Complete Postbox access transition matrix

src/govoplan_postbox/backend/router.py

@@ -18,8 +18,11 @@ from govoplan_core.db.session import get_session
 from govoplan_postbox.backend.manifest import (
     ACKNOWLEDGE_SCOPE,
     BINDING_ADMIN_SCOPE,
+    CONFIDENTIAL_SCOPE,
     DELIVERY_SCOPE,
     READ_SCOPE,
+    REPLY_SCOPE,
+    RESTRICTED_SCOPE,
     SEND_SCOPE,
     TEMPLATE_ADMIN_SCOPE,
 )
@@ -80,6 +83,8 @@ def _actor(
         actions.update(("discover", "read"))
     if has_scope(principal, SEND_SCOPE):
         actions.add("send")
+    if has_scope(principal, REPLY_SCOPE):
+        actions.add("reply")
     if has_scope(principal, ACKNOWLEDGE_SCOPE):
         actions.add("acknowledge")
     if has_scope(principal, BINDING_ADMIN_SCOPE) or has_scope(
@@ -90,12 +95,18 @@ def _actor(
     selected = assignment_context_id
     if selected is None and len(principal.function_assignment_ids) == 1:
         selected = next(iter(principal.function_assignment_ids))
+    classifications = {"public", "internal"}
+    if has_scope(principal, CONFIDENTIAL_SCOPE):
+        classifications.add("confidential")
+    if has_scope(principal, RESTRICTED_SCOPE):
+        classifications.update(("confidential", "restricted"))
     return PostboxActorRef(
         account_id=principal.account_id,
         identity_id=principal.identity_id,
         selected_assignment_id=selected,
         acting_for_account_id=principal.acting_for_account_id,
         authorized_actions=frozenset(actions),  # type: ignore[arg-type]
+        authorized_classifications=frozenset(classifications),  # type: ignore[arg-type]
     )
 
 
@@ -213,6 +224,7 @@ def api_postbox_access(
         "discover",
         "read",
         "send",
+        "reply",
         "acknowledge",
         "administer",
     ] = "read",