feat: права и инвайты

src/usecase/placement/update_placement.py

@@ -17,13 +17,17 @@ async def update_placement(
     user_id: uuid.UUID,
     workspace_id: uuid.UUID,
 ) -> dto.PlacementOutput:
-    await self.ensure_workspace_access(workspace_id, user_id)
+    context = await self.ensure_workspace_permission(
+        workspace_id, user_id, domain.PermissionKey.PLACEMENTS_WRITE
+    )
 
     placement = await self.database.get_placement(workspace_id, placement_id)
     if not placement:
         log.warning('Placement %s not found for user %s', placement_id, user_id)
         raise domain.PlacementNotFound(placement_id)
 
+    context.ensure_project_permission(domain.PermissionKey.PLACEMENTS_WRITE, placement.project_id)
+
     if input.placement_date is not None:
         placement.placement_date = input.placement_date
     if input.cost is not None: