feat(org): panel-based access system replacing roles (procurement/inventory)

- new tables user_panels (panel: procurement/inventory/pm + level full/limited) and user_project_members (M:N membership, separate from pm responsibility) - UserContext carries panels + member_project_ids; /users/me and the users list include them - admin endpoints: PUT /users/{id}/panels, PUT /users/{id}/panel-projects - inventory scope: panel inventory 'full' -> manager scope (all projects, NO stock change); 'limited' -> supervisor scope (own memberships, stock change allowed); legacy roles kept as migration fallback; admin untouched - procurement writes: _procurement_writer is now panel-aware (admin, legacy procurement_manager, or procurement 'full') across all 18 write routers; quote CREATE additionally allows 'limited' users restricted to their member projects (validated server-side) - frontend: panel-aware HomeRoute (inventory -> warehouse panel, procurement limited -> minimal RequesterHome), wizard project options restricted for limited users, change-inventory button/route gated to inventory 'limited', organization panel gains the panels & access-levels management section
2026-09-29 13:37:59 +03:30
parent c7d860f431
commit 4a3c226518
35 changed files with 591 additions and 72 deletions
@@ -17,15 +17,21 @@ import uuid

 import httpx
 from fastapi import APIRouter, Depends
-from sqlalchemy import select, update, text
+from sqlalchemy import delete, select, update, text
 from sqlalchemy.ext.asyncio import AsyncSession

 from app.auth import UserContext, get_current_user, require_role
 from app.utils.audit import record as audit_record
 from app.config import settings
 from app.db.engine import get_db
-from app.models.procurement import Project, User
-from app.schemas.procurement import UserCreate, UserProjectUpdate, UserRoleUpdate
+from app.models.procurement import Project, User, UserPanel, UserProjectMembership
+from app.schemas.procurement import (
+    UserCreate,
+    UserPanelsUpdate,
+    UserPanelProjectsUpdate,
+    UserProjectUpdate,
+    UserRoleUpdate,
+)
 from app.utils.errors import (
    ConflictError,
    ForbiddenError,
@@ -46,12 +52,39 @@ USER_ROLE_LABELS = {
 }


-def user_to_dict(user: User, projects: list[Project] | None = None) -> dict:
+PANEL_LEVELS = ("full", "limited")
+PANELS = ("procurement", "inventory", "pm")
+
+
+async def _panels_of(db: AsyncSession, user_id) -> dict:
+    """panel -> level map for the user (لایه پنل‌ها — جایگزین نقش‌ها)."""
+    rows = (
+        await db.execute(
+            select(UserPanel).where(UserPanel.user_id == user_id).order_by(UserPanel.created_at)
+        )
+    ).scalars().all()
+    return {row.panel: row.level for row in rows}
+
+
+async def _member_project_ids_of(db: AsyncSession, user_id) -> list[str]:
+    """عضویت M:N کاربر در پروژه‌ها (جدا از مسئولیت) — رشته."""
+    rows = (
+        await db.execute(
+            select(UserProjectMembership.project_id)
+            .where(UserProjectMembership.user_id == user_id)
+            .order_by(UserProjectMembership.created_at)
+        )
+    ).scalars().all()
+    return [str(pid) for pid in rows]
+
+
+async def user_to_dict(user: User, projects: list[Project] | None = None, db: AsyncSession | None = None) -> dict:
    """Serialize a user. `projects` = every project the PM manages (1:N);
-    project_id/project_name stay as the first (oldest) one for compatibility."""
+    project_id/project_name stay as the first (oldest) one for compatibility.
+    با db، پنل‌های تخصیصی و عضویت پروژه‌ای هم برمی‌گردند."""
    projects = projects or []
    first = projects[0] if projects else None
-    return {
+    out = {
        "id": str(user.id),
        "casdoor_id": user.casdoor_id,
        "username": user.username,
@@ -65,6 +98,10 @@ def user_to_dict(user: User, projects: list[Project] | None = None) -> dict:
        "projects": [{"id": str(p.id), "name": p.name} for p in projects],
        "created_at": to_iso(user.created_at),
    }
+    if db is not None:
+        out["panels"] = await _panels_of(db, user.id)
+        out["member_project_ids"] = await _member_project_ids_of(db, user.id)
+    return out


 async def _org_manager(ctx: UserContext = Depends(get_current_user)) -> UserContext:
@@ -130,7 +167,7 @@ async def _casdoor_users() -> list[dict]:
@router.get("/me")
 async def me(ctx: UserContext = Depends(get_current_user), db: AsyncSession = Depends(get_db)):
    projects = await _user_projects(db, ctx.user)
-    return {"data": user_to_dict(ctx.user, projects)}
+    return {"data": await user_to_dict(ctx.user, projects, db)}


