feat(pm): multi-project PMs (1:N) with project switching, scoping validation and org multi-select
Task 1 — PM 1:N + access-loss handling:
- projects.pm_user_id had no UNIQUE constraint (verified live + in schema); added a lookup index via init_db
- auth: UserContext.project_ids = every project of a PM (oldest first); project_id stays the first for compatibility
- GET /users/me/projects — assigned projects of the caller (drives the switcher + revocation validation)
- login / /users/me / /users list now return the full projects array per user
- /inventory/* and /pm/* scopes accept an explicit ?project_id=… and verify the PM manages it (403 otherwise); without the param they fall back to the first project; admin/manager use it as an optional filter
- POST /users/{id}/project is multi-aware: assigns one project (replacing that project's previous PM) and KEEPS the user's other assignments; null clears all
- PATCH /projects/{id} accepts pm_user_id (admin / procurement manager only)
- frontend: auth store holds projects + the active project (persisted via the existing localStorage store); RequirePmProjects re-validates on load, falls back when the active project was revoked, and shows a dedicated no-projects screen with logout (no redirect loop, no re-auth)
- Panels menu: «مدیریت انبار» gets a ChevronDown accordion listing the PM's projects with «✓ فعلی»; selecting one switches only the active project and reloads the section data
- inventory/pm API calls now send the active project_id explicitly
Task 2 — Organization page:
- new searchable ProjectMultiSelect combobox (chips with ×, live Persian filtering via normalize, assigned projects hidden) replaces the single select for PM users
- add = PATCH project pm_user_id=<user>; × = pm_user_id=null; table and project cards sync immediately; RBAC unchanged (role column admin-only, combobox editable for admin + procurement manager)
Verified locally: 17 scripted checks — multi-project assignment without unique conflicts, /users/me/projects, explicit project_id authorization (foreign project 403 on /inventory, /pm/on-the-way, /pm/receipts), PM blocked from pm_user_id changes, legacy assign endpoint keeps other assignments, revocation removes the project from the list, zero-project PM gets an empty list and a guarded inventory endpoint. All test data cleaned up afterwards.
This commit is contained in:
+34
-7
@@ -103,15 +103,17 @@ async def _verify_token(token: str) -> dict:
|
||||
class UserContext:
|
||||
user: User
|
||||
role: str | None
|
||||
project_id: object | None # uuid.UUID | None
|
||||
project_id: object | None # uuid.UUID | None — default (first) project of a PM
|
||||
project_ids: list # every project this PM manages (1:N — empty for non-PMs)
|
||||
display_name: str
|
||||
|
||||
|
||||
async def context_from_claims(claims: dict, db: AsyncSession) -> UserContext:
|
||||
"""Auto-provision the `users` row from token claims; resolve role + PM project.
|
||||
"""Auto-provision the `users` row from token claims; resolve role + PM projects.
|
||||
|
||||
First login: creates the row with role NULL (an admin assigns it later).
|
||||
PMs: resolves their single project via projects.pm_user_id.
|
||||
PMs: resolves EVERY project they manage (projects.pm_user_id = user);
|
||||
`project_id` stays the first one (oldest) for backward compatibility.
|
||||
"""
|
||||
casdoor_id = str(claims.get("sub") or claims.get("id") or "")
|
||||
if not casdoor_id:
|
||||
@@ -134,13 +136,38 @@ async def context_from_claims(claims: dict, db: AsyncSession) -> UserContext:
|
||||
db.add(user)
|
||||
await db.flush()
|
||||
|
||||
project_id = None
|
||||
project_ids: list = []
|
||||
if user.role == "pm":
|
||||
project = await db.scalar(select(Project).where(Project.pm_user_id == user.id))
|
||||
project_id = project.id if project else None
|
||||
projects = (
|
||||
await db.execute(
|
||||
select(Project)
|
||||
.where(Project.pm_user_id == user.id)
|
||||
.order_by(Project.created_at, Project.id)
|
||||
)
|
||||
).scalars().all()
|
||||
project_ids = [p.id for p in projects]
|
||||
project_id = project_ids[0] if project_ids else None
|
||||
|
||||
display_name = f"{user.first_name} {user.last_name}".strip() or user.casdoor_id
|
||||
return UserContext(user=user, role=user.role, project_id=project_id, display_name=display_name)
|
||||
return UserContext(
|
||||
user=user,
|
||||
role=user.role,
|
||||
project_id=project_id,
|
||||
project_ids=project_ids,
|
||||
display_name=display_name,
|
||||
)
|
||||
|
||||
|
||||
async def pm_project_ids(db: AsyncSession, user: User) -> list:
|
||||
"""Every project id managed by the given PM user (oldest first)."""
|
||||
rows = (
|
||||
await db.execute(
|
||||
select(Project.id)
|
||||
.where(Project.pm_user_id == user.id)
|
||||
.order_by(Project.created_at, Project.id)
|
||||
)
|
||||
).scalars().all()
|
||||
return list(rows)
|
||||
|
||||
|
||||
async def get_optional_user(request: Request, db: AsyncSession) -> UserContext | None:
|
||||
|
||||
@@ -302,6 +302,11 @@ _V26_DDL = [
|
||||
"""
|
||||
CREATE INDEX IF NOT EXISTS idx_suppliers_category_id ON suppliers(category_id)
|
||||
""",
|
||||
# PM → projects is 1:N (a PM may manage several projects). No UNIQUE on
|
||||
# pm_user_id — just a lookup index for "projects of this PM" queries.
|
||||
"""
|
||||
CREATE INDEX IF NOT EXISTS idx_projects_pm_user_id ON projects(pm_user_id)
|
||||
""",
|
||||
# supplier_materials (v2.5) + its triggers (functions are CREATE OR REPLACE below).
|
||||
"""
|
||||
CREATE TABLE IF NOT EXISTS supplier_materials (
|
||||
|
||||
@@ -20,7 +20,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
|
||||
from app.auth import _verify_token, context_from_claims
|
||||
from app.config import settings
|
||||
from app.db.engine import get_db
|
||||
from app.routers.users import _user_project, user_to_dict
|
||||
from app.routers.users import _user_projects, user_to_dict
|
||||
from app.utils.errors import ServiceUnavailableError, UnauthorizedError
|
||||
|
||||
logger = logging.getLogger("procurement.auth")
|
||||
@@ -74,12 +74,12 @@ async def login(payload: LoginRequest, db: AsyncSession = Depends(get_db)):
|
||||
# the app-side user (auto-provision on first login).
|
||||
claims = await _verify_token(access_token)
|
||||
ctx = await context_from_claims(claims, db)
|
||||
project = await _user_project(db, ctx.user) if ctx.role == "pm" else None
|
||||
projects = await _user_projects(db, ctx.user)
|
||||
return {
|
||||
"data": {
|
||||
"access_token": access_token,
|
||||
"token_type": "bearer",
|
||||
"expires_in": body.get("expires_in"),
|
||||
"user": user_to_dict(ctx.user, project),
|
||||
"user": user_to_dict(ctx.user, projects),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -59,10 +59,18 @@ class Scope:
|
||||
actor: str | None
|
||||
|
||||
|
||||
async def inventory_scope(request: Request, db: AsyncSession = Depends(get_db)) -> Scope:
|
||||
"""Resolve the caller role/project — Casdoor JWT first, dev headers as fallback."""
|
||||
# Primary path: Casdoor JWT. Role from users.role; PM project from
|
||||
# projects.pm_user_id (single PM per project).
|
||||
async def inventory_scope(
|
||||
request: Request,
|
||||
project_id: uuid.UUID | None = Query(default=None, description="پروژه فعال (PM: دادههای همین پروژه)"),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
) -> Scope:
|
||||
"""Resolve the caller role/project — Casdoor JWT first, dev headers as fallback.
|
||||
|
||||
The active project is explicit via `?project_id=…`. For a PM the backend
|
||||
verifies they manage that project (projects.pm_user_id, 1:N); without the
|
||||
param it falls back to their first assigned project. Admin / procurement
|
||||
manager may pass it as a filter (no param = all projects).
|
||||
"""
|
||||
if request.headers.get("authorization"):
|
||||
user: UserContext = await get_optional_user(request, db)
|
||||
if user is not None:
|
||||
@@ -70,16 +78,21 @@ async def inventory_scope(request: Request, db: AsyncSession = Depends(get_db))
|
||||
raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
|
||||
# v2.6: مدیر تدارکات = ادمین دفتر — دسترسی فقطخواندنی به پنل انبار.
|
||||
if user.role == "procurement_manager":
|
||||
return Scope(role="admin", project_id=None, actor=user.display_name)
|
||||
return Scope(role="admin", project_id=project_id, actor=user.display_name)
|
||||
if user.role not in ("pm", "admin"):
|
||||
raise ValidationError("نقش نامعتبر است — فقط pm یا admin برای موجودی", field="role")
|
||||
if user.role == "pm":
|
||||
if user.project_id is None:
|
||||
allowed = list(user.project_ids or [])
|
||||
if project_id is not None:
|
||||
if project_id not in allowed:
|
||||
raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
|
||||
return Scope(role="pm", project_id=project_id, actor=user.display_name)
|
||||
if not allowed:
|
||||
raise ValidationError(
|
||||
"کاربر PM به هیچ پروژهای متصل نیست (projects.pm_user_id)", field="project_id"
|
||||
)
|
||||
return Scope(role="pm", project_id=user.project_id, actor=user.display_name)
|
||||
return Scope(role="admin", project_id=None, actor=user.display_name)
|
||||
return Scope(role="pm", project_id=allowed[0], actor=user.display_name)
|
||||
return Scope(role="admin", project_id=project_id, actor=user.display_name)
|
||||
|
||||
# Dev fallback: header-based identity (fork's placeholder mode) — only
|
||||
# when an explicit X-User-Role header is sent. No auth info at all → 401.
|
||||
@@ -90,13 +103,14 @@ async def inventory_scope(request: Request, db: AsyncSession = Depends(get_db))
|
||||
role = ROLE_ADMIN # مدیر تدارکات = ادمین (فقطخواندنی)
|
||||
if role not in (ROLE_PM, ROLE_ADMIN):
|
||||
raise ValidationError("نقش نامعتبر است — فقط pm یا admin", field="X-User-Role")
|
||||
raw_project = request.headers.get("x-project-id") or settings.INVENTORY_DEFAULT_PROJECT_ID
|
||||
project_id = None
|
||||
if raw_project:
|
||||
try:
|
||||
project_id = uuid.UUID(str(raw_project))
|
||||
except ValueError:
|
||||
raise ValidationError("شناسه پروژه نامعتبر است", field="X-Project-Id")
|
||||
# The explicit query param wins; otherwise the dev header carries it.
|
||||
if project_id is None:
|
||||
raw_project = request.headers.get("x-project-id") or settings.INVENTORY_DEFAULT_PROJECT_ID
|
||||
if raw_project:
|
||||
try:
|
||||
project_id = uuid.UUID(str(raw_project))
|
||||
except ValueError:
|
||||
raise ValidationError("شناسه پروژه نامعتبر است", field="X-Project-Id")
|
||||
if role == ROLE_PM and project_id is None:
|
||||
raise ValidationError(
|
||||
"برای نقش PM هدر X-Project-Id (پروژه مسئول) الزامی است", field="X-Project-Id"
|
||||
|
||||
+30
-17
@@ -29,7 +29,7 @@ from contextlib import nullcontext
|
||||
from dataclasses import dataclass
|
||||
from decimal import Decimal
|
||||
|
||||
from fastapi import APIRouter, Depends, Request
|
||||
from fastapi import APIRouter, Depends, Query, Request
|
||||
from sqlalchemy import func, select
|
||||
from sqlalchemy.dialects.postgresql import insert as pg_insert
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
@@ -66,14 +66,20 @@ NULL_BRAND_SENTINEL = "00000000-0000-0000-0000-000000000000"
|
||||
class ArrivalScope:
|
||||
role: str # "pm" | "admin" (admin = admin or procurement_manager)
|
||||
user_id: uuid.UUID | None
|
||||
project_id: uuid.UUID | None # PM's single project; None for admin
|
||||
project_id: uuid.UUID | None # PM's active project; admin: optional filter
|
||||
display_name: str
|
||||
|
||||
|
||||
async def arrivals_scope(request: Request, db: AsyncSession = Depends(get_db)) -> ArrivalScope:
|
||||
async def arrivals_scope(
|
||||
request: Request,
|
||||
project_id: uuid.UUID | None = Query(default=None, description="پروژه فعال (PM: الزامی برای دادههای پروژه)"),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
) -> ArrivalScope:
|
||||
"""Resolve the arrivals caller — Casdoor JWT first, dev headers as fallback.
