feat: права и инвайты

src/usecase/analytics/get_creatives_analytics.py

@@ -14,18 +14,30 @@ log = logging.getLogger(__name__)
 async def get_creatives_analytics(
     self: 'Usecase', input: dto.GetCreativesAnalyticsInput
 ) -> dto.GetCreativesAnalyticsOutput:
-    await self.ensure_workspace_access(input.workspace_id, input.user_id)
+    context = await self.ensure_workspace_permission(
+        input.workspace_id, input.user_id, domain.PermissionKey.ANALYTICS_READ
+    )
+
+    allowed_project_ids = context.allowed_project_ids(domain.PermissionKey.ANALYTICS_READ)
 
     if input.project_id:
         project = await self.database.get_project(input.workspace_id, input.project_id)
         if not project:
             raise domain.ProjectNotFound(input.project_id)
+        context.ensure_project_permission(domain.PermissionKey.ANALYTICS_READ, project.id)
+        allowed_project_ids = None
 
     creatives = await self.database.get_workspace_creatives(
-        input.workspace_id, input.project_id, include_archived=False
+        input.workspace_id,
+        input.project_id,
+        include_archived=False,
+        allowed_project_ids=allowed_project_ids,
     )
     placements = await self.database.get_workspace_placements(
-        input.workspace_id, input.project_id, include_archived=False
+        input.workspace_id,
+        input.project_id,
+        include_archived=False,
+        allowed_project_ids=allowed_project_ids,
     )
 
     @dataclass