Enforce partner client ownership and partner-scoped imports

app/modules/clients/access.py

@@ -47,6 +47,21 @@ def build_scope(request, user, permission_checker):
     )
 
 
+
+def is_partner_role(role_names) -> bool:
+    names = {str(name).strip().lower() for name in (role_names or [])}
+    return "partner" in names and "firm admin" not in names and "system admin" not in names
+
+
+def enforce_partner_scope(scope: ClientAccessScope, *, user, role_names) -> ClientAccessScope:
+    if is_partner_role(role_names):
+        scope.allow_all_clients = False
+        scope.own_only = True
+        scope.locked_partner_id = int(user.id)
+        scope.can_assign_partner = False
+    return scope
+
+
 def effective_partner_id(row: dict):
     return row.get("assoc_partner_user_id") or row.get("partner_id")
 
@@ -71,6 +86,6 @@ def can_view_client_row(scope: ClientAccessScope, row: dict, *, user_id: int) ->
         return False
 
     if scope.own_only and scope.locked_partner_id and effective_partner_id(row) != scope.locked_partner_id:
-        return False
+        return bool(row.get("has_review_access"))
 
     return True