|
||||
|
||||
PM → scoped to his own project. Admin / procurement manager → all projects.
|
||||
PM → scoped to the requested project, which must be one they manage
|
||||
(projects.pm_user_id, 1:N); without the param, their first project.
|
||||
Admin / procurement manager → all projects (param = optional filter).
|
||||
"""
|
||||
if request.headers.get("authorization"):
|
||||
ctx: UserContext | None = await get_optional_user(request, db)
|
||||
@@ -81,11 +87,16 @@ async def arrivals_scope(request: Request, db: AsyncSession = Depends(get_db)) -
|
||||
if ctx.role is None:
|
||||
raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
|
||||
if ctx.role == "pm":
|
||||
if ctx.project_id is None:
|
||||
allowed = list(ctx.project_ids or [])
|
||||
if project_id is not None:
|
||||
if project_id not in allowed:
|
||||
raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
|
||||
return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
|
||||
if not allowed:
|
||||
raise ForbiddenError("شما به هیچ پروژهای متصل نیستید (projects.pm_user_id)")
|
||||
return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=ctx.project_id, display_name=ctx.display_name)
|
||||
return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=allowed[0], display_name=ctx.display_name)
|
||||
if ctx.role in ("admin", "procurement_manager"):
|
||||
return ArrivalScope(role="admin", user_id=ctx.user.id, project_id=None, display_name=ctx.display_name)
|
||||
return ArrivalScope(role="admin", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
|
||||
raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است")
|
||||
# Dev fallback: X-User-Role: pm | admin (procurement_manager maps to admin)
|
||||
if not request.headers.get("x-user-role"):
|
||||
@@ -95,8 +106,8 @@ async def arrivals_scope(request: Request, db: AsyncSession = Depends(get_db)) -
|
||||
role = "admin"
|
||||
if role not in ("pm", "admin"):
|
||||
raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است — هدر X-User-Role را بفرستید")
|
||||
project_id = None
|
||||
if role == "pm":
|
||||
# The explicit query param wins; otherwise the dev header carries it.
|
||||
if project_id is None and role == "pm":
|
||||
raw_project = request.headers.get("x-project-id")
|
||||
if not raw_project:
|
||||
raise ForbiddenError("هدر X-Project-Id (پروژه مسئول) الزامی است")
|
||||
@@ -172,9 +183,10 @@ async def pm_on_the_way(
|
||||
.outerjoin(Project, Project.id == ItemDecision.project_id)
|
||||
.where(ItemDecision.status == "chosen")
|
||||
)
|
||||
if ctx.role == "pm":
|
||||
if ctx.project_id is None:
|
||||
raise ForbiddenError("شما به هیچ پروژهای متصل نیستید (projects.pm_user_id)")
|
||||
if ctx.role == "pm" and ctx.project_id is None:
|
||||
raise ForbiddenError("شما به هیچ پروژهای متصل نیستید (projects.pm_user_id)")
|
||||
if ctx.project_id is not None:
|
||||
# PM: active project; admin/manager: optional project filter
|
||||
stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
|
||||
decisions = (await db.execute(stmt.order_by(ItemDecision.decided_at.desc().nulls_last()))).all()
|
||||
|
||||
@@ -238,8 +250,8 @@ async def pm_confirm_receipt(
|
||||
decision = await db.get(ItemDecision, payload.item_decision_id)
|
||||
if decision is None or decision.status != "chosen":
|
||||
raise NotFoundError("تصمیم خرید یافت نشد", field="item_decision_id")
|
||||
if ctx.role == "pm" and decision.project_id != ctx.project_id:
|
||||
raise ForbiddenError("این قلم متعلق به پروژه شما نیست")
|
||||
if ctx.project_id is not None and decision.project_id != ctx.project_id:
|
||||
raise ForbiddenError("این قلم متعلق به پروژه فعال نیست")
|
||||
|
||||
li = await db.get(LineItem, decision.line_item_id)
|
||||
quote = await db.get(Quote, li.quote_id)
|
||||
@@ -436,9 +448,10 @@ async def pm_receipts(
|
||||
.join(Quote, Quote.id == LineItem.quote_id)
|
||||
.join(Project, Project.id == ItemDecision.project_id)
|
||||
)
|
||||
if ctx.role == "pm":
|
||||
if ctx.project_id is None:
|
||||
raise ForbiddenError("شما به هیچ پروژهای متصل نیستید (projects.pm_user_id)")
|
||||
if ctx.role == "pm" and ctx.project_id is None:
|
||||
raise ForbiddenError("شما به هیچ پروژهای متصل نیستید (projects.pm_user_id)")
|
||||
if ctx.project_id is not None:
|
||||
# PM: active project; admin/manager: optional project filter
|
||||
stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
|
||||
rows = (await db.execute(stmt.order_by(ItemReceipt.received_at.desc()))).all()
|
||||
receipts = [r.ItemReceipt for r in rows]
|
||||
|
||||
@@ -1,19 +1,25 @@
|
||||
"""Projects CRUD + per-project stats."""
|
||||
from fastapi import APIRouter, Depends, Query
|
||||
from fastapi import APIRouter, Depends, Query, Request
|
||||
from sqlalchemy import func, or_, select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.auth import UserContext, get_optional_user
|
||||
from app.db.engine import get_db
|
||||
from app.models.procurement import Project, Quote, User
|
||||
from app.schemas.procurement import ProjectCreate, ProjectUpdate
|
||||
from app.services.quote_service import project_stats
|
||||
from app.utils.errors import ConflictError, NotFoundError
|
||||
from app.utils.errors import ConflictError, ForbiddenError, NotFoundError, ValidationError
|
||||
from app.utils.pagination import paginate, sort_query
|
||||
from app.utils.serialization import to_date, to_iso
|
||||
|
||||
router = APIRouter(prefix="/projects", tags=["projects"])
|
||||
|
||||
|
||||
async def _optional_ctx(request: Request, db: AsyncSession = Depends(get_db)) -> UserContext | None:
|
||||
"""JWT caller when present — used for RBAC on PM assignment (PATCH)."""
|
||||
return await get_optional_user(request, db)
|
||||
|
||||
|
||||
async def _pm_map(db: AsyncSession, projects: list[Project]) -> dict:
|
||||
"""project_id -> pm brief (v2.6: the single PM of the project)."""
|
||||
pm_ids = {p.pm_user_id for p in projects if p.pm_user_id}
|
||||
@@ -91,7 +97,13 @@ async def get_project(project_id, db: AsyncSession = Depends(get_db)):
|
||||
|
||||
|
||||
@router.patch("/{project_id}")
|
||||
async def update_project(project_id, payload: ProjectUpdate, db: AsyncSession = Depends(get_db)):
|
||||
async def update_project(
|
||||
project_id,
|
||||
payload: ProjectUpdate,
|
||||
request: Request,
|
||||
ctx: UserContext | None = Depends(_optional_ctx),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
project = await db.get(Project, project_id)
|
||||
if project is None:
|
||||
raise NotFoundError("پروژه یافت نشد")
|
||||
@@ -101,6 +113,21 @@ async def update_project(project_id, payload: ProjectUpdate, db: AsyncSession =
|
||||
project.description = payload.description
|
||||
if payload.start_date is not None:
