Complete Postbox access transition matrix

2026-07-31 18:21:36 +02:00
parent cbeaca979d
commit 0b6ebc3c74
9 changed files with 741 additions and 24 deletions
@@ -735,6 +735,94 @@ class PostboxServiceTests(unittest.TestCase):
            self.assertTrue(allowed.allowed)
            self.assertEqual("effective_acting_for_assignment", allowed.reason_code)

+    def test_classification_clearance_controls_directory_and_delivery(self) -> None:
+        self.idm.assignments.append(self.assignment)
+        elevated_actor = PostboxActorRef(
+            account_id="account-1",
+            identity_id="identity-1",
+            authorized_actions=frozenset({"discover", "read", "send", "reply"}),
+            authorized_classifications=frozenset(
+                {"public", "internal", "confidential"}
+            ),
+        )
+        with Session(self.engine) as session:
+            postbox = self.service.create_exact_postbox(
+                session,
+                tenant_id="tenant-1",
+                name="Confidential intake",
+                organization_unit_id="unit-1",
+                function_id="function-1",
+                address_key=None,
+                description=None,
+                classification="confidential",
+                actor_id="admin-1",
+            )
+
+            denied = self.service.explain_access(
+                session,
+                tenant_id="tenant-1",
+                postbox_id=postbox.id,
+                actor=self.actor,
+                action="read",
+            )
+            visible = self.service.list_visible_postboxes(
+                session,
+                tenant_id="tenant-1",
+                actor=elevated_actor,
+            )
+            delivered = self.service.deliver(
+                session,
+                PostboxDeliveryRequest(
+                    tenant_id="tenant-1",
+                    target=PostboxTargetRef(postbox_id=postbox.id),
+                    producer_module="campaigns",
+                    producer_resource_type="recipient",
+                    producer_resource_id="recipient-1",
+                    idempotency_key="confidential-message",
+                    subject="Confidential notice",
+                    classification="confidential",
+                ),
+            )
+
+            self.assertEqual(
+                denied.reason_code,
+                "classification_clearance_missing",
+            )
+            self.assertEqual([postbox.id], [item.id for item in visible])
+            self.assertIsNotNone(
+                self.service.get_message(
+                    session,
+                    tenant_id="tenant-1",
+                    message_id=delivered.message_id,
+                    actor=elevated_actor,
+                )
+            )
+            self.assertIsNone(
+                self.service.get_message(
+                    session,
+                    tenant_id="tenant-1",
+                    message_id=delivered.message_id,
+                    actor=self.actor,
+                )
+            )
+            with self.assertRaisesRegex(
+                PostboxError,
+                "exceeds the target Postbox classification",
+            ):
+                self.service.deliver(
+                    session,
+                    PostboxDeliveryRequest(
+                        tenant_id="tenant-1",
+                        target=PostboxTargetRef(postbox_id=postbox.id),
+                        producer_module="campaigns",
+                        producer_resource_type="recipient",
+                        producer_resource_id="recipient-2",
+                        idempotency_key="restricted-message",
+                        subject="Restricted notice",
+                        classification="restricted",
+                    ),
+                )
+
    def test_template_revision_is_immutable_and_materialization_idempotent(self) -> None:
        with Session(self.engine) as session:
            template = self.service.create_template(