Project unread postbox work with shared authorization

src/govoplan_postbox/backend/router.py

@@ -28,11 +28,9 @@ from govoplan_core.db.session import get_session
 from govoplan_postbox.backend.manifest import (
     ACKNOWLEDGE_SCOPE,
     BINDING_ADMIN_SCOPE,
-    CONFIDENTIAL_SCOPE,
     DELIVERY_SCOPE,
     READ_SCOPE,
     REPLY_SCOPE,
-    RESTRICTED_SCOPE,
     SEND_SCOPE,
     TEMPLATE_ADMIN_SCOPE,
 )
@@ -67,6 +65,10 @@ from govoplan_postbox.backend.schemas import (
     PostboxTemplateReviseRequest,
 )
 from govoplan_postbox.backend.service import PostboxError
+from govoplan_postbox.backend.principals import (
+    PostboxPrincipalError,
+    actor_from_principal,
+)
 
 
 router = APIRouter(prefix="/postbox", tags=["postbox"])
@@ -94,44 +96,16 @@ def _actor(
     *,
     assignment_context_id: str | None = None,
 ) -> PostboxActorRef:
-    actions: set[str] = set()
-    if has_scope(principal, READ_SCOPE):
-        actions.update(("discover", "read"))
-    if has_scope(principal, SEND_SCOPE):
-        actions.add("send")
-    if has_scope(principal, REPLY_SCOPE):
-        actions.add("reply")
-    if has_scope(principal, ACKNOWLEDGE_SCOPE):
-        actions.add("acknowledge")
-    if has_scope(principal, BINDING_ADMIN_SCOPE) or has_scope(
-        principal,
-        TEMPLATE_ADMIN_SCOPE,
-    ):
-        actions.add("administer")
-    if (
-        assignment_context_id is not None
-        and assignment_context_id not in principal.function_assignment_ids
-    ):
+    try:
+        return actor_from_principal(
+            principal,
+            assignment_context_id=assignment_context_id,
+        )
+    except PostboxPrincipalError as exc:
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
-            detail="The selected assignment context is not active for this principal.",
-        )
-    selected = assignment_context_id or principal.acting_assignment_id
-    if selected is None and len(principal.function_assignment_ids) == 1:
-        selected = next(iter(principal.function_assignment_ids))
-    classifications = {"public", "internal"}
-    if has_scope(principal, CONFIDENTIAL_SCOPE):
-        classifications.add("confidential")
-    if has_scope(principal, RESTRICTED_SCOPE):
-        classifications.update(("confidential", "restricted"))
-    return PostboxActorRef(
-        account_id=principal.account_id,
-        identity_id=principal.identity_id,
-        selected_assignment_id=selected,
-        acting_for_account_id=principal.acting_for_account_id,
-        authorized_actions=frozenset(actions),  # type: ignore[arg-type]
-        authorized_classifications=frozenset(classifications),  # type: ignore[arg-type]
-    )
+            detail=str(exc),
+        ) from exc
 
 
 def _http_error(exc: PostboxError) -> HTTPException: