Allow partners to add staff or branch managers

app/modules/employees/ui.py

@@ -328,10 +328,17 @@ def _form_options(db, current_user, scope, *, include_user_id: int | None = None
     users = list_linkable_users(db, scope, include_user_id=include_user_id)
     partner_staff_mode = bool(scope.is_partner and not scope.is_system_admin and not scope.is_firm_admin)
 
-    # A Partner may onboard or link Staff users only. The service layer repeats
-    # this rule so a forged POST cannot bypass the form restriction.
+    # A Partner may onboard or link only Staff and Branch Manager users. The
+    # service layer repeats this rule so a forged POST cannot bypass the form.
     if partner_staff_mode:
-        users = [user for user in users if "Staff" in set(get_user_roles(db, user.id))]
+        allowed_roles = {"Staff", "Branch Manager"}
+        prohibited_roles = {"System Admin", "Firm Admin", "Partner"}
+        users = [
+            user
+            for user in users
+            if set(get_user_roles(db, user.id)).intersection(allowed_roles)
+            and not set(get_user_roles(db, user.id)).intersection(prohibited_roles)
+        ]
 
     return {
         "tenants": visible_tenants(db, current_user),
@@ -601,7 +608,8 @@ async def employee_create_submit(request: Request):
         scope = build_employee_scope(db, current_user, tenant_id=form.get("tenant_id"), branch_id=form.get("branch_id"))
         payload = _form_payload(form, include_context=True)
         if scope.is_partner and not scope.is_system_admin and not scope.is_firm_admin:
-            payload["employee_role"] = "Staff"
+            requested_role = (payload.get("employee_role") or "Staff").strip()
+            payload["employee_role"] = requested_role if requested_role in {"Staff", "Branch Manager"} else "Staff"
             payload["tenant_id"] = scope.tenant_id
             payload["branch_id"] = scope.branch_id or current_user.branch_id
         try: