Phase 2 fix remaining RBAC safe responses and work route aliases

app/modules/documents/ui.py

@@ -904,8 +904,19 @@ def partner_branch_storage_dashboard(request: Request):
 
     It intentionally reuses the same storage node data model and keeps the full
     Storage Nodes screen intact. Partner/Branch Manager users are automatically
-    scoped to their own branch.
+    scoped to their own branch. Staff users receive a clear 403 instead of a
+    generic dashboard page.
     """
+    db = CommonSessionLocal()
+    try:
+        user, response = _require_user(request, db, "documents.view")
+        if response:
+            return response
+        scope = build_document_scope(request, db, user)
+        if not _can_manage_branch_storage(scope):
+            return _redirect_denied()
+    finally:
+        db.close()
     return storage_nodes(request)