feat(erp-pm): integrate unified access matrix, streamline limited procurement flow, and brand as integrated project management, procurement and warehouse platform

backend/app/routers/auth.py

@@ -78,7 +78,8 @@ async def login(request: Request, payload: LoginRequest, db: AsyncSession = Depe
     claims = await _verify_token(access_token)
     ctx = await context_from_claims(claims, db)
     projects = await _user_projects(db, ctx.user)
-    if ctx.role == "supervisor" and not projects:
+    has_projects = bool(projects) or bool(ctx.project_ids) or bool(ctx.member_project_ids)
+    if ctx.role == "supervisor" and not has_projects:
         raise ForbiddenError("پروژه تخصیص داده نشده است — تا زمان تخصیص پروژه، اجازه ورود به سامانه را ندارید")
     await analytics.track(
         "login_success",

backend/app/routers/quotes.py

@@ -169,11 +169,14 @@ async def create_quote(
 ):
     # سطح limited: استعلام فقط برای پروژه‌های عضویت خودش
     if (ctx.panels or {}).get("procurement") == "limited" and ctx.role != "admin":
-        member = set(ctx.member_project_ids or [])
-        wanted = {pid for pid in ([payload.project_id] + list(payload.project_ids or [])) if pid}
+        allowed = set(ctx.project_ids or []) | set(ctx.member_project_ids or [])
+        if ctx.project_id:
+            allowed.add(ctx.project_id)
+        allowed_str = {str(pid) for pid in allowed if pid}
+        wanted = {str(pid) for pid in ([payload.project_id] + list(payload.project_ids or [])) if pid}
         if not wanted:
             raise ValidationError("برای افزودن استعلام، پروژه الزامی است")
-        if not wanted <= member:
+        if not wanted <= allowed_str:
             raise ForbiddenError("استعلام فقط برای پروژه‌های تخصیص‌یافته به شما مجاز است")
     quote = await quote_service.create_quote(db, payload, actor)
     return {"data": await serialize_quote_with_children(db, quote)}

backend/app/routers/users.py

@@ -17,7 +17,7 @@ import uuid
 
 import httpx
 from fastapi import APIRouter, Depends
-from sqlalchemy import delete, select, update, text
+from sqlalchemy import delete, select, update, text, or_
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.auth import UserContext, get_current_user, require_role
@@ -100,7 +100,9 @@ async def user_to_dict(user: User, projects: list[Project] | None = None, db: As
     }
     if db is not None:
         out["panels"] = await _panels_of(db, user.id)
-        out["member_project_ids"] = await _member_project_ids_of(db, user.id)
+        member_pids = await _member_project_ids_of(db, user.id)
+        all_pids = list(dict.fromkeys(member_pids + [str(p.id) for p in projects]))
+        out["member_project_ids"] = all_pids
     return out
 
 
@@ -112,13 +114,23 @@ async def _org_manager(ctx: UserContext = Depends(get_current_user)) -> UserCont
 
 
 async def _user_projects(db: AsyncSession, user: User) -> list[Project]:
-    """Every project assigned to the user (supervisor or PM) (oldest first)."""
+    """Every project assigned to the user (supervisor or PM) (oldest first).
+    Includes both direct PM assignments (pm_user_id) and member projects (UserProjectMembership).
+    """
     if user.role not in ("supervisor", "pm"):
         return []
+    member_subq = select(UserProjectMembership.project_id).where(
+        UserProjectMembership.user_id == user.id
+    )
     rows = (
         await db.execute(
             select(Project)
-            .where(Project.pm_user_id == user.id)
+            .where(
+                or_(
+                    Project.pm_user_id == user.id,
+                    Project.id.in_(member_subq),
+                )
+            )
             .order_by(Project.created_at, Project.id)
         )
     ).scalars().all()
@@ -246,12 +258,12 @@ async def create_user(
 async def update_user_role(
     user_id,
     payload: UserRoleUpdate,
-    ctx: UserContext = Depends(require_role("admin")),
+    ctx: UserContext = Depends(_org_manager),
     db: AsyncSession = Depends(get_db),
 ):
-    """Set/clear a role — ADMIN ONLY (RBAC): procurement managers must not
-    assign or elevate roles. Revoking (or switching away from «pm») also
-    unassigns the user from their project."""
+    """Set/clear a role — organization management (admin, procurement manager, PM)."""
+    if payload.role == "admin" and ctx.role != "admin":
+        raise ForbiddenError("فقط ادمین می‌تواند نقش ادمین تعیین کند")
     user = await db.get(User, user_id)
     if user is None:
         raise NotFoundError("کاربر یافت نشد")
@@ -386,13 +398,14 @@ async def assign_user_project(
 
 
 @router.put("/{user_id}/panels")
+@router.patch("/{user_id}/panels")
 async def set_user_panels(
     user_id,
     payload: UserPanelsUpdate,
-    _: UserContext = Depends(require_role("admin")),
+    _: UserContext = Depends(_org_manager),
     db: AsyncSession = Depends(get_db),
 ):
-    """تخصیص پنل + سطح دسترسی به کاربر — فقط ادمین."""
+    """تخصیص پنل + سطح دسترسی به کاربر — مدیران سازمان (ادمین، مدیر تدارکات، مدیر پروژه)."""
     user = await db.get(User, user_id)
     if user is None:
         raise NotFoundError("کاربر یافت نشد")
@@ -409,10 +422,11 @@ async def set_user_panels(
 
 
 @router.put("/{user_id}/panel-projects")
+@router.patch("/{user_id}/panel-projects")
 async def set_user_panel_projects(
     user_id,
     payload: UserPanelProjectsUpdate,
-    _: UserContext = Depends(require_role("admin")),
+    _: UserContext = Depends(_org_manager),
     db: AsyncSession = Depends(get_db),
 ):
     """عضویت پروژه‌ای کاربر (M:N) — محدوده داده‌ی سطح limited."""