feat(inventory): limit supervisor access to own project inventory and remove rectangular change inventory icon

backend/app/routers/inventory.py

@@ -58,6 +58,7 @@ class Scope:
     role: str
     project_id: uuid.UUID | None
     actor: str | None
+    project_ids: list[uuid.UUID] | None = None
 
 
 async def inventory_scope(
@@ -79,7 +80,7 @@ async def inventory_scope(
                 raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
             # مدیر تدارکات و مدیر پروژه: دسترسی کامل به پنل انبار، اما فقط‌خواندنی در تغییر موجودی
             if user.role in ("procurement_manager", "pm"):
-                return Scope(role="manager", project_id=project_id, actor=user.display_name)
+                return Scope(role="manager", project_id=project_id, actor=user.display_name, project_ids=list(user.project_ids or []))
             if user.role == "supervisor":
                 allowed = list(user.project_ids or [])
                 if not allowed:
@@ -87,8 +88,8 @@ async def inventory_scope(
                 if project_id is not None:
                     if project_id not in allowed:
                         raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
-                    return Scope(role="supervisor", project_id=project_id, actor=user.display_name)
-                return Scope(role="supervisor", project_id=allowed[0], actor=user.display_name)
+                    return Scope(role="supervisor", project_id=project_id, actor=user.display_name, project_ids=allowed)
+                return Scope(role="supervisor", project_id=allowed[0], actor=user.display_name, project_ids=allowed)
             if user.role == "admin":
                 return Scope(role="admin", project_id=project_id, actor=user.display_name)
             raise ValidationError("نقش نامعتبر است", field="role")
@@ -214,7 +215,15 @@ async def list_warehouses(
 ):
     stmt = select(Warehouse)
     if scope.role in (ROLE_PM, "supervisor"):
-        stmt = stmt.where(Warehouse.project_id == scope.project_id)  # force PM / supervisor scope
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if project_id is not None:
+            if project_id not in allowed:
+                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+            stmt = stmt.where(Warehouse.project_id == project_id)
+        elif allowed:
+            stmt = stmt.where(Warehouse.project_id.in_(allowed))
+        else:
+            stmt = stmt.where(Warehouse.project_id == scope.project_id)
     elif project_id is not None:
         stmt = stmt.where(Warehouse.project_id == project_id)
     stmt = stmt.order_by(Warehouse.name)
@@ -246,9 +255,11 @@ async def create_warehouse(
     scope: Scope = Depends(inventory_scope),
     db: AsyncSession = Depends(get_db),
 ):
-    # PM: فقط پروژه خودش — Admin: ساختار را مدیریت می‌کند (هر پروژه)
-    if scope.role == ROLE_PM and payload.project_id != scope.project_id:
-        raise ValidationError("PM فقط می‌تواند برای پروژه خودش انبار بسازد", field="project_id")
+    # PM / سرپرست: فقط پروژه خودش — Admin: ساختار را مدیریت می‌کند (هر پروژه)
+    if scope.role in (ROLE_PM, "supervisor"):
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if payload.project_id not in allowed:
+            raise ValidationError("شما فقط می‌توانید برای پروژه تخصیص‌یافته به خود انبار بسازید", field="project_id")
     if await db.get(Project, payload.project_id) is None:
         raise NotFoundError("پروژه یافت نشد", field="project_id")
     wh = Warehouse(project_id=payload.project_id, name=payload.name, description=payload.description)
@@ -265,8 +276,9 @@ async def update_warehouse(
     db: AsyncSession = Depends(get_db),
 ):
     wh = await get_warehouse_or_404(db, warehouse_id)
-    if scope.role == ROLE_PM:
-        if scope.project_id != wh.project_id:
+    if scope.role in (ROLE_PM, "supervisor"):
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if wh.project_id not in allowed:
             raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
     if payload.name is not None:
         wh.name = payload.name
@@ -290,8 +302,10 @@ async def delete_warehouse(
     db: AsyncSession = Depends(get_db),
 ):
     wh = await get_warehouse_or_404(db, warehouse_id)
-    if scope.role == ROLE_PM and scope.project_id != wh.project_id:
-        raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
+    if scope.role in (ROLE_PM, "supervisor"):
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if wh.project_id not in allowed:
+            raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
     # inventory rows cascade via DDL; transactions are RESTRICTed through
     # inventory cascade — block deletion if any stock history exists.
     linked = await db.scalar(
@@ -322,9 +336,21 @@ async def list_inventory(
 ):
     stmt = select(InventoryItem)
     if scope.role in (ROLE_PM, "supervisor"):
-        stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
-            Warehouse.project_id == scope.project_id
-        )
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if project_id is not None:
+            if project_id not in allowed:
+                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+            stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
+                Warehouse.project_id == project_id
+            )
+        elif allowed:
+            stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
+                Warehouse.project_id.in_(allowed)
+            )
+        else:
+            stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
+                Warehouse.project_id == scope.project_id
+            )
     elif project_id is not None:
         stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
             Warehouse.project_id == project_id
@@ -387,7 +413,15 @@ async def list_transactions(
         InventoryItem, InventoryItem.id == InventoryTransaction.inventory_id
     ).join(Warehouse, Warehouse.id == InventoryItem.warehouse_id)
     if scope.role in (ROLE_PM, "supervisor"):
-        stmt = stmt.where(Warehouse.project_id == scope.project_id)
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if project_id is not None:
+            if project_id not in allowed:
+                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+            stmt = stmt.where(Warehouse.project_id == project_id)
+        elif allowed:
+            stmt = stmt.where(Warehouse.project_id.in_(allowed))
+        else:
+            stmt = stmt.where(Warehouse.project_id == scope.project_id)
     elif project_id is not None:
         stmt = stmt.where(Warehouse.project_id == project_id)
     if warehouse_id is not None:
@@ -452,8 +486,10 @@ async def inventory_history(
     if item is None:
         raise NotFoundError("موجودی یافت نشد")
     wh = await get_warehouse_or_404(db, item.warehouse_id)
-    if scope.role in (ROLE_PM, "supervisor") and wh.project_id != scope.project_id:
-        raise ForbiddenError("این موجودی متعلق به پروژه شما نیست")
+    if scope.role in (ROLE_PM, "supervisor"):
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if wh.project_id not in allowed:
+            raise ForbiddenError("این موجودی متعلق به پروژه شما نیست")
     txs = (await db.execute(
         select(InventoryTransaction)
         .where(InventoryTransaction.inventory_id == inventory_id)
@@ -478,12 +514,14 @@ async def create_transaction(
     # commits on success / rolls back on failure.
     with nullcontext():
         wh = await get_warehouse_or_404(db, payload.warehouse_id)
-        if scope.project_id is not None and wh.project_id != scope.project_id:
-            raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
-        if payload.dest_warehouse_id is not None:
-            dest = await get_warehouse_or_404(db, payload.dest_warehouse_id)
-            if scope.project_id is not None and dest.project_id != scope.project_id:
-                raise ForbiddenError("انبار مقصد متعلق به پروژه شما نیست")
+        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
+        if scope.role in (ROLE_PM, "supervisor"):
+            if wh.project_id not in allowed:
+                raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
+            if payload.dest_warehouse_id is not None:
+                dest = await get_warehouse_or_404(db, payload.dest_warehouse_id)
+                if dest.project_id not in allowed:
+                    raise ForbiddenError("انبار مقصد متعلق به پروژه شما نیست")
         txs = await apply_transaction(db, payload, performed_by=scope.actor)
         await audit_record(
             db,