feat(pm): multi-project PMs (1:N) with project switching, scoping validation and org multi-select

Task 1 — PM 1:N + access-loss handling: - projects.pm_user_id had no UNIQUE constraint (verified live + in schema); added a lookup index via init_db - auth: UserContext.project_ids = every project of a PM (oldest first); project_id stays the first for compatibility - GET /users/me/projects — assigned projects of the caller (drives the switcher + revocation validation) - login / /users/me / /users list now return the full projects array per user - /inventory/* and /pm/* scopes accept an explicit ?project_id=… and verify the PM manages it (403 otherwise); without the param they fall back to the first project; admin/manager use it as an optional filter - POST /users/{id}/project is multi-aware: assigns one project (replacing that project's previous PM) and KEEPS the user's other assignments; null clears all - PATCH /projects/{id} accepts pm_user_id (admin / procurement manager only) - frontend: auth store holds projects + the active project (persisted via the existing localStorage store); RequirePmProjects re-validates on load, falls back when the active project was revoked, and shows a dedicated no-projects screen with logout (no redirect loop, no re-auth) - Panels menu: «مدیریت انبار» gets a ChevronDown accordion listing the PM's projects with «✓ فعلی»; selecting one switches only the active project and reloads the section data - inventory/pm API calls now send the active project_id explicitly Task 2 — Organization page: - new searchable ProjectMultiSelect combobox (chips with ×, live Persian filtering via normalize, assigned projects hidden) replaces the single select for PM users - add = PATCH project pm_user_id=<user>; × = pm_user_id=null; table and project cards sync immediately; RBAC unchanged (role column admin-only, combobox editable for admin + procurement manager) Verified locally: 17 scripted checks — multi-project assignment without unique conflicts, /users/me/projects, explicit project_id authorization (foreign project 403 on /inventory, /pm/on-the-way, /pm/receipts), PM blocked from pm_user_id changes, legacy assign endpoint keeps other assignments, revocation removes the project from the list, zero-project PM gets an empty list and a guarded inventory endpoint. All test data cleaned up afterwards.
2026-09-15 19:23:50 +03:30
parent 3f4bbee6de
commit 1f16e44874
18 changed files with 673 additions and 122 deletions
@@ -20,7 +20,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.auth import _verify_token, context_from_claims
 from app.config import settings
 from app.db.engine import get_db
-from app.routers.users import _user_project, user_to_dict
+from app.routers.users import _user_projects, user_to_dict
 from app.utils.errors import ServiceUnavailableError, UnauthorizedError

 logger = logging.getLogger("procurement.auth")
@@ -74,12 +74,12 @@ async def login(payload: LoginRequest, db: AsyncSession = Depends(get_db)):
    # the app-side user (auto-provision on first login).
    claims = await _verify_token(access_token)
    ctx = await context_from_claims(claims, db)
-    project = await _user_project(db, ctx.user) if ctx.role == "pm" else None
+    projects = await _user_projects(db, ctx.user)
    return {
        "data": {
            "access_token": access_token,
            "token_type": "bearer",
            "expires_in": body.get("expires_in"),
-            "user": user_to_dict(ctx.user, project),
+            "user": user_to_dict(ctx.user, projects),
        }
    }
@@ -59,10 +59,18 @@ class Scope:
    actor: str | None


