Harden live mail OAuth and immutable releases

2026-07-30 02:00:09 +02:00
parent 1397f085bd
commit 67be350283
23 changed files with 429 additions and 20 deletions
@@ -48,7 +48,9 @@ def decrypt_mailbox_password(connection: MailboxConnection) -> str:
 def rotate_mailbox_credentials() -> int:
    """Re-encrypt every mailbox password with the first configured key."""
    rotated = 0
-    for connection in MailboxConnection.objects.select_for_update().all():
+    for connection in MailboxConnection.objects.select_for_update().exclude(
+        provider=MailboxConnection.Provider.OUTLOOK
+    ):
        password = decrypt_mailbox_password(connection)
        connection.encrypted_password = encrypt_mailbox_password(password)
        connection.save(update_fields=["encrypted_password", "updated_at"])
@@ -79,7 +81,10 @@ def save_mailbox_connection(
        "poll_interval_minutes",
    ):
        setattr(connection, field, cleaned_data[field])
-    if password:
+    uses_oauth = connection.provider == MailboxConnection.Provider.OUTLOOK
+    if uses_oauth:
+        connection.encrypted_password = ""
+    elif password:
        connection.encrypted_password = encrypt_mailbox_password(password)
    elif not connection.encrypted_password:
        raise MailboxCredentialError("Een app-wachtwoord is verplicht.")