Allow partners to securely add staff

app/modules/employees/service.py

@@ -290,6 +290,15 @@ def create_login_user_for_employee(
 
 def create_employee(db: Session, actor: User, scope: EmployeeScope, data: dict[str, Any]) -> Employee:
     cleaned = _clean_payload(data)
+    partner_staff_mode = bool(scope.is_partner and not scope.is_system_admin and not scope.is_firm_admin)
+
+    # Partners can create staff only in their own tenant and branch. Never trust
+    # tenant, branch or role values posted by the browser for this workflow.
+    if partner_staff_mode:
+        cleaned["tenant_id"] = scope.tenant_id
+        cleaned["branch_id"] = scope.branch_id or actor.branch_id
+        cleaned["employee_role"] = "Staff"
+
     tenant_id = int(cleaned.get("tenant_id") or scope.tenant_id)
     branch_id = int(cleaned.get("branch_id") or actor.branch_id)
 
@@ -311,6 +320,11 @@ def create_employee(db: Session, actor: User, scope: EmployeeScope, data: dict[s
             raise HTTPException(status_code=404, detail="Selected user was not found.")
         if linked_user.tenant_id != tenant_id or linked_user.branch_id != branch_id:
             raise HTTPException(status_code=400, detail="Selected user must belong to the employee tenant and branch.")
+        if partner_staff_mode:
+            linked_roles = _role_set(db, linked_user)
+            elevated_roles = {"System Admin", "Firm Admin", "Partner", "Branch Manager"}
+            if "Staff" not in linked_roles or linked_roles.intersection(elevated_roles):
+                raise HTTPException(status_code=403, detail="Partners can link only a Staff login user.")
         user_id = linked_user.id
     elif cleaned.get("create_login_user"):
         login_user = create_login_user_for_employee(