aanvraag geblokkeerd."
+        )
     # Mock/custom transports do not always expose the peer socket. Keep the conservative
-    # DNS-overlap fallback for those transports.
+    # DNS-overlap fallback only for explicitly injected test/custom clients.
     if not set(before.addresses).intersection(after.addresses):
         raise FetchError("DNS-rebindcontrole faalde bij het benaderen van bron.")
 
@@ -175,6 +180,7 @@ def fetch_url(
                 response,
                 before=validation,
                 after=post_validation,
+                require_peer=own_client,
             )
             if response.status_code in {301, 302, 303, 307, 308}:
                 location = response.headers.get("location")