@router.get("/me/projects")
@@ -141,6 +178,18 @@ async def my_projects(ctx: UserContext = Depends(get_current_user), db: AsyncSes
    active project against this list and falls back gracefully when a
    project is revoked."""
    projects = await _user_projects(db, ctx.user)
+    # عضویت‌های M:N (لایه پنل‌ها) هم به فهرست اضافه می‌شود
+    member_ids = set(ctx.member_project_ids or [])
+    have = {p.id for p in projects}
+    if member_ids:
+        extra = (
+            await db.execute(
+                select(Project)
+                .where(Project.id.in_(member_ids))
+                .order_by(Project.created_at, Project.id)
+            )
+        ).scalars().all()
+        projects = list(projects) + [p for p in extra if p.id not in have]
    return {"data": [{"id": str(p.id), "name": p.name} for p in projects]}


@@ -164,7 +213,7 @@ async def list_users(
        for p in projs:
            by_user.setdefault(p.pm_user_id, []).append(p)
    return {
-        "data": [user_to_dict(u, by_user.get(u.id, [])) for u in users],
+        "data": [await user_to_dict(u, by_user.get(u.id, []), db) for u in users],
        "meta": {"total": len(users)},
    }

@@ -190,7 +239,7 @@ async def create_user(
    db.add(user)
    await db.flush()
    await audit_record(db, actor=ctx.display_name, action="user.created", entity="user", entity_id=str(user.id), details={"role": payload.role})
-    return {"data": user_to_dict(user)}
+    return {"data": await user_to_dict(user)}


@router.patch("/{user_id}")
@@ -213,7 +262,7 @@ async def update_user_role(
    await db.flush()
    await audit_record(db, actor=ctx.display_name, action="user.role_changed", entity="user", entity_id=str(user.id), details={"from": previous_role, "to": payload.role})
    projects = await _user_projects(db, user)
-    return {"data": user_to_dict(user, projects)}
+    return {"data": await user_to_dict(user, projects)}


@router.post("/sync")
@@ -273,7 +322,7 @@ async def sync_casdoor_users(
        for p in projs:
            by_user.setdefault(p.pm_user_id, []).append(p)
    return {
-        "data": [user_to_dict(u, by_user.get(u.id, [])) for u in users],
+        "data": [await user_to_dict(u, by_user.get(u.id, []), db) for u in users],
        "meta": {"total": len(users), "created": created},
    }

@@ -307,7 +356,7 @@ async def assign_user_project(
                {"uname": user.username}
            )
        await db.flush()
-        return {"data": user_to_dict(user)}
+        return {"data": await user_to_dict(user)}

    project = await db.get(Project, payload.project_id)
    if project is None:
@@ -328,4 +377,63 @@ async def assign_user_project(
            {"pid": project.id, "uname": user.username}
        )
    await db.flush()
-    return {"data": user_to_dict(user, await _user_projects(db, user))}
+    return {"data": await user_to_dict(user, await _user_projects(db, user))}
+
+
+# ---------------------------------------------------------------------------
+# پنل‌ها و سطوح دسترسی — جایگزین مدل نقش برای کاربران عادی
+# ---------------------------------------------------------------------------
+
+
+@router.put("/{user_id}/panels")
+async def set_user_panels(
+    user_id,
+    payload: UserPanelsUpdate,
+    _: UserContext = Depends(require_role("admin")),
+    db: AsyncSession = Depends(get_db),
+):
+    """تخصیص پنل + سطح دسترسی به کاربر — فقط ادمین."""
+    user = await db.get(User, user_id)
+    if user is None:
+        raise NotFoundError("کاربر یافت نشد")
+    for panel, level in payload.panels.items():
+        if panel not in PANELS:
+            raise ValidationError(f"پنل نامعتبر: {panel}", field="panels")
+        if level not in PANEL_LEVELS:
+            raise ValidationError(f"سطح دسترسی نامعتبر: {level}", field="panels")
+    await db.execute(delete(UserPanel).where(UserPanel.user_id == user.id))
+    for panel, level in payload.panels.items():
+        db.add(UserPanel(user_id=user.id, panel=panel, level=level))
+    await db.flush()
+    return {"data": await user_to_dict(user, await _user_projects(db, user), db)}
+
+
+@router.put("/{user_id}/panel-projects")
+async def set_user_panel_projects(
+    user_id,
+    payload: UserPanelProjectsUpdate,
+    _: UserContext = Depends(require_role("admin")),
+    db: AsyncSession = Depends(get_db),
+):
+    """عضویت پروژه‌ای کاربر (M:N) — محدوده داده‌ی سطح limited."""
+    user = await db.get(User, user_id)
+    if user is None:
+        raise NotFoundError("کاربر یافت نشد")
+    wanted = list(dict.fromkeys(payload.project_ids))
+    if wanted:
+        found = (
+            await db.execute(select(Project).where(Project.id.in_(wanted)))
+        ).scalars().all()
+        found_ids = {p.id for p in found}
+        unknown = [str(pid) for pid in wanted if pid not in found_ids]
+        if unknown:
+            raise ValidationError(
+                "پروژه(های) نامعتبر: " + "، ".join(unknown), field="project_ids"
+            )
+    await db.execute(
+        delete(UserProjectMembership).where(UserProjectMembership.user_id == user.id)
+    )
+    for pid in wanted:
+        db.add(UserProjectMembership(user_id=user.id, project_id=pid))
+    await db.flush()
+    return {"data": await user_to_dict(user, await _user_projects(db, user), db)}