-async def inventory_scope(request: Request, db: AsyncSession = Depends(get_db)) -> Scope:
-    """Resolve the caller role/project — Casdoor JWT first, dev headers as fallback."""
-    # Primary path: Casdoor JWT. Role from users.role; PM project from
-    # projects.pm_user_id (single PM per project).
+async def inventory_scope(
+    request: Request,
+    project_id: uuid.UUID | None = Query(default=None, description="پروژه فعال (PM: داده‌های همین پروژه)"),
+    db: AsyncSession = Depends(get_db),
+) -> Scope:
+    """Resolve the caller role/project — Casdoor JWT first, dev headers as fallback.
+
+    The active project is explicit via `?project_id=…`. For a PM the backend
+    verifies they manage that project (projects.pm_user_id, 1:N); without the
+    param it falls back to their first assigned project. Admin / procurement
+    manager may pass it as a filter (no param = all projects).
+    """
    if request.headers.get("authorization"):
        user: UserContext = await get_optional_user(request, db)
        if user is not None:
@@ -70,16 +78,21 @@ async def inventory_scope(request: Request, db: AsyncSession = Depends(get_db))
                raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
            # v2.6: مدیر تدارکات = ادمین دفتر — دسترسی فقط‌خواندنی به پنل انبار.
            if user.role == "procurement_manager":
-                return Scope(role="admin", project_id=None, actor=user.display_name)
+                return Scope(role="admin", project_id=project_id, actor=user.display_name)
            if user.role not in ("pm", "admin"):
                raise ValidationError("نقش نامعتبر است — فقط pm یا admin برای موجودی", field="role")
            if user.role == "pm":
-                if user.project_id is None:
+                allowed = list(user.project_ids or [])
+                if project_id is not None:
+                    if project_id not in allowed:
+                        raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+                    return Scope(role="pm", project_id=project_id, actor=user.display_name)
+                if not allowed:
                    raise ValidationError(
                        "کاربر PM به هیچ پروژه‌ای متصل نیست (projects.pm_user_id)", field="project_id"
                    )
-                return Scope(role="pm", project_id=user.project_id, actor=user.display_name)
-            return Scope(role="admin", project_id=None, actor=user.display_name)
+                return Scope(role="pm", project_id=allowed[0], actor=user.display_name)
+            return Scope(role="admin", project_id=project_id, actor=user.display_name)

    # Dev fallback: header-based identity (fork's placeholder mode) — only
    # when an explicit X-User-Role header is sent. No auth info at all → 401.
@@ -90,13 +103,14 @@ async def inventory_scope(request: Request, db: AsyncSession = Depends(get_db))
        role = ROLE_ADMIN  # مدیر تدارکات = ادمین (فقط‌خواندنی)
    if role not in (ROLE_PM, ROLE_ADMIN):
        raise ValidationError("نقش نامعتبر است — فقط pm یا admin", field="X-User-Role")
-    raw_project = request.headers.get("x-project-id") or settings.INVENTORY_DEFAULT_PROJECT_ID
-    project_id = None
-    if raw_project:
-        try:
-            project_id = uuid.UUID(str(raw_project))
-        except ValueError:
-            raise ValidationError("شناسه پروژه نامعتبر است", field="X-Project-Id")
+    # The explicit query param wins; otherwise the dev header carries it.
+    if project_id is None:
+        raw_project = request.headers.get("x-project-id") or settings.INVENTORY_DEFAULT_PROJECT_ID
+        if raw_project:
+            try:
+                project_id = uuid.UUID(str(raw_project))
+            except ValueError:
+                raise ValidationError("شناسه پروژه نامعتبر است", field="X-Project-Id")
    if role == ROLE_PM and project_id is None:
        raise ValidationError(
            "برای نقش PM هدر X-Project-Id (پروژه مسئول) الزامی است", field="X-Project-Id"
@@ -29,7 +29,7 @@ from contextlib import nullcontext
 from dataclasses import dataclass
 from decimal import Decimal

-from fastapi import APIRouter, Depends, Request
+from fastapi import APIRouter, Depends, Query, Request
 from sqlalchemy import func, select
 from sqlalchemy.dialects.postgresql import insert as pg_insert
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -66,14 +66,20 @@ NULL_BRAND_SENTINEL = "00000000-0000-0000-0000-000000000000"
 class ArrivalScope:
    role: str  # "pm" | "admin" (admin = admin or procurement_manager)
    user_id: uuid.UUID | None
-    project_id: uuid.UUID | None  # PM's single project; None for admin
+    project_id: uuid.UUID | None  # PM's active project; admin: optional filter
    display_name: str


-async def arrivals_scope(request: Request, db: AsyncSession = Depends(get_db)) -> ArrivalScope:
+async def arrivals_scope(
+    request: Request,
+    project_id: uuid.UUID | None = Query(default=None, description="پروژه فعال (PM: الزامی برای داده‌های پروژه)"),
+    db: AsyncSession = Depends(get_db),
+) -> ArrivalScope:
    """Resolve the arrivals caller — Casdoor JWT first, dev headers as fallback.

