fix(bot): eliminate duplicate review cards caused by sync race and edit fallback

Their three commits (730d0bd, 5a9b543, 387edfb) reached production by push and
auto-deployed. 387edfb expects a users.username column that the live database does
not have, so POST /api/v1/auth/login was returning HTTP 500. Their schema changes
never applied either (projects still has only id, name, description, start_date,
pm_user_id, created_at), so nothing depends on the reverted code.

This commit sets the tree back to exactly a02b3ea — verified with git diff against
it — while keeping history linear: the work itself is preserved on 'pm' at 387edfb.

.gitignore

@@ -26,8 +26,12 @@ frontend/.env
 
 # ---- Local session / backups ----
 .zcode/
+.zcodeignore
+scratch/
 v1.2 - Copy/
 inv dash/
+bot/
+voice/
 
 # ---- Machine-local compose overrides (LAN phone access, etc.) ----
 docker-compose.override.yml

ai procurement/.env.example

@@ -0,0 +1,28 @@
+# Bale Bot API — token from Bale's BotFather (required)
+PROCUREMENT_BOT_BOT_TOKEN=
+PROCUREMENT_BOT_BALE_API_BASE=https://tapi.bale.ai
+
+# ERP procurement API (in Docker: http://api:8000/api/v1)
+PROCUREMENT_BOT_API_BASE_URL=http://localhost:8000/api/v1
+PROCUREMENT_BOT_DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost:5432/procurement
+
+# LLM provider — any OpenAI-compatible endpoint (JSON-mode chat completions)
+PROCUREMENT_BOT_AI_BASE_URL=https://api.deepseek.com
+PROCUREMENT_BOT_AI_API_KEY=
+PROCUREMENT_BOT_LLM_MODEL=deepseek-flash
+
+# STT provider — must expose POST /audio/transcriptions.
+# Falls back to AI_* when unset. DeepSeek has no audio API, so voice needs
+# its own whisper-compatible provider (OpenAI, GLM, self-hosted faster-whisper…).
+PROCUREMENT_BOT_STT_BASE_URL=
+PROCUREMENT_BOT_STT_API_KEY=
+PROCUREMENT_BOT_STT_MODEL=whisper-1
+PROCUREMENT_BOT_STT_LANGUAGE=fa
+
+# Bale chat ids allowed without Casdoor linking (comma separated)
+PROCUREMENT_BOT_ADMIN_CHAT_IDS=
+# Optional bearer for the day the ERP starts enforcing auth on procurement routes
+PROCUREMENT_BOT_SERVICE_TOKEN=
+# Drafts older than this are swept into `expired`
+PROCUREMENT_BOT_DRAFT_TTL_HOURS=24
+PROCUREMENT_BOT_LOG_LEVEL=INFO

ai procurement/.gitignore

@@ -0,0 +1,14 @@
+# ---- Env / secrets ----
+.env
+*.local
+
+# ---- Python ----
+__pycache__/
+*.pyc
+*.pyo
+.venv/
+venv/
+
+# ---- OS junk ----
+.DS_Store
+Thumbs.db

ai procurement/Dockerfile

@@ -0,0 +1,23 @@
+# Bale procurement bot — a long-polling worker against tapi.bale.ai.
+# ffmpeg converts Bale voice notes (OGG/Opus) before they are sent to STT.
+FROM python:3.13-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends ffmpeg \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /srv/bot
+
+# Dependencies first (layer caching). PIP_INDEX_URL overridable like the api image.
+ARG PIP_INDEX_URL=https://pypi.org/simple
+COPY requirements.txt .
+RUN pip install --no-cache-dir -i ${PIP_INDEX_URL} -r requirements.txt
+
+# Application
+COPY app ./app
+COPY tools ./tools
+
+CMD ["python", "-m", "app.main"]

ai procurement/README.md

@@ -0,0 +1,120 @@
+# procurement_ai_agent — Bale chatbot for the procurement ERP
+
+A **Bale messenger bot** that turns Persian **chat messages and voice notes**
+into procurement actions in the
+[procurement ERP](https://git.bennu-api-bahrestan.ir/ali_mohaghegh/ERP) —
+draft-first: it captures what it understood, tells you **what it did** and
+**what is still empty**, and **commits only after you approve** with a ✅ button.
+
+```
+you (Bale, text/voice)                      ┌─────────────────────────────────┐
+        │  getUpdates (long poll)           │        procurement_ai_agent     │
+        ▼                                   │  ffmpeg → STT (Persian)         │
+┌──────────────────┐   POST {base}/bot<T>    │  LLM → intent + entities        │
+│   tapi.bale.ai   │◄───────────────────────►│  fuzzy resolve → draft payload  │
+└──────────────────┘   sendMessage / buttons │  review + «چه چیزهایی خالی مونده»│
+                                             └───────────────┬─────────────────┘
+                                                             │ HTTP + X-Actor-Id
+                                                             ▼
+                                             ┌─────────────────────────────────┐
+                                             │   ERP api  (/api/v1)            │
+                                             │   quotes · suppliers · materials│
+                                             └─────────────────────────────────┘
+```
+
+## What it can do
+
+| Activity | Example (voice or text) | Committed via |
+|---|---|---|
+| Register a supplier quote | «سازان نو برای پروژه برج آسمان ۵۰۰ کیلو میلگرد A3 سایز ۱۴، هر کیلو ۴۵ تومن، پرداخت ۳ فاز» | `POST /quotes` |
+| Add a supplier | «تأمین‌کننده جدید پروفیل بر، دسته لوله و اتصالات، تلفن ۰۹۱۲…» | `POST /suppliers` |
+| Add a material | «کالای جدید میلگرد A3 سایز ۱۸ با واحد کیلوگرم» | `POST /materials` |
+| Status queries | «استعلام‌های در انتظار؟» / «کدام‌ها به‌زودی منقضی می‌شوند؟» | `GET /quotes?…` |
+| Accept a quote | «استعلام سازان نو را قبول کن» | `PATCH /quotes/{id}/accept` |
+| Announce a delivery | «اقلام سازان نو رسید، ۵۰۰ و ۲۰۰» | `PATCH /quotes/{id}/arrive-items` |
+
+### The draft → approve loop
+
+1. Send a message or voice note. Voice → ffmpeg → STT; text/STT text → LLM
+   extracts a typed **intent + entities** (JSON mode, Persian digits
+   normalized).
+2. Names are fuzzy-matched against the ERP. Several candidates → inline
+   **pick buttons**; no match → listed as missing.
+3. The bot replies with a **review card**: everything captured + a
+   ✅/⚠️/❌ list of what is still empty.
+4. Keep chatting to refine («قیمت میلگرد ۴۷ شد») — the open draft updates and
+   re-renders. Drafts survive bot restarts (postgres-backed, TTL-swept).
+5. **Nothing is written to the ERP until you tap ✅.** After commit you get the
+   created quote id and the fields left empty.
+
+### Team access & attribution
+
+Each member links their Bale chat once: `/start` → Casdoor username → password
+(validated via the ERP's real `POST /auth/login`, used once, never stored).
+Every mutating call carries `X-Actor-Id: <users.id>` so `quote_events.actor`
+records the **human** who asked.
+
+Commands: `/start` · `/help` · `/drafts` · `/cancel` · `/whoami` · `/unlink`
+
+## Quick start (Docker)
+
+```bash
+cp .env.example .env          # fill PROCUREMENT_BOT_BOT_TOKEN + AI_API_KEY
+docker build -t procurement-ai-agent .
+docker run -d --name procurement-bot --env-file .env \
+  --add-host host.docker.internal:host-gateway \
+  procurement-ai-agent
+docker logs -f procurement-bot
+```
+
+Or as part of the ERP stack — see [`integration/`](integration/README.md)
+(compose service + the one tiny ERP-side patch).
+
+Full setup, env-var reference, flows and troubleshooting:
+**[docs/SETUP.md](docs/SETUP.md)**.
+
+## Architecture
+
+```
+app/
+├── main.py          ensure bot tables → sweeper task → getUpdates long-poll loop
+├── config.py        pydantic-settings, PROCUREMENT_BOT_ prefix
+├── bale/client.py   Telegram-compatible Bale API (poll, send, edit, buttons, files)
+├── api/client.py    ERP /api/v1 client (X-Actor-Id attribution, error envelope)
+├── stt.py           ffmpeg (OGG/Opus → MP3) → OpenAI-compatible /audio/transcriptions
+├── nlu.py           Persian intent+entity extraction (JSON-mode chat completions)
+├── resolve.py       fuzzy name→id matching (difflib over ilike search), TTL caches
+├── drafts.py        draft store · QuoteCreate payload builder · missing-field logic
+├── keyboards.py     inline keyboards (callback_data ≤ 64 B op-codes)
+├── texts.py         Persian message templates
+├── runtime.py       context, link store, in-memory pending flows
+├── models.py        bot_links / bot_drafts / bot_messages / bot_meta (own schema)
+└── handlers/        dispatch · commands · callbacks · links ·
+                     quote · supplier · material · queries · decisions
+```
+
+Design notes:
+
+- **Telegram-compatible Bale API** (`tapi.bale.ai`): getUpdates long polling —
+  no public port, no webhook, resumable offset persisted across restarts.
+- **Draft-first**: `bot_drafts.payload` holds a talking-friendly JSON that is
+  converted into the exact `POST /quotes` request body (temp_id
+  cross-references) only on approval; the API deliberately tolerates
+  incomplete quotes, so partial commits are explicit, never accidental.
+- **Accept flow echoes the termsheet's existing `schedule_steps`** back to
+  `PATCH /quotes/{id}/accept` (the API replaces steps with what it receives).
+- **Persian-aware matching**: Persian/Arabic digit normalization, ZWNJ folding,
+  Arabic ya/ka folding, difflib ranking on top of the API's ilike search.
+- **Voice notes** arrive as OGG/Opus; ffmpeg converts to mono 16 kHz MP3 before
+  STT. The LLM provider and the STT provider are configured independently
+  (e.g. DeepSeek for NLU + any whisper-compatible endpoint for voice).
+
+## Testing
+
+An offline end-to-end harness stubs Bale/ERP/AI and drives the real handler
+pipeline with fake updates — no token, DB or API key needed:
+
+```bash
+pip install -r requirements.txt
+python tools/smoke_test.py     # → ALL PASSED: 48 passed
+```

ai procurement/app/__init__.py

@@ -0,0 +1,2 @@
+"""Bale procurement chatbot — drafts ERP actions from chat text/voice,
+reports what it captured + what is missing, and commits only on approval."""

ai procurement/app/api/__init__.py

@@ -0,0 +1 @@
+"""ERP API client — the only way the bot touches procurement data."""

ai procurement/app/api/client.py

@@ -0,0 +1,137 @@
+"""Async client for the procurement API (/api/v1).
+
+Attribution: every call carries ``X-Actor-Id`` (the linked ERP user id) so
+``quote_events.actor`` records the human who asked, not the bot. A service
+bearer token is sent when configured (procurement endpoints are currently
+open — the slot is for the day auth lands).
+"""
+import logging
+from typing import Any
+
+import httpx
+
+logger = logging.getLogger("bot.api")
+
+
+class ApiError(Exception):
+    def __init__(self, status: int, code: str, message: str, field: str | None = None):
+        super().__init__(message)
+        self.status = status
+        self.code = code
+        self.message = message
+        self.field = field
+
+
+class ErpClient:
+    def __init__(self, base_url: str, timeout: float = 30.0, service_token: str = ""):
+        self._base = base_url.rstrip("/")
+        self._timeout = timeout
+        self._service_token = service_token
+
+    def _actor_headers(self, actor_id: str | None, actor_name: str | None) -> dict:
+        headers: dict[str, str] = {}
+        if self._service_token:
+            headers["Authorization"] = f"Bearer {self._service_token}"
+        if actor_id:
+            headers["X-Actor-Id"] = actor_id
+        return headers
+
+    async def _request(self, method: str, path: str, *, actor_id: str | None = None,
+                       json: Any = None, params: dict | None = None) -> Any:
+        url = f"{self._base}{path}"
+        async with httpx.AsyncClient(timeout=self._timeout) as client:
+            try:
+                resp = await client.request(
+                    method, url, json=json, params=params, headers=self._actor_headers(actor_id, None)
+                )
+            except httpx.HTTPError as exc:
+                raise ApiError(0, "NETWORK", f"ERP API unreachable: {exc}") from exc
+        if resp.status_code in (200, 201):
+            return resp.json()
+        try:
+            err = resp.json().get("error") or {}
+        except ValueError:
+            err = {}
+        raise ApiError(
+            resp.status_code,
+            str(err.get("code") or "INTERNAL_ERROR"),
+            str(err.get("message") or f"HTTP {resp.status_code}"),
+            err.get("field"),
+        )
+
+    # ------------------------------------------------------------------ auth
+
+    async def login(self, username: str, password: str) -> dict:
+        body = await self._request("POST", "/auth/login", json={"username": username, "password": password})
+        return body.get("data") or {}
+
+    # ---------------------------------------------------------------- lookup
+
+    async def list_suppliers(self, q: str | None = None, page_size: int = 20) -> list[dict]:
+        params: dict = {"page_size": page_size}
+        if q:
+            params["q"] = q
+        return (await self._request("GET", "/suppliers", params=params)).get("data") or []
+
+    async def create_supplier(self, payload: dict, actor_id: str | None = None) -> dict:
+        return (await self._request("POST", "/suppliers", json=payload, actor_id=actor_id)).get("data") or {}
+
+    async def list_materials(self, q: str | None = None, page_size: int = 20) -> list[dict]:
+        params: dict = {"page_size": page_size}
+        if q:
+            params["q"] = q
+        return (await self._request("GET", "/materials", params=params)).get("data") or []
+
+    async def create_material(self, payload: dict, actor_id: str | None = None) -> dict:
+        return (await self._request("POST", "/materials", json=payload, actor_id=actor_id)).get("data") or []
+
+    async def list_units(self, q: str | None = None, page_size: int = 100) -> list[dict]:
+        params: dict = {"page_size": page_size}
+        if q:
+            params["q"] = q
+        return (await self._request("GET", "/units", params=params)).get("data") or []
+
+    async def list_projects(self, page_size: int = 100) -> list[dict]:
+        return (await self._request("GET", "/projects", params={"page_size": page_size})).get("data") or []
+
+    async def list_categories(self, page_size: int = 100) -> list[dict]:
+        return (await self._request("GET", "/material-categories", params={"page_size": page_size})).get("data") or []
+
+    # ---------------------------------------------------------------- quotes
+
+    async def list_quotes(self, *, status: str | None = None, q: str | None = None,
+                          expand: str | None = None, sort: str | None = None,
+                          page: int = 1, page_size: int = 10) -> tuple[list[dict], dict]:
+        params: dict = {"page": page, "page_size": page_size}
+        if status:
+            params["status"] = status
+        if q:
+            params["q"] = q
+        if expand:
+            params["expand"] = expand
+        if sort:
+            params["sort"] = sort
+        body = await self._request("GET", "/quotes", params=params)
+        return body.get("data") or [], body.get("meta") or {}
+
+    async def get_quote(self, quote_id: str, expand: str | None = None, actor_id: str | None = None) -> dict:
+        params = {"expand": expand} if expand else None
+        return (await self._request("GET", f"/quotes/{quote_id}", params=params, actor_id=actor_id)).get("data") or {}
+
+    async def create_quote(self, payload: dict, actor_id: str | None = None) -> dict:
+        return (await self._request("POST", "/quotes", json=payload, actor_id=actor_id)).get("data") or {}
+
+    async def accept_quote(self, quote_id: str, payload: dict, actor_id: str | None = None) -> dict:
+        path = f"/quotes/{quote_id}/accept"
+        return (await self._request("PATCH", path, json=payload, actor_id=actor_id)).get("data") or {}
+
+    async def arrive_quote(self, quote_id: str, actor_id: str | None = None) -> dict:
+        return (await self._request("PATCH", f"/quotes/{quote_id}/arrive", actor_id=actor_id)).get("data") or {}
+
+    async def arrive_items(self, quote_id: str, payload: dict, actor_id: str | None = None) -> dict:
+        return (await self._request("PATCH", f"/quotes/{quote_id}/arrive-items", json=payload, actor_id=actor_id)).get("data") or {}
+
+    async def reject_quote(self, quote_id: str, reason: str | None = None, actor_id: str | None = None) -> dict:
+        return (await self._request(
+            "PATCH", f"/quotes/{quote_id}/reject", json={"reason": reason} if reason else None, actor_id=actor_id
+        )).get("data") or {}

ai procurement/app/bale/__init__.py

@@ -0,0 +1 @@
+"""Bale Bot API client (Telegram-compatible surface at tapi.bale.ai)."""

