Merge pm (panel-based access, supervisor role) onto the restored RBAC base

Reverting 253c922 first made this merge small — only two conflicts:
- MobileTabBar: supervisor null-check combined with v7's /review hiding
- ArrivalsPage: pm's PM+supervisor scoping combined with v8's 3-way fetch
  (transfers) and its transfer-receive helpers, plus pm's canAccess gate

backend/app/auth.py

@@ -27,7 +27,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.config import settings
 from app.db.engine import AsyncSessionLocal
-from app.models.procurement import Project, User
+from app.models.procurement import Project, User, UserPanel, UserProjectMembership
 from app.utils.errors import (
     ForbiddenError,
     ServiceUnavailableError,
@@ -106,6 +106,10 @@ class UserContext:
     project_id: object | None  # uuid.UUID | None — default (first) project of a PM
     project_ids: list  # every project this PM manages (1:N — empty for non-PMs)
     display_name: str
+    # لایه پنل‌ها (جایگزین نقش‌ها): {'procurement': 'full'|'limited', 'inventory': ...}
+    panels: dict | None = None
+    # عضویت M:N در پروژه‌ها — محدوده داده سطح limited (جدا از مسئولیت PM)
+    member_project_ids: list | None = None
 
 
 async def context_from_claims(claims: dict, db: AsyncSession) -> UserContext:
@@ -153,6 +157,26 @@ async def context_from_claims(claims: dict, db: AsyncSession) -> UserContext:
         project_ids = [p.id for p in projects]
     project_id = project_ids[0] if project_ids else None
 
+    # لایه پنل‌ها: تخصیص پنل + سطح دسترسی و عضویت پروژه‌ای (جدا از نقش)
+    panels: dict = {}
+    panel_rows = (
+        await db.execute(
+            select(UserPanel).where(UserPanel.user_id == user.id).order_by(UserPanel.created_at)
+        )
+    ).scalars().all()
+    for row in panel_rows:
+        panels[row.panel] = row.level
+    member_project_ids: list = [
+        row.project_id
+        for row in (
+            await db.execute(
+                select(UserProjectMembership)
+                .where(UserProjectMembership.user_id == user.id)
+                .order_by(UserProjectMembership.created_at)
+            )
+        ).scalars().all()
+    ]
+
     display_name = f"{user.first_name} {user.last_name}".strip() or user.casdoor_id
     return UserContext(
         user=user,
@@ -160,6 +184,8 @@ async def context_from_claims(claims: dict, db: AsyncSession) -> UserContext:
         project_id=project_id,
         project_ids=project_ids,
         display_name=display_name,
+        panels=panels,
+        member_project_ids=member_project_ids,
     )
 
 
@@ -222,3 +248,31 @@ def require_role(*roles: str):
             raise ForbiddenError("دسترسی به این بخش برای نقش شما مجاز نیست")
         return ctx
     return _dep
+
+
+def require_procurement_writer():
+    """نوشتن در پنل تدارکات — ادمین، پنل تدارکات 'full'، یا نقش میراث مدیر تدارکات
+    (دوره مهاجرت از مدل نقش به مدل پنل)."""
+
+    async def _dep(ctx: UserContext = Depends(get_current_user)) -> UserContext:
+        if ctx.role in ("admin", "procurement_manager"):
+            return ctx
+        if (ctx.panels or {}).get("procurement") == "full":
+            return ctx
+        raise ForbiddenError("دسترسی نوشتن در پنل تدارکات را ندارید")
+
+    return _dep
+
+
+def allow_quote_create():
+    """افزودن استعلام — علاوه بر «نوشتن»، پنل تدارکات 'limited' هم مجاز است
+    (محدود به پروژه‌های عضویت؛ اعتبارسنجی عضویت در خود endpoint انجام می‌شود)."""
+
+    async def _dep(ctx: UserContext = Depends(get_current_user)) -> UserContext:
+        if ctx.role in ("admin", "procurement_manager"):
+            return ctx
+        if (ctx.panels or {}).get("procurement") in ("full", "limited"):
+            return ctx
+        raise ForbiddenError("دسترسی افزودن استعلام ندارید")
+
+    return _dep

backend/app/models/procurement.py

@@ -66,6 +66,47 @@ class User(Base):
     created_at: Mapped[datetime] = _timestamptz()
 
