feat: права и инвайты

src/usecase/creative/update_creative.py

@@ -17,13 +17,17 @@ async def update_creative(
     user_id: uuid.UUID,
     workspace_id: uuid.UUID,
 ) -> dto.CreativeOutput:
-    await self.ensure_workspace_access(workspace_id, user_id)
+    context = await self.ensure_workspace_permission(
+        workspace_id, user_id, domain.PermissionKey.PROJECTS_WRITE
+    )
 
     creative = await self.database.get_creative(workspace_id, creative_id)
     if not creative:
         log.warning('User %s attempted to update unavailable creative %s', user_id, creative_id)
         raise domain.CreativeNotFound(creative_id)
 
+    context.ensure_project_permission(domain.PermissionKey.PROJECTS_WRITE, creative.project_id)
+
     if input.name:
         creative.name = input.name
     if input.text: