feat(erp-pm): integrate unified access matrix, streamline limited procurement flow, and brand as integrated project management, procurement and warehouse platform

backend/app/routers/users.py

@@ -17,7 +17,7 @@ import uuid
 
 import httpx
 from fastapi import APIRouter, Depends
-from sqlalchemy import delete, select, update, text
+from sqlalchemy import delete, select, update, text, or_
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.auth import UserContext, get_current_user, require_role
@@ -100,7 +100,9 @@ async def user_to_dict(user: User, projects: list[Project] | None = None, db: As
     }
     if db is not None:
         out["panels"] = await _panels_of(db, user.id)
-        out["member_project_ids"] = await _member_project_ids_of(db, user.id)
+        member_pids = await _member_project_ids_of(db, user.id)
+        all_pids = list(dict.fromkeys(member_pids + [str(p.id) for p in projects]))
+        out["member_project_ids"] = all_pids
     return out
 
 
@@ -112,13 +114,23 @@ async def _org_manager(ctx: UserContext = Depends(get_current_user)) -> UserCont
 
 
 async def _user_projects(db: AsyncSession, user: User) -> list[Project]:
-    """Every project assigned to the user (supervisor or PM) (oldest first)."""
+    """Every project assigned to the user (supervisor or PM) (oldest first).
+    Includes both direct PM assignments (pm_user_id) and member projects (UserProjectMembership).
+    """
     if user.role not in ("supervisor", "pm"):
         return []
+    member_subq = select(UserProjectMembership.project_id).where(
+        UserProjectMembership.user_id == user.id
+    )
     rows = (
         await db.execute(
             select(Project)
-            .where(Project.pm_user_id == user.id)
+            .where(
+                or_(
+                    Project.pm_user_id == user.id,
+                    Project.id.in_(member_subq),
+                )
+            )
             .order_by(Project.created_at, Project.id)
         )
     ).scalars().all()
@@ -246,12 +258,12 @@ async def create_user(
 async def update_user_role(
     user_id,
     payload: UserRoleUpdate,
-    ctx: UserContext = Depends(require_role("admin")),
+    ctx: UserContext = Depends(_org_manager),
     db: AsyncSession = Depends(get_db),
 ):
-    """Set/clear a role — ADMIN ONLY (RBAC): procurement managers must not
-    assign or elevate roles. Revoking (or switching away from «pm») also
-    unassigns the user from their project."""
+    """Set/clear a role — organization management (admin, procurement manager, PM)."""
+    if payload.role == "admin" and ctx.role != "admin":
+        raise ForbiddenError("فقط ادمین می‌تواند نقش ادمین تعیین کند")
     user = await db.get(User, user_id)
     if user is None:
         raise NotFoundError("کاربر یافت نشد")
@@ -386,13 +398,14 @@ async def assign_user_project(
 
 
 @router.put("/{user_id}/panels")
+@router.patch("/{user_id}/panels")
 async def set_user_panels(
     user_id,
     payload: UserPanelsUpdate,
-    _: UserContext = Depends(require_role("admin")),
+    _: UserContext = Depends(_org_manager),
     db: AsyncSession = Depends(get_db),
 ):
-    """تخصیص پنل + سطح دسترسی به کاربر — فقط ادمین."""
+    """تخصیص پنل + سطح دسترسی به کاربر — مدیران سازمان (ادمین، مدیر تدارکات، مدیر پروژه)."""
     user = await db.get(User, user_id)
     if user is None:
         raise NotFoundError("کاربر یافت نشد")
@@ -409,10 +422,11 @@ async def set_user_panels(
 
 
 @router.put("/{user_id}/panel-projects")
+@router.patch("/{user_id}/panel-projects")
 async def set_user_panel_projects(
     user_id,
     payload: UserPanelProjectsUpdate,
-    _: UserContext = Depends(require_role("admin")),
+    _: UserContext = Depends(_org_manager),
     db: AsyncSession = Depends(get_db),
 ):
     """عضویت پروژه‌ای کاربر (M:N) — محدوده داده‌ی سطح limited."""