feat: protect postbox message content

src/govoplan_postbox/backend/migrations/versions/d8e3f6a9b2c5_postbox_content_protection.py

@@ -0,0 +1,55 @@
+"""postbox content-protection state
+
+Revision ID: d8e3f6a9b2c5
+Revises: a6d9e1f4c8b3
+Create Date: 2026-08-02 00:00:00.000000
+"""
+
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "d8e3f6a9b2c5"
+down_revision = "a6d9e1f4c8b3"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("postbox_template_revisions") as batch_op:
+        batch_op.add_column(
+            sa.Column("encryption_vault_id", sa.String(length=255), nullable=True)
+        )
+    with op.batch_alter_table("postbox_messages") as batch_op:
+        batch_op.add_column(
+            sa.Column("body_ciphertext", sa.LargeBinary(), nullable=True)
+        )
+        batch_op.add_column(
+            sa.Column("encryption_envelope_id", sa.String(length=255), nullable=True)
+        )
+        batch_op.add_column(
+            sa.Column("encryption_resource_id", sa.String(length=36), nullable=True)
+        )
+        batch_op.create_index(
+            op.f("ix_postbox_messages_encryption_envelope_id"),
+            ["encryption_envelope_id"],
+            unique=False,
+        )
+        batch_op.create_index(
+            op.f("ix_postbox_messages_encryption_resource_id"),
+            ["encryption_resource_id"],
+            unique=False,
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("postbox_messages") as batch_op:
+        batch_op.drop_index(op.f("ix_postbox_messages_encryption_resource_id"))
+        batch_op.drop_index(op.f("ix_postbox_messages_encryption_envelope_id"))
+        batch_op.drop_column("encryption_resource_id")
+        batch_op.drop_column("encryption_envelope_id")
+        batch_op.drop_column("body_ciphertext")
+    with op.batch_alter_table("postbox_template_revisions") as batch_op:
+        batch_op.drop_column("encryption_vault_id")