ai procurement/app/bale/client.py

@@ -0,0 +1,186 @@
+"""Thin async client for the Bale Bot API.
+
+Bale's bot surface is a Telegram Bot API clone: ``POST {base}/bot{token}/{method}``
+and file downloads at ``{base}/file/bot{token}/{file_path}``. Long polling via
+``getUpdates`` avoids any webhook/TLS setup on the server.
+
+HTML parse_mode is requested first; if Bale rejects it for a given payload we
+transparently retry as plain text so messages never get lost.
+"""
+import asyncio
+import logging
+
+import httpx
+
+logger = logging.getLogger("bot.bale")
+
+REPLY_MARKUP = "reply_markup"
+
+
+class BaleError(Exception):
+    def __init__(self, description: str, error_code: int | None = None):
+        super().__init__(description)
+        self.description = description
+        self.error_code = error_code
+
+
+class BaleClient:
+    def __init__(self, base_url: str, token: str, timeout: float = 60.0):
+        self._base = base_url.rstrip("/")
+        self._token = token
+        self._timeout = timeout
+
+    # ------------------------------------------------------------------ core
+
+    def _method_url(self, method: str) -> str:
+        return f"{self._base}/bot{self._token}/{method}"
+
+    def _file_url(self, file_path: str) -> str:
+        return f"{self._base}/file/bot{self._token}/{file_path.lstrip('/')}"
+
+    async def _call(self, method: str, payload: dict | None = None, timeout: float | None = None) -> dict:
+        async with httpx.AsyncClient(timeout=timeout or self._timeout) as client:
+            try:
+                resp = await client.post(self._method_url(method), json=payload or {})
+            except httpx.HTTPError as exc:
+                raise BaleError(f"network error calling {method}: {exc}") from exc
+        try:
+            body = resp.json()
+        except ValueError as exc:
+            raise BaleError(f"non-JSON response for {method} (HTTP {resp.status_code})") from exc
+        if not body.get("ok"):
+            raise BaleError(str(body.get("description") or "unknown bale error"), resp.status_code)
+        return body.get("result")
+
+    # ------------------------------------------------------------- receiving
+
+    async def get_updates(self, offset: int, timeout_seconds: int) -> list[dict]:
+        """Long poll. ``timeout_seconds=0`` returns immediately (drain mode)."""
+        result = await self._call(
+            "getUpdates",
+            {"offset": offset, "timeout": timeout_seconds, "allowed_updates": ["message", "callback_query"]},
+            timeout=timeout_seconds + 15,
+        )
+        return result or []
+
+    # -------------------------------------------------------------- sending
+
+    async def send_message(self, chat_id: int, text: str, reply_markup: dict | None = None,
+                           reply_to: int | None = None) -> dict:
+        payload: dict = {"chat_id": chat_id, "text": text[:4000], "parse_mode": "HTML"}
+        if reply_markup:
+            payload[REPLY_MARKUP] = reply_markup
+        if reply_to:
+            payload["reply_to_message_id"] = reply_to
+        try:
+            return await self._call("sendMessage", payload)
+        except BaleError:
+            # parse_mode / markup rejection fallback: retry plain, keep the keyboard.
+            payload.pop("parse_mode", None)
+            return await self._call("sendMessage", payload)
+
+    async def edit_message_text(self, chat_id: int, message_id: int, text: str,
+                                reply_markup: dict | None = None) -> dict:
+        payload: dict = {"chat_id": chat_id, "message_id": message_id, "text": text[:4000], "parse_mode": "HTML"}
+        if reply_markup:
+            payload[REPLY_MARKUP] = reply_markup
+        try:
+            return await self._call("editMessageText", payload)
+        except BaleError:
+            payload.pop("parse_mode", None)
+            return await self._call("editMessageText", payload)
+
+    async def delete_message(self, chat_id: int, message_id: int) -> bool:
+        payload: dict = {"chat_id": chat_id, "message_id": message_id}
+        try:
+            return bool(await self._call("deleteMessage", payload))
+        except BaleError as exc:
+            logger.warning("deleteMessage failed for chat %s msg %s: %s", chat_id, message_id, exc)
+            return False
+        except Exception as exc:
+            logger.warning("unexpected error in deleteMessage for chat %s msg %s: %s", chat_id, message_id, exc)
+            return False
+
+    async def answer_callback_query(self, callback_query_id: str, text: str | None = None) -> None:
+        payload: dict = {"callback_query_id": callback_query_id}
+        if text:
+            payload["text"] = text[:200]
+        try:
+            await self._call("answerCallbackQuery", payload)
+        except BaleError as exc:
+            logger.warning("answerCallbackQuery failed: %s", exc)
+
+    async def send_chat_action(self, chat_id: int, action: str = "typing") -> None:
+        try:
+            await self._call("sendChatAction", {"chat_id": chat_id, "action": action})
+        except BaleError as exc:
+            logger.debug("sendChatAction failed: %s", exc)
+
+    # ---------------------------------------------------------------- files
+
+    async def get_file(self, file_id: str) -> dict:
+        return await self._call("getFile", {"file_id": file_id})
+
+    async def download_file(self, file_id: str) -> bytes:
+        """Resolve a file_id to bytes (getFile → file_path → download URL)."""
+        info = await self.get_file(file_id)
+        file_path = info.get("file_path")
+        if not file_path:
+            raise BaleError("getFile returned no file_path")
+        async with httpx.AsyncClient(timeout=120) as client:
+            resp = await client.get(self._file_url(file_path))
+            resp.raise_for_status()
+            return resp.content
+
+
+async def poll_loop(client: BaleClient, on_update, offset_key: str = "bale_offset") -> None:
+    """Long-poll supervisor: resumable offset, one update at a time, never dies.
+
+    ``on_update`` must be an async callable receiving the raw update dict.
+    """
+    from app.db import SessionLocal
+    from app.models import BotMeta
+
+    async def load_offset() -> int:
+        async with SessionLocal() as session:
+            row = (await session.execute(
+                __import__("sqlalchemy").select(BotMeta.value).where(BotMeta.key == offset_key)
+            )).scalar()
+        return int(row) if row else 0
+
+    async def save_offset(value: int) -> None:
+        from sqlalchemy.dialects.postgresql import insert as pg_insert
+
+        async with SessionLocal() as session:
+            stmt = pg_insert(BotMeta).values(key=offset_key, value=str(value))
+            stmt = stmt.on_conflict_do_update(index_elements=[BotMeta.key], set_={"value": str(value)})
+            await session.execute(stmt)
+            await session.commit()
+
+    offset = await load_offset()
+    if offset == 0:
+        # Skip any backlog accumulated while the bot was down: peek once
+        # without waiting and jump straight to the newest update.
+        backlog = await client.get_updates(0, 0)
+        if backlog:
+            offset = max(u["update_id"] for u in backlog) + 1
+
+    logger.info("polling started (offset=%s)", offset)
+    while True:
+        try:
+            updates = await client.get_updates(offset, 25)
+            for update in updates:
+                offset = max(offset, update["update_id"] + 1)
+                await save_offset(offset)
+                try:
+                    await on_update(update)
+                except Exception:
+                    logger.exception("handler crashed on update %s", update.get("update_id"))
+        except asyncio.CancelledError:
+            raise
+        except BaleError as exc:
+            logger.warning("poll error: %s", exc)
+            await asyncio.sleep(3)
+        except Exception:
+            logger.exception("unexpected poll error")
+            await asyncio.sleep(3)

ai procurement/app/config.py

@@ -0,0 +1,77 @@
+"""Bot configuration.
+
+All settings can be overridden with environment variables prefixed with
+``PROCUREMENT_BOT_`` (e.g. ``PROCUREMENT_BOT_BOT_TOKEN=...``) or a local
+``.env`` file. Docker/compose passes them in directly (same convention as
+the api service's ``PROCUREMENT_*`` prefix).
+"""
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(
+        env_prefix="PROCUREMENT_BOT_",
+        env_file=".env",
+        env_file_encoding="utf-8",
+        extra="ignore",
+    )
+
+    # Bale Bot API — Telegram-compatible clone hosted at tapi.bale.ai.
+    BALE_API_BASE: str = "https://tapi.bale.ai"
+    BOT_TOKEN: str = ""  # from Bale's BotFather
+    POLL_TIMEOUT_SECONDS: int = 25  # getUpdates long-poll window
+    POLL_ERROR_SLEEP_SECONDS: float = 3.0
+
+    # ERP API (in-network service URL inside Docker).
+    API_BASE_URL: str = "http://localhost:8000/api/v1"
+    API_TIMEOUT_SECONDS: float = 30.0
+    # Optional bearer for the day procurement endpoints start enforcing auth.
+    SERVICE_TOKEN: str = ""
+
+    # Frontend URL (for opening Wizard from Bale bot)
+    FRONTEND_URL: str = "http://localhost:8081"
+
+    # OpenAI-compatible AI provider (LLM), e.g. OpenAI / GLM / DeepSeek / OpenRouter.
+    AI_BASE_URL: str = ""  # e.g. https://api.openai.com/v1
+    AI_API_KEY: str = ""
+    LLM_MODEL: str = "gpt-4o-mini"
+    LLM_TIMEOUT_SECONDS: float = 60.0
+
+    # STT provider — any OpenAI-compatible /audio/transcriptions endpoint.
+    # Falls back to the LLM provider when unset. Note: some providers
+    # (e.g. DeepSeek) have no audio API — voice stays disabled gracefully.
+    STT_BASE_URL: str = ""
+    STT_API_KEY: str = ""
+    STT_MODEL: str = "whisper-1"
+    STT_LANGUAGE: str = "fa"
+
+    @property
+    def stt_base_url(self) -> str:
+        return self.STT_BASE_URL or self.AI_BASE_URL
+
+    @property
+    def stt_api_key(self) -> str:
+        return self.STT_API_KEY or self.AI_API_KEY
+
+    # PostgreSQL — same instance/database as the api service.
+    DATABASE_URL: str = "postgresql+asyncpg://postgres:postgres@localhost:5432/procurement"
+
+    # Chats that may use the bot without Casdoor linking (comma separated).
+    ADMIN_CHAT_IDS: str = ""
+
+    # Drafts older than this are marked expired by the sweeper loop.
+    DRAFT_TTL_HOURS: int = 24
+
+    LOG_LEVEL: str = "INFO"
+
+    @property
+    def admin_chat_ids(self) -> set[int]:
+        out: set[int] = set()
+        for part in self.ADMIN_CHAT_IDS.replace(";", ",").split(","):
+            part = part.strip()
+            if part.isdigit():
+                out.add(int(part))
+        return out
+
+
+settings = Settings()

ai procurement/app/db.py

@@ -0,0 +1,7 @@
+"""Async engine/session for the bot's own tables (same postgres as the api)."""
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+
+from app.config import settings
+
+engine = create_async_engine(settings.DATABASE_URL, pool_pre_ping=True)
+SessionLocal = async_sessionmaker(engine, expire_on_commit=False)

ai procurement/app/db_init.py

@@ -0,0 +1,81 @@
+"""Idempotent DDL for the bot's own tables (mirrors the api's init_db.py
+convention — the ORM never creates tables; this script does, IF NOT EXISTS).
+"""
+import logging
+
+from sqlalchemy import text
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models import Base
+
+logger = logging.getLogger("bot.db_init")
+
+DDL = [
+    """
+    CREATE TABLE IF NOT EXISTS bot_links (
+        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        chat_id BIGINT UNIQUE NOT NULL,
+        user_id UUID,
+        casdoor_username TEXT,
+        display_name TEXT,
+        role VARCHAR(32),
+        created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+    )
+    """,
+    "CREATE INDEX IF NOT EXISTS ix_bot_links_chat_id ON bot_links (chat_id)",
+    """
+    CREATE TABLE IF NOT EXISTS bot_drafts (
+        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        chat_id BIGINT NOT NULL,
+        kind VARCHAR(16) NOT NULL,
+        payload JSONB NOT NULL DEFAULT '{}'::jsonb,
+        missing JSONB,
+        status VARCHAR(16) NOT NULL DEFAULT 'active',
+        source VARCHAR(16),
+        source_message_id BIGINT,
+        review_message_id BIGINT,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+    )
+    """,
+    "CREATE INDEX IF NOT EXISTS ix_bot_drafts_chat_id ON bot_drafts (chat_id)",
+    "CREATE INDEX IF NOT EXISTS ix_bot_drafts_chat_status ON bot_drafts (chat_id, status)",
+    "ALTER TABLE bot_drafts ADD COLUMN IF NOT EXISTS last_bale_update_at TIMESTAMPTZ",
+    "ALTER TABLE bot_drafts ADD COLUMN IF NOT EXISTS source_message_id BIGINT",
+    "CREATE INDEX IF NOT EXISTS ix_bot_drafts_review_msg ON bot_drafts (review_message_id)",
+    "CREATE INDEX IF NOT EXISTS ix_bot_drafts_source_msg ON bot_drafts (source_message_id)",
+    """
+    CREATE TABLE IF NOT EXISTS bot_messages (
+        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        chat_id BIGINT NOT NULL,
+        direction VARCHAR(4) NOT NULL,
+        kind VARCHAR(16) NOT NULL DEFAULT 'text',
+        body TEXT,
+        payload JSONB,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+    )
+    """,
+    "CREATE INDEX IF NOT EXISTS ix_bot_messages_chat_id ON bot_messages (chat_id)",
+    """
+    CREATE TABLE IF NOT EXISTS bot_meta (
+        key VARCHAR(64) PRIMARY KEY,
+        value TEXT,
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+    )
+    """,
+]
+
+
+async def ensure_bot_tables(session: AsyncSession) -> None:
+    for stmt in DDL:
+        await session.execute(text(stmt))
+    await session.commit()
+    logger.info("bot tables ready")
+
+
+async def ensure_schema() -> None:
+    from app.db import SessionLocal
+
+    async with SessionLocal() as session:
+        await ensure_bot_tables(session)

