Revert 253c922: restore the PM/RBAC work to the integration
Reverting the production revert so the pm branch can merge cleanly on top of the restored RBAC base. Conflicts against newer integration work resolved by combining: - App.tsx: v7's bot-draft wizard bypass + login returnUrl kept alongside the supervisor gating (no-project block screen, panel scoping) - LoginPage: returnUrl navigation kept, supervisor routing added - migration.sql: bot_drafts table kept, unified-projects ALTERs restored
This commit is contained in:
MMD
@@ -17,7 +17,7 @@ import uuid
|
||||
|
||||
import httpx
|
||||
from fastapi import APIRouter, Depends
|
||||
from sqlalchemy import select, update
|
||||
from sqlalchemy import select, update, text
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.auth import UserContext, get_current_user, require_role
|
||||
@@ -41,6 +41,8 @@ USER_ROLE_LABELS = {
|
||||
"pm": "مدیر پروژه",
|
||||
"procurement_manager": "مدیر تدارکات",
|
||||
"admin": "ادمین",
|
||||
# کاربر فقطِ پنل مدیریت پروژه (PM) — به انبار/تدارکات دسترسی ندارد
|
||||
"supervisor": "سرپرست پروژه",
|
||||
}
|
||||
|
||||
|
||||
@@ -52,6 +54,7 @@ def user_to_dict(user: User, projects: list[Project] | None = None) -> dict:
|
||||
return {
|
||||
"id": str(user.id),
|
||||
"casdoor_id": user.casdoor_id,
|
||||
"username": user.username,
|
||||
"first_name": user.first_name,
|
||||
"last_name": user.last_name,
|
||||
"phone": user.phone,
|
||||
@@ -65,15 +68,15 @@ def user_to_dict(user: User, projects: list[Project] | None = None) -> dict:
|
||||
|
||||
|
||||
async def _org_manager(ctx: UserContext = Depends(get_current_user)) -> UserContext:
|
||||
"""Admin OR procurement manager (the same person) — organization management."""
|
||||
if ctx.role not in ("admin", "procurement_manager"):
|
||||
"""Admin, procurement manager, or project manager — organization management."""
|
||||
if ctx.role not in ("admin", "procurement_manager", "pm"):
|
||||
raise ForbiddenError("دسترسی به این بخش برای نقش شما مجاز نیست")
|
||||
return ctx
|
||||
|
||||
|
||||
async def _user_projects(db: AsyncSession, user: User) -> list[Project]:
|
||||
"""Every project the user manages as PM (oldest first; [] for non-PMs)."""
|
||||
if user.role != "pm":
|
||||
"""Every project assigned to the user (supervisor or PM) (oldest first)."""
|
||||
if user.role not in ("supervisor", "pm"):
|
||||
return []
|
||||
rows = (
|
||||
await db.execute(
|
||||
@@ -148,13 +151,13 @@ async def list_users(
|
||||
):
|
||||
"""Every user (with role + assigned projects) — Organization panel."""
