Allow partners to securely add staff

app/modules/employees/ui.py

@@ -325,12 +325,21 @@ def _form_payload(form, *, include_context: bool = False):
 
 
 def _form_options(db, current_user, scope, *, include_user_id: int | None = None):
+    users = list_linkable_users(db, scope, include_user_id=include_user_id)
+    partner_staff_mode = bool(scope.is_partner and not scope.is_system_admin and not scope.is_firm_admin)
+
+    # A Partner may onboard or link Staff users only. The service layer repeats
+    # this rule so a forged POST cannot bypass the form restriction.
+    if partner_staff_mode:
+        users = [user for user in users if "Staff" in set(get_user_roles(db, user.id))]
+
     return {
         "tenants": visible_tenants(db, current_user),
         "branches": visible_branches(db, current_user, scope.tenant_id),
-        "users": list_linkable_users(db, scope, include_user_id=include_user_id),
+        "users": users,
         "managers": list_reporting_managers(db, scope),
         "scope": scope,
+        "partner_staff_mode": partner_staff_mode,
     }
 
 
@@ -563,7 +572,7 @@ def employee_new(request: Request):
             "modules/employees/templates/employees/form.html",
             db,
             current_user,
-            title="Add Employee",
+            title="Add Staff" if scope.is_partner else "Add Employee",
             employee=None,
             errors=[],
             mode="create",
@@ -591,6 +600,10 @@ async def employee_create_submit(request: Request):
             return _redirect_denied()
         scope = build_employee_scope(db, current_user, tenant_id=form.get("tenant_id"), branch_id=form.get("branch_id"))
         payload = _form_payload(form, include_context=True)
+        if scope.is_partner and not scope.is_system_admin and not scope.is_firm_admin:
+            payload["employee_role"] = "Staff"
+            payload["tenant_id"] = scope.tenant_id
+            payload["branch_id"] = scope.branch_id or current_user.branch_id
         try:
             emp = create_employee(db, current_user, scope, payload)
             return RedirectResponse(url=f"/employees/{emp.id}", status_code=303)
@@ -600,7 +613,7 @@ async def employee_create_submit(request: Request):
                 "modules/employees/templates/employees/form.html",
                 db,
                 current_user,
-                title="Add Employee",
+                title="Add Staff" if scope.is_partner else "Add Employee",
                 employee=payload,
                 errors=[getattr(exc, "detail", str(exc))],
                 mode="create",