feat(rbac): enforce procurement write restrictions and support supervisor role in SSO

backend/app/routers/brand_materials.py

@@ -3,6 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import Brand, BrandMaterial, Material
 from app.models.procurement import LineItem
@@ -12,6 +13,7 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/brand-materials", tags=["brand-materials"])
+_procurement_writer = require_role("admin", "procurement_manager")
 
 
 def bm_to_dict(bm: BrandMaterial, expand: set[str] = frozenset()) -> dict:
@@ -70,7 +72,11 @@ async def list_brand_materials(
 
 
 @router.post("", status_code=201)
-async def create_brand_material(payload: BrandMaterialCreate, db: AsyncSession = Depends(get_db)):
+async def create_brand_material(
+    payload: BrandMaterialCreate,
+    db: AsyncSession = Depends(get_db),
+    _auth=Depends(_procurement_writer),
+):
     if await db.get(Brand, payload.brand_id) is None:
         raise NotFoundError("برند یافت نشد", field="brand_id")
     if await db.get(Material, payload.material_id) is None:
@@ -107,7 +113,12 @@ async def get_brand_material(bm_id, expand: str | None = None, db: AsyncSession
 
 
 @router.patch("/{bm_id}")
-async def update_brand_material(bm_id, payload: BrandMaterialUpdate, db: AsyncSession = Depends(get_db)):
+async def update_brand_material(
+    bm_id,
+    payload: BrandMaterialUpdate,
+    db: AsyncSession = Depends(get_db),
+    _auth=Depends(_procurement_writer),
+):
     bm = await db.get(BrandMaterial, bm_id)
     if bm is None:
         raise NotFoundError("ارتباط برند-متریال یافت نشد")
@@ -120,7 +131,11 @@ async def update_brand_material(bm_id, payload: BrandMaterialUpdate, db: AsyncSe
 
 
 @router.delete("/{bm_id}")
-async def delete_brand_material(bm_id, db: AsyncSession = Depends(get_db)):
+async def delete_brand_material(
+    bm_id,
+    db: AsyncSession = Depends(get_db),
+    _auth=Depends(_procurement_writer),
+):
     bm = await db.get(BrandMaterial, bm_id)
     if bm is None:
         raise NotFoundError("ارتباط برند-متریال یافت نشد")