Project unread postbox work with shared authorization

src/govoplan_postbox/backend/manifest.py

@@ -45,27 +45,28 @@ from govoplan_core.core.postbox import (
     CAPABILITY_POSTBOX_ROUTING,
 )
 from govoplan_core.core.search import SearchSourceProviderRegistration
+from govoplan_core.core.tasks import WorkItemProviderRegistration
 from govoplan_core.core.views import ViewSurface
 from govoplan_core.db.base import Base
 from govoplan_postbox.backend.db import models as postbox_models
 from govoplan_postbox.backend.search_source import create_postbox_search_source
+from govoplan_postbox.backend.permissions import (
+    ACKNOWLEDGE_SCOPE,
+    BINDING_ADMIN_SCOPE,
+    CONFIDENTIAL_SCOPE,
+    DELIVERY_SCOPE,
+    READ_SCOPE,
+    REPLY_SCOPE,
+    RESTRICTED_SCOPE,
+    SEND_SCOPE,
+    TEMPLATE_ADMIN_SCOPE,
+)
 
 
 MODULE_ID = "postbox"
 MODULE_NAME = "Postbox"
 MODULE_VERSION = "0.1.18"
 
-READ_SCOPE = "postbox:postbox:read"
-SEND_SCOPE = "postbox:message:write"
-REPLY_SCOPE = "postbox:message:reply"
-ACKNOWLEDGE_SCOPE = "postbox:message:acknowledge"
-DELIVERY_SCOPE = "postbox:delivery:write"
-BINDING_ADMIN_SCOPE = "postbox:binding:admin"
-TEMPLATE_ADMIN_SCOPE = "postbox:template:admin"
-CONFIDENTIAL_SCOPE = "postbox:classification:confidential"
-RESTRICTED_SCOPE = "postbox:classification:restricted"
-
-
 def _permission(scope: str, label: str, description: str) -> PermissionDefinition:
     module_id, resource, action = scope.split(":", 2)
     return PermissionDefinition(
@@ -169,6 +170,12 @@ def _router(context: ModuleContext):
     return router
 
 
+def _work_items(context: ModuleContext):
+    from govoplan_postbox.backend.work_items import PostboxWorkItemProvider
+
+    return PostboxWorkItemProvider(registry=context.registry)
+
+
 def _tenant_summary(session, tenant_id: str) -> dict[str, int]:
     return {
         "postboxes": session.query(postbox_models.Postbox)
@@ -225,6 +232,7 @@ manifest = ModuleManifest(
         "views",
         "workflow_engine",
         "search",
+        "tasks",
     ),
     required_capabilities=(
         CAPABILITY_AUTH_PRINCIPAL_RESOLVER,
@@ -284,6 +292,13 @@ manifest = ModuleManifest(
             factory=create_postbox_search_source,
         ),
     ),
+    work_item_providers=(
+        WorkItemProviderRegistration(
+            id="postbox.unread",
+            factory=_work_items,
+            order=40,
+        ),
+    ),
     nav_items=(
         NavItem(
             path="/postbox",
@@ -413,7 +428,9 @@ manifest = ModuleManifest(
                 "server-envelope profile stores message bodies as ciphertext and "
                 "uses the optional Encryption capability for authorized reads. "
                 "External ciphertext profiles retain producer-managed references "
-                "and keys; neither profile is described as end-to-end encryption."
+                "and keys; neither profile is described as end-to-end encryption. "
+                "When Tasks is enabled, currently readable unread messages also appear "
+                "in the common work inbox and disappear when the personal read receipt is recorded."
             ),
             layer="available",
             documentation_types=("admin", "user"),
@@ -425,6 +442,7 @@ manifest = ModuleManifest(
                 "campaigns",
                 "files",
                 "notifications",
+                "tasks",
             ),
             links=(
                 DocumentationLink(