 
+class UserPanel(Base):
+    """user_panels — تخصیص پنل + سطح دسترسی به کاربر (جایگزین مدل نقش).
+
+    panel:  'procurement' | 'inventory' | 'pm'
+    level:  'full'    — تدارکات: تغییر کامل در کل پنل؛ انبار: همه پروژه‌ها
+                        (به‌جز تغییر موجودی)
+            'limited' — تدارکات: فقط افزودن استعلام برای پروژه‌های عضویت؛
+                        انبار: فقط پروژه‌های عضویت + امکان تغییر موجودی
+    """
+
+    __tablename__ = "user_panels"
+
+    id: Mapped[uuid.UUID] = _uuid_pk()
+    user_id: Mapped[uuid.UUID] = mapped_column(
+        ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    panel: Mapped[str] = mapped_column(Text, nullable=False)
+    level: Mapped[str] = mapped_column(Text, nullable=False)
+    created_at: Mapped[datetime] = _timestamptz()
+
+    __table_args__ = (UniqueConstraint("user_id", "panel", name="uq_user_panel"),)
+
+
+class UserProjectMembership(Base):
+    """user_project_members — عضویت M:N کاربر در پروژه‌ها، جدا از مسئولیت
+    پروژه (projects.pm_user_id). محدوده‌ی داده‌ی سطح limited را تعیین می‌کند."""
+
+    __tablename__ = "user_project_members"
+
+    id: Mapped[uuid.UUID] = _uuid_pk()
+    user_id: Mapped[uuid.UUID] = mapped_column(
+        ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    project_id: Mapped[uuid.UUID] = mapped_column(
+        ForeignKey("projects.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at: Mapped[datetime] = _timestamptz()
+
+    __table_args__ = (UniqueConstraint("user_id", "project_id", name="uq_user_project_member"),)
+
+
 class Supplier(Base):
     __tablename__ = "suppliers"
 

backend/app/routers/attribute_definitions.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import AttributeDefinition, MaterialAttributeValue, Unit
 from app.models.procurement import LineItemSpec
@@ -14,7 +14,7 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/attribute-definitions", tags=["attribute-definitions"])
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 def attr_def_to_dict(ad: AttributeDefinition, unit: Unit | None = None) -> dict:

backend/app/routers/auth.py

@@ -94,6 +94,6 @@ async def login(request: Request, payload: LoginRequest, db: AsyncSession = Depe
             "access_token": access_token,
             "token_type": "bearer",
             "expires_in": body.get("expires_in"),
-            "user": user_to_dict(ctx.user, projects),
+            "user": await user_to_dict(ctx.user, projects, db),
         }
     }

backend/app/routers/brand_materials.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import Brand, BrandMaterial, Material
 from app.models.procurement import LineItem
@@ -13,7 +13,7 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/brand-materials", tags=["brand-materials"])
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 def bm_to_dict(bm: BrandMaterial, expand: set[str] = frozenset()) -> dict:

backend/app/routers/brands.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import Brand, BrandMaterial
 from app.schemas.catalog import BrandCreate, BrandUpdate
@@ -12,7 +12,7 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/brands", tags=["brands"])
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 def brand_to_dict(brand: Brand) -> dict:

backend/app/routers/inventory.py

@@ -58,6 +58,7 @@ class Scope:
     role: str
     project_id: uuid.UUID | None
     actor: str | None
+    project_ids: list[uuid.UUID] | None = None
 
 
 async def inventory_scope(
@@ -75,11 +76,29 @@ async def inventory_scope(
     if request.headers.get("authorization"):
         user: UserContext = await get_optional_user(request, db)
         if user is not None:
-            if user.role is None:
-                raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
-            # مدیر تدارکات و مدیر پروژه: دسترسی کامل به پنل انبار، اما فقط‌خواندنی در تغییر موجودی
+            panels = user.panels or {}
+            if user.role is None and not panels:
+                raise ForbiddenError("دسترسی شما هنوز در سیستم تعیین نشده است")
+            # ادمین: دست‌نخورده — همه‌چیز از جمله تغییر موجودی
+            if user.role == "admin":
+                return Scope(role="admin", project_id=project_id, actor=user.display_name)
+            # لایه پنل‌ها (جایگزین نقش‌ها): پنل انبار اولویت دارد
+            if "inventory" in panels:
+                if panels["inventory"] == "full":
+                    # کل سیستم و تمام پروژه‌ها — به‌جز تغییر موجودی
+                    return Scope(role="manager", project_id=project_id, actor=user.display_name, project_ids=list(user.member_project_ids or []))
+                # limited: فقط پروژه‌های عضویت + امکان تغییر موجودی
+                allowed = list(user.member_project_ids or [])
+                if not allowed:
+                    raise ForbiddenError("پروژه‌ای به شما تخصیص داده نشده است")
+                if project_id is not None:
+                    if project_id not in allowed:
+                        raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+                    return Scope(role="supervisor", project_id=project_id, actor=user.display_name, project_ids=allowed)
+                return Scope(role="supervisor", project_id=allowed[0], actor=user.display_name, project_ids=allowed)
+            # مدیر تدارکات و مدیر پروژه (میراث): دسترسی کامل به پنل انبار، اما فقط‌خواندنی در تغییر موجودی
             if user.role in ("procurement_manager", "pm"):
-                return Scope(role="manager", project_id=project_id, actor=user.display_name)
+                return Scope(role="manager", project_id=project_id, actor=user.display_name, project_ids=list(user.project_ids or []))
             if user.role == "supervisor":
                 allowed = list(user.project_ids or [])
                 if not allowed:
@@ -87,8 +106,8 @@ async def inventory_scope(
                 if project_id is not None:
                     if project_id not in allowed:
                         raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
-                    return Scope(role="supervisor", project_id=project_id, actor=user.display_name)
-                return Scope(role="supervisor", project_id=allowed[0], actor=user.display_name)
+                    return Scope(role="supervisor", project_id=project_id, actor=user.display_name, project_ids=allowed)
+                return Scope(role="supervisor", project_id=allowed[0], actor=user.display_name, project_ids=allowed)
             if user.role == "admin":
                 return Scope(role="admin", project_id=project_id, actor=user.display_name)
             raise ValidationError("نقش نامعتبر است", field="role")
@@ -215,7 +234,15 @@ async def list_warehouses(
 ):
     stmt = select(Warehouse)
     if scope.role in (ROLE_PM, "supervisor"):
-        stmt = stmt.where(Warehouse.project_id == scope.project_id)  # force PM / supervisor scope
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if project_id is not None:
+            if project_id not in allowed:
+                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+            stmt = stmt.where(Warehouse.project_id == project_id)
+        elif allowed:
+            stmt = stmt.where(Warehouse.project_id.in_(allowed))
+        else:
+            stmt = stmt.where(Warehouse.project_id == scope.project_id)
     elif project_id is not None:
         stmt = stmt.where(Warehouse.project_id == project_id)
     stmt = stmt.order_by(Warehouse.name)
@@ -247,9 +274,11 @@ async def create_warehouse(
     scope: Scope = Depends(inventory_scope),
     db: AsyncSession = Depends(get_db),
 ):
-    # PM: فقط پروژه خودش — Admin: ساختار را مدیریت می‌کند (هر پروژه)
-    if scope.role == ROLE_PM and payload.project_id != scope.project_id:
-        raise ValidationError("PM فقط می‌تواند برای پروژه خودش انبار بسازد", field="project_id")
+    # PM / سرپرست: فقط پروژه خودش — Admin: ساختار را مدیریت می‌کند (هر پروژه)
+    if scope.role in (ROLE_PM, "supervisor"):
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if payload.project_id not in allowed:
+            raise ValidationError("شما فقط می‌توانید برای پروژه تخصیص‌یافته به خود انبار بسازید", field="project_id")
     if await db.get(Project, payload.project_id) is None:
         raise NotFoundError("پروژه یافت نشد", field="project_id")
     wh = Warehouse(project_id=payload.project_id, name=payload.name, description=payload.description)
@@ -266,8 +295,9 @@ async def update_warehouse(
     db: AsyncSession = Depends(get_db),
 ):
     wh = await get_warehouse_or_404(db, warehouse_id)
-    if scope.role == ROLE_PM:
-        if scope.project_id != wh.project_id:
+    if scope.role in (ROLE_PM, "supervisor"):
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if wh.project_id not in allowed:
             raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
     if payload.name is not None:
         wh.name = payload.name
@@ -291,8 +321,10 @@ async def delete_warehouse(
     db: AsyncSession = Depends(get_db),
 ):
     wh = await get_warehouse_or_404(db, warehouse_id)
-    if scope.role == ROLE_PM and scope.project_id != wh.project_id:
-        raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
+    if scope.role in (ROLE_PM, "supervisor"):
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if wh.project_id not in allowed:
+            raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
     # inventory rows cascade via DDL; transactions are RESTRICTed through
     # inventory cascade — block deletion if any stock history exists.
     linked = await db.scalar(
@@ -323,9 +355,21 @@ async def list_inventory(
 ):
     stmt = select(InventoryItem)
     if scope.role in (ROLE_PM, "supervisor"):
-        stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
-            Warehouse.project_id == scope.project_id
-        )
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if project_id is not None:
+            if project_id not in allowed:
+                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+            stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
+                Warehouse.project_id == project_id
+            )
+        elif allowed:
+            stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
+                Warehouse.project_id.in_(allowed)
+            )
+        else:
+            stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
+                Warehouse.project_id == scope.project_id
+            )
     elif project_id is not None:
         stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
             Warehouse.project_id == project_id
@@ -388,7 +432,15 @@ async def list_transactions(
         InventoryItem, InventoryItem.id == InventoryTransaction.inventory_id
     ).join(Warehouse, Warehouse.id == InventoryItem.warehouse_id)
     if scope.role in (ROLE_PM, "supervisor"):
-        stmt = stmt.where(Warehouse.project_id == scope.project_id)
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if project_id is not None:
+            if project_id not in allowed:
+                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+            stmt = stmt.where(Warehouse.project_id == project_id)
+        elif allowed:
+            stmt = stmt.where(Warehouse.project_id.in_(allowed))
+        else:
+            stmt = stmt.where(Warehouse.project_id == scope.project_id)
     elif project_id is not None:
         stmt = stmt.where(Warehouse.project_id == project_id)
     if warehouse_id is not None:
@@ -453,8 +505,10 @@ async def inventory_history(
     if item is None:
         raise NotFoundError("موجودی یافت نشد")
     wh = await get_warehouse_or_404(db, item.warehouse_id)
-    if scope.role in (ROLE_PM, "supervisor") and wh.project_id != scope.project_id:
-        raise ForbiddenError("این موجودی متعلق به پروژه شما نیست")
+    if scope.role in (ROLE_PM, "supervisor"):
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if wh.project_id not in allowed:
+            raise ForbiddenError("این موجودی متعلق به پروژه شما نیست")
     txs = (await db.execute(
         select(InventoryTransaction)
         .where(InventoryTransaction.inventory_id == inventory_id)
@@ -479,12 +533,14 @@ async def create_transaction(
     # commits on success / rolls back on failure.
     with nullcontext():
         wh = await get_warehouse_or_404(db, payload.warehouse_id)
-        if scope.project_id is not None and wh.project_id != scope.project_id:
-            raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
-        if payload.dest_warehouse_id is not None:
-            dest = await get_warehouse_or_404(db, payload.dest_warehouse_id)
-            if scope.project_id is not None and dest.project_id != scope.project_id:
-                raise ForbiddenError("انبار مقصد متعلق به پروژه شما نیست")
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if scope.role in (ROLE_PM, "supervisor"):
+            if wh.project_id not in allowed:
+                raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
+            if payload.dest_warehouse_id is not None:
+                dest = await get_warehouse_or_404(db, payload.dest_warehouse_id)
+                if dest.project_id not in allowed:
+                    raise ForbiddenError("انبار مقصد متعلق به پروژه شما نیست")
         txs = await apply_transaction(db, payload, performed_by=scope.actor)
         await audit_record(
             db,

backend/app/routers/item_receipts.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.procurement import ItemDecision, ItemReceipt, LineItem
 from app.schemas.procurement import ReceiptCreate, ReceiptUpdate
@@ -15,7 +15,7 @@ router = APIRouter(
     prefix="/quotes/{quote_id}/line-items/{line_item_id}/receipt",
     tags=["item-receipts"],
 )
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 async def _line_item_or_404(db: AsyncSession, quote_id, line_item_id) -> LineItem:

backend/app/routers/item_termsheets.py

@@ -7,7 +7,7 @@ from fastapi import APIRouter, Depends
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.procurement import (
     ItemDecision,
@@ -24,7 +24,7 @@ router = APIRouter(
     prefix="/quotes/{quote_id}/line-items/{line_item_id}/termsheets",
     tags=["item-termsheets"],
 )
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 async def _line_item_or_404(db: AsyncSession, quote_id, line_item_id) -> LineItem:

backend/app/routers/line_item_specs.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import AttributeDefinition, Unit
 from app.models.procurement import LineItem, LineItemSpec, Quote
@@ -13,7 +13,7 @@ from app.services.eav_service import flatten_eav_values
 from app.utils.errors import ConflictError, NotFoundError
 
 router = APIRouter(prefix="/quotes/{quote_id}/line-items/{line_item_id}/specs", tags=["line-item-specs"])
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 async def _line_item_or_404(db: AsyncSession, quote_id, line_item_id) -> LineItem:

backend/app/routers/line_items.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import Material, Unit
 from app.models.procurement import ItemDecision, LineItem, Quote
@@ -15,7 +15,7 @@ from app.utils.errors import ConflictError, NotFoundError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/quotes/{quote_id}/line-items", tags=["line-items"])
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 async def _quote_or_404(db: AsyncSession, quote_id) -> Quote:

backend/app/routers/material_categories.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import MaterialCategory
 from app.models.procurement import Supplier
@@ -13,7 +13,7 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/material-categories", tags=["material-categories"])
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 def category_to_dict(category: MaterialCategory) -> dict:

backend/app/routers/materials.py

@@ -9,7 +9,7 @@ from fastapi import APIRouter, Depends, Query, Request
 from sqlalchemy import exists, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import (
     AttributeDefinition,
@@ -39,7 +39,7 @@ from app.utils.errors import ConflictError, NotFoundError, ValidationError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/materials", tags=["materials"])
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 def _coerce_filter_value(data_type: str, raw: str):

backend/app/routers/pm.py

@@ -71,16 +71,17 @@ class ArrivalScope:
     user_id: uuid.UUID | None
     project_id: uuid.UUID | None  # PM's active project; admin: optional filter
     display_name: str
+    project_ids: list[uuid.UUID] | None = None
 
 
 async def arrivals_scope(
     request: Request,
-    project_id: uuid.UUID | None = Query(default=None, description="پروژه فعال (PM: الزامی برای داده‌های پروژه)"),
+    project_id: uuid.UUID | None = Query(default=None, description="پروژه فعال (PM / سرپرست: داده‌های پروژه)"),
     db: AsyncSession = Depends(get_db),
 ) -> ArrivalScope:
     """Resolve the arrivals caller — Casdoor JWT first, dev headers as fallback.
 
-    PM → scoped to the requested project, which must be one they manage
+    PM / supervisor → scoped to the requested project, which must be one they manage
     (projects.pm_user_id, 1:N); without the param, their first project.
     Admin / procurement manager → all projects (param = optional filter).
     """
@@ -89,19 +90,19 @@ async def arrivals_scope(
         if ctx is not None:
             if ctx.role is None:
                 raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
-            if ctx.role == "pm":
+            if ctx.role in ("pm", "supervisor"):
                 allowed = list(ctx.project_ids or [])
                 if project_id is not None:
                     if project_id not in allowed:
                         raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
-                    return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
+                    return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name, project_ids=allowed)
                 if not allowed:
                     raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
-                return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=allowed[0], display_name=ctx.display_name)
+                return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=allowed[0], display_name=ctx.display_name, project_ids=allowed)
             if ctx.role in ("admin", "procurement_manager"):
                 return ArrivalScope(role="admin", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
-            raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است")
-    # Dev fallback: X-User-Role: pm | admin (procurement_manager maps to
+            raise ForbiddenError("این بخش فقط برای مدیر یا سرپرست پروژه و مدیر تدارکات است")
+    # Dev fallback: X-User-Role: pm | supervisor | admin (procurement_manager maps to
     # admin) — ONLY when DEV_LOGIN_ENABLED (local testing without Casdoor).
     # Disabled by default: an ungated header identity in production would
     # let anyone confirm receipts as PM.
@@ -110,8 +111,10 @@ async def arrivals_scope(
     role = (request.headers.get("x-user-role") or "").strip().lower()
     if role == "procurement_manager":
         role = "admin"
+    elif role == "supervisor":
+        role = "pm"
     if role not in ("pm", "admin"):
-        raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است — هدر X-User-Role را بفرستید")
+        raise ForbiddenError("این بخش فقط برای مدیر یا سرپرست پروژه و مدیر تدارکات است — هدر X-User-Role را بفرستید")
     # The explicit query param wins; otherwise the dev header carries it.
     if project_id is None and role == "pm":
         raw_project = request.headers.get("x-project-id")
@@ -189,10 +192,17 @@ async def pm_on_the_way(
         .outerjoin(Project, Project.id == ItemDecision.project_id)
         .where(ItemDecision.status == "chosen")
     )
-    if ctx.role == "pm" and ctx.project_id is None:
-        raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
-    if ctx.project_id is not None:
-        # PM: active project; admin/manager: optional project filter
+    if ctx.role == "pm":
+        allowed = ctx.project_ids or ([ctx.project_id] if ctx.project_id else [])
+        if not allowed:
+            raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
+        if ctx.project_id is not None:
+            if ctx.project_id not in allowed:
+                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+            stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
+        else:
+            stmt = stmt.where(ItemDecision.project_id.in_(allowed))
+    elif ctx.project_id is not None:
         stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
     decisions = (await db.execute(stmt.order_by(ItemDecision.decided_at.desc().nulls_last()))).all()
 
@@ -243,8 +253,12 @@ async def pm_confirm_receipt(
         decision = await db.get(ItemDecision, payload.item_decision_id)
         if decision is None or decision.status != "chosen":
             raise NotFoundError("تصمیم خرید یافت نشد", field="item_decision_id")
-        if ctx.project_id is not None and decision.project_id != ctx.project_id:
-            raise ForbiddenError("این قلم متعلق به پروژه فعال نیست")
+        if ctx.role == "pm":
+            allowed = ctx.project_ids or ([ctx.project_id] if ctx.project_id else [])
+            if decision.project_id not in allowed:
+                raise ForbiddenError("این قلم متعلق به پروژه شما نیست")
+            if ctx.project_id is not None and decision.project_id != ctx.project_id:
+                raise ForbiddenError("این قلم متعلق به پروژه فعال نیست")
 
         li = await db.get(LineItem, decision.line_item_id)
         quote = await db.get(Quote, li.quote_id)
@@ -451,10 +465,17 @@ async def pm_receipts(
         .join(Quote, Quote.id == LineItem.quote_id)
         .join(Project, Project.id == ItemDecision.project_id)
     )
-    if ctx.role == "pm" and ctx.project_id is None:
-        raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
-    if ctx.project_id is not None:
-        # PM: active project; admin/manager: optional project filter
+    if ctx.role == "pm":
+        allowed = ctx.project_ids or ([ctx.project_id] if ctx.project_id else [])
+        if not allowed:
+            raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
+        if ctx.project_id is not None:
+            if ctx.project_id not in allowed:
+                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+            stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
+        else:
+            stmt = stmt.where(ItemDecision.project_id.in_(allowed))
+    elif ctx.project_id is not None:
         stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
     rows = (await db.execute(stmt.order_by(ItemReceipt.received_at.desc()))).all()
     receipts = [r.ItemReceipt for r in rows]

backend/app/routers/projects.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query, Request
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import UserContext, get_optional_user, require_role
+from app.auth import UserContext, get_optional_user, require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.procurement import Project, Quote, User
 from app.schemas.procurement import ProjectCreate, ProjectUpdate
@@ -13,7 +13,7 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_date, to_iso
 
 router = APIRouter(prefix="/projects", tags=["projects"])
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 async def _optional_ctx(request: Request, db: AsyncSession = Depends(get_db)) -> UserContext | None:

backend/app/routers/quote_events.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.procurement import Quote, QuoteEvent
 from app.schemas.procurement import NoteEventIn
@@ -12,7 +12,7 @@ from app.utils.errors import NotFoundError, ValidationError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/quotes/{quote_id}/events", tags=["quote-events"])
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 @router.get("")

backend/app/routers/quotes.py

@@ -8,7 +8,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import exists, func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import UserContext, allow_quote_create, require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import Material
 from app.models.procurement import (
@@ -37,14 +37,14 @@ from app.services.expand_service import (
     serialize_quote_with_children,
     serialize_quotes,
 )
-from app.utils.errors import NotFoundError
+from app.utils.errors import ForbiddenError, NotFoundError, ValidationError
 from app.utils.pagination import sort_query
 from app.utils.security import get_actor
 
 router = APIRouter(prefix="/quotes", tags=["quotes"])
 
 # عملیات نوشتنی تدارکات — فقط ادمین و مدیر تدارکات (مدیر پروژه فقط خواندن دارد)
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 # --- list filter helpers ---------------------------------------------------
@@ -164,8 +164,17 @@ async def create_quote(
     payload: QuoteCreate,
     db: AsyncSession = Depends(get_db),
     actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
+    ctx: UserContext = Depends(allow_quote_create()),
+    _auth=None,
 ):
+    # سطح limited: استعلام فقط برای پروژه‌های عضویت خودش
+    if (ctx.panels or {}).get("procurement") == "limited" and ctx.role != "admin":
+        member = set(ctx.member_project_ids or [])
+        wanted = {pid for pid in ([payload.project_id] + list(payload.project_ids or [])) if pid}
+        if not wanted:
+            raise ValidationError("برای افزودن استعلام، پروژه الزامی است")
+        if not wanted <= member:
+            raise ForbiddenError("استعلام فقط برای پروژه‌های تخصیص‌یافته به شما مجاز است")
     quote = await quote_service.create_quote(db, payload, actor)
     return {"data": await serialize_quote_with_children(db, quote)}
 

backend/app/routers/schedule_steps.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.procurement import Termsheet, TermsheetScheduleStep
 from app.schemas.procurement import ScheduleStepCreate, ScheduleStepUpdate
@@ -16,7 +16,7 @@ router = APIRouter(
     prefix="/quotes/{quote_id}/termsheets/{termsheet_id}/schedule-steps",
     tags=["schedule-steps"],
 )
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 async def _termsheet_or_404(db: AsyncSession, quote_id, termsheet_id) -> Termsheet:

backend/app/routers/standard_conversions.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import StandardConversion
 from app.schemas.catalog import StandardConversionCreate, StandardConversionUpdate
@@ -12,7 +12,7 @@ from app.utils.pagination import paginate
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/standard-conversions", tags=["standard-conversions"])
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 def sc_to_dict(sc: StandardConversion) -> dict:

backend/app/routers/supplier_materials.py

@@ -8,7 +8,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import Material, MaterialCategory
 from app.models.procurement import Supplier, SupplierMaterial
@@ -19,7 +19,7 @@ from app.utils.pagination import paginate
 from app.utils.serialization import to_iso
 
 router = APIRouter(tags=["supplier-materials"])
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 def link_to_dict(link: SupplierMaterial, material: Material | None = None,

backend/app/routers/suppliers.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import MaterialCategory
 from app.models.procurement import Quote, Supplier
@@ -13,7 +13,7 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/suppliers", tags=["suppliers"])
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 def supplier_to_dict(supplier: Supplier, category: MaterialCategory | None = None) -> dict:

backend/app/routers/termsheets.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.procurement import (
     ItemDecision,
@@ -27,7 +27,7 @@ from app.utils.errors import ConflictError, NotFoundError, ValidationError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/quotes/{quote_id}/termsheets", tags=["termsheets"])
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 async def _quote_or_404(db: AsyncSession, quote_id) -> Quote:

backend/app/routers/units.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import AttributeDefinition, Material, MaterialUnit, Unit
 from app.models.procurement import LineItem, LineItemSpec
@@ -12,7 +12,7 @@ from app.utils.errors import ConflictError, NotFoundError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/units", tags=["units"])
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 def unit_full_to_dict(unit: Unit) -> dict:

