feat(inventory): limit supervisor access to own project inventory and remove rectangular change inventory icon

2026-09-27 18:42:05 +03:30
parent 387edfb1ab
commit c7d860f431
9 changed files with 138 additions and 73 deletions
@@ -58,6 +58,7 @@ class Scope:
    role: str
    project_id: uuid.UUID | None
    actor: str | None
+    project_ids: list[uuid.UUID] | None = None


 async def inventory_scope(
@@ -79,7 +80,7 @@ async def inventory_scope(
                raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
            # مدیر تدارکات و مدیر پروژه: دسترسی کامل به پنل انبار، اما فقط‌خواندنی در تغییر موجودی
            if user.role in ("procurement_manager", "pm"):
-                return Scope(role="manager", project_id=project_id, actor=user.display_name)
+                return Scope(role="manager", project_id=project_id, actor=user.display_name, project_ids=list(user.project_ids or []))
            if user.role == "supervisor":
                allowed = list(user.project_ids or [])
                if not allowed:
@@ -87,8 +88,8 @@ async def inventory_scope(
                if project_id is not None:
                    if project_id not in allowed:
                        raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
-                    return Scope(role="supervisor", project_id=project_id, actor=user.display_name)
-                return Scope(role="supervisor", project_id=allowed[0], actor=user.display_name)
+                    return Scope(role="supervisor", project_id=project_id, actor=user.display_name, project_ids=allowed)
+                return Scope(role="supervisor", project_id=allowed[0], actor=user.display_name, project_ids=allowed)
            if user.role == "admin":
                return Scope(role="admin", project_id=project_id, actor=user.display_name)
            raise ValidationError("نقش نامعتبر است", field="role")
@@ -214,7 +215,15 @@ async def list_warehouses(
 ):
    stmt = select(Warehouse)
    if scope.role in (ROLE_PM, "supervisor"):
-        stmt = stmt.where(Warehouse.project_id == scope.project_id)  # force PM / supervisor scope
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if project_id is not None:
+            if project_id not in allowed:
+                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+            stmt = stmt.where(Warehouse.project_id == project_id)
+        elif allowed:
+            stmt = stmt.where(Warehouse.project_id.in_(allowed))
+        else:
+            stmt = stmt.where(Warehouse.project_id == scope.project_id)
    elif project_id is not None:
        stmt = stmt.where(Warehouse.project_id == project_id)
    stmt = stmt.order_by(Warehouse.name)
@@ -246,9 +255,11 @@ async def create_warehouse(
    scope: Scope = Depends(inventory_scope),
    db: AsyncSession = Depends(get_db),
 ):
-    # PM: فقط پروژه خودش — Admin: ساختار را مدیریت می‌کند (هر پروژه)
-    if scope.role == ROLE_PM and payload.project_id != scope.project_id:
-        raise ValidationError("PM فقط می‌تواند برای پروژه خودش انبار بسازد", field="project_id")
+    # PM / سرپرست: فقط پروژه خودش — Admin: ساختار را مدیریت می‌کند (هر پروژه)
+    if scope.role in (ROLE_PM, "supervisor"):
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if payload.project_id not in allowed:
+            raise ValidationError("شما فقط می‌توانید برای پروژه تخصیص‌یافته به خود انبار بسازید", field="project_id")
    if await db.get(Project, payload.project_id) is None:
        raise NotFoundError("پروژه یافت نشد", field="project_id")
    wh = Warehouse(project_id=payload.project_id, name=payload.name, description=payload.description)
@@ -265,8 +276,9 @@ async def update_warehouse(
    db: AsyncSession = Depends(get_db),
 ):
    wh = await get_warehouse_or_404(db, warehouse_id)
-    if scope.role == ROLE_PM:
-        if scope.project_id != wh.project_id:
+    if scope.role in (ROLE_PM, "supervisor"):
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if wh.project_id not in allowed:
            raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
    if payload.name is not None:
        wh.name = payload.name
@@ -290,8 +302,10 @@ async def delete_warehouse(
    db: AsyncSession = Depends(get_db),
 ):
    wh = await get_warehouse_or_404(db, warehouse_id)
-    if scope.role == ROLE_PM and scope.project_id != wh.project_id:
-        raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