|
||||
project.start_date = payload.start_date
|
||||
# PM assignment (1:N): one PM per project, a PM may own many projects.
|
||||
# Admin / procurement manager only (same rule as the Organization panel).
|
||||
if "pm_user_id" in payload.model_fields_set:
|
||||
role = ctx.role if ctx else (request.headers.get("x-user-role") or "").strip().lower()
|
||||
if role not in ("admin", "procurement_manager"):
|
||||
raise ForbiddenError("تعیین مدیر پروژه فقط برای ادمین / مدیر تدارکات مجاز است")
|
||||
if payload.pm_user_id is None:
|
||||
project.pm_user_id = None
|
||||
else:
|
||||
pm_user = await db.get(User, payload.pm_user_id)
|
||||
if pm_user is None:
|
||||
raise NotFoundError("کاربر یافت نشد", field="pm_user_id")
|
||||
if pm_user.role != "pm":
|
||||
raise ValidationError("ابتدا نقش این کاربر را «مدیر پروژه» کنید", field="pm_user_id")
|
||||
project.pm_user_id = pm_user.id
|
||||
await db.flush()
|
||||
return {"data": await project_to_dict(db, project)}
|
||||
|
||||
|
||||
@@ -1,12 +1,14 @@
|
||||
"""Users — profile + role assignment + organization management (v2.6, Casdoor-backed).
|
||||
|
||||
Organization panel endpoints (admin / procurement manager — same person):
|
||||
- GET /users — list every user with role + assigned project.
|
||||
- GET /users — list every user with role + assigned projects.
|
||||
- POST /users — define a new user (manual identity, casdoor_id optional).
|
||||
- PATCH /users/{id} — set/clear role; clearing (or switching away from
|
||||
«pm») also unassigns the user from their project.
|
||||
- POST /users/{id}/project — assign/unassign the user's single project
|
||||
(project_id=None unassigns; one PM per project).
|
||||
«pm») also unassigns the user from every project.
|
||||
- POST /users/{id}/project — assign/unassign ONE project (multi-project:
|
||||
other assignments are kept; project_id=None
|
||||
clears all; one PM per project).
|
||||
- GET /users/me/projects — every project assigned to the caller (PM).
|
||||
|
||||
Role management is open to BOTH «admin» and «procurement_manager» (they are
|
||||
the same person in this system), unlike the plain require_role("admin").
|
||||
@@ -41,7 +43,11 @@ USER_ROLE_LABELS = {
|
||||
}
|
||||
|
||||
|
||||
def user_to_dict(user: User, project: Project | None = None) -> dict:
|
||||
def user_to_dict(user: User, projects: list[Project] | None = None) -> dict:
|
||||
"""Serialize a user. `projects` = every project the PM manages (1:N);
|
||||
project_id/project_name stay as the first (oldest) one for compatibility."""
|
||||
projects = projects or []
|
||||
first = projects[0] if projects else None
|
||||
return {
|
||||
"id": str(user.id),
|
||||
"casdoor_id": user.casdoor_id,
|
||||
@@ -50,8 +56,9 @@ def user_to_dict(user: User, project: Project | None = None) -> dict:
|
||||
"phone": user.phone,
|
||||
"role": user.role,
|
||||
"role_label": USER_ROLE_LABELS.get(user.role) if user.role else None,
|
||||
"project_id": str(project.id) if project else None,
|
||||
"project_name": project.name if project else None,
|
||||
"project_id": str(first.id) if first else None,
|
||||
"project_name": first.name if first else None,
|
||||
"projects": [{"id": str(p.id), "name": p.name} for p in projects],
|
||||
"created_at": to_iso(user.created_at),
|
||||
}
|
||||
|
||||
@@ -63,14 +70,28 @@ async def _org_manager(ctx: UserContext = Depends(get_current_user)) -> UserCont
|
||||
return ctx
|
||||
|
||||
|
||||
async def _user_project(db: AsyncSession, user: User) -> Project | None:
|
||||
async def _user_projects(db: AsyncSession, user: User) -> list[Project]:
|
||||
"""Every project the user manages as PM (oldest first; [] for non-PMs)."""
