feat(rbac): enforce procurement write restrictions and support supervisor role in SSO

backend/app/routers/brands.py

@@ -3,6 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import Brand, BrandMaterial
 from app.schemas.catalog import BrandCreate, BrandUpdate
@@ -11,6 +12,7 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/brands", tags=["brands"])
+_procurement_writer = require_role("admin", "procurement_manager")
 
 
 def brand_to_dict(brand: Brand) -> dict:
@@ -42,7 +44,11 @@ async def list_brands(
 
 
 @router.post("", status_code=201)
-async def create_brand(payload: BrandCreate, db: AsyncSession = Depends(get_db)):
+async def create_brand(
+    payload: BrandCreate,
+    db: AsyncSession = Depends(get_db),
+    _auth=Depends(_procurement_writer),
+):
     rows = (await db.execute(select(Brand).where(Brand.name == payload.name))).scalars().all()
     if any(b.country == payload.country for b in rows):
         raise ConflictError("برندی با این نام و کشور قبلاً ثبت شده است")
@@ -61,7 +67,12 @@ async def get_brand(brand_id, db: AsyncSession = Depends(get_db)):
 
 
 @router.patch("/{brand_id}")
-async def update_brand(brand_id, payload: BrandUpdate, db: AsyncSession = Depends(get_db)):
+async def update_brand(
+    brand_id,
+    payload: BrandUpdate,
+    db: AsyncSession = Depends(get_db),
+    _auth=Depends(_procurement_writer),
+):
     brand = await db.get(Brand, brand_id)
     if brand is None:
         raise NotFoundError("برند یافت نشد")
@@ -79,7 +90,11 @@ async def update_brand(brand_id, payload: BrandUpdate, db: AsyncSession = Depend
 
 
 @router.delete("/{brand_id}")
-async def delete_brand(brand_id, db: AsyncSession = Depends(get_db)):
+async def delete_brand(
+    brand_id,
+    db: AsyncSession = Depends(get_db),
+    _auth=Depends(_procurement_writer),
+):
     brand = await db.get(Brand, brand_id)
     if brand is None:
         raise NotFoundError("برند یافت نشد")