+    if scope.role in (ROLE_PM, "supervisor"):
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if wh.project_id not in allowed:
+            raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
    # inventory rows cascade via DDL; transactions are RESTRICTed through
    # inventory cascade — block deletion if any stock history exists.
    linked = await db.scalar(
@@ -322,9 +336,21 @@ async def list_inventory(
 ):
    stmt = select(InventoryItem)
    if scope.role in (ROLE_PM, "supervisor"):
-        stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
-            Warehouse.project_id == scope.project_id
-        )
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if project_id is not None:
+            if project_id not in allowed:
+                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+            stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
+                Warehouse.project_id == project_id
+            )
+        elif allowed:
+            stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
+                Warehouse.project_id.in_(allowed)
+            )
+        else:
+            stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
+                Warehouse.project_id == scope.project_id
+            )
    elif project_id is not None:
        stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
            Warehouse.project_id == project_id
@@ -387,7 +413,15 @@ async def list_transactions(
        InventoryItem, InventoryItem.id == InventoryTransaction.inventory_id
    ).join(Warehouse, Warehouse.id == InventoryItem.warehouse_id)
    if scope.role in (ROLE_PM, "supervisor"):
-        stmt = stmt.where(Warehouse.project_id == scope.project_id)
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if project_id is not None:
+            if project_id not in allowed:
+                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+            stmt = stmt.where(Warehouse.project_id == project_id)
+        elif allowed:
+            stmt = stmt.where(Warehouse.project_id.in_(allowed))
+        else:
+            stmt = stmt.where(Warehouse.project_id == scope.project_id)
    elif project_id is not None:
        stmt = stmt.where(Warehouse.project_id == project_id)
    if warehouse_id is not None:
@@ -452,8 +486,10 @@ async def inventory_history(
    if item is None:
        raise NotFoundError("موجودی یافت نشد")
    wh = await get_warehouse_or_404(db, item.warehouse_id)
-    if scope.role in (ROLE_PM, "supervisor") and wh.project_id != scope.project_id:
-        raise ForbiddenError("این موجودی متعلق به پروژه شما نیست")
+    if scope.role in (ROLE_PM, "supervisor"):
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if wh.project_id not in allowed:
+            raise ForbiddenError("این موجودی متعلق به پروژه شما نیست")
    txs = (await db.execute(
        select(InventoryTransaction)
        .where(InventoryTransaction.inventory_id == inventory_id)
@@ -478,12 +514,14 @@ async def create_transaction(
    # commits on success / rolls back on failure.
    with nullcontext():
        wh = await get_warehouse_or_404(db, payload.warehouse_id)
-        if scope.project_id is not None and wh.project_id != scope.project_id:
-            raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
-        if payload.dest_warehouse_id is not None:
-            dest = await get_warehouse_or_404(db, payload.dest_warehouse_id)
-            if scope.project_id is not None and dest.project_id != scope.project_id:
-                raise ForbiddenError("انبار مقصد متعلق به پروژه شما نیست")
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if scope.role in (ROLE_PM, "supervisor"):
+            if wh.project_id not in allowed:
+                raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
+            if payload.dest_warehouse_id is not None:
+                dest = await get_warehouse_or_404(db, payload.dest_warehouse_id)
+                if dest.project_id not in allowed:
+                    raise ForbiddenError("انبار مقصد متعلق به پروژه شما نیست")
        txs = await apply_transaction(db, payload, performed_by=scope.actor)
        await audit_record(
            db,
@@ -71,16 +71,17 @@ class ArrivalScope:
    user_id: uuid.UUID | None
    project_id: uuid.UUID | None  # PM's active project; admin: optional filter
    display_name: str
+    project_ids: list[uuid.UUID] | None = None


 async def arrivals_scope(
    request: Request,
-    project_id: uuid.UUID | None = Query(default=None, description="پروژه فعال (PM: الزامی برای داده‌های پروژه)"),
+    project_id: uuid.UUID | None = Query(default=None, description="پروژه فعال (PM / سرپرست: داده‌های پروژه)"),
    db: AsyncSession = Depends(get_db),
 ) -> ArrivalScope:
    """Resolve the arrivals caller — Casdoor JWT first, dev headers as fallback.

-    PM → scoped to the requested project, which must be one they manage
+    PM / supervisor → scoped to the requested project, which must be one they manage
    (projects.pm_user_id, 1:N); without the param, their first project.
    Admin / procurement manager → all projects (param = optional filter).
    """
@@ -89,19 +90,19 @@ async def arrivals_scope(
        if ctx is not None:
            if ctx.role is None:
                raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
-            if ctx.role == "pm":
+            if ctx.role in ("pm", "supervisor"):
                allowed = list(ctx.project_ids or [])
                if project_id is not None:
                    if project_id not in allowed:
                        raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
-                    return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
+                    return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name, project_ids=allowed)
                if not allowed:
                    raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
-                return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=allowed[0], display_name=ctx.display_name)
+                return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=allowed[0], display_name=ctx.display_name, project_ids=allowed)
            if ctx.role in ("admin", "procurement_manager"):
                return ArrivalScope(role="admin", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
-            raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است")
-    # Dev fallback: X-User-Role: pm | admin (procurement_manager maps to
+            raise ForbiddenError("این بخش فقط برای مدیر یا سرپرست پروژه و مدیر تدارکات است")
+    # Dev fallback: X-User-Role: pm | supervisor | admin (procurement_manager maps to
    # admin) — ONLY when DEV_LOGIN_ENABLED (local testing without Casdoor).
    # Disabled by default: an ungated header identity in production would
    # let anyone confirm receipts as PM.
@@ -110,8 +111,10 @@ async def arrivals_scope(
    role = (request.headers.get("x-user-role") or "").strip().lower()
    if role == "procurement_manager":
        role = "admin"
+    elif role == "supervisor":
+        role = "pm"
    if role not in ("pm", "admin"):
-        raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است — هدر X-User-Role را بفرستید")
+        raise ForbiddenError("این بخش فقط برای مدیر یا سرپرست پروژه و مدیر تدارکات است — هدر X-User-Role را بفرستید")
    # The explicit query param wins; otherwise the dev header carries it.
    if project_id is None and role == "pm":
        raw_project = request.headers.get("x-project-id")
@@ -189,10 +192,17 @@ async def pm_on_the_way(
        .outerjoin(Project, Project.id == ItemDecision.project_id)
        .where(ItemDecision.status == "chosen")
    )
-    if ctx.role == "pm" and ctx.project_id is None:
-        raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
-    if ctx.project_id is not None:
-        # PM: active project; admin/manager: optional project filter
+    if ctx.role == "pm":
+        allowed = ctx.project_ids or ([ctx.project_id] if ctx.project_id else [])
+        if not allowed:
+            raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
+        if ctx.project_id is not None:
+            if ctx.project_id not in allowed:
+                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+            stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
+        else:
+            stmt = stmt.where(ItemDecision.project_id.in_(allowed))
+    elif ctx.project_id is not None:
        stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
    decisions = (await db.execute(stmt.order_by(ItemDecision.decided_at.desc().nulls_last()))).all()

@@ -243,8 +253,12 @@ async def pm_confirm_receipt(
        decision = await db.get(ItemDecision, payload.item_decision_id)
        if decision is None or decision.status != "chosen":
            raise NotFoundError("تصمیم خرید یافت نشد", field="item_decision_id")
-        if ctx.project_id is not None and decision.project_id != ctx.project_id:
-            raise ForbiddenError("این قلم متعلق به پروژه فعال نیست")
+        if ctx.role == "pm":
+            allowed = ctx.project_ids or ([ctx.project_id] if ctx.project_id else [])
+            if decision.project_id not in allowed:
+                raise ForbiddenError("این قلم متعلق به پروژه شما نیست")
+            if ctx.project_id is not None and decision.project_id != ctx.project_id:
+                raise ForbiddenError("این قلم متعلق به پروژه فعال نیست")

        li = await db.get(LineItem, decision.line_item_id)
        quote = await db.get(Quote, li.quote_id)
@@ -451,10 +465,17 @@ async def pm_receipts(
        .join(Quote, Quote.id == LineItem.quote_id)
        .join(Project, Project.id == ItemDecision.project_id)
    )
-    if ctx.role == "pm" and ctx.project_id is None:
-        raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
-    if ctx.project_id is not None:
-        # PM: active project; admin/manager: optional project filter
+    if ctx.role == "pm":
+        allowed = ctx.project_ids or ([ctx.project_id] if ctx.project_id else [])
+        if not allowed:
+            raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
+        if ctx.project_id is not None:
+            if ctx.project_id not in allowed:
+                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+            stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
+        else:
+            stmt = stmt.where(ItemDecision.project_id.in_(allowed))
+    elif ctx.project_id is not None:
        stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
    rows = (await db.execute(stmt.order_by(ItemReceipt.received_at.desc()))).all()
    receipts = [r.ItemReceipt for r in rows]