backend/app/routers/users.py

@@ -17,15 +17,21 @@ import uuid
 
 import httpx
 from fastapi import APIRouter, Depends
-from sqlalchemy import select, update, text
+from sqlalchemy import delete, select, update, text
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.auth import UserContext, get_current_user, require_role
 from app.utils.audit import record as audit_record
 from app.config import settings
 from app.db.engine import get_db
-from app.models.procurement import Project, User
-from app.schemas.procurement import UserCreate, UserProjectUpdate, UserRoleUpdate
+from app.models.procurement import Project, User, UserPanel, UserProjectMembership
+from app.schemas.procurement import (
+    UserCreate,
+    UserPanelsUpdate,
+    UserPanelProjectsUpdate,
+    UserProjectUpdate,
+    UserRoleUpdate,
+)
 from app.utils.errors import (
     ConflictError,
     ForbiddenError,
@@ -46,12 +52,39 @@ USER_ROLE_LABELS = {
 }
 
 
-def user_to_dict(user: User, projects: list[Project] | None = None) -> dict:
+PANEL_LEVELS = ("full", "limited")
+PANELS = ("procurement", "inventory", "pm")
+
+
+async def _panels_of(db: AsyncSession, user_id) -> dict:
+    """panel -> level map for the user (لایه پنل‌ها — جایگزین نقش‌ها)."""
+    rows = (
+        await db.execute(
+            select(UserPanel).where(UserPanel.user_id == user_id).order_by(UserPanel.created_at)
+        )
+    ).scalars().all()
+    return {row.panel: row.level for row in rows}
+
+
+async def _member_project_ids_of(db: AsyncSession, user_id) -> list[str]:
+    """عضویت M:N کاربر در پروژه‌ها (جدا از مسئولیت) — رشته."""
+    rows = (
+        await db.execute(
+            select(UserProjectMembership.project_id)
+            .where(UserProjectMembership.user_id == user_id)
+            .order_by(UserProjectMembership.created_at)
+        )
+    ).scalars().all()
+    return [str(pid) for pid in rows]
+
+
+async def user_to_dict(user: User, projects: list[Project] | None = None, db: AsyncSession | None = None) -> dict:
     """Serialize a user. `projects` = every project the PM manages (1:N);
-    project_id/project_name stay as the first (oldest) one for compatibility."""
+    project_id/project_name stay as the first (oldest) one for compatibility.
+    با db، پنل‌های تخصیصی و عضویت پروژه‌ای هم برمی‌گردند."""
     projects = projects or []
     first = projects[0] if projects else None
-    return {
+    out = {
         "id": str(user.id),
         "casdoor_id": user.casdoor_id,
         "username": user.username,
@@ -65,6 +98,10 @@ def user_to_dict(user: User, projects: list[Project] | None = None) -> dict:
         "projects": [{"id": str(p.id), "name": p.name} for p in projects],
         "created_at": to_iso(user.created_at),
     }
+    if db is not None:
+        out["panels"] = await _panels_of(db, user.id)
+        out["member_project_ids"] = await _member_project_ids_of(db, user.id)
+    return out
 
 
 async def _org_manager(ctx: UserContext = Depends(get_current_user)) -> UserContext:
@@ -130,7 +167,7 @@ async def _casdoor_users() -> list[dict]:
 @router.get("/me")
 async def me(ctx: UserContext = Depends(get_current_user), db: AsyncSession = Depends(get_db)):
     projects = await _user_projects(db, ctx.user)
-    return {"data": user_to_dict(ctx.user, projects)}
+    return {"data": await user_to_dict(ctx.user, projects, db)}
 
 
 @router.get("/me/projects")
@@ -141,6 +178,18 @@ async def my_projects(ctx: UserContext = Depends(get_current_user), db: AsyncSes
     active project against this list and falls back gracefully when a
     project is revoked."""
     projects = await _user_projects(db, ctx.user)
+    # عضویت‌های M:N (لایه پنل‌ها) هم به فهرست اضافه می‌شود
+    member_ids = set(ctx.member_project_ids or [])
+    have = {p.id for p in projects}
+    if member_ids:
+        extra = (
+            await db.execute(
+                select(Project)
+                .where(Project.id.in_(member_ids))
+                .order_by(Project.created_at, Project.id)
+            )
+        ).scalars().all()
+        projects = list(projects) + [p for p in extra if p.id not in have]
     return {"data": [{"id": str(p.id), "name": p.name} for p in projects]}
 
 
@@ -164,7 +213,7 @@ async def list_users(
         for p in projs:
             by_user.setdefault(p.pm_user_id, []).append(p)
     return {
-        "data": [user_to_dict(u, by_user.get(u.id, [])) for u in users],
+        "data": [await user_to_dict(u, by_user.get(u.id, []), db) for u in users],
         "meta": {"total": len(users)},
     }
 
@@ -190,7 +239,7 @@ async def create_user(
     db.add(user)
     await db.flush()
     await audit_record(db, actor=ctx.display_name, action="user.created", entity="user", entity_id=str(user.id), details={"role": payload.role})
-    return {"data": user_to_dict(user)}
+    return {"data": await user_to_dict(user)}
 