ai procurement/app/drafts.py

@@ -0,0 +1,474 @@
+"""Draft store + payload/missing-field logic.
+
+A draft's ``payload`` is a talking-friendly JSON the bot keeps refining. When
+the user approves, ``build_quote_payload`` converts it into the exact
+``POST /quotes`` request body (temp_ids cross-referencing line items,
+termsheets and prices).
+
+Resolution state lives inside the payload:
+  payload["supplier_id"], payload["project_id"],
+  item["material_id"], item["unit_id"], item["unit_explicit"],
+  payload["options"][field] = candidate list shown as pick-buttons.
+"""
+import difflib
+import uuid
+from datetime import datetime, timedelta, timezone
+
+from sqlalchemy import cast, func, select, String, update
+
+from app.db import SessionLocal
+from app.models import BotDraft
+from app.nlu import normalize_text
+
+KIND_QUOTE = "quote"
+KIND_SUPPLIER = "supplier"
+KIND_MATERIAL = "material"
+
+
+# ---------------------------------------------------------------------------
+# Store
+# ---------------------------------------------------------------------------
+
+async def create(chat_id: int, kind: str, payload: dict, source: str | None = None,
+                 source_message_id: int | None = None) -> BotDraft:
+    async with SessionLocal() as session:
+        draft = BotDraft(
+            chat_id=chat_id,
+            kind=kind,
+            payload=payload,
+            source=source,
+            source_message_id=source_message_id,
+        )
+        session.add(draft)
+        await session.commit()
+        await session.refresh(draft)
+        return draft
+
+
+async def get_active(chat_id: int, kind: str | None = None) -> BotDraft | None:
+    async with SessionLocal() as session:
+        stmt = select(BotDraft).where(BotDraft.chat_id == chat_id, BotDraft.status == "active")
+        if kind:
+            stmt = stmt.where(BotDraft.kind == kind)
+        stmt = stmt.order_by(BotDraft.updated_at.desc()).limit(1)
+        return (await session.execute(stmt)).scalar_one_or_none()
+
+
+async def get_by_message_id(chat_id: int, message_id: int) -> BotDraft | None:
+    """Find the active draft associated with a given message_id (review card or user source message)."""
+    async with SessionLocal() as session:
+        stmt = (
+            select(BotDraft)
+            .where(
+                BotDraft.chat_id == chat_id,
+                BotDraft.status == "active",
+                (BotDraft.review_message_id == message_id) | (BotDraft.source_message_id == message_id),
+            )
+            .order_by(BotDraft.updated_at.desc())
+            .limit(1)
+        )
+        return (await session.execute(stmt)).scalar_one_or_none()
+
+
+async def get_by_prefix(draft_prefix: str, chat_id: int | None = None) -> BotDraft | None:
+    """Resolve the short id used in callback_data (first 8 hex of the UUID)."""
+    async with SessionLocal() as session:
+        stmt = select(BotDraft).where(cast(BotDraft.id, String).like(f"{draft_prefix}%"))
+        if chat_id is not None:
+            stmt = stmt.where(BotDraft.chat_id == chat_id)
+        return (await session.execute(stmt)).scalar_one_or_none()
+
+
+async def save_payload(draft: BotDraft, missing: dict | None = None,
+                       review_message_id: int | None = None,
+                       source_message_id: int | None = None,
+                       mark_bale_synced: bool = False) -> None:
+    async with SessionLocal() as session:
+        effective_review_msg_id = review_message_id if review_message_id is not None else draft.review_message_id
+        values: dict = {
+            "payload": draft.payload,
+            "missing": missing,
+            "review_message_id": effective_review_msg_id,
+        }
+        if source_message_id is not None:
+            values["source_message_id"] = source_message_id
+            draft.source_message_id = source_message_id
+        if mark_bale_synced:
+            values["last_bale_update_at"] = func.now()
+        await session.execute(
+            update(BotDraft)
+            .where(BotDraft.id == draft.id)
+            .values(**values)
+        )
+        await session.commit()
+        draft.review_message_id = effective_review_msg_id
+
+
+async def set_status(draft_id: str, status: str) -> None:
+    async with SessionLocal() as session:
+        await session.execute(update(BotDraft).where(BotDraft.id == draft_id).values(status=status))
+        await session.commit()
+
+
+async def set_bale_updated_at(draft_id) -> None:
+    async with SessionLocal() as session:
+        await session.execute(
+            update(BotDraft)
+            .where(BotDraft.id == draft_id)
+            .values(last_bale_update_at=func.now())
+        )
+        await session.commit()
+
+
+async def get_pending_bale_updates() -> list[BotDraft]:
+    async with SessionLocal() as session:
+        stmt = (
+            select(BotDraft)
+            .where(
+                BotDraft.review_message_id.is_not(None),
+                (BotDraft.last_bale_update_at.is_(None)) | (BotDraft.updated_at > BotDraft.last_bale_update_at),
+            )
+            .order_by(BotDraft.updated_at.asc())
+            .limit(10)
+        )
+        return list((await session.execute(stmt)).scalars().all())
+
+
+async def expire_stale(ttl_hours: int) -> int:
+    cutoff = datetime.now(timezone.utc) - timedelta(hours=ttl_hours)
+    async with SessionLocal() as session:
+        result = await session.execute(
+            update(BotDraft)
+            .where(BotDraft.status == "active", BotDraft.updated_at < cutoff)
+            .values(status="expired")
+        )
+        await session.commit()
+        return result.rowcount or 0
+
+
+# ---------------------------------------------------------------------------
+# Quote payload
+# ---------------------------------------------------------------------------
+
+def new_quote_payload() -> dict:
+    return {
+        "supplier_name": None, "supplier_id": None,
+        "project_name": None, "project_id": None, "project_names": [], "project_ids": [],
+        "is_official": True, "notes": None, "expiry_date": None,
+        "items": [], "termsheets": [],
+        "options": {}, "proforma_file": None,
+    }
+
+
+def new_item(material_name: str | None = None) -> dict:
+    return {
+        "material_name": material_name, "material_id": None,
+        "quantity": None, "unit_name": None, "unit_id": None, "unit_explicit": False,
+        "unit_price": None, "brand_name": None, "specs": [], "notes": None,
+    }
+
+
+def _similarity(a: str | None, b: str | None) -> float:
+    na, nb = normalize_text(a or ""), normalize_text(b or "")
+    if not na or not nb:
+        return 0.0
+    ratio = difflib.SequenceMatcher(None, na, nb).ratio()
+    if na in nb or nb in na:
+        ratio += 0.3
+    return ratio
+
+
+def merge_quote_patch(payload: dict, patch: dict) -> bool:
+    """Merge an NLU patch into the payload. Returns True if anything changed."""
+    changed = False
+
+    def set_field(key: str, value) -> None:
+        nonlocal changed
+        if value is None:
+            return
+        if payload.get(key) != value:
+            payload[key] = value
+            changed = True
+
+    if patch.get("supplier_name"):
+        payload["supplier_name"] = str(patch["supplier_name"]).strip()
+        payload["supplier_id"] = None  # needs re-resolution
+        changed = True
+    if patch.get("project_names"):
+        payload["project_names"] = [str(p).strip() for p in patch["project_names"] if p]
+        if payload["project_names"] and not payload.get("project_name"):
+            payload["project_name"] = payload["project_names"][0]
+            payload["project_id"] = None
+        changed = True
+    elif patch.get("project_name"):
+        payload["project_name"] = str(patch["project_name"]).strip()
+        payload["project_id"] = None
+        if not payload.get("project_names"):
+            payload["project_names"] = [payload["project_name"]]
+        changed = True
+    set_field("is_official", patch.get("is_official"))
+    if patch.get("notes"):
+        payload["notes"] = f"{payload.get('notes') or ''}\n{patch['notes']}".strip()
+        changed = True
+    if patch.get("expiry_date"):
+        set_field("expiry_date", patch["expiry_date"])
+
+    for raw in patch.get("items") or []:
+        name = (raw.get("material_name") or "").strip() or None
+        target = None
+        if name:
+            best, best_ratio = None, 0.0
+            for item in payload["items"]:
+                # If both items have distinct specs, they are different line items
+                if raw.get("specs") and item.get("specs") and set(raw["specs"]) != set(item["specs"]):
+                    continue
+                # If both items have distinct brands, they are different line items
+                if raw.get("brand_name") and item.get("brand_name") and normalize_text(raw["brand_name"]) != normalize_text(item["brand_name"]):
+                    continue
+                ratio = _similarity(name, item.get("material_name"))
+                if ratio > best_ratio:
+                    best, best_ratio = item, ratio
+            if best is not None and best_ratio >= 0.55:
+                target = best
+        if target is None:
+            target = new_item(name)
+            payload["items"].append(target)
+            changed = True
+        for key in ("quantity", "unit_price"):
+            if raw.get(key) is not None:
+                try:
+                    value = float(raw[key])
+                except (TypeError, ValueError):
+                    continue
+                if target.get(key) != value:
+                    target[key] = value
+                    changed = True
+        if raw.get("specs"):
+            target["specs"] = [str(s).strip() for s in raw["specs"] if s]
+            spec_str = "، ".join(target["specs"])
+            if spec_str and not target.get("notes"):
+                target["notes"] = spec_str
+                changed = True
+        for key in ("unit_name", "brand_name", "notes"):
+            if raw.get(key):
+                val = str(raw[key]).strip()
+                if target.get(key) != val:
+                    target[key] = val
+                    changed = True
+
+    for raw in patch.get("payment_terms") or []:
+        label = (raw.get("label") or "شرایط پرداخت").strip()
+        milestones = []
+        for m in raw.get("milestones") or []:
+            if m.get("due_date") or m.get("amount"):
+                milestones.append({
+                    "due_date": m.get("due_date"),
+                    "amount": float(m.get("amount") or 0),
+                    "note": m.get("note"),
+                })
+        entry = {
+            "label": label,
+            "discount_type": raw.get("discount_type") or "none",
+            "discount_value": float(raw.get("discount_value") or 0),
+            "milestones": milestones,
+            "description": (raw.get("description") or "").strip() or None,
+        }
+        if not any(normalize_text(t["label"]) == normalize_text(label) for t in payload["termsheets"]):
+            payload["termsheets"].append(entry)
+            changed = True
+
+    return changed
+
+
+def compute_quote_missing(payload: dict) -> list[dict]:
+    """What is still empty — the user's explicit ask («یادآوری چیزهای خالی»)."""
+    out: list[dict] = []
+
+    def add(key: str, label: str, ok: bool, blocking: bool) -> None:
+        out.append({"key": key, "label": label, "ok": ok, "blocking": blocking})
+
+    sup_ok = bool(payload.get("supplier_id"))
+    add("supplier", "تأمین‌کننده", sup_ok, True)
+    add("project", "پروژه", bool(payload.get("project_id") or payload.get("project_ids")), False)
+    add("expiry", "تاریخ اعتبار", bool(payload.get("expiry_date")), False)
+
+    items = payload.get("items") or []
+    add("items", "قلم (کالا/مقدار)", bool(items), True)
+    for i, item in enumerate(items, start=1):
+        name = item.get("material_name") or f"قلم {i}"
+        if not item.get("material_id"):
+            add(f"item:{i}:material", f"شناسه کالا برای «{name}»", False, True)
+        if not item.get("quantity"):
+            add(f"item:{i}:qty", f"مقدار «{name}»", False, True)
+        if not (item.get("unit_id") or item.get("unit_name")):
+            add(f"item:{i}:unit", f"واحد «{name}»", False, True)
+        if not item.get("unit_price"):
+            add(f"item:{i}:price", f"قیمت واحد «{name}»", False, False)
+    if items and not payload.get("termsheets"):
+        add("terms", "شرایط پرداخت", False, False)
+    if not payload.get("notes"):
+        add("notes", "یادداشت", False, False)
+    return out
+
+
+def quote_ready(payload: dict) -> tuple[bool, list[str]]:
+    """Blocking check before commit; returns (ok, blocking_labels)."""
+    missing = compute_quote_missing(payload)
+    return all(not (m["blocking"] and not m["ok"]) for m in missing), [
+        m["label"] for m in missing if m["blocking"] and not m["ok"]
+    ]
+
+
+def build_quote_request(payload: dict, only_resolved_items: bool = False) -> tuple[dict | None, list[str]]:
+    """Convert the payload into a QuoteCreate body. Returns (body, problems)."""
+    problems: list[str] = []
+    if not payload.get("supplier_id"):
+        return None, ["تأمین‌کننده مشخص نیست"]
+
+    items = payload.get("items") or []
+    line_items: list[dict] = []
+    for i, item in enumerate(items, start=1):
+        if not item.get("material_id"):
+            if only_resolved_items:
+                continue
+            problems.append(f"کالای قلم {i} («{item.get('material_name') or '?'}») شناسایی نشد")
+            continue
+        if not item.get("quantity"):
+            problems.append(f"مقدار قلم {i} («{item.get('material_name') or '?'}») مشخص نیست")
+            continue
+        unit_id = item.get("unit_id")
+        if not unit_id:
+            problems.append(f"واحد قلم {i} («{item.get('material_name') or '?'}») مشخص نیست")
+            continue
+        notes_parts = []
+        if item.get("brand_name"):
+            notes_parts.append(f"برند: {item['brand_name']}")
+        if item.get("specs"):
+            notes_parts.append("، ".join(item["specs"]))
+        if item.get("notes"):
+            if item["notes"] not in notes_parts:
+                notes_parts.append(item["notes"])
+        notes_str = " | ".join(notes_parts) if notes_parts else None
+
+        line_items.append({
+            "temp_id": f"t{i}",
+            "material_id": item["material_id"],
+            "unit_id": int(unit_id),
+            "quantity": item["quantity"],
+            "notes": notes_str,
+        })
+
+    termsheets: list[dict] = []
+    item_termsheets: list[dict] = []
+    priced = [it for it in items if it.get("unit_price") and it.get("material_id")]
+    if priced:
+        raw_sheets = payload.get("termsheets") or []
+        if not raw_sheets:
+            raw_sheets = [{"label": "پیشنهاد قیمت"}]
+        for j, ts in enumerate(raw_sheets, start=1):
+            steps = []
+            for s_idx, m in enumerate(ts.get("milestones") or ts.get("schedule_steps") or [], start=1):
+                steps.append({
+                    "step_no": s_idx,
+                    "due_date": m.get("due_date"),
+                    "amount": float(m.get("amount") or 0),
+                    "note": m.get("note"),
+                })
+            termsheets.append({
+                "temp_id": f"p{j}",
+                "label": ts.get("label") or f"شرایط {j}",
+                "discount_type": ts.get("discount_type") or "none",
+                "discount_value": float(ts.get("discount_value") or 0),
+                "schedule_steps": steps,
+            })
+        first = termsheets[0]["temp_id"]
+        for i, item in enumerate(items, start=1):
+            if item.get("unit_price") and item.get("material_id") and item.get("quantity") and item.get("unit_id"):
+                item_termsheets.append({
+                    "line_item_temp_id": f"t{i}",
+                    "termsheet_temp_id": first,
+                    "unit_price": item["unit_price"],
+                })
+
+    body: dict = {
+        "supplier_id": payload["supplier_id"],
+        "is_official": bool(payload.get("is_official", True)),
+        "line_items": line_items,
+        "termsheets": termsheets,
+        "item_termsheets": item_termsheets,
+    }
+    if payload.get("project_ids"):
+        body["project_ids"] = payload["project_ids"]
+    elif payload.get("project_id"):
+        body["project_ids"] = [payload["project_id"]]
+    if payload.get("expiry_date"):
+        body["expiry_date"] = payload["expiry_date"]
+    if payload.get("notes"):
+        body["notes"] = payload["notes"]
+    if not line_items and problems:
+        return None, problems
+    return body, problems
+
+
+# ---------------------------------------------------------------------------
+# Supplier / material payloads
+# ---------------------------------------------------------------------------
+
+def new_supplier_payload() -> dict:
+    return {"name": None, "category_id": None, "category_name": None,
+            "phone": None, "location": None, "contact_person": None, "options": {}}
+
+
+def merge_supplier_patch(payload: dict, patch: dict) -> bool:
+    src = patch.get("supplier") or patch
+    changed = False
+    for key in ("name", "phone", "location", "contact_person"):
+        if src.get(key) and payload.get(key) != str(src[key]).strip():
+            payload[key] = str(src[key]).strip()
+            changed = True
+    if src.get("category_name"):
+        payload["category_name"] = str(src["category_name"]).strip()
+        payload["category_id"] = None
+        changed = True
+    return changed
+
+
+def supplier_missing(payload: dict) -> list[dict]:
+    return [
+        {"key": "name", "label": "نام تأمین‌کننده", "ok": bool(payload.get("name")), "blocking": True},
+        {"key": "category", "label": "دسته‌بندی", "ok": bool(payload.get("category_id")), "blocking": True},
+        {"key": "phone", "label": "تلفن", "ok": bool(payload.get("phone")), "blocking": False},
+        {"key": "location", "label": "موقعیت", "ok": bool(payload.get("location")), "blocking": False},
+    ]
+
+
+def new_material_payload() -> dict:
+    return {"name": None, "canonical_unit_id": None, "unit_name": None, "topic": None, "options": {}}
+
+
+def merge_material_patch(payload: dict, patch: dict) -> bool:
+    src = patch.get("material") or patch
+    changed = False
+    if src.get("name") and payload.get("name") != str(src["name"]).strip():
+        payload["name"] = str(src["name"]).strip()
+        changed = True
+    if src.get("unit_name"):
+        payload["unit_name"] = str(src["unit_name"]).strip()
+        payload["canonical_unit_id"] = None
+        changed = True
+    if src.get("topic") and payload.get("topic") != str(src["topic"]).strip():
+        payload["topic"] = str(src["topic"]).strip()
+        changed = True
+    return changed
+
+
+def material_missing(payload: dict) -> list[dict]:
+    return [
+        {"key": "name", "label": "نام کالا", "ok": bool(payload.get("name")), "blocking": True},
+        {"key": "unit", "label": "واحد اصلی", "ok": bool(payload.get("canonical_unit_id")), "blocking": True},
+        {"key": "topic", "label": "تاپیک", "ok": bool(payload.get("topic")), "blocking": False},
+    ]
+
+
+def short_id() -> str:
+    return uuid.uuid4().hex[:8]

ai procurement/app/handlers/__init__.py

@@ -0,0 +1,215 @@
+"""Update dispatch — the heart of the bot.
+
+Pipeline per update:
+  callback_query → callbacks router (link-gated)
+  message text starting "/" → command router
+  voice/audio → download → STT → treated as text (source=voice)
+  text → pending-flow interception (linking / accept-arrive confirmations)
+       → auth gate (link or admin)
+       → NLU → intent router
+"""
+import logging
+
+from app import drafts as draft_store
+from app.config import settings
+from app.nlu import understand
+from app.runtime import BotContext, LinkedUser
+from app.stt import transcribe
+from app.texts import CANCELLED, LINK_START, NOTHING_TO_COMMIT, STT_FAILED, UNKNOWN_HINT, VOICE_EMPTY
+
+from . import commands, callbacks, quote, supplier, material, queries, decisions
+
+logger = logging.getLogger("bot.handlers")
+
+
+async def handle_update(ctx: BotContext, update: dict) -> None:
+    if update.get("callback_query"):
+        await callbacks.handle_callback(ctx, update["callback_query"])
+        return
+    message = update.get("message") or update.get("edited_message")
+    if not message:
+        return
+    chat_id = message["chat"]["id"]
+    try:
+        await handle_message(ctx, chat_id, message)
+    except Exception:
+        logger.exception("message handling failed for chat %s", chat_id)
+        await ctx.send(chat_id, "خطای غیرمنتظره رخ داد؛ دوباره تلاش کن.")
+
+
+async def handle_message(ctx: BotContext, chat_id: int, message: dict) -> None:
+    text = (message.get("text") or "").strip()
+    source = "text"
+
+    if text.startswith("/"):
+        await commands.handle_command(ctx, chat_id, text)
+        return
+
+    if not text and (message.get("voice") or message.get("audio") or message.get("document")):
+        source = "voice"
+        await ctx.bale.send_chat_action(chat_id, "typing")
+        file_id = (message.get("voice") or message.get("audio") or message.get("document"))["file_id"]
+        try:
+            audio = await ctx.bale.download_file(file_id)
+            text = await transcribe(settings, audio,
+                                    mime_type=(message.get("voice") or {}).get("mime_type"),
+                                    filename=(message.get("voice") or {}).get("file_name"))
+        except Exception as exc:
+            detail = "هوش مصنوعی تنظیم نشده" if "not configured" in str(exc) else str(exc)[:200]
+            await ctx.send(chat_id, STT_FAILED.format(detail=esc(detail)))
+            return
+        if not text:
+            await ctx.send(chat_id, VOICE_EMPTY)
+            return
+        await ctx._log(chat_id, "in", "voice", text)
+
+    # Pending multi-step interactions take the message first.
+    flow = ctx.pending.get(chat_id)
+    if flow:
+        handled = await _route_to_flow(ctx, chat_id, flow, text)
+        if handled:
+            return
+        ctx.pending.pop(chat_id)  # stale/irrelevant flow → fall through
+
+    user = await _gate(ctx, chat_id, message)
+    if user is None:
+        return  # gate either started linking or is mid-linking
+
+    message_id = message.get("message_id")
+    reply_to = message.get("reply_to_message")
+    reply_to_msg_id = reply_to.get("message_id") if reply_to else None
+
+    target_draft = None
+    if reply_to_msg_id is not None:
+        target_draft = await draft_store.get_by_message_id(chat_id, reply_to_msg_id)
+        if target_draft is None:
+            await ctx.send(
+                chat_id,
+                "⚠️ پیش‌نویس فعال مربوط به این پیام یافت نشد (ممکن است ثبت نهایی، منقضی یا لغو شده باشد).\nبرای ثبت استعلام جدید، پیام خود را بدون ریپلای ارسال فرمایید.",
+                reply_to=message_id,
+            )
+            return
+
+    draft_summary = _draft_summary(target_draft) if target_draft else None
+    result = await understand(settings, text, draft_summary)
+    intent, patch = result.get("intent"), result.get("patch") or {}
+    logger.info("chat %s intent=%s conf=%s (is_edit=%s)", chat_id, intent, result.get("confidence"), target_draft is not None)
+
+    if intent in ("register_quote", "update_draft"):
+        await quote.handle_entities(
+            ctx, chat_id, user, patch, source,
+            incoming_msg_id=message_id,
+            target_draft=target_draft,
+        )
+    elif intent == "commit_draft":
+        active = target_draft or await draft_store.get_active(chat_id)
+        if active is None:
+            await ctx.send(chat_id, NOTHING_TO_COMMIT, reply_to=message_id)
+        elif active.kind == draft_store.KIND_QUOTE:
+            await quote.commit(ctx, chat_id, user, active)
+        elif active.kind == draft_store.KIND_SUPPLIER:
+            await supplier.commit(ctx, chat_id, user, active)
+        elif active.kind == draft_store.KIND_MATERIAL:
+            await material.commit(ctx, chat_id, user, active)
+    elif intent == "discard_draft":
+        active = target_draft or await draft_store.get_active(chat_id)
+        if active:
+            await draft_store.set_status(active.id, "cancelled")
+            if active.review_message_id:
+                try:
+                    await ctx.delete(chat_id, active.review_message_id)
+                except Exception:
+                    pass
+        ctx.pending.pop(chat_id, None)
+        await ctx.send(chat_id, CANCELLED, reply_to=message_id)
+    elif intent == "show_draft":
+        active = target_draft or await draft_store.get_active(chat_id)
+        if active is None:
+            await ctx.send(chat_id, NOTHING_TO_COMMIT, reply_to=message_id)
+        elif active.kind == draft_store.KIND_QUOTE:
+            await quote.render(ctx, chat_id, active, fresh=False)
+        elif active.kind == draft_store.KIND_SUPPLIER:
+            await supplier.render(ctx, chat_id, active)
+        elif active.kind == draft_store.KIND_MATERIAL:
+            await material.render(ctx, chat_id, active)
+    elif intent == "add_supplier":
+        await supplier.handle_entities(ctx, chat_id, user, patch, source)
+    elif intent == "add_material":
+        await material.handle_entities(ctx, chat_id, user, patch, source)
+    elif intent == "status_query":
+        await queries.handle_query(ctx, chat_id, user, patch)
+    elif intent == "accept_quote":
+        await decisions.start_accept(ctx, chat_id, user, patch)
+    elif intent == "arrive_items":
+        await decisions.start_arrive(ctx, chat_id, user, patch)
+    else:
+        await ctx.send(chat_id, UNKNOWN_HINT)
+
+
+# ---------------------------------------------------------------------------
+# helpers
+# ---------------------------------------------------------------------------
+
+async def _gate(ctx: BotContext, chat_id: int, message: dict) -> LinkedUser | None:
+    """Link or admin gate. Returns None when the message was consumed by linking."""
+    from . import links
+
+    link = await ctx.links.get(chat_id)
+    if link and link.user_id:
+        return LinkedUser(chat_id, link.user_id, link.display_name, link.role, is_admin=False)
+    if chat_id in ctx.admin_chat_ids:
+        return LinkedUser(chat_id, None, None, None, is_admin=True)
+
+    flow = ctx.pending.get(chat_id)
+    if flow and flow.kind == "link_password":
+        await links.finish_link(ctx, chat_id, flow, text=None, password=message.get("text") or "")
+        return None
+    if flow and flow.kind == "link_username":
+        await links.finish_username_step(ctx, chat_id, flow, message.get("text") or "")
+        return None
+    await ctx.send(chat_id, LINK_START)
+    ctx.pending.set(chat_id, "link_username", {})
+    return None
+
+
+async def _route_to_flow(ctx: BotContext, chat_id: int, flow, text: str) -> bool:
+    from . import links, decisions
+
+    if flow.kind == "link_username":
+        await links.finish_username_step(ctx, chat_id, flow, text)
+        return True
+    if flow.kind == "link_password":
+        await links.finish_link(ctx, chat_id, flow, text=text, password=text)
+        return True
+    if flow.kind == "quote_pick":
+        await decisions.handle_quote_pick_text(ctx, chat_id, flow, text)
+        return True
+    if flow.kind in ("accept", "arrive_qty", "arrive_confirm"):
+        return await decisions.handle_flow_text(ctx, chat_id, flow, text)
+    return False
+
+
+def _draft_summary(draft) -> str | None:
+    if draft is None:
+        return None
+    import json
+
+    payload = draft.payload or {}
+    if draft.kind == draft_store.KIND_QUOTE:
+        items = ", ".join(
+            f"{it.get('material_name') or '?'}"
+            + (f" {it.get('quantity')}" if it.get("quantity") else "")
+            + (f" {it.get('unit_name')}" if it.get("unit_name") else "")
+            for it in payload.get("items") or []
+        )
+        summary = (
+            f"kind=quote; supplier={payload.get('supplier_name') or '?'}; project={payload.get('project_name') or '?'}; "
+            f"items=[{items}]; terms={[t.get('label') for t in payload.get('termsheets') or []]}"
+        )
+    elif draft.kind == draft_store.KIND_SUPPLIER:
+        summary = f"kind=add_supplier; name={payload.get('name') or '?'}; category={payload.get('category_name') or '?'}"
+    elif draft.kind == draft_store.KIND_MATERIAL:
+        summary = f"kind=add_material; name={payload.get('name') or '?'}; unit={payload.get('unit_name') or '?'}"
+    else:
+        summary = json.dumps(payload, ensure_ascii=False)[:500]
+    return summary