|
||||
if user.role != "pm":
|
||||
return None
|
||||
return await db.scalar(select(Project).where(Project.pm_user_id == user.id))
|
||||
return []
|
||||
rows = (
|
||||
await db.execute(
|
||||
select(Project)
|
||||
.where(Project.pm_user_id == user.id)
|
||||
.order_by(Project.created_at, Project.id)
|
||||
)
|
||||
).scalars().all()
|
||||
return list(rows)
|
||||
|
||||
|
||||
async def _user_project(db: AsyncSession, user: User) -> Project | None:
|
||||
"""First (oldest) project of a PM — legacy single-project view."""
|
||||
projects = await _user_projects(db, user)
|
||||
return projects[0] if projects else None
|
||||
|
||||
|
||||
async def _unassign_projects(db: AsyncSession, user_id) -> None:
|
||||
"""Clear the user's pm assignment on every project (one project per PM)."""
|
||||
"""Clear the user's pm assignment on every project (role revocation)."""
|
||||
await db.execute(
|
||||
update(Project).where(Project.pm_user_id == user_id).values(pm_user_id=None)
|
||||
)
|
||||
@@ -104,8 +125,19 @@ async def _casdoor_users() -> list[dict]:
|
||||
|
||||
@router.get("/me")
|
||||
async def me(ctx: UserContext = Depends(get_current_user), db: AsyncSession = Depends(get_db)):
|
||||
project = await _user_project(db, ctx.user) if ctx.role == "pm" else None
|
||||
return {"data": user_to_dict(ctx.user, project)}
|
||||
projects = await _user_projects(db, ctx.user)
|
||||
return {"data": user_to_dict(ctx.user, projects)}
|
||||
|
||||
|
||||
@router.get("/me/projects")
|
||||
async def my_projects(ctx: UserContext = Depends(get_current_user), db: AsyncSession = Depends(get_db)):
|
||||
"""Every project assigned to the caller (empty list for non-PM roles).
|
||||
|
||||
Drives the PM project switcher: the frontend validates its persisted
|
||||
active project against this list and falls back gracefully when a
|
||||
project is revoked."""
|
||||
projects = await _user_projects(db, ctx.user)
|
||||
return {"data": [{"id": str(p.id), "name": p.name} for p in projects]}
|
||||
|
||||
|
||||
@router.get("")
|
||||
@@ -113,15 +145,22 @@ async def list_users(
|
||||
_: UserContext = Depends(_org_manager),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Every user (with role + assigned project) — Organization panel."""
|
||||
"""Every user (with role + assigned projects) — Organization panel."""
|
||||
users = (await db.execute(select(User).order_by(User.created_at))).scalars().all()
|
||||
pm_ids = {u.id for u in users if u.role == "pm"}
|
||||
projects: dict = {}
|
||||
by_user: dict = {}
|
||||
if pm_ids:
|
||||
projs = (await db.execute(select(Project).where(Project.pm_user_id.in_(pm_ids)))).scalars().all()
|
||||
projects = {p.pm_user_id: p for p in projs}
|
||||
projs = (
|
||||
await db.execute(
|
||||
select(Project)
|
||||
.where(Project.pm_user_id.in_(pm_ids))
|
||||
.order_by(Project.created_at, Project.id)
|
||||
)
|
||||
).scalars().all()
|
||||
for p in projs:
|
||||
by_user.setdefault(p.pm_user_id, []).append(p)
|
||||
return {
|
||||
"data": [user_to_dict(u, projects.get(u.id)) for u in users],
|
||||
"data": [user_to_dict(u, by_user.get(u.id, [])) for u in users],
|
||||
"meta": {"total": len(users)},
|
||||
}
|
||||
|
||||
@@ -166,8 +205,8 @@ async def update_user_role(
|
||||
await _unassign_projects(db, user.id)
|
||||
user.role = payload.role
|
||||
await db.flush()
|
||||
project = await _user_project(db, user)
|
||||
return {"data": user_to_dict(user, project)}
|
||||
projects = await _user_projects(db, user)
|
||||
return {"data": user_to_dict(user, projects)}
