feat(postbox): enforce unified inbox separation

webui/src/api/postbox.ts

@@ -45,6 +45,7 @@ export type PostboxDirectoryItem = {
   key_epoch: number;
   encryption_vault_id?: string | null;
   protection_policy: PostboxProtectionPolicy;
+  grouping_policy: PostboxGroupingPolicy;
   access?: PostboxAccessDecision | null;
   resource_revision: number;
   etag: string;
@@ -74,6 +75,11 @@ export type PostboxProtectionPolicy = {
   vacancy_escalation_content_access: "metadata_only";
 };
 
+export type PostboxGroupingPolicy = {
+  mode: "allow" | "same_classification" | "separate";
+  reason?: string | null;
+};
+
 export type PostboxProtectionProfile = {
   id: PostboxProtectionProfileId;
   label: string;
@@ -200,6 +206,13 @@ export type PostboxGrouping = {
   postbox_ids: string[];
   total_count: number;
   unread_count: number;
+  constraints: Array<{
+    code: "source_requires_separation" | "classification_separation_required";
+    mode: PostboxGroupingPolicy["mode"];
+    postbox_id: string;
+    reason?: string | null;
+    enforced_by: "postbox_configuration";
+  }>;
   resource_revision: number;
   etag: string;
   created_at: string;
@@ -288,6 +301,7 @@ export type PostboxTemplateRevision = {
   encryption_profile: string;
   encryption_vault_id?: string | null;
   protection_policy: PostboxProtectionPolicy;
+  grouping_policy: PostboxGroupingPolicy;
   history_policy: Record<string, unknown>;
   routing_policy: PostboxRoutingPolicy;
   retention_policy: Record<string, unknown>;
@@ -326,6 +340,7 @@ export type PostboxTemplateRevisionPayload = Pick<
   | "encryption_profile"
   | "encryption_vault_id"
   | "protection_policy"
+  | "grouping_policy"
   | "routing_policy"
 >;
 
@@ -371,6 +386,7 @@ export type PostboxExactCreatePayload = {
   encryption_profile: PostboxProtectionProfileId;
   encryption_vault_id?: string | null;
   protection_policy: PostboxProtectionPolicy;
+  grouping_policy: PostboxGroupingPolicy;
 };
 
 export type PostboxMessageAuthoringPayload = {
@@ -613,6 +629,25 @@ export function updatePostboxProtectionPolicy(
   );
 }
 
+export function updatePostboxGroupingPolicy(
+  settings: ApiSettings,
+  postbox: PostboxDirectoryItem,
+  groupingPolicy: PostboxGroupingPolicy
+): Promise<PostboxDirectoryItem> {
+  return apiFetch(
+    settings,
+    `/api/v1/postbox/admin/postboxes/${encodeURIComponent(postbox.id)}/grouping-policy`,
+    {
+      method: "PUT",
+      headers: { "If-Match": postbox.etag },
+      body: JSON.stringify({
+        base_revision: postbox.resource_revision,
+        grouping_policy: groupingPolicy
+      })
+    }
+  );
+}
+
 export async function listPostboxOrganizationTargets(
   settings: ApiSettings
 ): Promise<PostboxOrganizationTargets> {