-    PM → scoped to his own project. Admin / procurement manager → all projects.
+    PM → scoped to the requested project, which must be one they manage
+    (projects.pm_user_id, 1:N); without the param, their first project.
+    Admin / procurement manager → all projects (param = optional filter).
    """
    if request.headers.get("authorization"):
        ctx: UserContext | None = await get_optional_user(request, db)
@@ -81,11 +87,16 @@ async def arrivals_scope(request: Request, db: AsyncSession = Depends(get_db)) -
            if ctx.role is None:
                raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
            if ctx.role == "pm":
-                if ctx.project_id is None:
+                allowed = list(ctx.project_ids or [])
+                if project_id is not None:
+                    if project_id not in allowed:
+                        raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+                    return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
+                if not allowed:
                    raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
-                return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=ctx.project_id, display_name=ctx.display_name)
+                return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=allowed[0], display_name=ctx.display_name)
            if ctx.role in ("admin", "procurement_manager"):
-                return ArrivalScope(role="admin", user_id=ctx.user.id, project_id=None, display_name=ctx.display_name)
+                return ArrivalScope(role="admin", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
            raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است")
    # Dev fallback: X-User-Role: pm | admin (procurement_manager maps to admin)
    if not request.headers.get("x-user-role"):
@@ -95,8 +106,8 @@ async def arrivals_scope(request: Request, db: AsyncSession = Depends(get_db)) -
        role = "admin"
    if role not in ("pm", "admin"):
        raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است — هدر X-User-Role را بفرستید")
-    project_id = None
-    if role == "pm":
+    # The explicit query param wins; otherwise the dev header carries it.
+    if project_id is None and role == "pm":
        raw_project = request.headers.get("x-project-id")
        if not raw_project:
            raise ForbiddenError("هدر X-Project-Id (پروژه مسئول) الزامی است")
@@ -172,9 +183,10 @@ async def pm_on_the_way(
        .outerjoin(Project, Project.id == ItemDecision.project_id)
        .where(ItemDecision.status == "chosen")
    )
-    if ctx.role == "pm":
-        if ctx.project_id is None:
-            raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
+    if ctx.role == "pm" and ctx.project_id is None:
+        raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
+    if ctx.project_id is not None:
+        # PM: active project; admin/manager: optional project filter
        stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
    decisions = (await db.execute(stmt.order_by(ItemDecision.decided_at.desc().nulls_last()))).all()

@@ -238,8 +250,8 @@ async def pm_confirm_receipt(
        decision = await db.get(ItemDecision, payload.item_decision_id)
        if decision is None or decision.status != "chosen":
            raise NotFoundError("تصمیم خرید یافت نشد", field="item_decision_id")
-        if ctx.role == "pm" and decision.project_id != ctx.project_id:
-            raise ForbiddenError("این قلم متعلق به پروژه شما نیست")
+        if ctx.project_id is not None and decision.project_id != ctx.project_id:
+            raise ForbiddenError("این قلم متعلق به پروژه فعال نیست")

        li = await db.get(LineItem, decision.line_item_id)
        quote = await db.get(Quote, li.quote_id)
@@ -436,9 +448,10 @@ async def pm_receipts(
        .join(Quote, Quote.id == LineItem.quote_id)
        .join(Project, Project.id == ItemDecision.project_id)
    )
-    if ctx.role == "pm":
-        if ctx.project_id is None:
-            raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
+    if ctx.role == "pm" and ctx.project_id is None:
+        raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
+    if ctx.project_id is not None:
+        # PM: active project; admin/manager: optional project filter
        stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
    rows = (await db.execute(stmt.order_by(ItemReceipt.received_at.desc()))).all()
    receipts = [r.ItemReceipt for r in rows]
@@ -1,19 +1,25 @@
 """Projects CRUD + per-project stats."""
-from fastapi import APIRouter, Depends, Query
+from fastapi import APIRouter, Depends, Query, Request
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession

+from app.auth import UserContext, get_optional_user
 from app.db.engine import get_db
 from app.models.procurement import Project, Quote, User
 from app.schemas.procurement import ProjectCreate, ProjectUpdate
 from app.services.quote_service import project_stats
-from app.utils.errors import ConflictError, NotFoundError
+from app.utils.errors import ConflictError, ForbiddenError, NotFoundError, ValidationError
 from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_date, to_iso

 router = APIRouter(prefix="/projects", tags=["projects"])


+async def _optional_ctx(request: Request, db: AsyncSession = Depends(get_db)) -> UserContext | None:
+    """JWT caller when present — used for RBAC on PM assignment (PATCH)."""
+    return await get_optional_user(request, db)
+
+
 async def _pm_map(db: AsyncSession, projects: list[Project]) -> dict:
    """project_id -> pm brief (v2.6: the single PM of the project)."""
    pm_ids = {p.pm_user_id for p in projects if p.pm_user_id}
@@ -91,7 +97,13 @@ async def get_project(project_id, db: AsyncSession = Depends(get_db)):


@router.patch("/{project_id}")
-async def update_project(project_id, payload: ProjectUpdate, db: AsyncSession = Depends(get_db)):
+async def update_project(
+    project_id,
+    payload: ProjectUpdate,
+    request: Request,
+    ctx: UserContext | None = Depends(_optional_ctx),
+    db: AsyncSession = Depends(get_db),
+):
    project = await db.get(Project, project_id)
    if project is None:
        raise NotFoundError("پروژه یافت نشد")
@@ -101,6 +113,21 @@ async def update_project(project_id, payload: ProjectUpdate, db: AsyncSession =
        project.description = payload.description
    if payload.start_date is not None:
        project.start_date = payload.start_date
+    # PM assignment (1:N): one PM per project, a PM may own many projects.
+    # Admin / procurement manager only (same rule as the Organization panel).
+    if "pm_user_id" in payload.model_fields_set:
+        role = ctx.role if ctx else (request.headers.get("x-user-role") or "").strip().lower()
+        if role not in ("admin", "procurement_manager"):
+            raise ForbiddenError("تعیین مدیر پروژه فقط برای ادمین / مدیر تدارکات مجاز است")
+        if payload.pm_user_id is None:
+            project.pm_user_id = None
+        else:
+            pm_user = await db.get(User, payload.pm_user_id)
+            if pm_user is None:
+                raise NotFoundError("کاربر یافت نشد", field="pm_user_id")
+            if pm_user.role != "pm":
+                raise ValidationError("ابتدا نقش این کاربر را «مدیر پروژه» کنید", field="pm_user_id")
+            project.pm_user_id = pm_user.id
    await db.flush()
    return {"data": await project_to_dict(db, project)}

@@ -1,12 +1,14 @@
 """Users — profile + role assignment + organization management (v2.6, Casdoor-backed).

 Organization panel endpoints (admin / procurement manager — same person):
- GET  /users                — list every user with role + assigned project.
+- GET  /users                — list every user with role + assigned projects.
 - POST /users                — define a new user (manual identity, casdoor_id optional).
 - PATCH /users/{id}          — set/clear role; clearing (or switching away from
-                               «pm») also unassigns the user from their project.
- POST /users/{id}/project   — assign/unassign the user's single project
-                               (project_id=None unassigns; one PM per project).
+                               «pm») also unassigns the user from every project.
+- POST /users/{id}/project   — assign/unassign ONE project (multi-project:
+                               other assignments are kept; project_id=None
+                               clears all; one PM per project).
+- GET  /users/me/projects    — every project assigned to the caller (PM).