 
 @router.patch("/{user_id}")
@@ -213,7 +262,7 @@ async def update_user_role(
     await db.flush()
     await audit_record(db, actor=ctx.display_name, action="user.role_changed", entity="user", entity_id=str(user.id), details={"from": previous_role, "to": payload.role})
     projects = await _user_projects(db, user)
-    return {"data": user_to_dict(user, projects)}
+    return {"data": await user_to_dict(user, projects)}
 
 
 @router.post("/sync")
@@ -273,7 +322,7 @@ async def sync_casdoor_users(
         for p in projs:
             by_user.setdefault(p.pm_user_id, []).append(p)
     return {
-        "data": [user_to_dict(u, by_user.get(u.id, [])) for u in users],
+        "data": [await user_to_dict(u, by_user.get(u.id, []), db) for u in users],
         "meta": {"total": len(users), "created": created},
     }
 
@@ -307,7 +356,7 @@ async def assign_user_project(
                 {"uname": user.username}
             )
         await db.flush()
-        return {"data": user_to_dict(user)}
+        return {"data": await user_to_dict(user)}
 
     project = await db.get(Project, payload.project_id)
     if project is None:
@@ -328,4 +377,63 @@ async def assign_user_project(
             {"pid": project.id, "uname": user.username}
         )
     await db.flush()
-    return {"data": user_to_dict(user, await _user_projects(db, user))}
+    return {"data": await user_to_dict(user, await _user_projects(db, user))}
+
+
+# ---------------------------------------------------------------------------
+# پنل‌ها و سطوح دسترسی — جایگزین مدل نقش برای کاربران عادی
+# ---------------------------------------------------------------------------
+
+
+@router.put("/{user_id}/panels")
+async def set_user_panels(
+    user_id,
+    payload: UserPanelsUpdate,
+    _: UserContext = Depends(require_role("admin")),
+    db: AsyncSession = Depends(get_db),
+):
+    """تخصیص پنل + سطح دسترسی به کاربر — فقط ادمین."""
+    user = await db.get(User, user_id)
+    if user is None:
+        raise NotFoundError("کاربر یافت نشد")
+    for panel, level in payload.panels.items():
+        if panel not in PANELS:
+            raise ValidationError(f"پنل نامعتبر: {panel}", field="panels")
+        if level not in PANEL_LEVELS:
+            raise ValidationError(f"سطح دسترسی نامعتبر: {level}", field="panels")
+    await db.execute(delete(UserPanel).where(UserPanel.user_id == user.id))
+    for panel, level in payload.panels.items():
+        db.add(UserPanel(user_id=user.id, panel=panel, level=level))
+    await db.flush()
+    return {"data": await user_to_dict(user, await _user_projects(db, user), db)}
+
+
+@router.put("/{user_id}/panel-projects")
+async def set_user_panel_projects(
+    user_id,
+    payload: UserPanelProjectsUpdate,
+    _: UserContext = Depends(require_role("admin")),
+    db: AsyncSession = Depends(get_db),
+):
+    """عضویت پروژه‌ای کاربر (M:N) — محدوده داده‌ی سطح limited."""
+    user = await db.get(User, user_id)
+    if user is None:
+        raise NotFoundError("کاربر یافت نشد")
+    wanted = list(dict.fromkeys(payload.project_ids))
+    if wanted:
+        found = (
+            await db.execute(select(Project).where(Project.id.in_(wanted)))
+        ).scalars().all()
+        found_ids = {p.id for p in found}
+        unknown = [str(pid) for pid in wanted if pid not in found_ids]
+        if unknown:
+            raise ValidationError(
+                "پروژه(های) نامعتبر: " + "، ".join(unknown), field="project_ids"
+            )
+    await db.execute(
+        delete(UserProjectMembership).where(UserProjectMembership.user_id == user.id)
+    )
+    for pid in wanted:
+        db.add(UserProjectMembership(user_id=user.id, project_id=pid))
+    await db.flush()
+    return {"data": await user_to_dict(user, await _user_projects(db, user), db)}

backend/app/schemas/procurement.py

@@ -352,3 +352,16 @@ class ReceiptUpdate(APIModel):
     received_qty: Decimal | None = Field(default=None, gt=0)
     on_time: bool | None = None
     quality_note: str | None = None
+
+
+class UserPanelsUpdate(APIModel):
+    """Replace the user's panel assignments. هر پنل: 'full' | 'limited' —
+    پنل غایب یعنی تخصیص نداشتن و کلید آن حذف می‌شود."""
+
+    panels: dict[str, str] = Field(default_factory=dict)
+
+
+class UserPanelProjectsUpdate(APIModel):
+    """Replace the user's project memberships (M:N — جدا از مسئولیت پروژه)."""
+
+    project_ids: list[UUID] = Field(default_factory=list)