ai procurement/app/handlers/callbacks.py

@@ -0,0 +1,107 @@
+"""Inline-button routing (callback_query).
+
+Data grammar (≤64 bytes):  op:{arg}:{d8}  /  pk:{d8}:{field}:{idx}  /  qc:{idx}
+ / ac:{op}[:{i}] / ar:{op} — full state lives in bot_drafts / pending flows.
+"""
+import logging
+
+from app import drafts as draft_store
+from app.runtime import LinkedUser
+from app.texts import CANCELLED, UNLINKED, esc
+
+from . import quote, supplier, material, decisions
+
+logger = logging.getLogger("bot.callbacks")
+
+
+async def handle_callback(ctx, cq: dict) -> None:
+    chat_id = ((cq.get("message") or {}).get("chat") or {}).get("id")
+    data = cq.get("data") or ""
+    if chat_id is None:
+        return
+    try:
+        await _dispatch(ctx, chat_id, data, cq)
+    except Exception:
+        logger.exception("callback failed: %s", data)
+        await ctx.send(chat_id, "خطا در پردازش دکمه؛ دوباره تلاش کن.")
+    finally:
+        await ctx.bale.answer_callback_query(cq.get("id"), None)
+
+
+async def _gate(ctx, chat_id: int) -> LinkedUser | None:
+    link = await ctx.links.get(chat_id)
+    if link and link.user_id:
+        return LinkedUser(chat_id, link.user_id, link.display_name, link.role, is_admin=False)
+    if chat_id in ctx.admin_chat_ids:
+        return LinkedUser(chat_id, None, None, None, is_admin=True)
+    await ctx.send(chat_id, UNLINKED)
+    return None
+
+
+async def _dispatch(ctx, chat_id: int, data: str, cq: dict) -> None:
+    user = await _gate(ctx, chat_id)
+    if user is None:
+        return
+    parts = data.split(":")
+
+    # ---- pending-flow buttons (accept / arrive / quote pick) ---------------
+    if parts[0] == "qc" and len(parts) == 2:
+        flow = ctx.pending.get(chat_id)
+        if flow and flow.kind == "quote_pick":
+            await decisions.apply_quote_pick(ctx, chat_id, user, flow, int(parts[1]))
+        return
+    if parts[0] == "ac":
+        await decisions.handle_accept_callback(ctx, chat_id, user, parts)
+        return
+    if parts[0] == "ar":
+        await decisions.handle_arrive_callback(ctx, chat_id, user, parts)
+        return
+
+    # ---- pick a candidate for a draft field -------------------------------
+    if parts[0] == "pk" and len(parts) == 4:
+        draft = await draft_store.get_by_prefix(parts[1], chat_id)
+        if draft is None:
+            await ctx.send(chat_id, "این پیش‌نویس دیگر معتبر نیست.")
+            return
+        await _apply_pick(ctx, chat_id, user, draft, parts[2], int(parts[3]))
+        return
+
+    # ---- draft commit / cancel --------------------------------------------
+    op, arg, prefix = parts[0], parts[1], parts[2] if len(parts) > 2 else ""
+    if op in ("q", "s", "m") and arg in ("ok", "ok2", "no"):
+        kind = {"q": draft_store.KIND_QUOTE, "s": draft_store.KIND_SUPPLIER, "m": draft_store.KIND_MATERIAL}[op]
+        draft = await draft_store.get_by_prefix(prefix, chat_id)
+        if draft is None or draft.kind != kind:
+            await ctx.send(chat_id, "این پیش‌نویس دیگر معتبر نیست.")
+            return
+        if arg == "no":
+            await draft_store.set_status(draft.id, "cancelled")
+            ctx.pending.pop(chat_id, None)
+            if draft.review_message_id:
+                try:
+                    await ctx.bale.edit_message_text(chat_id, draft.review_message_id, "❌ این پیش‌نویس لغو شد.", reply_markup=None)
+                    await draft_store.set_bale_updated_at(draft.id)
+                except Exception:
+                    pass
+            await ctx.send(chat_id, CANCELLED)
+            return
+        if kind == draft_store.KIND_QUOTE:
+            await quote.commit(ctx, chat_id, user, draft, only_resolved=(arg == "ok2"))
+        elif kind == draft_store.KIND_SUPPLIER:
+            await supplier.commit(ctx, chat_id, user, draft)
+        else:
+            await material.commit(ctx, chat_id, user, draft)
+
+
+async def _apply_pick(ctx, chat_id: int, user: LinkedUser, draft, field: str, idx: int) -> None:
+    options = (draft.payload.get("options") or {}).get(field) or []
+    if idx < 0 or idx >= len(options):
+        await ctx.send(chat_id, "گزینه نامعتبر است.")
+        return
+    choice = options[idx]
+    if draft.kind == draft_store.KIND_QUOTE:
+        await quote.apply_pick(ctx, chat_id, user, draft, field, choice)
+    elif draft.kind == draft_store.KIND_SUPPLIER:
+        await supplier.apply_pick(ctx, chat_id, user, draft, field, choice)
+    elif draft.kind == draft_store.KIND_MATERIAL:
+        await material.apply_pick(ctx, chat_id, user, draft, field, choice)

ai procurement/app/handlers/commands.py

@@ -0,0 +1,82 @@
+"""/commands — /start /help /drafts /cancel /whoami /unlink."""
+import logging
+
+from app import drafts as draft_store
+from app.runtime import ROLE_FA
+from app.texts import CANCELLED, DRAFTS_EMPTY, DRAFTS_LIST_HEADER, HELP, UNLINKED, WELCOME, esc
+
+logger = logging.getLogger("bot.commands")
+
+KIND_FA = {"quote": "استعلام", "supplier": "تأمین‌کننده", "material": "کالا"}
+STATUS_FA = {"active": "باز", "committed": "ثبت‌شده", "cancelled": "لغوشده", "expired": "منقضی"}
+
+
+async def handle_command(ctx, chat_id: int, text: str) -> None:
+    command = text.split()[0].split("@")[0].lower()
+    if command == "/start":
+        await _start(ctx, chat_id)
+    elif command in ("/help", "/راهنما"):
+        await ctx.send(chat_id, HELP)
+    elif command == "/drafts":
+        await _drafts(ctx, chat_id)
+    elif command in ("/cancel", "/لغو"):
+        await _cancel(ctx, chat_id)
+    elif command == "/whoami":
+        await _whoami(ctx, chat_id)
+    elif command == "/unlink":
+        await ctx.links.delete(chat_id)
+        await ctx.send(chat_id, "اتصال قطع شد. برای اتصال دوباره /start بزن.")
+    else:
+        await ctx.send(chat_id, HELP)
+
+
+async def _start(ctx, chat_id: int) -> None:
+    await ctx.send(chat_id, WELCOME)
+    link = await ctx.links.get(chat_id)
+    if not link or not link.user_id:
+        if chat_id not in ctx.admin_chat_ids:
+            await ctx.send(chat_id, "برای شروع، حساب خود را متصل کن — نام کاربری Casdoor را بفرست:")
+            ctx.pending.set(chat_id, "link_username", {})
+
+
+async def _drafts(ctx, chat_id: int) -> None:
+    from sqlalchemy import select
+
+    from app.db import SessionLocal
+    from app.models import BotDraft
+
+    async with SessionLocal() as session:
+        rows = (await session.execute(
+            select(BotDraft)
+            .where(BotDraft.chat_id == chat_id, BotDraft.status == "active")
+            .order_by(BotDraft.updated_at.desc())
+        )).scalars().all()
+    if not rows:
+        await ctx.send(chat_id, DRAFTS_EMPTY)
+        return
+    lines = [DRAFTS_LIST_HEADER]
+    for d in rows:
+        p = d.payload or {}
+        title = p.get("supplier_name") or p.get("name") or "بدون عنوان"
+        lines.append(f"• {KIND_FA.get(d.kind, d.kind)}: {esc(title)}")
+    await ctx.send(chat_id, "\n".join(lines))
+
+
+async def _cancel(ctx, chat_id: int) -> None:
+    ctx.pending.pop(chat_id)
+    active = await draft_store.get_active(chat_id)
+    if active:
+        await draft_store.set_status(active.id, "cancelled")
+    await ctx.send(chat_id, CANCELLED)
+
+
+async def _whoami(ctx, chat_id: int) -> None:
+    link = await ctx.links.get(chat_id)
+    if chat_id in ctx.admin_chat_ids:
+        await ctx.send(chat_id, "حالت ادمین (بدون اتصال Casdoor).")
+        return
+    if not link or not link.user_id:
+        await ctx.send(chat_id, UNLINKED)
+        return
+    role = ROLE_FA.get(link.role or "", link.role or "بدون نقش")
+    await ctx.send(chat_id, f"اتصال: <b>{esc(link.display_name)}</b> — {role}")

