feat: protect postbox message content

src/govoplan_postbox/backend/schemas.py

@@ -355,6 +355,23 @@ class PostboxExactCreateRequest(BaseModel):
     function_id: str = Field(min_length=1, max_length=36)
     address_key: str | None = Field(default=None, max_length=120)
     classification: PostboxClassification = "internal"
+    encryption_profile: Literal["plaintext_v1", "server_envelope_v1"] = (
+        "plaintext_v1"
+    )
+    encryption_vault_id: str | None = Field(default=None, max_length=255)
+
+    @model_validator(mode="after")
+    def validate_encryption(self) -> "PostboxExactCreateRequest":
+        if self.encryption_profile == "server_envelope_v1":
+            if not str(self.encryption_vault_id or "").strip():
+                raise ValueError(
+                    "Server-envelope Postboxes require an encryption vault."
+                )
+        elif self.encryption_vault_id:
+            raise ValueError(
+                "A plaintext Postbox cannot select an encryption vault."
+            )
+        return self
 
 
 class PostboxTemplateRevisionPayload(BaseModel):
@@ -373,10 +390,27 @@ class PostboxTemplateRevisionPayload(BaseModel):
     )
     classification: PostboxClassification = "internal"
     allow_vacant_delivery: bool = True
+    encryption_profile: Literal["plaintext_v1", "server_envelope_v1"] = (
+        "plaintext_v1"
+    )
+    encryption_vault_id: str | None = Field(default=None, max_length=255)
     routing_policy: PostboxRoutingPolicyPayload = Field(
         default_factory=PostboxRoutingPolicyPayload
     )
 
+    @model_validator(mode="after")
+    def validate_encryption(self) -> "PostboxTemplateRevisionPayload":
+        if self.encryption_profile == "server_envelope_v1":
+            if not str(self.encryption_vault_id or "").strip():
+                raise ValueError(
+                    "Server-envelope Postbox templates require an encryption vault."
+                )
+        elif self.encryption_vault_id:
+            raise ValueError(
+                "A plaintext Postbox template cannot select an encryption vault."
+            )
+        return self
+
 
 class PostboxTemplateCreateRequest(PostboxTemplateRevisionPayload):
     slug: str = Field(min_length=1, max_length=120)
@@ -391,7 +425,6 @@ class PostboxTemplateReviseRequest(PostboxTemplateRevisionPayload):
 class PostboxTemplateRevisionItem(PostboxTemplateRevisionPayload):
     id: str
     revision: int
-    encryption_profile: str
     history_policy: dict[str, Any] = Field(default_factory=dict)
     retention_policy: dict[str, Any] = Field(default_factory=dict)
     published_at: datetime | None = None