Enforce partner client ownership and partner-scoped imports

app/modules/clients/service.py

@@ -30,16 +30,15 @@ from app.modules.core.iam.models import User
 from app.modules.core.rbac.models import Role, UserRole
 from app.modules.documents.models import PermanentClientDocument
 from app.modules.consultants.service import sync_primary_client_consultant_link
-
 from app.modules.clients.models import Client
 
 
 
-
 def _get_client_group(*args, **kwargs):
-    # Imported lazily to prevent clients ↔ client_groups circular imports.
     from app.modules.client_groups.service import get_group
     return get_group(*args, **kwargs)
+
+
 def _payload_from_schema(data):
     payload = data.model_dump(exclude_none=True) if hasattr(data, "model_dump") else data.dict(exclude_none=True)
     # primary_consultant_id belongs to ClientConsultantLink, not the clients table.
@@ -367,6 +366,8 @@ def get_client_or_404(
     branch_id: int | None,
     allow_cross_branch: bool,
     allow_all_clients: bool = False,
+    viewer_partner_id: int | None = None,
+    allow_review_access: bool = False,
 ):
     row = repository.get_client_by_id(db, client_id)
     if not row:
@@ -375,6 +376,11 @@ def get_client_or_404(
         raise HTTPException(status_code=404, detail="Client not found in current tenant.")
     if not allow_all_clients and not allow_cross_branch and branch_id and row.branch_id != branch_id:
         raise HTTPException(status_code=404, detail="Client not found in current branch.")
+    if viewer_partner_id is not None and int(row.partner_id or 0) != int(viewer_partner_id):
+        if not allow_review_access or not repository.has_partner_review_access(
+            db, tenant_id=tenant_id, client_id=client_id, partner_user_id=viewer_partner_id
+        ):
+            raise HTTPException(status_code=404, detail="Client not found.")
     return row