ai procurement/app/handlers/decisions.py

@@ -0,0 +1,389 @@
+"""Accept / arrive flows — always with an explicit confirmation step."""
+import logging
+import re
+
+from app.api.client import ApiError
+from app.keyboards import accept_keyboard, arrive_keyboard, quote_pick_keyboard
+from app.nlu import normalize_digits
+from app.texts import (
+    ACCEPT_DONE_TS, ACCEPT_REPORT, ARRIVE_REPORT, CANCELLED, ERR_GENERIC,
+    QUOTE_NOT_FOUND, STATUS_FA, esc,
+)
+
+logger = logging.getLogger("bot.decisions")
+
+EXPAND = "supplier,line_items,termsheets"
+CONFIRM_WORDS = {"تایید", "تأیید", "ثبت", "ثبت کن", "اوکی", "اوکیه", "بله", "yes", "ok"}
+CANCEL_WORDS = {"لغو", "بی خیال", "بیخیال", "انصراف", "نه", "cancel"}
+
+
+def _norm(text: str) -> str:
+    return (text or "").strip().lower().replace("\u200c", " ")
+
+
+# ---------------------------------------------------------------------------
+# shared: pick a quote by supplier text
+# ---------------------------------------------------------------------------
+
+async def start_accept(ctx, chat_id, user, patch: dict) -> None:
+    await _start_for_status(ctx, chat_id, user, patch, mode="accept", status="offered")
+
+
+async def start_arrive(ctx, chat_id, user, patch: dict) -> None:
+    await _start_for_status(ctx, chat_id, user, patch, mode="arrive", status="accepted")
+
+
+async def _start_for_status(ctx, chat_id, user, patch: dict, mode: str, status: str) -> None:
+    target = (patch.get("target") or {})
+    q = target.get("supplier_name") or target.get("project_name") or target.get("quote_id")
+    try:
+        quotes, _ = await ctx.api.list_quotes(status=status, q=q, expand=EXPAND, page_size=10)
+    except ApiError as exc:
+        await ctx.send(chat_id, ERR_GENERIC.format(detail=esc(exc.message)))
+        return
+    if not quotes:
+        await ctx.send(chat_id, QUOTE_NOT_FOUND.format(q=esc(q or "?")))
+        return
+    if len(quotes) == 1:
+        if mode == "accept":
+            await begin_accept(ctx, chat_id, user, quotes[0])
+        else:
+            await begin_arrive(ctx, chat_id, user, quotes[0])
+        return
+    pairs = [(_quote_label(qq), str(qq["id"])) for qq in quotes]
+    flow = ctx.pending.set(chat_id, "quote_pick", {"mode": mode, "ids": [pid for _, pid in pairs]})
+    flow.data["user_id"] = user.actor_id
+    message = await ctx.send(chat_id, "چند مورد پیدا شد؛ کدام را می‌خواهی؟", reply_markup=quote_pick_keyboard(pairs))
+    flow.data["message_id"] = (message or {}).get("message_id")
+
+
+def _quote_label(quote: dict) -> str:
+    sup = (quote.get("supplier") or {}).get("name") or "—"
+    return f"#{str(quote.get('id'))[:8]} {sup}"
+
+
+async def apply_quote_pick(ctx, chat_id, user, flow, idx: int) -> None:
+    ids = flow.data.get("ids") or []
+    ctx.pending.pop(chat_id)
+    if idx < 0 or idx >= len(ids):
+        await ctx.send(chat_id, "گزینه نامعتبر است.")
+        return
+    try:
+        quote = await ctx.api.get_quote(ids[idx], expand=EXPAND, actor_id=user.actor_id)
+    except ApiError as exc:
+        await ctx.send(chat_id, ERR_GENERIC.format(detail=esc(exc.message)))
+        return
+    if flow.data.get("mode") == "arrive":
+        await begin_arrive(ctx, chat_id, user, quote)
+    else:
+        await begin_accept(ctx, chat_id, user, quote)
+
+
+async def handle_quote_pick_text(ctx, chat_id, flow, text: str) -> None:
+    if _norm(text) in CANCEL_WORDS:
+        ctx.pending.pop(chat_id)
+        await ctx.send(chat_id, CANCELLED)
+        return
+    numbers = re.findall(r"\d+", normalize_digits(text))
+    if numbers:
+        await apply_quote_pick(ctx, chat_id, _flow_user(flow), flow, int(numbers[0]) - 1)
+    else:
+        await ctx.send(chat_id, "شماره مورد را بفرست یا از دکمه‌ها استفاده کن.")
+
+
+def _flow_user(flow):
+    from app.runtime import LinkedUser
+    return LinkedUser(chat_id=None, user_id=flow.data.get("user_id"), display_name=None,
+                      role=None, is_admin=False)
+
+
+# ---------------------------------------------------------------------------
+# accept
+# ---------------------------------------------------------------------------
+
+def _accept_summary(quote: dict, chosen: int) -> str:
+    lines = [
+        f"✔️ <b>پذیرش استعلام</b> #{esc(str(quote.get('id'))[:8])} — {esc((quote.get('supplier') or {}).get('name') or '—')}",
+        "",
+        "<b>اقلام:</b>",
+    ]
+    for li in quote.get("line_items") or []:
+        mat = (li.get("material") or {}).get("name") or li.get("material_id") or "?"
+        unit = ((li.get("unit") or {}).get("name_fa")) or ""
+        price = li.get("unit_price")
+        parts = [f"• {esc(mat)} — مقدار {esc(li.get('quantity'))} {unit}"]
+        if price:
+            parts.append(f"قیمت {esc(price)}")
+        lines.append(" — ".join(parts))
+    lines.append("")
+    lines.append("<b>شرایط پرداخت:</b>")
+    for i, ts in enumerate(quote.get("termsheets") or []):
+        mark = "👉" if i == chosen else "  "
+        discount = f" (تخفیف {esc(ts.get('discount_value'))})" if ts.get("discount_value") else ""
+        lines.append(f"{mark} [{i + 1}] {esc(ts.get('label'))}{discount} — {len(ts.get('schedule_steps') or [])} مرحله")
+    lines.append("")
+    lines.append("شرایط را انتخاب کن و پذیرش را تأیید کن.")
+    return "\n".join(lines)
+
+
+async def begin_accept(ctx, chat_id, user, quote: dict) -> None:
+    termsheets = quote.get("termsheets") or []
+    if not termsheets:
+        await ctx.send(chat_id, "این استعلام شرایط پرداخت ندارد؛ اول در برنامه ثبت کن.")
+        return
+    if not quote.get("line_items"):
+        await ctx.send(chat_id, "این استعلام قلم ندارد.")
+        return
+    flow = ctx.pending.set(chat_id, "accept", {
+        "quote_id": str(quote["id"]),
+        "quote_snapshot": {
+            "id": quote.get("id"),
+            "supplier": quote.get("supplier"),
+            "line_items": quote.get("line_items") or [],
+        },
+        "termsheets": termsheets,
+        "chosen": 0,
+        "user_id": user.actor_id,
+    })
+    text = _accept_summary(quote, 0)
+    message = await ctx.send(chat_id, text, reply_markup=accept_keyboard([ts.get("label") or "?" for ts in termsheets]))
+    flow.data["message_id"] = (message or {}).get("message_id")
+
+
+async def handle_accept_callback(ctx, chat_id, user, parts) -> None:
+    flow = ctx.pending.get(chat_id)
+    if not flow or flow.kind != "accept":
+        await ctx.send(chat_id, "این عملیات منقضی شده؛ دوباره درخواست بده.")
+        return
+    op = parts[1] if len(parts) > 1 else ""
+    if op == "no":
+        ctx.pending.pop(chat_id)
+        await ctx.send(chat_id, CANCELLED)
+        return
+    if op == "ts" and len(parts) == 3:
+        idx = int(parts[2])
+        if 0 <= idx < len(flow.data["termsheets"]):
+            flow.data["chosen"] = idx
+            await ctx.edit(chat_id, flow.data.get("message_id"),
+                           _accept_summary(flow.data["quote_snapshot"], idx),
+                           reply_markup=accept_keyboard([ts.get("label") or "?" for ts in flow.data["termsheets"]]))
+        return
+    if op == "ok":
+        await _commit_accept(ctx, chat_id, user, flow)
+
+
+async def _commit_accept(ctx, chat_id, user, flow) -> None:
+    data = flow.data
+    quote_id = data["quote_id"]
+    termsheets = data["termsheets"]
+    ts_index = data.get("chosen", 0)
+    if not 0 <= ts_index < len(termsheets):
+        await ctx.send(chat_id, "شرایط پرداخت انتخاب نشده است.")
+        return
+    ts = termsheets[ts_index]
+    steps = ts.get("schedule_steps") or []
+    if not steps:
+        await ctx.send(chat_id, "ترم‌شیت انتخابی مرحله پرداخت ندارد؛ در برنامه تکمیلش کن.")
+        return
+
+    try:
+        quote = await ctx.api.get_quote(quote_id, expand=EXPAND, actor_id=user.actor_id)
+    except ApiError as exc:
+        await ctx.send(chat_id, ERR_GENERIC.format(detail=esc(exc.message)))
+        return
+
+    decisions_payload = []
+    problems = []
+    for li in quote.get("line_items") or []:
+        decision = li.get("decision") or {}
+        if decision.get("status") == "rejected":
+            continue
+        price = li.get("unit_price")
+        if not price:
+            problems.append(f"قیمت قلم «{(li.get('material') or {}).get('name') or '?'}» ثبت نشده")
+            continue
+        li_projects = li.get("projects") or []
+        project_id = li_projects[0]["id"] if len(li_projects) == 1 else quote.get("project_id")
+        decisions_payload.append({
+            "line_item_id": li["id"],
+            "status": "chosen",
+            "accepted_termsheet_index": 0,
+            "adjusted_unit_price": price,
+            "project_id": project_id,
+        })
+    if problems:
+        await ctx.send(chat_id, "پذیرش ممکن نیست:\n" + "\n".join(f"❌ {esc(p)}" for p in problems))
+        return
+    if not decisions_payload:
+        await ctx.send(chat_id, "قلم قابل پذیرشی نیست (همه رد شده‌اند؟).")
+        return
+
+    payload = {
+        "accepted_termsheets": [{
+            "id": ts["id"],
+            "label": ts.get("label"),
+            "discount_type": ts.get("discount_type") or "none",
+            "discount_value": ts.get("discount_value") or 0,
+            "schedule_steps": steps,
+        }],
+        "item_decisions": decisions_payload,
+    }
+    try:
+        result = await ctx.api.accept_quote(quote_id, payload, actor_id=user.actor_id)
+    except ApiError as exc:
+        await ctx.send(chat_id, ERR_GENERIC.format(detail=esc(exc.message)))
+        return
+    ctx.pending.pop(chat_id)
+    chosen_label = ts.get("label") or ""
+    await ctx.send(chat_id, ACCEPT_REPORT.format(
+        id=esc(str(result.get("id"))[:8]),
+        status=STATUS_FA.get(result.get("status"), result.get("status")),
+        count=len(decisions_payload),
+    ) + "\n" + ACCEPT_DONE_TS.format(label=esc(chosen_label)))
+
+
+async def handle_flow_text(ctx, chat_id, flow, text: str) -> bool:
+    if flow.kind == "accept":
+        norm = _norm(text)
+        if norm in CANCEL_WORDS:
+            ctx.pending.pop(chat_id)
+            await ctx.send(chat_id, CANCELLED)
+            return True
+        if any(word in norm for word in ("تایید", "تأیید", "ثبت", "اوکی", "ok", "yes")):
+            await _commit_accept(ctx, chat_id, _flow_user(flow), flow)
+            return True
+        await ctx.send(chat_id, "برای پذیرش از دکمه‌ها استفاده کن (یا /cancel).")
+        return True
+    if flow.kind == "arrive_qty":
+        await _handle_arrive_quantities(ctx, chat_id, flow, text)
+        return True
+    if flow.kind == "arrive_confirm":
+        norm = _norm(text)
+        if any(word in norm for word in ("تایید", "تأیید", "ثبت", "اوکی", "ok", "yes")):
+            await _commit_arrive(ctx, chat_id, _flow_user(flow), flow)
+            return True
+        if norm in CANCEL_WORDS:
+            ctx.pending.pop(chat_id)
+            await ctx.send(chat_id, CANCELLED)
+            return True
+        await ctx.send(chat_id, "با دکمه‌ها تأیید یا لغو کن (یا /cancel).")
+        return True
+    return False
+
+
+# ---------------------------------------------------------------------------
+# arrive (partial deliveries)
+# ---------------------------------------------------------------------------
+
+def _arrive_summary(items: list[dict], quantities: dict[str, float] | None = None) -> str:
+    lines = ["🚚 <b>اعلام رسیدن اقلام</b>", ""]
+    for li in items:
+        mat = (li.get("material") or {}).get("name") or "?"
+        ordered = li.get("quantity") or 0
+        received = ((li.get("receipt") or {}).get("received_qty")) or 0
+        unit = ((li.get("unit") or {}).get("name_fa")) or ""
+        got = ""
+        if quantities and li["id"] in quantities:
+            got = f" → <b>الان: {esc(quantities[li['id']])} {unit}</b>"
+        lines.append(f"• {esc(mat)} — سفارش {esc(ordered)} {unit} — تاکنون {esc(received)}{got}")
+    return "\n".join(lines)
+
+
+async def begin_arrive(ctx, chat_id, user, quote: dict) -> None:
+    items = [li for li in quote.get("line_items") or [] if (li.get("decision") or {}).get("status") == "chosen"]
+    if not items:
+        await ctx.send(chat_id, "قلم پذیرفته‌شده‌ای برای تحویل نیست.")
+        return
+    flow = ctx.pending.set(chat_id, "arrive_qty", {
+        "quote_id": str(quote["id"]),
+        "items": [{"id": li["id"], "name": (li.get("material") or {}).get("name") or "?",
+                   "ordered": li.get("quantity"), "unit": ((li.get("unit") or {}).get("name_fa")) or "",
+                   "received": ((li.get("receipt") or {}).get("received_qty")) or 0} for li in items],
+        "user_id": user.actor_id,
+    })
+    text = (
+        f"استعلام #{esc(str(quote.get('id'))[:8])} — {esc((quote.get('supplier') or {}).get('name') or '—')}\n"
+        + _arrive_summary(quote.get("line_items") or [])
+        + "\n\nمقادیر رسیده را به ترتیب اقلام بفرست (مثلاً: «500 و 200»)، یا «تحویل کامل همه» را بزن."
+    )
+    message = await ctx.send(chat_id, text, reply_markup=arrive_keyboard())
+    flow.data["message_id"] = (message or {}).get("message_id")
+
+
+async def _handle_arrive_quantities(ctx, chat_id, flow, text: str) -> None:
+    numbers = [float(n) for n in re.findall(r"\d+(?:\.\d+)?", normalize_digits(text))]
+    items = flow.data["items"]
+    if not numbers:
+        await ctx.send(chat_id, "مقادیر را عددی بفرست، مثل «500 و 200»، یا از دکمه‌ها استفاده کن.")
+        return
+    if len(numbers) == 1 and len(items) > 1:
+        await ctx.send(chat_id, f"{len(items)} قلم است؛ برای هر قلم یک عدد بفرست (به ترتیب).")
+        return
+    if len(numbers) != len(items):
+        await ctx.send(chat_id, "تعداد اعداد با تعداد اقلام نمی‌خواند؛ دوباره بفرست.")
+        return
+    quantities = {item["id"]: qty for item, qty in zip(items, numbers)}
+    flow.kind = "arrive_confirm"
+    flow.data["quantities"] = quantities
+    await ctx.edit(chat_id, flow.data.get("message_id"),
+                   _arrive_summary(_items_with_details(flow.data["items"]), quantities)
+                   + "\n\nتأیید می‌کنی؟",
+                   reply_markup=arrive_keyboard())
+
+
+def _items_with_details(items: list[dict]) -> list[dict]:
+    return [{
+        "id": it["id"],
+        "material": {"name": it["name"]},
+        "quantity": it["ordered"],
+        "unit": {"name_fa": it["unit"]},
+        "receipt": {"received_qty": it["received"]},
+    } for it in items]
+
+
+async def handle_arrive_callback(ctx, chat_id, user, parts) -> None:
+    flow = ctx.pending.get(chat_id)
+    if not flow or not flow.kind.startswith("arrive"):
+        await ctx.send(chat_id, "این عملیات منقضی شده؛ دوباره درخواست بده.")
+        return
+    op = parts[1] if len(parts) > 1 else ""
+    if op == "no":
+        ctx.pending.pop(chat_id)
+        await ctx.send(chat_id, CANCELLED)
+        return
+    if op == "full":
+        quantities = {item["id"]: max(float(item["ordered"] or 0) - float(item["received"] or 0), 0) for item in flow.data["items"]}
+        if any(v <= 0 for v in quantities.values()):
+            await ctx.send(chat_id, "برای بعضی اقلام چیزی برای تحویل نمانده؛ مقادیر را دستی بفرست.")
+            return
+        flow.kind = "arrive_confirm"
+        flow.data["quantities"] = quantities
+        await ctx.edit(chat_id, flow.data.get("message_id"),
+                       _arrive_summary(_items_with_details(flow.data["items"]), quantities)
+                       + "\n\nتأیید می‌کنی؟",
+                       reply_markup=arrive_keyboard())
+        return
+    if op == "ok":
+        if flow.kind != "arrive_confirm" or not flow.data.get("quantities"):
+            await ctx.send(chat_id, "اول مقادیر رسیده را بفرست یا «تحویل کامل همه» را بزن.")
+            return
+        await _commit_arrive(ctx, chat_id, user, flow)
+
+
+async def _commit_arrive(ctx, chat_id, user, flow) -> None:
+    quantities: dict = flow.data["quantities"]
+    payload = {"items": [{"line_item_id": li_id, "received_qty": qty} for li_id, qty in quantities.items()]}
+    try:
+        result = await ctx.api.arrive_items(flow.data["quote_id"], payload, actor_id=user.actor_id)
+    except ApiError as exc:
+        await ctx.send(chat_id, ERR_GENERIC.format(detail=esc(exc.message)))
+        return
+    ctx.pending.pop(chat_id)
+    lines = []
+    for item in result.get("items") or []:
+        lines.append(f"• قلم {esc(str(item.get('line_item_id'))[:8])} — {esc(item.get('received_qty'))} ثبت شد")
+    await ctx.send(chat_id, ARRIVE_REPORT.format(
+        id=esc(str(result.get("id"))[:8]),
+        status=STATUS_FA.get(result.get("status"), result.get("status")),
+        lines="\n".join(lines) or "—",
+    ))

ai procurement/app/handlers/links.py

@@ -0,0 +1,46 @@
+"""Casdoor linking: chat ↔ ERP user (validated through the real login endpoint)."""
+import logging
+
+from app.api.client import ApiError
+from app.runtime import ROLE_FA
+from app.texts import LINK_ASK_PASSWORD, LINK_FAIL, LINK_OK, esc
+
+logger = logging.getLogger("bot.links")
+
+
+async def finish_username_step(ctx, chat_id: int, flow, text: str) -> None:
+    username = (text or "").strip()
+    if not username or username.startswith("/"):
+        ctx.pending.pop(chat_id)
+        return
+    flow.kind = "link_password"
+    flow.data["username"] = username
+    await ctx.send(chat_id, LINK_ASK_PASSWORD)
+
+
+async def finish_link(ctx, chat_id: int, flow, text: str | None, password: str) -> None:
+    username = flow.data.get("username") or ""
+    ctx.pending.pop(chat_id)
+    if not password or password.startswith("/"):
+        return
+    try:
+        data = await ctx.api.login(username, password)
+    except ApiError as exc:
+        await ctx.send(chat_id, LINK_FAIL.format(detail=esc(exc.message)))
+        return
+    except Exception as exc:  # network etc.
+        logger.exception("login failed")
+        await ctx.send(chat_id, LINK_FAIL.format(detail=esc(str(exc)[:200])))
+        return
+
+    user = data.get("user") or {}
+    display = " ".join(x for x in [user.get("first_name"), user.get("last_name")] if x) or username
+    await ctx.links.upsert(
+        chat_id=chat_id,
+        user_id=user.get("id"),
+        username=username,
+        display_name=display,
+        role=user.get("role"),
+    )
+    role_fa = ROLE_FA.get(user.get("role") or "", user.get("role") or "بدون نقش")
+    await ctx.send(chat_id, LINK_OK.format(name=esc(display), role=role_fa))

ai procurement/app/handlers/material.py

@@ -0,0 +1,98 @@
+"""Add-material flow: name + canonical unit (required)."""
+import logging
+
+from app import drafts as draft_store
+from app.api.client import ApiError
+from app.drafts import (
+    KIND_MATERIAL, merge_material_patch, material_missing, new_material_payload,
+)
+from app.keyboards import pick_buttons, simple_review_keyboard
+from app.resolve import safe_resolve
+from app.texts import ERR_GENERIC, esc, material_committed_report, material_review_text
+
+logger = logging.getLogger("bot.material")
+
+
+async def handle_entities(ctx, chat_id, user, patch: dict, source: str | None) -> None:
+    draft = await draft_store.get_active(chat_id, KIND_MATERIAL)
+    if draft is not None:
+        payload = draft.payload
+        merge_material_patch(payload, patch)
+    else:
+        payload = new_material_payload()
+        merge_material_patch(payload, patch)
+        draft = await draft_store.create(chat_id, KIND_MATERIAL, payload, source=source)
+    await resolve_payload(ctx, payload)
+    await draft_store.save_payload(draft, missing={"fields": material_missing(payload)})
+    await render(ctx, chat_id, draft, fresh=draft.review_message_id is None)
+
+
+async def resolve_payload(ctx, payload: dict) -> None:
+    options = payload.setdefault("options", {})
+    if not payload.get("canonical_unit_id") and payload.get("unit_name"):
+        res = await safe_resolve(ctx.resolver, "unit", payload["unit_name"])
+        if res.resolved:
+            payload["canonical_unit_id"] = res.candidates[0].id
+            payload["unit_name"] = res.candidates[0].name
+            options.pop("unit", None)
+        elif res.candidates:
+            options["unit"] = [{"id": c.id, "name": c.name} for c in res.candidates]
+        else:
+            options.pop("unit", None)
+
+
+async def apply_pick(ctx, chat_id, user, draft, field: str, choice: dict) -> None:
+    if field == "unit":
+        draft.payload["canonical_unit_id"] = choice["id"]
+        draft.payload["unit_name"] = choice["name"]
+        draft.payload.setdefault("options", {}).pop("unit", None)
+    await draft_store.save_payload(draft, missing={"fields": material_missing(draft.payload)})
+    await render(ctx, chat_id, draft, fresh=False)
+
+
+def _keyboard(payload: dict, draft_id: str) -> dict:
+    rows: list[list[dict]] = []
+    options = (payload.get("options") or {}).get("unit") or []
+    if options:
+        rows += pick_buttons(draft_id, "unit", [o["name"] for o in options[:6]])
+    return simple_review_keyboard(draft_id, KIND_MATERIAL, rows)
+
+
+async def render(ctx, chat_id, draft, fresh: bool = True) -> None:
+    payload = draft.payload
+    missing = material_missing(payload)
+    text = material_review_text(payload, missing)
+    keyboard = _keyboard(payload, draft.id)
+    if fresh:
+        message = await ctx.send(chat_id, text, reply_markup=keyboard)
+        draft.review_message_id = (message or {}).get("message_id")
+        await draft_store.save_payload(draft, missing={"fields": missing},
+                                       review_message_id=draft.review_message_id)
+    else:
+        await ctx.edit(chat_id, draft.review_message_id, text, reply_markup=keyboard)
+        await draft_store.save_payload(draft, missing={"fields": missing})
+
+
+async def commit(ctx, chat_id, user, draft) -> None:
+    payload = draft.payload
+    await resolve_payload(ctx, payload)
+    missing = {m["key"]: m["ok"] for m in material_missing(payload)}
+    problems = [label for key, label, ok in [
+        ("name", "نام کالا", missing.get("name")),
+        ("unit", "واحد اصلی", missing.get("unit")),
+    ] if not ok]
+    if problems:
+        await ctx.send(chat_id, "ثبت ممکن نیست؛ اول این‌ها را مشخص کن:\n" +
+                       "\n".join(f"❌ {esc(p)}" for p in problems))
+        return
+    body = {"name": payload["name"], "canonical_unit_id": int(payload["canonical_unit_id"])}
+    if payload.get("topic"):
+        body["topic"] = payload["topic"]
+    try:
+        created = await ctx.api.create_material(body, actor_id=user.actor_id)
+    except ApiError as exc:
+        await ctx.send(chat_id, ERR_GENERIC.format(detail=esc(exc.message)))
+        return
+    await draft_store.set_status(draft.id, "committed")
+    ctx.resolver.invalidate("materials")
+    await ctx.send(chat_id, material_committed_report(created))

ai procurement/app/handlers/queries.py

@@ -0,0 +1,44 @@
+"""Status queries: «استعلام‌های در انتظار؟»، «کدام‌ها منقضی می‌شوند؟» …"""
+import logging
+from datetime import date, timedelta
+
+from app.api.client import ApiError
+from app.texts import ERR_GENERIC, status_report, esc
+
+logger = logging.getLogger("bot.queries")
+
+EXPAND = "supplier,line_items"
+
+
+async def handle_query(ctx, chat_id, user, patch: dict) -> None:
+    query = patch.get("query") or {}
+    kind = query.get("kind") or "pending"
+    supplier_name = query.get("supplier_name")
+    q = supplier_name or query.get("project_name")
+
+    try:
+        if kind == "expiring":
+            quotes, _ = await ctx.api.list_quotes(status="offered", expand=EXPAND,
+                                                  q=q, sort="-quote_date", page_size=100)
+            deadline = date.today() + timedelta(days=query.get("days") or 7)
+            soon = []
+            for quote in quotes:
+                expiry = (quote.get("expiry_date") or "")[:10]
+                if expiry and expiry <= deadline.isoformat():
+                    soon.append(quote)
+            soon.sort(key=lambda x: x.get("expiry_date") or "9999")
+            await ctx.send(chat_id, status_report("expiring", soon[:10]))
+            return
+
+        if kind in ("accepted", "arrived", "pending", "offered"):
+            status = "offered" if kind == "pending" else kind
+            quotes, _ = await ctx.api.list_quotes(status=status, expand=EXPAND, q=q,
+                                                  sort="-quote_date", page_size=10)
+            await ctx.send(chat_id, status_report("pending" if kind == "offered" else kind, quotes))
+            return
+
+        # recent / anything else
+        quotes, meta = await ctx.api.list_quotes(expand=EXPAND, q=q, sort="-quote_date", page_size=5)
+        await ctx.send(chat_id, status_report("recent", quotes))
+    except ApiError as exc:
+        await ctx.send(chat_id, ERR_GENERIC.format(detail=esc(exc.message)))

