improve permissison handling in invoice screen (#2965)

src/Voter/CustomerVoter.php

@@ -34,6 +34,7 @@ final class CustomerVoter extends Voter
         'comments',
         'comments_create',
         'details',
+        'access',
     ];
 
     private $permissionManager;
@@ -75,6 +76,22 @@ final class CustomerVoter extends Voter
             return false;
         }
 
+        // this is a virtual permission, only meant to be used by developer
+        // it checks if access to the given customer is potentially possible
+        if ($attribute === 'access') {
+            if ($subject->getTeams()->count() === 0) {
+                return true;
+            }
+
+            foreach ($subject->getTeams() as $team) {
+                if ($user->isInTeam($team)) {
+                    return true;
+                }
+            }
+
+            return false;
+        }
+
         if ($this->permissionManager->hasRolePermission($user, $attribute . '_customer')) {
             return true;
         }

src/Voter/UserVoter.php

@@ -29,7 +29,6 @@ final class UserVoter extends Voter
         'preferences',
         'api-token',
         'hourly-rate',
-        // teams_own_profile could be merged with view_team_member
         'view_team_member',
     ];