feat(org,rbac): dedicate organization panel, enforce role permissions, subheader info, and fix supervisor project sync

backend/app/routers/inventory.py

@@ -77,23 +77,21 @@ async def inventory_scope(
         if user is not None:
             if user.role is None:
                 raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
-            # v2.6: مدیر تدارکات = ادمین دفتر — دسترسی فقط‌خواندنی به پنل انبار.
-            if user.role == "procurement_manager":
-                return Scope(role="admin", project_id=project_id, actor=user.display_name)
-            if user.role not in ("pm", "admin"):
-                raise ValidationError("نقش نامعتبر است — فقط pm یا admin برای موجودی", field="role")
-            if user.role == "pm":
+            # مدیر تدارکات و مدیر پروژه: دسترسی کامل به پنل انبار، اما فقط‌خواندنی در تغییر موجودی
+            if user.role in ("procurement_manager", "pm"):
+                return Scope(role="manager", project_id=project_id, actor=user.display_name)
+            if user.role == "supervisor":
                 allowed = list(user.project_ids or [])
+                if not allowed:
+                    raise ForbiddenError("پروژه تخصیص داده نشده است")
                 if project_id is not None:
                     if project_id not in allowed:
                         raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
-                    return Scope(role="pm", project_id=project_id, actor=user.display_name)
-                if not allowed:
-                    raise ValidationError(
-                        "کاربر PM به هیچ پروژه‌ای متصل نیست (projects.pm_user_id)", field="project_id"
-                    )
-                return Scope(role="pm", project_id=allowed[0], actor=user.display_name)
-            return Scope(role="admin", project_id=project_id, actor=user.display_name)
+                    return Scope(role="supervisor", project_id=project_id, actor=user.display_name)
+                return Scope(role="supervisor", project_id=allowed[0], actor=user.display_name)
+            if user.role == "admin":
+                return Scope(role="admin", project_id=project_id, actor=user.display_name)
+            raise ValidationError("نقش نامعتبر است", field="role")
 
     # Dev fallback: header-based identity (fork's placeholder mode) — only
     # when DEV_LOGIN_ENABLED is explicitly turned on (local testing without
@@ -128,9 +126,9 @@ async def inventory_scope(
     return Scope(role=role, project_id=project_id, actor=actor)
 
 
-def _require_pm(scope: Scope) -> None:
-    if scope.role != ROLE_PM:
-        raise ForbiddenError("دسترسی ادمین فقط خواندنی است — ثبت/تغییر موجودی مجاز نیست")
+def _require_inventory_modifier(scope: Scope) -> None:
+    if scope.role not in (ROLE_ADMIN, "admin", "supervisor", ROLE_PM):
+        raise ForbiddenError("مدیر تدارکات و مدیر پروژه امکان تغییر موجودی انبار را ندارند — فقط سرپرست پروژه و ادمین مجاز هستند")
 
 
 # ---------------------------------------------------------------------------
@@ -215,8 +213,8 @@ async def list_warehouses(
     db: AsyncSession = Depends(get_db),
 ):
     stmt = select(Warehouse)
-    if scope.role == ROLE_PM:
-        stmt = stmt.where(Warehouse.project_id == scope.project_id)  # force PM scope
+    if scope.role in (ROLE_PM, "supervisor"):
+        stmt = stmt.where(Warehouse.project_id == scope.project_id)  # force PM / supervisor scope
     elif project_id is not None:
         stmt = stmt.where(Warehouse.project_id == project_id)
     stmt = stmt.order_by(Warehouse.name)
@@ -323,7 +321,7 @@ async def list_inventory(
     db: AsyncSession = Depends(get_db),
 ):
     stmt = select(InventoryItem)
-    if scope.role == ROLE_PM:
+    if scope.role in (ROLE_PM, "supervisor"):
         stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
             Warehouse.project_id == scope.project_id
         )
@@ -388,7 +386,7 @@ async def list_transactions(
     stmt = select(InventoryTransaction).join(
         InventoryItem, InventoryItem.id == InventoryTransaction.inventory_id
     ).join(Warehouse, Warehouse.id == InventoryItem.warehouse_id)
-    if scope.role == ROLE_PM:
+    if scope.role in (ROLE_PM, "supervisor"):
         stmt = stmt.where(Warehouse.project_id == scope.project_id)
     elif project_id is not None:
         stmt = stmt.where(Warehouse.project_id == project_id)
@@ -454,7 +452,7 @@ async def inventory_history(
     if item is None:
         raise NotFoundError("موجودی یافت نشد")
     wh = await get_warehouse_or_404(db, item.warehouse_id)
-    if scope.role == ROLE_PM and wh.project_id != scope.project_id:
+    if scope.role in (ROLE_PM, "supervisor") and wh.project_id != scope.project_id:
         raise ForbiddenError("این موجودی متعلق به پروژه شما نیست")
     txs = (await db.execute(
         select(InventoryTransaction)
@@ -474,17 +472,17 @@ async def create_transaction(
     scope: Scope = Depends(inventory_scope),
     db: AsyncSession = Depends(get_db),
 ):
-    _require_pm(scope)
+    _require_inventory_modifier(scope)
     # No explicit db.begin(): the session may already be inside an implicit
     # transaction (inventory_scope read from it in the JWT path); get_db
     # commits on success / rolls back on failure.
     with nullcontext():
         wh = await get_warehouse_or_404(db, payload.warehouse_id)
-        if wh.project_id != scope.project_id:
+        if scope.project_id is not None and wh.project_id != scope.project_id:
             raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
         if payload.dest_warehouse_id is not None:
             dest = await get_warehouse_or_404(db, payload.dest_warehouse_id)
-            if dest.project_id != scope.project_id:
+            if scope.project_id is not None and dest.project_id != scope.project_id:
                 raise ForbiddenError("انبار مقصد متعلق به پروژه شما نیست")
         txs = await apply_transaction(db, payload, performed_by=scope.actor)
         await audit_record(