ai procurement/app/handlers/quote.py

@@ -0,0 +1,316 @@
+"""Register-quote flow: entities → draft → resolve → review (+missing) → commit."""
+import logging
+
+from app import drafts as draft_store
+from app.api.client import ApiError
+from app.drafts import (
+    KIND_QUOTE, build_quote_request, compute_quote_missing, merge_quote_patch,
+    new_quote_payload, quote_ready,
+)
+from app.keyboards import quote_review_keyboard
+from app.resolve import safe_resolve
+from app.texts import ERR_GENERIC, quote_committed_report, quote_review_text, esc
+
+logger = logging.getLogger("bot.quote")
+
+FIELD_FA = {"sup": "تأمین‌کننده", "prj": "پروژه"}
+
+
+async def handle_entities(
+    ctx, chat_id, user, patch: dict, source: str | None,
+    incoming_msg_id: int | None = None,
+    target_draft = None,
+) -> None:
+    prev_review_msg_id = None
+    if target_draft is not None:
+        draft = target_draft
+        prev_review_msg_id = draft.review_message_id
+        draft.review_message_id = None
+        payload = draft.payload
+        merge_quote_patch(payload, patch)
+        draft.source_message_id = incoming_msg_id
+    else:
+        payload = new_quote_payload()
+        merge_quote_patch(payload, patch)
+        draft = await draft_store.create(
+            chat_id, KIND_QUOTE, payload, source=source, source_message_id=incoming_msg_id
+        )
+
+    await resolve_payload(ctx, payload)
+
+    if prev_review_msg_id:
+        try:
+            await ctx.delete(chat_id, prev_review_msg_id)
+        except Exception as e:
+            logger.warning("Could not delete previous review message %s: %s", prev_review_msg_id, e)
+
+    await render(ctx, chat_id, draft, fresh=True, reply_to=incoming_msg_id)
+
+
+# ---------------------------------------------------------------------------
+# resolution
+# ---------------------------------------------------------------------------
+
+async def resolve_payload(ctx, payload: dict) -> None:
+    options = payload.setdefault("options", {})
+
+    if not payload.get("supplier_id") and payload.get("supplier_name"):
+        res = await safe_resolve(ctx.resolver, "supplier", payload["supplier_name"])
+        if res.resolved:
+            payload["supplier_id"] = res.candidates[0].id
+            payload["supplier_name"] = res.candidates[0].name
+            options.pop("sup", None)
+        elif res.candidates:
+            options["sup"] = [{"id": c.id, "name": c.name} for c in res.candidates]
+        else:
+            options.pop("sup", None)
+
+    if not payload.get("project_id") and payload.get("project_name"):
+        res = await safe_resolve(ctx.resolver, "project", payload["project_name"])
+        if res.resolved:
+            payload["project_id"] = res.candidates[0].id
+            payload["project_name"] = res.candidates[0].name
+            if payload["project_id"] not in payload.get("project_ids", []):
+                payload.setdefault("project_ids", []).append(payload["project_id"])
+            options.pop("prj", None)
+        elif res.candidates:
+            options["prj"] = [{"id": c.id, "name": c.name} for c in res.candidates]
+        else:
+            options.pop("prj", None)
+
+    for p_name in payload.get("project_names") or []:
+        res = await safe_resolve(ctx.resolver, "project", p_name)
+        if res.resolved:
+            p_id = res.candidates[0].id
+            if p_id not in payload.get("project_ids", []):
+                payload.setdefault("project_ids", []).append(p_id)
+            if not payload.get("project_id"):
+                payload["project_id"] = p_id
+
+    for i, item in enumerate(payload.get("items") or [], start=1):
+        if not item.get("material_id") and item.get("material_name"):
+            res = await safe_resolve(ctx.resolver, "material", item["material_name"])
+            if res.resolved:
+                _set_material(item, res.candidates[0].id, res.candidates[0].name, res.candidates[0].extra)
+                options.pop(f"mat{i}", None)
+            elif res.candidates:
+                options[f"mat{i}"] = [{"id": c.id, "name": c.name} for c in res.candidates]
+            else:
+                options.pop(f"mat{i}", None)
+        if not item.get("unit_id"):
+            await _resolve_unit(ctx, item)
+
+
+def _set_material(item: dict, material_id: str, name: str, extra: dict | None = None) -> None:
+    item["material_id"] = material_id
+    item["material_row"] = {"id": material_id, "canonical_unit_id": (extra or {}).get("canonical_unit_id")}
+
+
+async def _resolve_unit(ctx, item: dict) -> None:
+    if item.get("unit_id"):
+        return
+    if item.get("unit_name"):
+        res = await safe_resolve(ctx.resolver, "unit", item["unit_name"])
+        if res.resolved:
+            item["unit_id"] = res.candidates[0].id
+            item["unit_explicit"] = True
+            item["unit_name"] = res.candidates[0].name
+            return
+    canonical = ((item.get("material_row") or {}).get("canonical_unit_id"))
+    if canonical:
+        item["unit_id"] = str(canonical)
+        item["unit_explicit"] = False
+
+
+async def apply_pick(ctx, chat_id, user, draft, field: str, choice: dict) -> None:
+    payload = draft.payload
+    options = payload.setdefault("options", {})
+    options.pop(field, None)
+
+    if field == "sup":
+        payload["supplier_id"] = choice["id"]
+        payload["supplier_name"] = choice["name"]
+    elif field == "prj":
+        payload["project_id"] = choice["id"]
+        payload["project_name"] = choice["name"]
+    elif field.startswith("mat"):
+        index = int(field[3:]) - 1
+        items = payload.get("items") or []
+        if 0 <= index < len(items):
+            items[index]["material_name"] = choice["name"]
+            _set_material(items[index], choice["id"], choice["name"])
+            await _resolve_unit(ctx, items[index])
+    elif field.startswith("unit"):
+        index = int(field[4:]) - 1
+        items = payload.get("items") or []
+        if 0 <= index < len(items):
+            items[index]["unit_id"] = choice["id"]
+            items[index]["unit_explicit"] = True
+            items[index]["unit_name"] = choice["name"]
+
+    await resolve_payload(ctx, payload)
+    await draft_store.save_payload(draft, missing={"fields": compute_quote_missing(payload)})
+    await render(ctx, chat_id, draft, fresh=False)
+
+
+# ---------------------------------------------------------------------------
+# rendering
+# ---------------------------------------------------------------------------
+
+def _pick_rows(payload: dict) -> list[list[str]]:
+    """Field labels shown as pick-button rows (via keyboards.pick_buttons)."""
+    rows: list[list[str]] = []
+    options = payload.get("options") or {}
+    if options.get("sup"):
+        rows.append(["sup"] + [o["name"] for o in options["sup"]])
+    if options.get("prj"):
+        rows.append(["prj"] + [o["name"] for o in options["prj"]])
+    for i, item in enumerate(payload.get("items") or [], start=1):
+        if options.get(f"mat{i}"):
+            rows.append([f"mat{i}"] + [o["name"] for o in options[f"mat{i}"]])
+        if options.get(f"unit{i}"):
+            rows.append([f"unit{i}"] + [o["name"] for o in options[f"unit{i}"]])
+    return rows
+
+
+def _keyboard(payload: dict, draft_id: str, wizard_url: str | None = None) -> dict:
+    from app.keyboards import pick_buttons
+
+    prefix = str(draft_id)[:8]
+    pick_rows: list[list[dict]] = []
+    for row in _pick_rows(payload):
+        field, names = row[0], row[1:]
+        pick_rows += pick_buttons(prefix, field, names[:6])
+    ready_items = sum(
+        1 for it in payload.get("items") or []
+        if it.get("material_id") and it.get("quantity") and it.get("unit_id")
+    )
+    has_partial = 0 < ready_items < len(payload.get("items") or [])
+    return quote_review_keyboard(prefix, pick_rows, has_partial_option=has_partial, wizard_url=wizard_url)
+
+
+async def render(ctx, chat_id, draft, fresh: bool = True, note: str | None = None,
+                 reply_to: int | None = None) -> None:
+    from app.config import settings
+
+    payload = draft.payload
+    missing = compute_quote_missing(payload)
+    wizard_url = f"{settings.FRONTEND_URL}/wizard?draft={draft.id}"
+    text = quote_review_text(payload, missing, status_note=note)
+    text += f"\n\n🖥 مشاهده و تکمیل در ویزارد:\n{wizard_url}"
+    keyboard = _keyboard(payload, str(draft.id), wizard_url=wizard_url)
+    if fresh:
+        message = await ctx.send(chat_id, text, reply_markup=keyboard, reply_to=reply_to)
+        new_review_id = (message or {}).get("message_id")
+        if new_review_id:
+            draft.review_message_id = new_review_id
+            await draft_store.save_payload(
+                draft,
+                missing={"fields": missing},
+                review_message_id=new_review_id,
+                source_message_id=reply_to or draft.source_message_id,
+                mark_bale_synced=True,
+            )
+        else:
+            await draft_store.save_payload(
+                draft,
+                missing={"fields": missing},
+                source_message_id=reply_to or draft.source_message_id,
+                mark_bale_synced=True,
+            )
+    else:
+        if not draft.review_message_id:
+            return
+        success = await ctx.edit(chat_id, draft.review_message_id, text, reply_markup=keyboard)
+        if success:
+            await draft_store.save_payload(draft, missing={"fields": missing}, mark_bale_synced=True)
+        else:
+            logger.warning("Could not edit review message %s for draft %s", draft.review_message_id, draft.id)
+            await draft_store.set_bale_updated_at(draft.id)
+
+
+# ---------------------------------------------------------------------------
+# commit
+# ---------------------------------------------------------------------------
+
+async def commit(ctx, chat_id, user, draft, only_resolved: bool = False) -> None:
+    payload = draft.payload
+    await resolve_payload(ctx, payload)
+
+    # 1. Sequential pre-creation for new supplier if user wants to commit
+    if not payload.get("supplier_id") and payload.get("supplier_name"):
+        cat_id = payload.get("supplier_category_id")
+        if not cat_id:
+            cats = await ctx.resolver.categories()
+            if cats:
+                cat_id = cats[0].id
+        if cat_id:
+            try:
+                sup_body = {
+                    "name": payload["supplier_name"],
+                    "category_id": cat_id,
+                }
+                if payload.get("supplier_phone"):
+                    sup_body["phone"] = payload["supplier_phone"]
+                created_sup = await ctx.api.create_supplier(sup_body, actor_id=user.actor_id)
+                payload["supplier_id"] = created_sup["id"]
+                ctx.resolver.invalidate("suppliers")
+            except Exception as e:
+                logger.warning("Could not auto-create supplier: %s", e)
+
+    # 2. Sequential pre-creation for new materials
+    for i, item in enumerate(payload.get("items") or [], start=1):
+        if not item.get("material_id") and item.get("material_name") and item.get("unit_id"):
+            try:
+                created_mat = await ctx.api.create_material({
+                    "name": item["material_name"],
+                    "canonical_unit_id": int(item["unit_id"]),
+                }, actor_id=user.actor_id)
+                _set_material(item, created_mat["id"], created_mat.get("name") or item["material_name"])
+                ctx.resolver.invalidate("materials")
+            except Exception as e:
+                logger.warning("Could not auto-create material: %s", e)
+
+    ready, blockers = quote_ready(payload)
+    body, problems = build_quote_request(payload, only_resolved_items=only_resolved)
+    if body is None:
+        lines = ["ثبت ممکن نیست؛ این‌ها را اول مشخص کن:"] + [f"❌ {esc(p)}" for p in problems]
+        await ctx.send(chat_id, "\n".join(lines))
+        return
+    if not ready and not only_resolved:
+        lines = ["برای ثبت کامل، اول این‌ها را مشخص کن:"] + [f"❌ {esc(b)}" for b in blockers]
+        lines += ["", "یا دکمه «ثبت فقط اقلام مشخص» را بزن."]
+        await ctx.send(chat_id, "\n".join(lines))
+        return
+
+    try:
+        created = await ctx.api.create_quote(body, actor_id=user.actor_id)
+    except ApiError as exc:
+        await ctx.send(chat_id, ERR_GENERIC.format(detail=esc(exc.message)))
+        return
+    except Exception:
+        logger.exception("create_quote failed")
+        await ctx.send(chat_id, ERR_GENERIC.format(detail="خطای شبکه"))
+        return
+
+    await draft_store.set_status(draft.id, "committed")
+    ctx.pending.pop(chat_id, None)
+    ctx.resolver.invalidate()
+
+    if draft.review_message_id:
+        try:
+            quote_id = (created or {}).get("id") or ""
+            msg = f"✅ این پیشنهاد در سیستم با موفقیت ثبت نهایی شد.\nشناسه پیشنهاد: {quote_id}"
+            await ctx.edit(chat_id, draft.review_message_id, msg, reply_markup=None)
+            await draft_store.set_bale_updated_at(draft.id)
+        except Exception:
+            pass
+
+    remaining = [
+        m["label"] for m in compute_quote_missing(payload)
+        if not m["blocking"] and not m["ok"]
+    ]
+    dropped = len(payload.get("items") or []) - len(body.get("line_items") or [])
+    if dropped > 0:
+        remaining.append(f"{dropped} قلم ناشناس حذف شد")
+    await ctx.send(chat_id, quote_committed_report(created, payload, remaining))

ai procurement/app/handlers/supplier.py

@@ -0,0 +1,103 @@
+"""Add-supplier flow: name + one of the 8 fixed Persian categories (required)."""
+import logging
+
+from app import drafts as draft_store
+from app.api.client import ApiError
+from app.drafts import (
+    KIND_SUPPLIER, merge_supplier_patch, new_supplier_payload, supplier_missing,
+)
+from app.keyboards import pick_buttons, simple_review_keyboard
+from app.resolve import safe_resolve
+from app.texts import ERR_GENERIC, esc, supplier_committed_report, supplier_review_text
+
+logger = logging.getLogger("bot.supplier")
+
+
+async def handle_entities(ctx, chat_id, user, patch: dict, source: str | None) -> None:
+    draft = await draft_store.get_active(chat_id, KIND_SUPPLIER)
+    if draft is not None:
+        payload = draft.payload
+        merge_supplier_patch(payload, patch)
+    else:
+        payload = new_supplier_payload()
+        merge_supplier_patch(payload, patch)
+        draft = await draft_store.create(chat_id, KIND_SUPPLIER, payload, source=source)
+    await resolve_payload(ctx, payload)
+    await draft_store.save_payload(draft, missing={"fields": supplier_missing(payload)})
+    await render(ctx, chat_id, draft, fresh=draft.review_message_id is None)
+
+
+async def resolve_payload(ctx, payload: dict) -> None:
+    options = payload.setdefault("options", {})
+    if not payload.get("category_id") and payload.get("category_name"):
+        res = await safe_resolve(ctx.resolver, "category", payload["category_name"])
+        if res.resolved:
+            payload["category_id"] = res.candidates[0].id
+            payload["category_name"] = res.candidates[0].name
+            options.pop("cat", None)
+        elif res.candidates:
+            options["cat"] = [{"id": c.id, "name": c.name} for c in res.candidates]
+        else:
+            options.pop("cat", None)
+
+
+async def apply_pick(ctx, chat_id, user, draft, field: str, choice: dict) -> None:
+    if field == "cat":
+        draft.payload["category_id"] = choice["id"]
+        draft.payload["category_name"] = choice["name"]
+        draft.payload.setdefault("options", {}).pop("cat", None)
+    await draft_store.save_payload(draft, missing={"fields": supplier_missing(draft.payload)})
+    await render(ctx, chat_id, draft, fresh=False)
+
+
+def _keyboard(payload: dict, draft_id: str) -> dict:
+    rows: list[list[dict]] = []
+    options = (payload.get("options") or {}).get("cat") or []
+    if options:
+        rows += pick_buttons(draft_id, "cat", [o["name"] for o in options[:6]])
+    return simple_review_keyboard(draft_id, KIND_SUPPLIER, rows)
+
+
+async def render(ctx, chat_id, draft, fresh: bool = True) -> None:
+    payload = draft.payload
+    missing = supplier_missing(payload)
+    text = supplier_review_text(payload, missing)
+    keyboard = _keyboard(payload, draft.id)
+    if fresh:
+        message = await ctx.send(chat_id, text, reply_markup=keyboard)
+        draft.review_message_id = (message or {}).get("message_id")
+        await draft_store.save_payload(draft, missing={"fields": missing},
+                                       review_message_id=draft.review_message_id)
+    else:
+        await ctx.edit(chat_id, draft.review_message_id, text, reply_markup=keyboard)
+        await draft_store.save_payload(draft, missing={"fields": missing})
+
+
+async def commit(ctx, chat_id, user, draft) -> None:
+    payload = draft.payload
+    await resolve_payload(ctx, payload)
+    missing = {m["key"]: m["ok"] for m in supplier_missing(payload)}
+    problems = [label for key, label, ok in [
+        ("name", "نام تأمین‌کننده", missing.get("name")),
+        ("category", "دسته‌بندی", missing.get("category")),
+    ] if not ok]
+    if problems:
+        await ctx.send(chat_id, "ثبت ممکن نیست؛ اول این‌ها را مشخص کن:\n" +
+                       "\n".join(f"❌ {esc(p)}" for p in problems))
+        return
+    body = {
+        "name": payload["name"],
+        "category_id": payload["category_id"],
+        "phone": payload.get("phone"),
+        "location": payload.get("location"),
+        "contact_person": payload.get("contact_person"),
+    }
+    body = {k: v for k, v in body.items() if v}
+    try:
+        created = await ctx.api.create_supplier(body, actor_id=user.actor_id)
+    except ApiError as exc:
+        await ctx.send(chat_id, ERR_GENERIC.format(detail=esc(exc.message)))
+        return
+    await draft_store.set_status(draft.id, "committed")
+    ctx.resolver.invalidate("suppliers")
+    await ctx.send(chat_id, supplier_committed_report(created))

