feat(roles): let each section decide who may assign work to others

Section access now only creates a record for yourself. Assigning it to a colleague requires a separate permission on that section.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/routines/routines.service.ts

@@ -13,6 +13,7 @@ import type { Prisma } from '@prisma/client';
 import { PrismaService } from '../prisma/prisma.service';
 import type { Actor } from '../common/record-scope';
 import { elevated } from '../common/record-scope';
+import { actorCanAssignToOthers, assignOthersDeniedMessage } from '../common/assign-access';
 import {
   ChangeRoutineAssigneeDto,
   ListRoutinesQueryDto,
@@ -360,6 +361,11 @@ export class RoutinesService {
     assigneeId?: string | null,
     teamId?: string | null,
   ): Promise<{ assigneeId: string | null; teamId: string | null }> {
+    if ((assigneeId && assigneeId !== actor.userId) || teamId) {
+      if (!(await actorCanAssignToOthers(this.prisma, actor, 'routines'))) {
+        throw new ForbiddenException(assignOthersDeniedMessage('routines'));
+      }
+    }
     if (assigneeId) {
       if (!canManage(scope, assigneeId)) {
         throw new ForbiddenException('اجازه تعریف روتین برای این کاربر را ندارید');