add permission check for form productor and product

backend/src/forms/service.py

@@ -108,12 +108,25 @@ def delete_one(session: Session, _id: int) -> models.FormPublic:
     return result
 
 
-def is_allowed(session: Session, user: models.User, _id: int) -> bool:
+def is_allowed(
+    session: Session, 
+    user: models.User, 
+    _id: int = None, 
+    form: models.FormCreate = None
+) -> bool:
+    if not _id:
+        statement = (
+            select(models.Productor)
+            .where(models.Productor.id == form.productor_id)
+        )
+        productor = session.exec(statement).first()
+        return productor.type in [r.name for r in user.roles]
     statement = (
         select(models.Form)
         .join(
             models.Productor,
-            models.Form.productor_id == models.Productor.id)
+            models.Form.productor_id == models.Productor.id
+        )
         .where(models.Form.id == _id)
         .where(
             models.Productor.type.in_(