ai procurement/app/keyboards.py

@@ -0,0 +1,74 @@
+"""Inline keyboard builders.
+
+Bale keeps Telegram's 64-byte ``callback_data`` cap, so every callback is a
+short op-code plus the 8-char draft prefix; the full state lives in bot_drafts
+(or the in-memory pending-flow map) and is looked up on tap.
+"""
+
+
+def _kb(rows: list[list[dict]]) -> dict:
+    return {"inline_keyboard": rows}
+
+
+def _btn(text: str, data: str) -> dict:
+    return {"text": text, "callback_data": data}
+
+
+# callback scheme (≤64 bytes):
+#   q:ok:{d8} / q:no:{d8} / q:ok2:{d8}      quote commit / cancel / commit-resolved-only
+#   s:ok:{d8} / s:no:{d8}                   supplier
+#   m:ok:{d8} / m:no:{d8}                   material
+#   pk:{d8}:{field}:{idx}                   pick candidate for a draft field
+#   qc:{idx} / ac:{op} / ar:{op}            pending-flow buttons (accept/arrive)
+
+def draft_actions(prefix: str, kind: str, has_partial_option: bool = False) -> list[list[dict]]:
+    op = {"quote": "q", "supplier": "s", "material": "m"}.get(kind, "q")
+    rows = [[_btn("✅ ثبت نهایی", f"{op}:ok:{prefix}"), _btn("❌ انصراف", f"{op}:no:{prefix}")]]
+    if has_partial_option:
+        rows.insert(0, [_btn("✅ ثبت فقط اقلام مشخص", f"{op}:ok2:{prefix}")])
+    return rows
+
+
+def pick_buttons(prefix: str, field: str, names: list[str]) -> list[list[dict]]:
+    return [[_btn(name[:60], f"pk:{prefix}:{field}:{i}")] for i, name in enumerate(names)]
+
+
+def quote_review_keyboard(
+    prefix: str,
+    pick_rows: list[list[dict]],
+    has_partial_option: bool = False,
+    wizard_url: str | None = None,
+) -> dict:
+    rows = list(pick_rows)
+    if wizard_url:
+        rows.append([{"text": "🖥 بازبینی و تکمیل در ویزارد", "url": wizard_url}])
+    rows += draft_actions(prefix, "quote", has_partial_option=has_partial_option)
+    return _kb(rows)
+
+
+def simple_review_keyboard(prefix: str, kind: str, pick_rows: list[list[dict]]) -> dict:
+    rows = list(pick_rows)
+    rows += draft_actions(prefix, kind)
+    return _kb(rows)
+
+
+def quote_pick_keyboard(pairs: list[tuple[str, str]]) -> dict:
+    """Pick among candidate quotes: pairs of (label, quote_id)."""
+    return _kb([[_btn(label[:60], f"qc:{i}")] for i, (label, _) in enumerate(pairs)])
+
+
+def accept_keyboard(termsheet_labels: list[str]) -> dict:
+    rows = [[_btn(f"شرایط: {label[:40]}", f"ac:ts:{i}")] for i, label in enumerate(termsheet_labels)]
+    rows.append([_btn("✅ تأیید پذیرش", "ac:ok"), _btn("❌ انصراف", "ac:no")])
+    return _kb(rows)
+
+
+def arrive_keyboard() -> dict:
+    return _kb([
+        [_btn("📦 تحویل کامل همه اقلام", "ar:full")],
+        [_btn("✅ ثبت مقادیر اعلام‌شده", "ar:ok"), _btn("❌ انصراف", "ar:no")],
+    ])
+
+
+def cancel_keyboard() -> dict:
+    return _kb([[_btn("❌ انصراف", "ac:no")]])

ai procurement/app/main.py

@@ -0,0 +1,60 @@
+"""Bot entrypoint: ensure tables → sweeper task → Bale long-poll loop.
+
+Mirrors the api's pattern of a plain asyncio background loop (no Celery/Redis).
+"""
+import asyncio
+import logging
+
+from app.bale.client import BaleClient, poll_loop
+from app.config import settings
+from app.db_init import ensure_schema
+from app.drafts import expire_stale
+from app.handlers import handle_update
+from app.runtime import BotContext
+from app.api.client import ErpClient
+from app.sync import sync_drafts_loop
+
+logging.basicConfig(
+    level=getattr(logging, settings.LOG_LEVEL.upper(), logging.INFO),
+    format="%(asctime)s %(levelname)s %(name)s — %(message)s",
+)
+logger = logging.getLogger("bot.main")
+
+
+async def sweeper_loop() -> None:
+    """Expire stale drafts + sweep dead pending flows every 10 minutes."""
+    while True:
+        try:
+            expired = await expire_stale(settings.DRAFT_TTL_HOURS)
+            if expired:
+                logger.info("expired %s stale drafts", expired)
+        except Exception:
+            logger.exception("sweeper failed")
+        await asyncio.sleep(600)
+
+
+async def main() -> None:
+    if not settings.BOT_TOKEN:
+        raise SystemExit("PROCUREMENT_BOT_BOT_TOKEN is not set — get one from Bale's BotFather")
+    logger.info("starting bale procurement bot (api=%s, ai=%s)",
+                settings.API_BASE_URL, "configured" if settings.AI_BASE_URL else "NOT configured")
+    await ensure_schema()
+
+    bale = BaleClient(settings.BALE_API_BASE, settings.BOT_TOKEN)
+    api = ErpClient(settings.API_BASE_URL, settings.API_TIMEOUT_SECONDS, settings.SERVICE_TOKEN)
+    ctx = BotContext(bale, api)
+
+    sweeper = asyncio.create_task(sweeper_loop())
+    sync_task = asyncio.create_task(sync_drafts_loop(ctx))
+    try:
+        await poll_loop(bale, lambda update: handle_update(ctx, update))
+    finally:
+        sweeper.cancel()
+        sync_task.cancel()
+
+
+if __name__ == "__main__":
+    try:
+        asyncio.run(main())
+    except KeyboardInterrupt:
+        pass

ai procurement/app/models.py

@@ -0,0 +1,85 @@
+"""Bot-owned tables (bot_* prefix, idempotent DDL in db_init.py).
+
+These are separate from the ERP schema on purpose: the bot is an autonomous
+container and owns its own state (links, drafts, message audit log).
+"""
+from datetime import datetime
+
+from sqlalchemy import BigInteger, DateTime, Index, Integer, String, Text, func
+from sqlalchemy.dialects.postgresql import JSONB, UUID
+from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column
+
+
+class Base(DeclarativeBase):
+    pass
+
+
+def _uuid_pk() -> Mapped[str]:
+    return mapped_column(UUID(as_uuid=False), primary_key=True, server_default=func.gen_random_uuid())
+
+
+def _timestamptz(**kwargs) -> Mapped[datetime]:
+    return mapped_column(DateTime(timezone=True), server_default=func.now(), nullable=False, **kwargs)
+
+
+class BotLink(Base):
+    """Bale chat ↔ ERP user mapping (established via Casdoor login)."""
+
+    __tablename__ = "bot_links"
+
+    id: Mapped[str] = _uuid_pk()
+    chat_id: Mapped[int] = mapped_column(BigInteger, unique=True, nullable=False, index=True)
+    user_id: Mapped[str | None] = mapped_column(UUID(as_uuid=False))  # users.id
+    casdoor_username: Mapped[str | None] = mapped_column(Text)
+    display_name: Mapped[str | None] = mapped_column(Text)
+    role: Mapped[str | None] = mapped_column(String(32))
+    created_at: Mapped[datetime] = _timestamptz()
+    updated_at: Mapped[datetime] = _timestamptz(onupdate=func.now())
+
+
+class BotDraft(Base):
+    """A prepared-but-not-committed ERP action (quote / supplier / material)."""
+
+    __tablename__ = "bot_drafts"
+    __table_args__ = (
+        Index("ix_bot_drafts_chat_status", "chat_id", "status"),
+        Index("ix_bot_drafts_review_msg", "review_message_id"),
+        Index("ix_bot_drafts_source_msg", "source_message_id"),
+    )
+
+    id: Mapped[str] = _uuid_pk()
+    chat_id: Mapped[int] = mapped_column(BigInteger, nullable=False, index=True)
+    kind: Mapped[str] = mapped_column(String(16), nullable=False)  # quote|supplier|material
+    payload: Mapped[dict] = mapped_column(JSONB, nullable=False, default=dict)
+    missing: Mapped[dict | None] = mapped_column(JSONB)
+    status: Mapped[str] = mapped_column(String(16), nullable=False, default="active")  # active|committed|cancelled|expired|failed
+    source: Mapped[str | None] = mapped_column(String(16))  # text|voice
+    source_message_id: Mapped[int | None] = mapped_column(BigInteger)
+    review_message_id: Mapped[int | None] = mapped_column(BigInteger)
+    last_bale_update_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    created_at: Mapped[datetime] = _timestamptz()
+    updated_at: Mapped[datetime] = _timestamptz(onupdate=func.now())
+
+
+class BotMessage(Base):
+    """Audit log of every inbound/outbound message (who asked for what)."""
+
+    __tablename__ = "bot_messages"
+
+    id: Mapped[str] = _uuid_pk()
+    chat_id: Mapped[int] = mapped_column(BigInteger, nullable=False, index=True)
+    direction: Mapped[str] = mapped_column(String(4), nullable=False)  # in|out
+    kind: Mapped[str] = mapped_column(String(16), nullable=False, default="text")  # text|voice|callback|error
+    body: Mapped[str | None] = mapped_column(Text)
+    payload: Mapped[dict | None] = mapped_column(JSONB)
+    created_at: Mapped[datetime] = _timestamptz()
+
+
+class BotMeta(Base):
+    """Tiny KV store (e.g. last processed Bale update_id across restarts)."""
+
+    __tablename__ = "bot_meta"
+
+    key: Mapped[str] = mapped_column(String(64), primary_key=True)
+    value: Mapped[str | None] = mapped_column(Text)
+    updated_at: Mapped[datetime] = _timestamptz(onupdate=func.now())

ai procurement/app/nlu.py

@@ -0,0 +1,149 @@
+"""Natural-language understanding: Persian free text → typed intent + entities.
+
+One chat/completions call per message with JSON-mode output. The prompt embeds
+the current draft summary so the model can decide between "start a new
+activity" and "refine the open draft" (update_draft with a partial patch).
+"""
+import json
+import logging
+import re
+
+import httpx
+
+from app.config import Settings
+
+logger = logging.getLogger("bot.nlu")
+
+PERSIAN_DIGITS = str.maketrans("۰۱۲۳۴۵۶۷۸۹٠١٢٣٤٥٦٧٨٩", "01234567890123456789")
+
+
+def normalize_digits(text: str) -> str:
+    return (text or "").translate(PERSIAN_DIGITS)
+
+
+ZWNJ = "\u200c"
+
+
+def normalize_text(text: str) -> str:
+    """Normalize Persian text for fuzzy matching (ZWNJ, arabic ya/ka, spaces)."""
+    t = normalize_digits(text or "")
+    t = t.replace(ZWNJ, " ").replace("ي", "ی").replace("ك", "ک")
+    t = re.sub(r"\s+", " ", t).strip().lower()
+    return t
+
+
+INTENTS = [
+    "register_quote",   # ثبت استعلام/پیشنهاد جدید از یک تأمین‌کننده
+    "update_draft",     # تکمیل/اصلاح پیش‌نویس باز (patch روی آن)
+    "commit_draft",     # «ثبت کن» / «تأیید» — commit the open draft
+    "discard_draft",    # «بی‌خیال» / «لغو»
+    "show_draft",       # «وضعیت پیش‌نویس؟»
+    "add_supplier",
+    "add_material",
+    "status_query",     # پرس‌وجو: استعلام‌های در انتظار / به‌زودی منقضی / ...
+    "accept_quote",     # پذیرش یک استعلام
+    "arrive_items",     # اعلام رسیدن اقلام
+    "help",
+    "unknown",
+]
+
+SYSTEM_PROMPT = """تو دستیار تدارکات یک ERP فارسی هستی. ورودی تو پیام صوتی/متنی کاربر است.
+یک JSON و فقط JSON برگردان (بدون توضیح اضافه) با این شکل:
+
+{
+  "intent": یکی از {intents},
+  "patch": {شکل partial هر فعالیتی که کاربر داده},
+  "confidence": 0.0..1.0
+}
+
+قوانین:
+- اگر پیام کاربر اطلاعات جدیدی به پیش‌نویسِ باز اضافه می‌کند یا اصلاح می‌کند → intent="update_draft" و patch شامل فقط فیلدهای جدید/تغییریافته.
+- اگر عبارت تأیید نهایی است (مثل «ثبت کن»، «همینه، ثبتش کن») → intent="commit_draft".
+- اگر لغو است («بی‌خیال»، «لغو») → intent="discard_draft".
+- اگر سؤال درباره وضعیت است → intent="status_query".
+- اگر درباره پذیرش استعلام است → intent="accept_quote" و در patch.target نام تأمین‌کننده/استعلام.
+- اگر درباره اعلام رسیدن اقلام است → intent="arrive_items" و در patch.target نام تأمین‌کننده/استعلام و در patch.arrivals مقادیر.
+- برای کالاها: material_name فقط نام کلی کالا باشد (مانند «میلگرد» یا «لوله»)؛ کارخانه یا برند در brand_name؛ و مشخصات فنی (مثل سایز یا گرید) در آرایه specs قرار گیرد.
+- برای شرایط پرداخت: در صورت ذکر اقساط/موعد و مبالغ، در milestones: [{"due_date": "YYYY-MM-DD", "amount": number}] قرار بده.
+
+شکل patch برای intent="register_quote"/"update_draft":
+{"supplier_name": str, "project_name": str, "project_names": [str], "is_official": bool, "notes": str, "expiry_date": "YYYY-MM-DD",
+ "items": [{"material_name": str, "brand_name": str, "specs": [str], "quantity": number, "unit_name": str, "unit_price": number, "notes": str}],
+ "payment_terms": [{"label": str, "milestones": [{"due_date": "YYYY-MM-DD", "amount": number}], "discount_type": "none|percent|fixed", "discount_value": number}]}
+
+شکل patch برای intent="add_supplier":
+{"supplier": {"name": str, "category_name": str, "phone": str, "location": str, "contact_person": str}}
+
+شکل patch برای intent="add_material":
+{"material": {"name": str, "unit_name": str, "topic": str}}
+
+شکل patch برای intent="status_query":
+{"query": {"kind": "pending|accepted|arrived|expiring|recent", "supplier_name": str, "project_name": str, "days": int}}
+
+شکل patch برای intent="accept_quote"/"arrive_items":
+{"target": {"supplier_name": str, "project_name": str, "quote_id": str},
+ "arrivals": [{"material_name": str, "quantity": number, "quality_note": str}]}
+
+{draft_block}
+"""
+
+
+def _build_system_prompt(draft_summary: str | None) -> str:
+    intents = ", ".join(INTENTS)
+    prompt = SYSTEM_PROMPT.replace("{intents}", intents).replace("{draft_block}", "")
+    if draft_summary:
+        prompt += (
+            "\n\nپیش‌نویسِ باز فعلی کاربر (اگر مرتبط است به آن تکیه کن و فیلدهای تکراری را بازنویسی نکن):\n"
+            + draft_summary
+        )
+    return prompt
+
+
+def _extract_json(raw: str) -> dict | None:
+    raw = (raw or "").strip()
+    if raw.startswith("```"):
+        raw = re.sub(r"^```[a-zA-Z]*\n?", "", raw).rstrip("`").strip()
+    start = raw.find("{")
+    end = raw.rfind("}")
+    if start == -1 or end <= start:
+        return None
+    try:
+        return json.loads(raw[start : end + 1])
+    except json.JSONDecodeError:
+        return None
+
+
+async def understand(settings: Settings, text: str, draft_summary: str | None = None) -> dict:
+    """Return {"intent": ..., "patch": {...}, "confidence": ...}; never raises."""
+    fallback = {"intent": "unknown", "patch": {}, "confidence": 0.0}
+    if not settings.AI_BASE_URL or not settings.AI_API_KEY:
+        logger.warning("AI provider not configured; cannot understand message")
+        return fallback
+    try:
+        async with httpx.AsyncClient(timeout=settings.LLM_TIMEOUT_SECONDS) as client:
+            resp = await client.post(
+                f"{settings.AI_BASE_URL.rstrip('/')}/chat/completions",
+                headers={"Authorization": f"Bearer {settings.AI_API_KEY}"},
+                json={
+                    "model": settings.LLM_MODEL,
+                    "messages": [
+                        {"role": "system", "content": _build_system_prompt(draft_summary)},
+                        {"role": "user", "content": normalize_digits(text)},
+                    ],
+                    "temperature": 0.1,
+                    "response_format": {"type": "json_object"},
+                },
+            )
+        if resp.status_code != 200:
+            logger.error("LLM HTTP %s: %s", resp.status_code, resp.text[:300])
+            return fallback
+        content = ((resp.json() or {}).get("choices") or [{}])[0].get("message", {}).get("content", "")
+        parsed = _extract_json(content)
+        if not parsed or parsed.get("intent") not in INTENTS:
+            logger.warning("unparseable LLM output: %r", content[:200])
+            return fallback
+        parsed.setdefault("patch", {})
+        return parsed
+    except (httpx.HTTPError, json.JSONDecodeError, KeyError, TypeError):
+        logger.exception("NLU failure")
+        return fallback

