feat: harden campaign delivery and editing

tests/test_response_security.py

@@ -5,6 +5,7 @@ import unittest
 from datetime import UTC, datetime
 from types import SimpleNamespace
 
+from govoplan_core.core.postbox import PostboxDeliveryReceiptSummaryRef
 from govoplan_campaign.backend.response_security import public_campaign_payload
 from govoplan_campaign.backend.services.job_queries import (
     _job_attempts_payload,
@@ -88,6 +89,30 @@ def _imap_attempt() -> SimpleNamespace:
     )
 
 
+def _postbox_attempt() -> SimpleNamespace:
+    return SimpleNamespace(
+        id="postbox-attempt-1",
+        target_index=0,
+        attempt_number=1,
+        status="accepted",
+        postbox_id="postbox-1",
+        address="intake@postbox",
+        holder_count=1,
+        vacant=False,
+        duplicate=False,
+        target_snapshot={"address": "intake@postbox"},
+        started_at=_now(),
+        finished_at=_now(),
+        error_code=None,
+        idempotency_key="private-idempotency-key",
+        provider_delivery_id="delivery-1",
+        provider_message_id="message-1",
+        evidence={"target_snapshot": {"address": "intake@postbox"}},
+        error_type=None,
+        error_message=None,
+    )
+
+
 def test_public_payload_recursively_removes_infrastructure_locators() -> None:
     source = {
         "campaign_file": "/tmp/campaign.json",
@@ -243,6 +268,33 @@ def test_operator_diagnostics_include_claim_and_storage_details() -> None:
     assert "provider-secret" in diagnostics["worker_claim"]["last_error"]
 
 
+def test_postbox_receipt_summary_is_aggregate_and_contains_no_holder_identity() -> None:
+    summary = PostboxDeliveryReceiptSummaryRef(
+        delivery_id="delivery-1",
+        message_id="message-1",
+        postbox_id="postbox-1",
+        delivery_status="accepted",
+        accepted_at=_now(),
+        current_holder_count=2,
+        currently_readable=True,
+        read_receipt_count=1,
+        acknowledged_receipt_count=1,
+    )
+    attempts = _job_attempts_payload(
+        [],
+        [],
+        [_postbox_attempt()],  # type: ignore[list-item]
+        postbox_receipts={"delivery-1": summary},
+    )
+
+    payload = attempts["postbox"][0]
+    assert payload["receipt_summary_status"] == "available"
+    assert payload["receipt_summary"]["currently_readable"] is True
+    assert payload["receipt_summary"]["read_receipt_count"] == 1
+    assert "account_id" not in repr(payload["receipt_summary"])
+    assert "identity_id" not in repr(payload["receipt_summary"])
+
+
 def test_diagnostics_permission_is_operator_only_by_default() -> None:
     from govoplan_campaign.backend.manifest import PERMISSIONS, ROLE_TEMPLATES