Add encrypted envelope recipient state

src/govoplan_postbox/backend/router.py

@@ -17,9 +17,11 @@ from govoplan_core.core.postbox import (
     PostboxActorRef,
     PostboxAttachmentRef,
     PostboxDeliveryRequest,
+    PostboxExternalRecipientTokenRef,
     PostboxMessageAuthoringRequest,
     PostboxParticipantRef,
     PostboxTargetRef,
+    PostboxWrappedKeyRef,
 )
 from govoplan_core.db.session import get_session
 from govoplan_postbox.backend.manifest import (
@@ -103,7 +105,15 @@ def _actor(
         TEMPLATE_ADMIN_SCOPE,
     ):
         actions.add("administer")
-    selected = assignment_context_id
+    if (
+        assignment_context_id is not None
+        and assignment_context_id not in principal.function_assignment_ids
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="The selected assignment context is not active for this principal.",
+        )
+    selected = assignment_context_id or principal.acting_assignment_id
     if selected is None and len(principal.function_assignment_ids) == 1:
         selected = next(iter(principal.function_assignment_ids))
     classifications = {"public", "internal"}
@@ -542,6 +552,16 @@ def api_deliver_to_postbox(
             for attachment in payload.attachments
         ),
         expires_at=payload.expires_at,
+        ciphertext_ref=payload.ciphertext_ref,
+        signed_manifest_ref=payload.signed_manifest_ref,
+        wrapped_keys=tuple(
+            PostboxWrappedKeyRef(**item.model_dump())
+            for item in payload.wrapped_keys
+        ),
+        external_recipient_tokens=tuple(
+            PostboxExternalRecipientTokenRef(**item.model_dump())
+            for item in payload.external_recipient_tokens
+        ),
         metadata=payload.metadata,
     )
     try: