feat: permissions modal — replace folder dropdown with per-list checkboxes; fix savePermissions body

portal/templates/app/project.html

@@ -262,12 +262,15 @@
           <span class="text-sm text-[#94a3b8]">Edit request lists</span>
           <input type="checkbox" id="pmEditLists" class="w-4 h-4 accent-[#c9a84c]">
         </div>
-        <div class="flex items-center justify-between">
+        <div>
-          <span class="text-sm text-[#94a3b8]">Folder access</span>
+          <div class="flex items-center justify-between mb-2">
-          <select id="pmFolderAccess" class="px-3 py-1.5 bg-[#0a1628] border border-white/[0.08] rounded-lg text-white text-xs focus:outline-none focus:border-[#c9a84c]">
+            <span class="text-sm text-[#94a3b8]">Visible request lists</span>
-            <option value="assigned">Assigned lists only</option>
+            <label class="flex items-center gap-1.5 text-xs text-[#94a3b8] cursor-pointer">
-            <option value="all">All request lists</option>
+              <input type="checkbox" id="pmAllLists" class="w-3.5 h-3.5 accent-[#c9a84c]" onchange="toggleAllLists(this.checked)">
-          </select>
+              All lists
+            </label>
+          </div>
+          <div id="pmListChecks" class="space-y-1.5 max-h-40 overflow-y-auto pr-1"></div>
         </div>
       </div>
       <div class="p-6 border-t border-white/[0.08] flex gap-3">
@@ -997,7 +1000,13 @@
                   ${perms.upload ? '<span>📤 Upload</span>' : ''}
                   ${perms.add_request_lists ? '<span>➕ Add lists</span>' : ''}
                   ${perms.edit_request_lists ? '<span>✏️ Edit lists</span>' : ''}
-                  <span>${perms.folder_access === 'all' ? '📂 All folders' : '📂 Assigned only'}</span>
+                  <span>${(() => {
+                    const vl = perms.visible_lists;
+                    if (!vl || vl === 'all') return '📂 All lists';
+                    if (Array.isArray(vl) && vl.length === 0) return '📂 No lists';
+                    if (Array.isArray(vl)) return '📂 ' + vl.length + ' list' + (vl.length > 1 ? 's' : '');
+                    return '📂 All lists';
+                  })()}</span>
                 </div>
               </div>
               <button onclick="openPermModalById('${o.deal_org_id}')"
@@ -1253,7 +1262,6 @@
           await fetchAPI('/api/projects/' + projectID + '/entries/' + added.deal_org_id, {
             method: 'PUT',
             body: JSON.stringify({
-              project_id: projectID, parent_id: projectID, type: 'deal_org', depth: 1,
               data: JSON.stringify({ org_id: orgId, role, domain_lock: false, permissions: perms, members }),
               version: 1
             })
@@ -1290,12 +1298,33 @@
       document.getElementById('pmUpload').checked = !!perms.upload;
       document.getElementById('pmAddLists').checked = !!perms.add_request_lists;
       document.getElementById('pmEditLists').checked = !!perms.edit_request_lists;
-      document.getElementById('pmFolderAccess').value = perms.folder_access || 'assigned';
+
+      // Populate request list checkboxes
+      const visibleLists = perms.visible_lists || null; // null = all
+      const allChecked = visibleLists === null || visibleLists === 'all';
+      document.getElementById('pmAllLists').checked = allChecked;
+      const lists = treeData.filter(t => t.type === 'request_list');
+      const container = document.getElementById('pmListChecks');
+      container.innerHTML = lists.map(l => {
+        const name = (l.data && l.data.name) ? l.data.name : 'Request List';
+        const checked = allChecked || (Array.isArray(visibleLists) && visibleLists.includes(l.entry_id));
+        return `<label class="flex items-center gap-2 text-sm text-white cursor-pointer">
+          <input type="checkbox" class="pm-list-check w-3.5 h-3.5 accent-[#c9a84c]" value="${l.entry_id}" ${checked ? 'checked' : ''}>
+          ${escHtml(name)}
+        </label>`;
+      }).join('');
+      container.style.display = allChecked ? 'none' : 'block';
       document.getElementById('permModal').classList.remove('hidden');
     }
 
     function closePermModal() { document.getElementById('permModal').classList.add('hidden'); }
 
+    function toggleAllLists(checked) {
+      const container = document.getElementById('pmListChecks');
+      container.style.display = checked ? 'none' : 'block';
+      document.querySelectorAll('.pm-list-check').forEach(cb => cb.checked = checked);
+    }
+
     async function savePermissions() {
       const dealOrgId = document.getElementById('permModalDealOrgId').value;
       const orgId = document.getElementById('permModalOrgId').value;
@@ -1306,13 +1335,14 @@
         upload: document.getElementById('pmUpload').checked,
         add_request_lists: document.getElementById('pmAddLists').checked,
         edit_request_lists: document.getElementById('pmEditLists').checked,
-        folder_access: document.getElementById('pmFolderAccess').value,
+        visible_lists: document.getElementById('pmAllLists').checked
+          ? 'all'
+          : Array.from(document.querySelectorAll('.pm-list-check:checked')).map(cb => cb.value),
       };
       try {
         await fetchAPI('/api/projects/' + projectID + '/entries/' + dealOrgId, {
           method: 'PUT',
           body: JSON.stringify({
-            project_id: projectID, parent_id: projectID, type: 'deal_org', depth: 1,
             data: JSON.stringify({ org_id: orgId, role, domain_lock: false, permissions: perms }),
             version
           })