feat: protect postbox message content

tests/test_migration.py

@@ -26,6 +26,10 @@ class PostboxMigrationTests(unittest.TestCase):
             "govoplan_postbox.backend.migrations.versions."
             "a6d9e1f4c8b3_v013_external_recipient_tokens"
         )
+        protection_migration = importlib.import_module(
+            "govoplan_postbox.backend.migrations.versions."
+            "d8e3f6a9b2c5_postbox_content_protection"
+        )
         engine = create_engine("sqlite:///:memory:")
         try:
             with engine.begin() as connection:
@@ -34,15 +38,18 @@ class PostboxMigrationTests(unittest.TestCase):
                 route_original = route_migration.op
                 occ_original = occ_migration.op
                 envelope_original = envelope_migration.op
+                protection_original = protection_migration.op
                 migration.op = operations
                 route_migration.op = operations
                 occ_migration.op = operations
                 envelope_migration.op = operations
+                protection_migration.op = operations
                 try:
                     migration.upgrade()
                     route_migration.upgrade()
                     occ_migration.upgrade()
                     envelope_migration.upgrade()
+                    protection_migration.upgrade()
                     tables = set(inspect(connection).get_table_names())
                     self.assertIn("postboxes", tables)
                     self.assertIn("postbox_messages", tables)
@@ -63,8 +70,20 @@ class PostboxMigrationTests(unittest.TestCase):
                             "key_epoch",
                             "expires_at",
                             "withdrawn_at",
+                            "body_ciphertext",
+                            "encryption_envelope_id",
+                            "encryption_resource_id",
                         }.issubset(message_columns)
                     )
+                    self.assertIn(
+                        "encryption_vault_id",
+                        {
+                            column["name"]
+                            for column in inspect(connection).get_columns(
+                                "postbox_template_revisions"
+                            )
+                        },
+                    )
                     self.assertIn("authoring_key", message_columns)
                     for table_name in (
                         "postbox_templates",
@@ -91,6 +110,7 @@ class PostboxMigrationTests(unittest.TestCase):
                             route_columns
                         )
                     )
+                    protection_migration.downgrade()
                     envelope_migration.downgrade()
                     occ_migration.downgrade()
                     route_migration.downgrade()
@@ -107,6 +127,7 @@ class PostboxMigrationTests(unittest.TestCase):
                     route_migration.op = route_original
                     occ_migration.op = occ_original
                     envelope_migration.op = envelope_original
+                    protection_migration.op = protection_original
         finally:
             engine.dispose()