Harden live mail OAuth and immutable releases

tests/unit/test_fetcher.py

@@ -8,6 +8,7 @@ from apps.sources.services.fetcher import (
     FetchTimeoutError,
     PolicyBlockedError,
     RateLimitedError,
+    _validate_connected_peer,
     fetch_url,
 )
 from apps.sources.services.url_security import ValidatedUrl
@@ -100,6 +101,24 @@ def test_fetcher_rejects_dns_rebinding(monkeypatch):
     client.close()
 
 
+def test_production_transport_fails_closed_without_connected_peer():
+    validated = ValidatedUrl(
+        url="https://example.org/jobs",
+        hostname="example.org",
+        port=443,
+        addresses=("93.184.216.34",),
+    )
+    response = httpx.Response(200)
+
+    with pytest.raises(FetchError, match="Verbonden IP-adres"):
+        _validate_connected_peer(
+            response,
+            before=validated,
+            after=validated,
+            require_peer=True,
+        )
+
+
 class _PeerStream:
     def __init__(self, address: str) -> None:
         self.address = address