Add invite_users permission to PM/Dispatcher/Sales Manager roles for bulk invites

docs/features/bulk-invitations.md

@@ -166,8 +166,10 @@ Template types:
 
 ## Authorization
 
+All roles with `invite_users` permission can use bulk invitations:
+
 **Platform Admin:**
-- Can bulk invite to any context
+- Can bulk invite to any context (organization or project)
 
 **Client Admin:**
 - Can bulk invite to their client organization only
@@ -177,9 +179,17 @@ Template types:
 
 **Project Manager:**
 - Can bulk invite to their own projects
+- Must invite to their contractor's organization
+
+**Dispatcher:**
+- Can bulk invite to projects in their contractor
+- Must invite to their contractor's organization
 
-**Dispatcher/Sales Manager:**
+**Sales Manager:**
 - Can bulk invite to projects in their contractor
+- Must invite to their contractor's organization
+
+**Note:** Service-level authorization validates that users can only invite within their scope (own organization/projects)
 
 ## Tracking
 

src/app/core/permissions.py

@@ -124,6 +124,7 @@ ROLE_PERMISSIONS: Dict[AppRole, List[str]] = {
     AppRole.PROJECT_MANAGER: [
         # User Management
         "view_users",
+        "invite_users",        # Can invite users to their projects
         "manage_org_users",    # Can manage users in their organization
         "reset_user_password", # Can reset passwords for users in their org
         "view_team_performance",
@@ -155,6 +156,7 @@ ROLE_PERMISSIONS: Dict[AppRole, List[str]] = {
     AppRole.DISPATCHER: [
         # User Management
         "view_users",
+        "invite_users",        # Can invite users to projects in their contractor
         "manage_org_users",    # Can manage users in their organization
         "reset_user_password", # Can reset passwords for users in their org
         "view_agent_locations",
@@ -209,6 +211,7 @@ ROLE_PERMISSIONS: Dict[AppRole, List[str]] = {
     AppRole.SALES_MANAGER: [
         # User Management
         "view_users",
+        "invite_users",        # Can invite users to projects in their contractor
         "manage_org_users",    # Can manage users in their organization
         "reset_user_password", # Can reset passwords for users in their org
         "manage_sales_agents",