 Role management is open to BOTH «admin» and «procurement_manager» (they are
 the same person in this system), unlike the plain require_role("admin").
@@ -41,7 +43,11 @@ USER_ROLE_LABELS = {
 }


-def user_to_dict(user: User, project: Project | None = None) -> dict:
+def user_to_dict(user: User, projects: list[Project] | None = None) -> dict:
+    """Serialize a user. `projects` = every project the PM manages (1:N);
+    project_id/project_name stay as the first (oldest) one for compatibility."""
+    projects = projects or []
+    first = projects[0] if projects else None
    return {
        "id": str(user.id),
        "casdoor_id": user.casdoor_id,
@@ -50,8 +56,9 @@ def user_to_dict(user: User, project: Project | None = None) -> dict:
        "phone": user.phone,
        "role": user.role,
        "role_label": USER_ROLE_LABELS.get(user.role) if user.role else None,
-        "project_id": str(project.id) if project else None,
-        "project_name": project.name if project else None,
+        "project_id": str(first.id) if first else None,
+        "project_name": first.name if first else None,
+        "projects": [{"id": str(p.id), "name": p.name} for p in projects],
        "created_at": to_iso(user.created_at),
    }

@@ -63,14 +70,28 @@ async def _org_manager(ctx: UserContext = Depends(get_current_user)) -> UserCont
    return ctx


-async def _user_project(db: AsyncSession, user: User) -> Project | None:
+async def _user_projects(db: AsyncSession, user: User) -> list[Project]:
+    """Every project the user manages as PM (oldest first; [] for non-PMs)."""
    if user.role != "pm":
-        return None
-    return await db.scalar(select(Project).where(Project.pm_user_id == user.id))
+        return []
+    rows = (
+        await db.execute(
+            select(Project)
+            .where(Project.pm_user_id == user.id)
+            .order_by(Project.created_at, Project.id)
+        )
+    ).scalars().all()
+    return list(rows)
+
+
+async def _user_project(db: AsyncSession, user: User) -> Project | None:
+    """First (oldest) project of a PM — legacy single-project view."""
+    projects = await _user_projects(db, user)
+    return projects[0] if projects else None


 async def _unassign_projects(db: AsyncSession, user_id) -> None:
-    """Clear the user's pm assignment on every project (one project per PM)."""
+    """Clear the user's pm assignment on every project (role revocation)."""
    await db.execute(
        update(Project).where(Project.pm_user_id == user_id).values(pm_user_id=None)
    )
@@ -104,8 +125,19 @@ async def _casdoor_users() -> list[dict]:

@router.get("/me")
 async def me(ctx: UserContext = Depends(get_current_user), db: AsyncSession = Depends(get_db)):
-    project = await _user_project(db, ctx.user) if ctx.role == "pm" else None
-    return {"data": user_to_dict(ctx.user, project)}
+    projects = await _user_projects(db, ctx.user)
+    return {"data": user_to_dict(ctx.user, projects)}
+
+
+@router.get("/me/projects")
+async def my_projects(ctx: UserContext = Depends(get_current_user), db: AsyncSession = Depends(get_db)):
+    """Every project assigned to the caller (empty list for non-PM roles).
+
+    Drives the PM project switcher: the frontend validates its persisted
+    active project against this list and falls back gracefully when a
+    project is revoked."""
+    projects = await _user_projects(db, ctx.user)
+    return {"data": [{"id": str(p.id), "name": p.name} for p in projects]}