|
||||
|
||||
|
||||
@router.post("/sync")
|
||||
@@ -204,12 +243,19 @@ async def sync_casdoor_users(
|
||||
|
||||
users = (await db.execute(select(User).order_by(User.created_at))).scalars().all()
|
||||
pm_ids = {u.id for u in users if u.role == "pm"}
|
||||
projects: dict = {}
|
||||
by_user: dict = {}
|
||||
if pm_ids:
|
||||
projs = (await db.execute(select(Project).where(Project.pm_user_id.in_(pm_ids)))).scalars().all()
|
||||
projects = {p.pm_user_id: p for p in projs}
|
||||
projs = (
|
||||
await db.execute(
|
||||
select(Project)
|
||||
.where(Project.pm_user_id.in_(pm_ids))
|
||||
.order_by(Project.created_at, Project.id)
|
||||
)
|
||||
).scalars().all()
|
||||
for p in projs:
|
||||
by_user.setdefault(p.pm_user_id, []).append(p)
|
||||
return {
|
||||
"data": [user_to_dict(u, projects.get(u.id)) for u in users],
|
||||
"data": [user_to_dict(u, by_user.get(u.id, [])) for u in users],
|
||||
"meta": {"total": len(users), "created": created},
|
||||
}
|
||||
|
||||
@@ -221,11 +267,13 @@ async def assign_user_project(
|
||||
_: UserContext = Depends(_org_manager),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Assign the user as PM of one project (project_id=None unassigns).
|
||||
"""Assign the user as PM of ONE project (multi-project aware).
|
||||
|
||||
Rules: the user must hold the «pm» role; a PM manages ONE project at a
|
||||
time (assignment on other projects is cleared); assigning a new PM to a
|
||||
project replaces the previous PM there.
|
||||
- project_id given: that project gets this PM (a previous PM there is
|
||||
replaced); the user's OTHER project assignments are kept.
|
||||
- project_id=None: clears ALL of the user's project assignments.
|
||||
|
||||
Rules: the user must hold the «pm» role; a project has at most one PM.
|
||||
"""
|
||||
user = await db.get(User, user_id)
|
||||
if user is None:
|
||||
@@ -233,8 +281,8 @@ async def assign_user_project(
|
||||
if user.role != "pm":
|
||||
raise ValidationError("ابتدا نقش این کاربر را «مدیر پروژه» کنید", field="role")
|
||||
|
||||
await _unassign_projects(db, user.id)
|
||||
if payload.project_id is None:
|
||||
await _unassign_projects(db, user.id)
|
||||
await db.flush()
|
||||
return {"data": user_to_dict(user)}
|
||||
|
||||
@@ -243,4 +291,4 @@ async def assign_user_project(
|
||||
raise NotFoundError("پروژه یافت نشد", field="project_id")
|
||||
project.pm_user_id = user.id
|
||||
await db.flush()
|
||||
return {"data": user_to_dict(user, project)}
|
||||
return {"data": user_to_dict(user, await _user_projects(db, user))}
|
||||
|
||||
@@ -52,6 +52,9 @@ class ProjectUpdate(APIModel):
|
||||
name: str | None = Field(default=None, min_length=1)
|
||||
description: str | None = None
|
||||
start_date: date | None = None
|
||||
# PM assignment (1:N — one PM per project, a PM may own many projects).
|
||||
# Admin / procurement manager only; None unassigns this project's PM.
|
||||
pm_user_id: UUID | None = None
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
@@ -210,7 +213,11 @@ class UserRoleUpdate(APIModel):
|
||||
|
||||
|
||||
class UserProjectUpdate(APIModel):
|
||||
"""Assign/unassign the user's single project (project_id=None unassigns)."""
|
||||
"""Assign the user to one project (multi-project aware).
|
||||
|
||||
project_id given → that project gets this PM (previous PM replaced,
|
||||
the user's other projects kept); None → clears every assignment.
|
||||
"""
|
||||
|
||||
project_id: UUID | None = None
|
||||
|
||||
|
||||
Reference in New Issue
Block a user