fix(activities): keep comment and postpone open for assignees under creator-only edit

Allow dueAt/description patches for collaborators when editPolicy is creator-only, and show the no-edit warning only when they try to change locked fields—not as a permanent banner.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/activities/activities.service.ts

@@ -83,6 +83,26 @@ function canMutateActivity(
   return assigneeIdList(row).includes(actor.userId);
 }
 
+/** ثبت نظر / تعویق — برای همهٔ مسئولان، حتی وقتی ویرایش فقط با ایجادکننده است */
+function canCollaborateActivity(
+  actor: { userId: string; role: string },
+  row: {
+    createdById?: string | null;
+    assigneeId?: string | null;
+    assignees?: Array<{ id: string }>;
+  },
+): boolean {
+  if (actor.role === 'owner' || actor.role === 'admin') return true;
+  if (row.createdById && actor.userId === row.createdById) return true;
+  return assigneeIdList(row).includes(actor.userId);
+}
+
+/** فقط dueAt / description → تعویق و ثبت نظر */
+function isCollaboratorPatch(dto: UpdateActivityRequest): boolean {
+  const keys = Object.keys(dto);
+  return keys.length > 0 && keys.every((key) => key === 'dueAt' || key === 'description');
+}
+
 function reconcileAllShares(assigneeIds: string[], completedByIds: string[]) {
   const kept = [...new Set(completedByIds.filter((id) => assigneeIds.includes(id)))];
   const done = assigneeIds.length > 0 && assigneeIds.every((id) => kept.includes(id));
@@ -836,7 +856,15 @@ export class ActivitiesService {
         assignees: { select: { id: true } },
       },
     });
-    if (!existing || !canMutateActivity(actor, existing)) {
+    if (!existing) {
+      throw new ForbiddenException('شما مجوز ویرایش این فعالیت را ندارید');
+    }
+    const collabOnly = isCollaboratorPatch(dto);
+    if (collabOnly) {
+      if (!canCollaborateActivity(actor, existing)) {
+        throw new ForbiddenException('شما مجوز ثبت نظر یا تعویق این فعالیت را ندارید');
+      }
+    } else if (!canMutateActivity(actor, existing)) {
       throw new ForbiddenException('شما مجوز ویرایش این فعالیت را ندارید');
     }
     const data: Prisma.ActivityUncheckedUpdateInput = {};