Scope --allow-invalid-certs to the server the user named

The flag switched certificate checks off for every connection in the run.
That included the Microsoft sign-in endpoints, so a user passing it for a
self-signed source also sent refresh tokens, device codes and EWS client
secrets over unverified TLS. It also covered the export target, and any host
a server redirected to or named for its API, uploads or downloads.

It now applies only where the user pointed it: the host of --url, for the
source of an import or the target of an export. For an Exchange import with
no --url, it covers the mailbox's own domain, where on-premises Autodiscover
looks, and then only the EWS endpoint Autodiscover finds. The Microsoft and
Google sign-in and cloud hosts are always verified, with or without the flag.

Each HTTP client keeps a verifying agent and, only when the flag applies, a
second one that accepts invalid certificates, and picks per request by host.
The sign-in modules no longer take the flag at all. Autodiscover v2, which is
Microsoft's own service, is always verified.

tests/live_stalwart.rs

@@ -11,6 +11,7 @@ mod seeder;
 use inbuxa_migrate::jmap::account::{self, AccountSelector};
 use inbuxa_migrate::jmap::http::{Auth, HttpClient, RetryPolicy};
 use inbuxa_migrate::jmap::session::Session;
+use inbuxa_migrate::net::CertOverride;
 use integration::stalwart::shared as shared_stalwart;
 
 fn admin_client() -> HttpClient {
@@ -20,7 +21,7 @@ fn admin_client() -> HttpClient {
             password: seeder::ADMIN_PASSWORD.into(),
         },
         RetryPolicy::new(5),
-        true,
+        CertOverride::for_url(true, shared_stalwart().base_url()),
     )
 }
 

tests/mock_dav.rs

@@ -13,6 +13,7 @@ use inbuxa_migrate::dav::parse::{parse_multistatus, strip_ascii_control_chars};
 use inbuxa_migrate::dav::xml;
 use inbuxa_migrate::jmap::error::JmapError;
 use inbuxa_migrate::jmap::http::{Auth, RetryPolicy};
+use inbuxa_migrate::net::CertOverride;
 
 fn client(retries: u32) -> DavClient {
     DavClient::new(
@@ -21,7 +22,7 @@ fn client(retries: u32) -> DavClient {
             password: "p".into(),
         },
         RetryPolicy::new(retries),
-        false,
+        CertOverride::none(),
     )
 }
 

tests/mock_exchange_ews.rs

@@ -22,6 +22,7 @@ use inbuxa_migrate::exchange_ews::xml::{
     get_item_body, sync_folder_items_body,
 };
 use inbuxa_migrate::jmap::http::{Auth, RetryPolicy};
+use inbuxa_migrate::net::CertOverride;
 use mockito::Matcher;
 
 const TXT_XML: &str = "text/xml; charset=utf-8";
@@ -33,7 +34,7 @@ fn client(retries: u32) -> EwsClient {
             token: "t".to_owned(),
         },
         RetryPolicy::new(retries),
-        false,
+        CertOverride::none(),
     )
 }
 
@@ -63,7 +64,7 @@ fn autodiscover_v2_returns_global_endpoint() {
     let _ = server;
     let url = "https://outlook.office365.com/EWS/Exchange.asmx";
     assert!(inbuxa_migrate::exchange_ews::autodiscover::is_fully_qualified_ews_url(url));
-    let r = discover(Some(url), None, None, false).unwrap();
+    let r = discover(Some(url), None, None, &CertOverride::none()).unwrap();
     assert_eq!(r.source, DiscoverySource::SuppliedUrl);
     assert_eq!(r.ews_url, url);
 }

tests/mock_exchange_graph.rs

@@ -21,6 +21,7 @@ use inbuxa_migrate::exchange_graph::recurrence::convert_patterned_recurrence;
 use inbuxa_migrate::exchange_graph::retry::{HttpClass, classify_http_status};
 use inbuxa_migrate::exchange_graph::types::Surfaces;
 use inbuxa_migrate::jmap::http::RetryPolicy;
+use inbuxa_migrate::net::CertOverride;
 use mockito::{Matcher, Server};
 use serde_json::json;
 