@router.get("")
@@ -113,15 +145,22 @@ async def list_users(
    _: UserContext = Depends(_org_manager),
    db: AsyncSession = Depends(get_db),
 ):
-    """Every user (with role + assigned project) — Organization panel."""
+    """Every user (with role + assigned projects) — Organization panel."""
    users = (await db.execute(select(User).order_by(User.created_at))).scalars().all()
    pm_ids = {u.id for u in users if u.role == "pm"}
-    projects: dict = {}
+    by_user: dict = {}
    if pm_ids:
-        projs = (await db.execute(select(Project).where(Project.pm_user_id.in_(pm_ids)))).scalars().all()
-        projects = {p.pm_user_id: p for p in projs}
+        projs = (
+            await db.execute(
+                select(Project)
+                .where(Project.pm_user_id.in_(pm_ids))
+                .order_by(Project.created_at, Project.id)
+            )
+        ).scalars().all()
+        for p in projs:
+            by_user.setdefault(p.pm_user_id, []).append(p)
    return {
-        "data": [user_to_dict(u, projects.get(u.id)) for u in users],
+        "data": [user_to_dict(u, by_user.get(u.id, [])) for u in users],
        "meta": {"total": len(users)},
    }

@@ -166,8 +205,8 @@ async def update_user_role(
        await _unassign_projects(db, user.id)
    user.role = payload.role
    await db.flush()
-    project = await _user_project(db, user)
-    return {"data": user_to_dict(user, project)}
+    projects = await _user_projects(db, user)
+    return {"data": user_to_dict(user, projects)}


@router.post("/sync")
@@ -204,12 +243,19 @@ async def sync_casdoor_users(

    users = (await db.execute(select(User).order_by(User.created_at))).scalars().all()
    pm_ids = {u.id for u in users if u.role == "pm"}
-    projects: dict = {}
+    by_user: dict = {}
    if pm_ids:
-        projs = (await db.execute(select(Project).where(Project.pm_user_id.in_(pm_ids)))).scalars().all()
-        projects = {p.pm_user_id: p for p in projs}
+        projs = (
+            await db.execute(
+                select(Project)
+                .where(Project.pm_user_id.in_(pm_ids))
+                .order_by(Project.created_at, Project.id)
+            )
+        ).scalars().all()
+        for p in projs:
+            by_user.setdefault(p.pm_user_id, []).append(p)
    return {
-        "data": [user_to_dict(u, projects.get(u.id)) for u in users],
+        "data": [user_to_dict(u, by_user.get(u.id, [])) for u in users],
        "meta": {"total": len(users), "created": created},
    }

@@ -221,11 +267,13 @@ async def assign_user_project(
    _: UserContext = Depends(_org_manager),
    db: AsyncSession = Depends(get_db),
 ):
-    """Assign the user as PM of one project (project_id=None unassigns).
+    """Assign the user as PM of ONE project (multi-project aware).

-    Rules: the user must hold the «pm» role; a PM manages ONE project at a
-    time (assignment on other projects is cleared); assigning a new PM to a
-    project replaces the previous PM there.
+    - project_id given: that project gets this PM (a previous PM there is
+      replaced); the user's OTHER project assignments are kept.
+    - project_id=None: clears ALL of the user's project assignments.
+
+    Rules: the user must hold the «pm» role; a project has at most one PM.
    """
    user = await db.get(User, user_id)
    if user is None:
@@ -233,8 +281,8 @@ async def assign_user_project(
    if user.role != "pm":
        raise ValidationError("ابتدا نقش این کاربر را «مدیر پروژه» کنید", field="role")

-    await _unassign_projects(db, user.id)
    if payload.project_id is None:
+        await _unassign_projects(db, user.id)
        await db.flush()
        return {"data": user_to_dict(user)}

@@ -243,4 +291,4 @@ async def assign_user_project(
        raise NotFoundError("پروژه یافت نشد", field="project_id")
    project.pm_user_id = user.id
    await db.flush()
-    return {"data": user_to_dict(user, project)}
+    return {"data": user_to_dict(user, await _user_projects(db, user))}