feat(pm): multi-project PMs (1:N) with project switching, scoping validation and org multi-select
Task 1 — PM 1:N + access-loss handling:
- projects.pm_user_id had no UNIQUE constraint (verified live + in schema); added a lookup index via init_db
- auth: UserContext.project_ids = every project of a PM (oldest first); project_id stays the first for compatibility
- GET /users/me/projects — assigned projects of the caller (drives the switcher + revocation validation)
- login / /users/me / /users list now return the full projects array per user
- /inventory/* and /pm/* scopes accept an explicit ?project_id=… and verify the PM manages it (403 otherwise); without the param they fall back to the first project; admin/manager use it as an optional filter
- POST /users/{id}/project is multi-aware: assigns one project (replacing that project's previous PM) and KEEPS the user's other assignments; null clears all
- PATCH /projects/{id} accepts pm_user_id (admin / procurement manager only)
- frontend: auth store holds projects + the active project (persisted via the existing localStorage store); RequirePmProjects re-validates on load, falls back when the active project was revoked, and shows a dedicated no-projects screen with logout (no redirect loop, no re-auth)
- Panels menu: «مدیریت انبار» gets a ChevronDown accordion listing the PM's projects with «✓ فعلی»; selecting one switches only the active project and reloads the section data
- inventory/pm API calls now send the active project_id explicitly
Task 2 — Organization page:
- new searchable ProjectMultiSelect combobox (chips with ×, live Persian filtering via normalize, assigned projects hidden) replaces the single select for PM users
- add = PATCH project pm_user_id=<user>; × = pm_user_id=null; table and project cards sync immediately; RBAC unchanged (role column admin-only, combobox editable for admin + procurement manager)
Verified locally: 17 scripted checks — multi-project assignment without unique conflicts, /users/me/projects, explicit project_id authorization (foreign project 403 on /inventory, /pm/on-the-way, /pm/receipts), PM blocked from pm_user_id changes, legacy assign endpoint keeps other assignments, revocation removes the project from the list, zero-project PM gets an empty list and a guarded inventory endpoint. All test data cleaned up afterwards.
This commit is contained in:
+30
-17
@@ -29,7 +29,7 @@ from contextlib import nullcontext
|
||||
from dataclasses import dataclass
|
||||
from decimal import Decimal
|
||||
|
||||
from fastapi import APIRouter, Depends, Request
|
||||
from fastapi import APIRouter, Depends, Query, Request
|
||||
from sqlalchemy import func, select
|
||||
from sqlalchemy.dialects.postgresql import insert as pg_insert
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
@@ -66,14 +66,20 @@ NULL_BRAND_SENTINEL = "00000000-0000-0000-0000-000000000000"
|
||||
class ArrivalScope:
|
||||
role: str # "pm" | "admin" (admin = admin or procurement_manager)
|
||||
user_id: uuid.UUID | None
|
||||
project_id: uuid.UUID | None # PM's single project; None for admin
|
||||
project_id: uuid.UUID | None # PM's active project; admin: optional filter
|
||||
display_name: str
|
||||
|
||||
|
||||
async def arrivals_scope(request: Request, db: AsyncSession = Depends(get_db)) -> ArrivalScope:
|
||||
async def arrivals_scope(
|
||||
request: Request,
|
||||
project_id: uuid.UUID | None = Query(default=None, description="پروژه فعال (PM: الزامی برای داده‌های پروژه)"),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
) -> ArrivalScope:
|
||||
"""Resolve the arrivals caller — Casdoor JWT first, dev headers as fallback.
|
||||
|
||||
PM → scoped to his own project. Admin / procurement manager → all projects.
|
||||
PM → scoped to the requested project, which must be one they manage
|
||||
(projects.pm_user_id, 1:N); without the param, their first project.
|
||||
Admin / procurement manager → all projects (param = optional filter).
