feat(rbac): enforce procurement write restrictions and support supervisor role in SSO

backend/app/routers/quotes.py

@@ -8,6 +8,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import exists, func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import Material
 from app.models.procurement import (
@@ -42,6 +43,9 @@ from app.utils.security import get_actor
 
 router = APIRouter(prefix="/quotes", tags=["quotes"])
 
+# عملیات نوشتنی تدارکات — فقط ادمین و مدیر تدارکات (مدیر پروژه فقط خواندن دارد)
+_procurement_writer = require_role("admin", "procurement_manager")
+
 
 # --- list filter helpers ---------------------------------------------------
 
@@ -156,7 +160,12 @@ async def get_quote(quote_id, expand: str | None = None, db: AsyncSession = Depe
 # ---------------------------------------------------------------------------
 
 @router.post("", status_code=201)
-async def create_quote(payload: QuoteCreate, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)):
+async def create_quote(
+    payload: QuoteCreate,
+    db: AsyncSession = Depends(get_db),
+    actor: str = Depends(get_actor),
+    _auth=Depends(_procurement_writer),
+):
     quote = await quote_service.create_quote(db, payload, actor)
     return {"data": await serialize_quote_with_children(db, quote)}
 
@@ -167,7 +176,11 @@ async def create_quote(payload: QuoteCreate, db: AsyncSession = Depends(get_db),
 
 @router.patch("/{quote_id}")
 async def update_quote(
-    quote_id, payload: QuoteUpdate, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
+    quote_id,
+    payload: QuoteUpdate,
+    db: AsyncSession = Depends(get_db),
+    actor: str = Depends(get_actor),
+    _auth=Depends(_procurement_writer),
 ):
     quote = await quote_service.update_quote(db, quote_id, payload, actor)
     return {"data": await serialize_quote(db, quote, set())}
@@ -175,7 +188,11 @@ async def update_quote(
 
 @router.patch("/{quote_id}/children")
 async def replace_quote_children(
-    quote_id, payload: QuoteChildrenReplaceIn, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
+    quote_id,
+    payload: QuoteChildrenReplaceIn,
+    db: AsyncSession = Depends(get_db),
+    actor: str = Depends(get_actor),
+    _auth=Depends(_procurement_writer),
 ):
     """Full replacement of a quote's line items + termsheets (edit modal)."""
     quote = await quote_service.replace_quote_children(db, quote_id, payload, actor)
@@ -188,7 +205,11 @@ async def replace_quote_children(
 
 @router.patch("/{quote_id}/accept")
 async def accept_quote(
-    quote_id, payload: AcceptQuoteIn, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
+    quote_id,
+    payload: AcceptQuoteIn,
+    db: AsyncSession = Depends(get_db),
+    actor: str = Depends(get_actor),
+    _auth=Depends(_procurement_writer),
 ):
     quote = await quote_service.accept_quote(db, quote_id, payload, actor)
     return {"data": await _accept_response(db, quote)}
@@ -224,7 +245,12 @@ async def _accept_response(db: AsyncSession, quote: Quote) -> dict:
 
 
 @router.patch("/{quote_id}/arrive")
-async def arrive_quote(quote_id, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)):
+async def arrive_quote(
+    quote_id,
+    db: AsyncSession = Depends(get_db),
+    actor: str = Depends(get_actor),
+    _auth=Depends(_procurement_writer),
+):
     quote = await quote_service.arrive_quote(db, quote_id, actor)
     return {
         "data": {
@@ -237,7 +263,11 @@ async def arrive_quote(quote_id, db: AsyncSession = Depends(get_db), actor: str
 
 @router.patch("/{quote_id}/arrive-items")
 async def arrive_items(
-    quote_id, payload: ArriveItemsIn, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
+    quote_id,
+    payload: ArriveItemsIn,
+    db: AsyncSession = Depends(get_db),
+    actor: str = Depends(get_actor),
+    _auth=Depends(_procurement_writer),
 ):
     quote = await quote_service.arrive_items(db, quote_id, payload, actor)
     return {
@@ -259,14 +289,23 @@ async def arrive_items(
 
 @router.patch("/{quote_id}/reject")
 async def reject_quote(
-    quote_id, payload: RejectQuoteIn | None = None, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
+    quote_id,
+    payload: RejectQuoteIn | None = None,
+    db: AsyncSession = Depends(get_db),
+    actor: str = Depends(get_actor),
+    _auth=Depends(_procurement_writer),
 ):
     quote = await quote_service.reject_quote(db, quote_id, payload or RejectQuoteIn(), actor)
     return {"data": {"id": str(quote.id), "status": quote.status}}
 
 
 @router.patch("/{quote_id}/expire")
-async def expire_quote(quote_id, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)):
+async def expire_quote(
+    quote_id,
+    db: AsyncSession = Depends(get_db),
+    actor: str = Depends(get_actor),
+    _auth=Depends(_procurement_writer),
+):
     quote = await quote_service.expire_quote(db, quote_id, actor)
     return {"data": {"id": str(quote.id), "status": quote.status}}
 
@@ -276,6 +315,10 @@ async def expire_quote(quote_id, db: AsyncSession = Depends(get_db), actor: str
 # ---------------------------------------------------------------------------
 
 @router.delete("/{quote_id}")
-async def delete_quote(quote_id, db: AsyncSession = Depends(get_db)):
+async def delete_quote(
+    quote_id,
+    db: AsyncSession = Depends(get_db),
+    _auth=Depends(_procurement_writer),
+):
     result = await quote_service.delete_quote(db, quote_id)
     return {"data": result}