@@ -28,7 +29,11 @@ static INIT: Once = Once::new();
 
 fn client_with_retries(retries: u32) -> GraphClient {
     INIT.call_once(|| {});
-    GraphClient::new("BEARER".to_owned(), RetryPolicy::new(retries), false)
+    GraphClient::new(
+        "BEARER".to_owned(),
+        RetryPolicy::new(retries),
+        CertOverride::none(),
+    )
 }
 
 fn url_message_collection(server_url: &str, folder: &str, top: usize) -> String {
@@ -1681,7 +1686,11 @@ fn graph_client_retries_after_401_when_bearer_is_swapped() {
         .expect(1)
         .create();
     let base = server.url();
-    let client = GraphClient::new("EXPIRED".to_owned(), RetryPolicy::new(0), false);
+    let client = GraphClient::new(
+        "EXPIRED".to_owned(),
+        RetryPolicy::new(0),
+        CertOverride::none(),
+    );
     let url = format!("{base}/me");
     let err = client.get(&url, Accept::Json).unwrap_err();
     assert!(matches!(err, GraphError::Auth(_)));

tests/mock_jmap.rs

@@ -17,6 +17,7 @@ use inbuxa_migrate::jmap::session::{Limits, Session};
 use inbuxa_migrate::jmap::wire::JmapId;
 use inbuxa_migrate::jmap::wire::identity::Identity;
 use inbuxa_migrate::jmap::wire::mailbox::Mailbox;
+use inbuxa_migrate::net::CertOverride;
 use serde_json::json;
 
 fn client(retries: u32) -> HttpClient {
@@ -26,7 +27,7 @@ fn client(retries: u32) -> HttpClient {
             password: "p".into(),
         },
         RetryPolicy::new(retries),
-        false,
+        CertOverride::none(),
     )
 }
 

tests/sync_jmap.rs

@@ -16,6 +16,7 @@ use inbuxa_migrate::jmap::http::{Auth, HttpClient, RetryPolicy};
 use inbuxa_migrate::jmap::request::Request;
 use inbuxa_migrate::jmap::session::Session;
 use inbuxa_migrate::logging::Logger;
+use inbuxa_migrate::net::CertOverride;
 use inbuxa_migrate::sync::{self, CommonConfig, ConnectConfig, ExportConfig, ImportConfig};
 use integration::stalwart::shared as shared_stalwart;
 use rusqlite::Connection;
@@ -785,7 +786,11 @@ fn export_inlines_contact_and_event_blobs_instead_of_blob_ids() {
         assert_eq!(counts.failed, 0, "{name} had no failures: {counts:?}");
     }
 
-    let client = HttpClient::new(basic("test6"), RetryPolicy::new(5), true);
+    let client = HttpClient::new(
+        basic("test6"),
+        RetryPolicy::new(5),
+        CertOverride::for_url(true, base_url()),
+    );
     let session = Session::discover(&client, base_url()).expect("discover target session");
     let api = session.api_url.clone();
 
@@ -1047,7 +1052,11 @@ fn live_burst_exceeds_concurrent_requests_and_recovers() {
     let fx = seeder::provision(base_url()).expect("provision");
     let acc = fx.account("test1").expect("test1");
 
-    let client = HttpClient::new(basic("test1"), RetryPolicy::new(20), true);
+    let client = HttpClient::new(
+        basic("test1"),
+        RetryPolicy::new(20),
+        CertOverride::for_url(true, base_url()),
+    );
     let session = Session::discover(&client, base_url()).expect("discover session");
     let server_limits = session.core_limits().expect("core limits");
 
@@ -1148,7 +1157,7 @@ impl JmapSettingsGuard {
                 password: seeder::ADMIN_PASSWORD.to_owned(),
             },
             RetryPolicy::new(5),
-            true,
+            CertOverride::for_url(true, base_url()),
         );
         let session = Session::discover(&admin, base_url()).expect("admin discover");
         let admin_account = session
@@ -1269,7 +1278,11 @@ fn live_blob_quota_429_triggers_retry_after_then_succeeds() {
     );
     let _ttl_guard = JmapSettingsGuard::override_settings(updates);
 
-    let client = HttpClient::new(basic("test1"), RetryPolicy::new(20), true);
+    let client = HttpClient::new(
+        basic("test1"),
+        RetryPolicy::new(20),
+        CertOverride::for_url(true, base_url()),
+    );
     let session = Session::discover(&client, base_url()).expect("discover session");
     let limits = session.core_limits().expect("core limits");
     client.set_limits(&limits);
@@ -1346,7 +1359,11 @@ fn import_delta_propagates_email_keyword_change_via_changes() {
         .expect("an unflagged email exists in the archive")
     };
 
-    let client = HttpClient::new(basic("test1"), RetryPolicy::new(5), true);
+    let client = HttpClient::new(
+        basic("test1"),
+        RetryPolicy::new(5),
+        CertOverride::for_url(true, base_url()),
+    );
     let session = Session::discover(&client, base_url()).expect("session discovered");
     let account = account::resolve(
         &AccountSelector::Id(acc.account_id.clone()),