|
||||
"""
|
||||
if request.headers.get("authorization"):
|
||||
ctx: UserContext | None = await get_optional_user(request, db)
|
||||
@@ -81,11 +87,16 @@ async def arrivals_scope(request: Request, db: AsyncSession = Depends(get_db)) -
|
||||
if ctx.role is None:
|
||||
raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
|
||||
if ctx.role == "pm":
|
||||
if ctx.project_id is None:
|
||||
allowed = list(ctx.project_ids or [])
|
||||
if project_id is not None:
|
||||
if project_id not in allowed:
|
||||
raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
|
||||
return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
|
||||
if not allowed:
|
||||
raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
|
||||
return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=ctx.project_id, display_name=ctx.display_name)
|
||||
return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=allowed[0], display_name=ctx.display_name)
|
||||
if ctx.role in ("admin", "procurement_manager"):
|
||||
return ArrivalScope(role="admin", user_id=ctx.user.id, project_id=None, display_name=ctx.display_name)
|
||||
return ArrivalScope(role="admin", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
|
||||
raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است")
|
||||
# Dev fallback: X-User-Role: pm | admin (procurement_manager maps to admin)
|
||||
if not request.headers.get("x-user-role"):
|
||||
@@ -95,8 +106,8 @@ async def arrivals_scope(request: Request, db: AsyncSession = Depends(get_db)) -
|
||||
role = "admin"
|
||||
if role not in ("pm", "admin"):
|
||||
raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است — هدر X-User-Role را بفرستید")
|
||||
project_id = None
|
||||
if role == "pm":
|
||||
# The explicit query param wins; otherwise the dev header carries it.
|
||||
if project_id is None and role == "pm":
|
||||
raw_project = request.headers.get("x-project-id")
|
||||
if not raw_project:
|
||||
raise ForbiddenError("هدر X-Project-Id (پروژه مسئول) الزامی است")
|
||||
@@ -172,9 +183,10 @@ async def pm_on_the_way(
|
||||
.outerjoin(Project, Project.id == ItemDecision.project_id)
|
||||
.where(ItemDecision.status == "chosen")
|
||||
)
|
||||
if ctx.role == "pm":
|
||||
if ctx.project_id is None:
|
||||
raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
|
||||
if ctx.role == "pm" and ctx.project_id is None:
|
||||
raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
|
||||
if ctx.project_id is not None:
|
||||
# PM: active project; admin/manager: optional project filter
|
||||
stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
|
||||
decisions = (await db.execute(stmt.order_by(ItemDecision.decided_at.desc().nulls_last()))).all()
|
||||
|
||||
@@ -238,8 +250,8 @@ async def pm_confirm_receipt(
|
||||
decision = await db.get(ItemDecision, payload.item_decision_id)
|
||||
if decision is None or decision.status != "chosen":
|
||||
raise NotFoundError("تصمیم خرید یافت نشد", field="item_decision_id")
|
||||
if ctx.role == "pm" and decision.project_id != ctx.project_id:
|
||||
raise ForbiddenError("این قلم متعلق به پروژه شما نیست")
|
||||
if ctx.project_id is not None and decision.project_id != ctx.project_id:
|
||||
raise ForbiddenError("این قلم متعلق به پروژه فعال نیست")
|
||||
|
||||
li = await db.get(LineItem, decision.line_item_id)
|
||||
quote = await db.get(Quote, li.quote_id)
|
||||
@@ -436,9 +448,10 @@ async def pm_receipts(
|
||||
.join(Quote, Quote.id == LineItem.quote_id)
|
||||
.join(Project, Project.id == ItemDecision.project_id)
|
||||
)
|
||||
if ctx.role == "pm":
|
||||
if ctx.project_id is None:
|
||||
raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
|
||||
if ctx.role == "pm" and ctx.project_id is None:
|
||||
raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
|
||||
if ctx.project_id is not None:
|
||||
# PM: active project; admin/manager: optional project filter
|
||||
stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
|
||||
rows = (await db.execute(stmt.order_by(ItemReceipt.received_at.desc()))).all()
|
||||
receipts = [r.ItemReceipt for r in rows]
|
||||
|
||||
Reference in New Issue
Block a user