feat: права и инвайты

src/usecase/creative/get_creatives.py

@@ -1,16 +1,27 @@
 from typing import TYPE_CHECKING
 
-from src import dto
+from src import domain, dto
 
 if TYPE_CHECKING:
     from .. import Usecase
 
 
 async def get_creatives(self: 'Usecase', input: dto.GetCreativesInput) -> dto.GetCreativesOutput:
-    await self.ensure_workspace_access(input.workspace_id, input.user_id)
+    context = await self.ensure_workspace_permission(
+        input.workspace_id, input.user_id, domain.PermissionKey.PROJECTS_READ
+    )
+
+    allowed_project_ids = context.allowed_project_ids(domain.PermissionKey.PROJECTS_READ)
+
+    if input.project_id is not None:
+        context.ensure_project_permission(domain.PermissionKey.PROJECTS_READ, input.project_id)
+        allowed_project_ids = None
 
     creatives = await self.database.get_workspace_creatives(
-        input.workspace_id, input.project_id, input.include_archived
+        input.workspace_id,
+        input.project_id,
+        input.include_archived,
+        allowed_project_ids=allowed_project_ids,
     )
 
     return dto.GetCreativesOutput(