|
||||
users = (await db.execute(select(User).order_by(User.created_at))).scalars().all()
|
||||
pm_ids = {u.id for u in users if u.role == "pm"}
|
||||
supervisor_ids = {u.id for u in users if u.role in ("supervisor", "pm")}
|
||||
by_user: dict = {}
|
||||
if pm_ids:
|
||||
if supervisor_ids:
|
||||
projs = (
|
||||
await db.execute(
|
||||
select(Project)
|
||||
.where(Project.pm_user_id.in_(pm_ids))
|
||||
.where(Project.pm_user_id.in_(supervisor_ids))
|
||||
.order_by(Project.created_at, Project.id)
|
||||
)
|
||||
).scalars().all()
|
||||
@@ -204,7 +207,7 @@ async def update_user_role(
|
||||
if user is None:
|
||||
raise NotFoundError("کاربر یافت نشد")
|
||||
previous_role = user.role
|
||||
if user.role == "pm" and payload.role != "pm":
|
||||
if user.role in ("supervisor", "pm") and payload.role not in ("supervisor", "pm"):
|
||||
await _unassign_projects(db, user.id)
|
||||
user.role = payload.role
|
||||
await db.flush()
|
||||
@@ -231,8 +234,15 @@ async def sync_casdoor_users(
|
||||
continue
|
||||
existing = await db.scalar(select(User).where(User.casdoor_id == cid))
|
||||
if existing is None:
|
||||
uname = str(cu.get("name") or cu.get("preferred_username") or "") or None
|
||||
if uname:
|
||||
by_uname = await db.scalar(select(User).where(User.username == uname))
|
||||
if by_uname is not None:
|
||||
by_uname.casdoor_id = cid
|
||||
continue
|
||||
db.add(User(
|
||||
casdoor_id=cid,
|
||||
username=uname,
|
||||
first_name=str(
|
||||
cu.get("firstName")
|
||||
or cu.get("displayName")
|
||||
@@ -243,16 +253,20 @@ async def sync_casdoor_users(
|
||||
phone=str(cu.get("phone") or "") or None,
|
||||
))
|
||||
created += 1
|
||||
elif not existing.username:
|
||||
uname = str(cu.get("name") or cu.get("preferred_username") or "") or None
|
||||
if uname:
|
||||
existing.username = uname
|
||||
await db.flush()
|
||||
|
||||
users = (await db.execute(select(User).order_by(User.created_at))).scalars().all()
|
||||
pm_ids = {u.id for u in users if u.role == "pm"}
|
||||
supervisor_ids = {u.id for u in users if u.role in ("supervisor", "pm")}
|
||||
by_user: dict = {}
|
||||
if pm_ids:
|
||||
if supervisor_ids:
|
||||
projs = (
|
||||
await db.execute(
|
||||
select(Project)
|
||||
.where(Project.pm_user_id.in_(pm_ids))
|
||||
.where(Project.pm_user_id.in_(supervisor_ids))
|
||||
.order_by(Project.created_at, Project.id)
|
||||
)
|
||||
).scalars().all()
|
||||
@@ -282,11 +296,16 @@ async def assign_user_project(
|
||||
user = await db.get(User, user_id)
|
||||
if user is None:
|
||||
raise NotFoundError("کاربر یافت نشد")
|
||||
if user.role != "pm":
|
||||
raise ValidationError("ابتدا نقش این کاربر را «مدیر پروژه» کنید", field="role")
|
||||
if user.role not in ("supervisor", "pm"):
|
||||
raise ValidationError("ابتدا نقش این کاربر را «سرپرست پروژه» کنید", field="role")
|
||||
|
||||
if payload.project_id is None:
|
||||
await _unassign_projects(db, user.id)
|
||||
if user.username:
|
||||
await db.execute(
|
||||
text("DELETE FROM project_assignments WHERE user_id IN (SELECT id FROM pm_users WHERE username = :uname)"),
|
||||
{"uname": user.username}
|
||||
)
|
||||
await db.flush()
|
||||
return {"data": user_to_dict(user)}
|
||||
|
||||
@@ -294,5 +313,19 @@ async def assign_user_project(
|
||||
if project is None:
|
||||
raise NotFoundError("پروژه یافت نشد", field="project_id")
|
||||
project.pm_user_id = user.id
|
||||
if user.username:
|
||||
await db.execute(
|
||||
text("""
|
||||
INSERT INTO project_assignments (id, user_id, project_id)
|
||||
SELECT gen_random_uuid(), pu.id, :pid
|
||||
FROM pm_users pu
|
||||
WHERE pu.username = :uname
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM project_assignments pa
|
||||
WHERE pa.user_id = pu.id AND pa.project_id = :pid
|
||||
)
|
||||
"""),
|
||||
{"pid": project.id, "uname": user.username}
|
||||
)
|
||||
await db.flush()
|
||||
return {"data": user_to_dict(user, await _user_projects(db, user))}
|
||||
|
||||
Reference in New Issue
Block a user