feat: add modal-edit permissions for projects milestones and tasks

app/api/routers/projects.py

@@ -10,7 +10,7 @@ from app.models import models
 from app.models.role_permission import Role
 from app.schemas import schemas
 from app.api.deps import get_current_user_or_apikey
-from app.api.rbac import check_project_role, check_permission
+from app.api.rbac import check_project_role, check_permission, ensure_can_edit_project
 
 router = APIRouter(prefix="/projects", tags=["Projects"])
 
@@ -197,10 +197,10 @@ def update_project(
     db: Session = Depends(get_db),
     current_user: models.User = Depends(get_current_user_or_apikey),
 ):
-    check_project_role(db, current_user.id, project_id, min_role="mgr")
     project = db.query(models.Project).filter(models.Project.id == project_id).first()
     if not project:
         raise HTTPException(status_code=404, detail="Project not found")
+    ensure_can_edit_project(db, current_user.id, project)
     update_data = project_update.model_dump(exclude_unset=True)
     update_data.pop("name", None)
     if "sub_projects" in update_data and update_data["sub_projects"]: