Complete Postbox access transition matrix

src/govoplan_postbox/backend/manifest.py

@@ -52,10 +52,13 @@ MODULE_VERSION = "0.1.2"
 
 READ_SCOPE = "postbox:postbox:read"
 SEND_SCOPE = "postbox:message:write"
+REPLY_SCOPE = "postbox:message:reply"
 ACKNOWLEDGE_SCOPE = "postbox:message:acknowledge"
 DELIVERY_SCOPE = "postbox:delivery:write"
 BINDING_ADMIN_SCOPE = "postbox:binding:admin"
 TEMPLATE_ADMIN_SCOPE = "postbox:template:admin"
+CONFIDENTIAL_SCOPE = "postbox:classification:confidential"
+RESTRICTED_SCOPE = "postbox:classification:restricted"
 
 
 def _permission(scope: str, label: str, description: str) -> PermissionDefinition:
@@ -81,7 +84,12 @@ PERMISSIONS = (
     _permission(
         SEND_SCOPE,
         "Send through assigned postboxes",
-        "Create replies and new messages in postboxes available through the current function context.",
+        "Create new messages in postboxes available through the current function context.",
+    ),
+    _permission(
+        REPLY_SCOPE,
+        "Reply through assigned postboxes",
+        "Reply to messages in postboxes available through the current function context.",
     ),
     _permission(
         ACKNOWLEDGE_SCOPE,
@@ -103,6 +111,16 @@ PERMISSIONS = (
         "Administer postbox templates",
         "Create, revise, publish, and retire reusable function-scoped postbox templates.",
     ),
+    _permission(
+        CONFIDENTIAL_SCOPE,
+        "Access confidential Postbox content",
+        "Discover and use confidential Postboxes and messages when function access also permits it.",
+    ),
+    _permission(
+        RESTRICTED_SCOPE,
+        "Access restricted Postbox content",
+        "Discover and use restricted Postboxes and messages when function access also permits it.",
+    ),
 )
 
 ROLE_TEMPLATES = (
@@ -110,7 +128,7 @@ ROLE_TEMPLATES = (
         slug="postbox_user",
         name="Postbox user",
         description="Use postboxes available through current function assignments.",
-        permissions=(READ_SCOPE, SEND_SCOPE, ACKNOWLEDGE_SCOPE),
+        permissions=(READ_SCOPE, SEND_SCOPE, REPLY_SCOPE, ACKNOWLEDGE_SCOPE),
         default_authenticated=True,
     ),
     RoleTemplate(
@@ -120,10 +138,13 @@ ROLE_TEMPLATES = (
         permissions=(
             READ_SCOPE,
             SEND_SCOPE,
+            REPLY_SCOPE,
             ACKNOWLEDGE_SCOPE,
             DELIVERY_SCOPE,
             BINDING_ADMIN_SCOPE,
             TEMPLATE_ADMIN_SCOPE,
+            CONFIDENTIAL_SCOPE,
+            RESTRICTED_SCOPE,
         ),
     ),
 )