fix(activities): keep comment and postpone open for assignees under creator-only edit

Allow dueAt/description patches for collaborators when editPolicy is creator-only, and show the no-edit warning only when they try to change locked fields—not as a permanent banner.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/lib/activity-access.ts

@@ -5,12 +5,22 @@ type ActivityAccessUser = {
   role?: string | null;
 } | null | undefined;
 
+type ActivityAccessRow = Pick<
+  ActivityDto,
+  'editPolicy' | 'createdBy' | 'assignee' | 'assignees'
+> | null | undefined;
+
+function isAssignee(
+  activity: NonNullable<ActivityAccessRow>,
+  userId: string,
+): boolean {
+  if (activity.assignee?.id === userId) return true;
+  return (activity.assignees ?? []).some((a) => a.id === userId);
+}
+
 /** ویرایش/حذف فیلدهای فعالیت — انجام/جابه‌جایی ستون جداست */
 export function canMutateActivity(
-  activity: Pick<
-    ActivityDto,
-    'editPolicy' | 'createdBy' | 'assignee' | 'assignees'
-  > | null | undefined,
+  activity: ActivityAccessRow,
   user: ActivityAccessUser,
 ): boolean {
   if (!activity || !user?.id) return false;
@@ -18,6 +28,16 @@ export function canMutateActivity(
   if (activity.createdBy?.id === user.id) return true;
   const policy: ActivityEditPolicy = activity.editPolicy ?? 'creator';
   if (policy !== 'assignees') return false;
-  if (activity.assignee?.id === user.id) return true;
-  return (activity.assignees ?? []).some((a) => a.id === user.id);
+  return isAssignee(activity, user.id);
+}
+
+/** ثبت نظر و تعویق برای همهٔ مسئولان (حتی وقتی ویرایش فقط با ایجادکننده است) */
+export function canCollaborateOnActivity(
+  activity: ActivityAccessRow,
+  user: ActivityAccessUser,
+): boolean {
+  if (!activity || !user?.id) return false;
+  if (user.role === 'owner' || user.role === 'admin') return true;
+  if (activity.createdBy?.id === user.id) return true;
+  return isAssignee(activity, user.id);
 }