feat: права и инвайты

src/usecase/analytics/get_spending_analytics.py

@@ -33,15 +33,24 @@ def _format_period(dt: 'datetime.datetime', grouping: dto.DateGrouping) -> str:
 async def get_spending_analytics(
     self: 'Usecase', input: dto.GetSpendingAnalyticsInput
 ) -> dto.GetSpendingAnalyticsOutput:
-    await self.ensure_workspace_access(input.workspace_id, input.user_id)
+    context = await self.ensure_workspace_permission(
+        input.workspace_id, input.user_id, domain.PermissionKey.ANALYTICS_READ
+    )
+
+    allowed_project_ids = context.allowed_project_ids(domain.PermissionKey.ANALYTICS_READ)
 
     if input.project_id:
         project = await self.database.get_project(input.workspace_id, input.project_id)
         if not project:
             raise domain.ProjectNotFound(input.project_id)
+        context.ensure_project_permission(domain.PermissionKey.ANALYTICS_READ, project.id)
+        allowed_project_ids = None
 
     placements = await self.database.get_workspace_placements(
-        input.workspace_id, input.project_id, include_archived=False
+        input.workspace_id,
+        input.project_id,
+        include_archived=False,
+        allowed_project_ids=allowed_project_ids,
     )
 
     filtered = [