Project unread postbox work with shared authorization

tests/test_manifest.py

@@ -41,6 +41,7 @@ class PostboxManifestTests(unittest.TestCase):
             manifest.required_capabilities,
         )
         self.assertIn("encryption", manifest.optional_dependencies)
+        self.assertEqual("postbox.unread", manifest.work_item_providers[0].id)
         self.assertTrue(
             any(
                 requirement.name == CAPABILITY_ENCRYPTION_CONTENT_CIPHER

tests/test_real_directory_access.py

@@ -6,7 +6,10 @@ from datetime import timedelta
 from sqlalchemy import create_engine
 from sqlalchemy.orm import Session
 
+from govoplan_core.auth import ApiPrincipal
+from govoplan_core.core.access import PrincipalRef
 from govoplan_core.core.postbox import PostboxActorRef
+from govoplan_core.core.tasks import WorkItemQuery
 from govoplan_core.db.base import Base
 from govoplan_core.db.session import (
     DatabaseHandle,
@@ -41,6 +44,8 @@ from govoplan_postbox.backend.db.models import (
     PostboxTemplateRevision,
 )
 from govoplan_postbox.backend.service import PostboxService
+from govoplan_postbox.backend.principals import actor_from_principal
+from govoplan_postbox.backend.work_items import PostboxWorkItemProvider
 
 
 TABLES = (
@@ -269,6 +274,67 @@ class PostboxRealDirectoryAccessTests(unittest.TestCase):
         self.assertFalse(expired.allowed)
         self.assertEqual(expired.reason_code, "effective_assignment_missing")
 
+    def test_unread_message_is_projected_as_current_work_until_read(self) -> None:
+        self._add_assignment(
+            assignment_id="owner-assignment",
+            identity_id="identity-owner",
+            account_id="account-owner",
+        )
+        principal = ApiPrincipal(
+            principal=PrincipalRef(
+                account_id="account-owner",
+                membership_id="membership-owner",
+                tenant_id="tenant-1",
+                identity_id="identity-owner",
+                scopes=frozenset({"postbox:postbox:read"}),
+                function_assignment_ids=frozenset({"owner-assignment"}),
+            ),
+            account=object(),
+            user=object(),
+        )
+        provider = PostboxWorkItemProvider(service=self.service)
+        with self.database.SessionLocal() as session:
+            message = PostboxMessage(
+                tenant_id="tenant-1",
+                postbox_id=self.postbox_id,
+                subject="Review the submitted evidence",
+                status="delivered",
+                classification="internal",
+                sender_label="Permit service",
+                delivered_at=utc_now(),
+                wrapped_keys=[],
+                external_recipient_tokens=[],
+                metadata_={},
+            )
+            session.add(message)
+            session.commit()
+
+            page = provider.list_items(
+                session,
+                principal,
+                query=WorkItemQuery(tenant_id="tenant-1"),
+            )
+            self.assertEqual(1, page.total)
+            self.assertEqual(message.id, page.items[0].id)
+            self.assertEqual("owner-assignment", page.items[0].assignments[0].id)
+
+            self.service.mark_message(
+                session,
+                tenant_id="tenant-1",
+                message_id=message.id,
+                actor=actor_from_principal(principal),
+                state="read",
+            )
+            session.commit()
+            self.assertEqual(
+                0,
+                provider.list_items(
+                    session,
+                    principal,
+                    query=WorkItemQuery(tenant_id="tenant-1"),
+                ).total,
+            )
+
     def test_real_organization_state_and_function_move_fail_closed(self) -> None:
         self._add_assignment(
             assignment_id="owner-assignment",