ai procurement/app/resolve.py

@@ -0,0 +1,151 @@
+"""Name → ERP id resolution with fuzzy matching (Persian-aware) + tiny caches.
+
+The ERP search endpoints are ilike-based; we fetch candidates with `q=` and
+rank them with difflib so "میلگرد A3 14" still matches "میلگرد A3 سایز ۱۴".
+"""
+import difflib
+import time
+from dataclasses import dataclass, field
+
+from app.api.client import ApiError, ErpClient
+from app.nlu import normalize_text
+
+
+@dataclass
+class Candidate:
+    id: str
+    name: str
+    extra: dict = field(default_factory=dict)
+
+
+@dataclass
+class Resolution:
+    status: str  # "one" | "many" | "none"
+    candidates: list[Candidate]
+
+    @property
+    def resolved(self) -> bool:
+        return self.status == "one"
+
+
+def _rank(query: str, items: list[Candidate], limit: int = 6) -> list[Candidate]:
+    q = normalize_text(query)
+    if not q:
+        return items[:limit]
+    scored = []
+    for item in items:
+        name = normalize_text(item.name)
+        ratio = difflib.SequenceMatcher(None, q, name).ratio()
+        if q == name:
+            ratio = 1.0
+        elif q in name:
+            ratio += 0.35
+        scored.append((ratio, item))
+    scored.sort(key=lambda pair: (-pair[0], pair[1].name))
+    return [item for ratio, item in scored[:limit] if ratio >= 0.40]
+
+
+class Resolver:
+    """Caches catalog lists (units/categories/projects are stable; suppliers/materials queried on demand)."""
+
+    def __init__(self, api: ErpClient, ttl_seconds: float = 1800):
+        self._api = api
+        self._ttl = ttl_seconds
+        self._cache: dict[str, tuple[float, list[Candidate]]] = {}
+
+    async def _cached(self, key: str, fetch) -> list[Candidate]:
+        entry = self._cache.get(key)
+        now = time.monotonic()
+        if entry and now - entry[0] < self._ttl:
+            return entry[1]
+        items = await fetch()
+        self._cache[key] = (now, items)
+        return items
+
+    def invalidate(self, key: str | None = None) -> None:
+        if key:
+            self._cache.pop(key, None)
+        else:
+            self._cache.clear()
+
+    # ---------------------------------------------------------------- sources
+
+    async def units(self) -> list[Candidate]:
+        async def fetch():
+            rows = await self._api.list_units()
+            return [Candidate(id=str(u["id"]), name=u.get("name_fa") or u.get("code") or str(u["id"]),
+                              extra={"code": u.get("code")}) for u in rows]
+        return await self._cached("units", fetch)
+
+    async def categories(self) -> list[Candidate]:
+        async def fetch():
+            rows = await self._api.list_categories()
+            return [Candidate(id=str(c["id"]), name=c.get("name") or c.get("slug") or str(c["id"])) for c in rows]
+        return await self._cached("categories", fetch)
+
+    async def projects(self) -> list[Candidate]:
+        async def fetch():
+            rows = await self._api.list_projects()
+            return [Candidate(id=str(p["id"]), name=p.get("name") or str(p["id"])) for p in rows]
+        return await self._cached("projects", fetch)
+
+    async def suppliers(self, q: str | None = None) -> list[Candidate]:
+        rows = await self._api.list_suppliers(q=q, page_size=20)
+        items = [Candidate(id=str(s["id"]), name=s.get("name") or str(s["id"])) for s in rows]
+        return _rank(q, items) if q else items
+
+    async def materials(self, q: str | None = None) -> list[Candidate]:
+        rows = await self._api.list_materials(q=q, page_size=20)
+        extra = {str(m["id"]): m for m in rows}
+        items = [Candidate(id=str(m["id"]), name=m.get("name") or str(m["id"]), extra=extra.get(str(m["id"]), {}))
+                 for m in rows]
+        return _rank(q, items) if q else items
+
+    # ------------------------------------------------------------ resolutions
+
+    async def resolve(self, kind: str, name: str | None) -> Resolution:
+        """Resolve by name; exact hit → "one", several close → "many", none → "none"."""
+        if not name or not name.strip():
+            return Resolution("none", [])
+        if kind == "supplier":
+            candidates = await self.suppliers(name)
+        elif kind == "material":
+            candidates = await self.materials(name)
+        elif kind == "project":
+            candidates = _rank(name, await self.projects())
+        elif kind == "unit":
+            candidates = _rank(name, await self.units())
+        elif kind == "category":
+            candidates = _rank(name, await self.categories())
+        else:
+            raise ValueError(f"unknown kind: {kind}")
+        if not candidates:
+            return Resolution("none", [])
+        norm_name = normalize_text(name)
+        exact = [c for c in candidates if normalize_text(c.name) == norm_name]
+        if len(exact) == 1:
+            return Resolution("one", exact)
+        top = candidates[0]
+        top_norm = normalize_text(top.name)
+        ratio = difflib.SequenceMatcher(None, norm_name, top_norm).ratio()
+        if ratio >= 0.88 and (len(candidates) == 1 or ratio > 0.95):
+            return Resolution("one", [top])
+        return Resolution("many", candidates)
+
+    async def unit_for_material(self, unit_name: str | None, material: dict | None) -> tuple[str | None, bool]:
+        """Return (unit_id, explicitly_resolved). Falls back to the material's
+        canonical unit when the spoken unit isn't found."""
+        if unit_name:
+            res = await self.resolve("unit", unit_name)
+            if res.resolved:
+                return res.candidates[0].id, True
+        if material and material.get("canonical_unit_id"):
+            return str(material["canonical_unit_id"]), False
+        return None, False
+
+
+async def safe_resolve(resolver: Resolver, kind: str, name: str | None) -> Resolution:
+    try:
+        return await resolver.resolve(kind, name)
+    except ApiError:
+        return Resolution("none", [])

ai procurement/app/runtime.py

@@ -0,0 +1,170 @@
+"""Shared runtime: BotContext wiring + per-chat pending interaction flows.
+
+Pending flows (Casdoor linking, quote picking, accept/arrive confirmations)
+are short-lived and single-instance, so they live in memory; anything that
+must survive restarts (drafts, links) lives in postgres.
+"""
+import logging
+import time
+from dataclasses import dataclass, field
+
+from sqlalchemy import select, update
+
+from app.api.client import ErpClient
+from app.bale.client import BaleClient
+from app.config import settings
+from app.db import SessionLocal
+from app.models import BotLink, BotMessage
+from app.resolve import Resolver
+
+logger = logging.getLogger("bot.runtime")
+
+
+# ---------------------------------------------------------------------------
+# Links (postgres)
+# ---------------------------------------------------------------------------
+
+class LinkStore:
+    async def get(self, chat_id: int) -> BotLink | None:
+        async with SessionLocal() as session:
+            return (await session.execute(
+                select(BotLink).where(BotLink.chat_id == chat_id)
+            )).scalar_one_or_none()
+
+    async def upsert(self, chat_id: int, user_id: str | None, username: str | None,
+                     display_name: str | None, role: str | None) -> BotLink:
+        async with SessionLocal() as session:
+            link = (await session.execute(select(BotLink).where(BotLink.chat_id == chat_id))).scalar_one_or_none()
+            if link is None:
+                link = BotLink(chat_id=chat_id)
+                session.add(link)
+            link.user_id = user_id
+            link.casdoor_username = username
+            link.display_name = display_name
+            link.role = role
+            await session.commit()
+            await session.refresh(link)
+            return link
+
+    async def delete(self, chat_id: int) -> bool:
+        async with SessionLocal() as session:
+            result = await session.execute(
+                update(BotLink).where(BotLink.chat_id == chat_id).values(user_id=None, role=None,
+                                                                         casdoor_username=None)
+            )
+            await session.commit()
+            return (result.rowcount or 0) > 0
+
+
+ROLE_FA = {"pm": "مدیر پروژه", "procurement_manager": "مدیر تدارکات", "admin": "ادمین"}
+
+
+# ---------------------------------------------------------------------------
+# Pending flows (memory) — one per chat
+# ---------------------------------------------------------------------------
+
+@dataclass
+class PendingFlow:
+    kind: str  # link_username | link_password | quote_pick | accept | arrive_qty | arrive_confirm
+    data: dict = field(default_factory=dict)
+    created: float = field(default_factory=time.monotonic)
+
+    @property
+    def age_seconds(self) -> float:
+        return time.monotonic() - self.created
+
+
+class PendingFlows:
+    TTL_SECONDS = 1800
+
+    def __init__(self):
+        self._flows: dict[int, PendingFlow] = {}
+
+    def set(self, chat_id: int, kind: str, data: dict | None = None) -> PendingFlow:
+        flow = PendingFlow(kind=kind, data=data or {})
+        self._flows[chat_id] = flow
+        return flow
+
+    def get(self, chat_id: int) -> PendingFlow | None:
+        flow = self._flows.get(chat_id)
+        if flow and flow.age_seconds > self.TTL_SECONDS:
+            self._flows.pop(chat_id, None)
+            return None
+        return flow
+
+    def pop(self, chat_id: int, default=None):
+        return self._flows.pop(chat_id, default)
+
+    def sweep(self) -> None:
+        for chat_id, flow in list(self._flows.items()):
+            if flow.age_seconds > self.TTL_SECONDS:
+                self._flows.pop(chat_id, None)
+
+
+# ---------------------------------------------------------------------------
+# Context
+# ---------------------------------------------------------------------------
+
+class BotContext:
+    def __init__(self, bale: BaleClient, api: ErpClient):
+        self.bale = bale
+        self.api = api
+        self.resolver = Resolver(api)
+        self.links = LinkStore()
+        self.pending = PendingFlows()
+
+    @property
+    def admin_chat_ids(self) -> set[int]:
+        return settings.admin_chat_ids
+
+    async def send(self, chat_id: int, text: str, reply_markup: dict | None = None,
+                   reply_to: int | None = None) -> dict:
+        """Send + audit-log every outbound message."""
+        try:
+            message = await self.bale.send_message(chat_id, text, reply_markup=reply_markup, reply_to=reply_to)
+        except Exception:
+            logger.exception("failed to send to chat %s", chat_id)
+            message = {}
+        await self._log(chat_id, "out", "text", text)
+        return message
+
+    async def edit(self, chat_id: int, message_id: int | None, text: str,
+                   reply_markup: dict | None = None) -> bool:
+        if not message_id:
+            return False
+        try:
+            await self.bale.edit_message_text(chat_id, message_id, text, reply_markup=reply_markup)
+            return True
+        except Exception as exc:
+            logger.warning("failed to edit message %s in chat %s: %s", message_id, chat_id, exc)
+            return False
+
+    async def delete(self, chat_id: int, message_id: int | None) -> bool:
+        if not message_id:
+            return False
+        try:
+            return await self.bale.delete_message(chat_id, message_id)
+        except Exception:
+            logger.exception("failed to delete message %s in chat %s", message_id, chat_id)
+            return False
+
+    async def _log(self, chat_id: int, direction: str, kind: str, body: str | None = None) -> None:
+        try:
+            async with SessionLocal() as session:
+                session.add(BotMessage(chat_id=chat_id, direction=direction, kind=kind, body=body))
+                await session.commit()
+        except Exception:
+            logger.exception("failed to log bot message")
+
+
+@dataclass
+class LinkedUser:
+    chat_id: int
+    user_id: str | None
+    display_name: str | None
+    role: str | None
+    is_admin: bool
+
+    @property
+    def actor_id(self) -> str | None:
+        return self.user_id

ai procurement/app/stt.py

@@ -0,0 +1,62 @@
+"""Speech-to-text via an OpenAI-compatible /audio/transcriptions endpoint.
+
+Bale voice notes arrive as OGG/Opus which not every provider accepts, so the
+audio is first converted to mono 16 kHz MP3 with ffmpeg (installed in the bot
+image). Any OpenAI-compatible provider works (OpenAI, GLM, OpenRouter proxies,
+self-hosted whisper servers exposing the same contract).
+"""
+import asyncio
+import logging
+import subprocess
+import tempfile
+from pathlib import Path
+
+import httpx
+
+from app.config import Settings
+
+logger = logging.getLogger("bot.stt")
+
+_CONVERT_TIMEOUT = 60
+_STT_TIMEOUT = 120
+
+
+def _to_mp3(raw: bytes, suffix: str) -> bytes:
+    """Convert arbitrary audio bytes to mono 16 kHz MP3 using ffmpeg."""
+    with tempfile.TemporaryDirectory() as tmp:
+        src = Path(tmp) / f"in{suffix or '.ogg'}"
+        dst = Path(tmp) / "out.mp3"
+        src.write_bytes(raw)
+        proc = subprocess.run(
+            ["ffmpeg", "-y", "-i", str(src), "-vn", "-ac", "1", "-ar", "16000", "-b:a", "64k", str(dst)],
+            capture_output=True,
+            timeout=_CONVERT_TIMEOUT,
+        )
+        if proc.returncode != 0 or not dst.exists():
+            raise RuntimeError(f"ffmpeg failed: {proc.stderr[-400:]!r}")
+        return dst.read_bytes()
+
+
+async def transcribe(settings: Settings, audio: bytes, mime_type: str | None = None,
+                     filename: str | None = None) -> str:
+    """Return the Persian transcript for a voice note (empty string on silence)."""
+    if not settings.stt_base_url or not settings.stt_api_key:
+        raise RuntimeError("STT provider is not configured (PROCUREMENT_BOT_STT_BASE_URL / _AI_BASE_URL)")
+
+    suffix = Path(filename or "").suffix
+    if not suffix and mime_type:
+        suffix = {"audio/ogg": ".ogg", "audio/opus": ".ogg", "audio/mpeg": ".mp3",
+                  "audio/mp4": ".m4a", "audio/wav": ".wav"}.get(mime_type.split(";")[0].strip(), ".ogg")
+    converted = await asyncio.to_thread(_to_mp3, audio, suffix)
+
+    url = f"{settings.stt_base_url.rstrip('/')}/audio/transcriptions"
+    async with httpx.AsyncClient(timeout=_STT_TIMEOUT) as client:
+        resp = await client.post(
+            url,
+            headers={"Authorization": f"Bearer {settings.stt_api_key}"},
+            files={"file": ("voice.mp3", converted, "audio/mpeg")},
+            data={"model": settings.STT_MODEL, "language": settings.STT_LANGUAGE},
+        )
+    if resp.status_code != 200:
+        raise RuntimeError(f"STT provider returned HTTP {resp.status_code}: {resp.text[:300]}")
+    return str((resp.json() or {}).get("text") or "").strip()

ai procurement/app/sync.py

@@ -0,0 +1,59 @@
+"""Background sync loop: watches bot_drafts for updates from Web Wizard or external API.
+
+If a draft was updated in the Wizard:
+  - If status == 'active': re-renders review text & keyboard in Bale so chat reflects edits.
+  - If status == 'committed': edits Bale message to show it was committed and removes buttons.
+  - If status == 'cancelled': edits Bale message to show it was cancelled and removes buttons.
+"""
+import asyncio
+import logging
+from app import drafts as draft_store
+from app.handlers import quote
+
+logger = logging.getLogger("bot.sync")
+
+
+async def sync_drafts_loop(ctx) -> None:
+    while True:
+        try:
+            pending = await draft_store.get_pending_bale_updates()
+            for draft in pending:
+                try:
+                    if not draft.review_message_id:
+                        await draft_store.set_bale_updated_at(draft.id)
+                        continue
+
+                    if draft.status == "committed":
+                        payload = draft.payload or {}
+                        quote_id = payload.get("committed_quote_id") or ""
+                        msg = "✅ این پیشنهاد با موفقیت در سیستم ثبت نهایی شد."
+                        if quote_id:
+                            msg += f"\nشناسه پیشنهاد: {quote_id}"
+                        await ctx.bale.edit_message_text(draft.chat_id, draft.review_message_id, msg, reply_markup=None)
+                        await draft_store.set_bale_updated_at(draft.id)
+                        logger.info("Synced committed draft %s to Bale message %s", draft.id, draft.review_message_id)
+
+                    elif draft.status == "cancelled":
+                        msg = "❌ این پیش‌نویس لغو شد."
+                        await ctx.bale.edit_message_text(draft.chat_id, draft.review_message_id, msg, reply_markup=None)
+                        await draft_store.set_bale_updated_at(draft.id)
+                        logger.info("Synced cancelled draft %s to Bale message %s", draft.id, draft.review_message_id)
+
+                    elif draft.status == "active" and draft.kind == draft_store.KIND_QUOTE:
+                        await quote.render(ctx, draft.chat_id, draft, fresh=False)
+                        await draft_store.set_bale_updated_at(draft.id)
+                        logger.info("Synced active draft %s edits to Bale message %s", draft.id, draft.review_message_id)
+
+                    else:
+                        await draft_store.set_bale_updated_at(draft.id)
+
+                except Exception as exc:
+                    logger.warning("Failed to sync draft %s to Bale: %s", draft.id, exc)
+                    await draft_store.set_bale_updated_at(draft.id)
+
+        except asyncio.CancelledError:
+            break
+        except Exception:
+            logger.exception("Error in sync_drafts_loop")
+
+        await asyncio.sleep(1.5)

ai procurement/app/texts.py

@@ -0,0 +1,254 @@
+"""Persian message templates (the ERP's user-facing layer is Persian)."""
+import html
+from datetime import date
+
+STATUS_FA = {
+    "offered": "🔵 در انتظار بررسی",
+    "accepted": "🟢 پذیرفته‌شده",
+    "arrived": "✅ رسیده",
+    "rejected": "🔴 ردشده",
+    "expired": "⚪️ منقضی",
+}
+
+MISSING_MARKS = {True: "✅", False: "❌"}
+WARNING_MARK = "⚠️"
+
+
+def esc(value) -> str:
+    return html.escape(str(value if value is not None else "—"))
+
+
+def fa_date(value: str | None) -> str:
+    if not value:
+        return "—"
+    return str(value)[:10]
+
+
+WELCOME = (
+    "سلام! 👋 من دستیار تدارکات هستم.\n\n"
+    "می‌توانی با پیام متنی یا <b>صوتی</b> فعالیتی تعریف کنی — مثلاً:\n"
+    "«سازان نو برای پروژه برج آسمان، ۵۰۰ کیلو میلگرد A3، هر کیلو ۴۵ تومن، پرداخت ۳ فاز»\n\n"
+    "من هر چه را فهمیدم به‌صورت پیش‌نویس آماده می‌کنم، چیزی که فهمیدم و چیزهای خالی را نشان "
+    "می‌دهم و فقط با تأیید تو در سیستم ثبت می‌کنم.\n\n"
+    "دستورها:\n"
+    "/drafts — پیش‌نویس‌های باز\n"
+    "/cancel — لغو پیش‌نویس/عملیات جاری\n"
+    "/whoami — اتصال من\n"
+    "/unlink — قطع اتصال\n"
+    "/help — راهنما"
+)
+
+HELP = (
+    "<b>چه کارهایی می‌توانم بکنم؟</b>\n\n"
+    "🧾 <b>ثبت استعلام</b> — تأمین‌کننده، پروژه، اقلام (کالا/مقدار/واحد)، قیمت و شرایط پرداخت را از گفتگو درمی‌آورم.\n"
+    "🏢 <b>افزودن تأمین‌کننده</b> — «تأمین‌کننده جدید فلانی، دسته لوله و اتصالات، تلفن ...»\n"
+    "📦 <b>افزودن کالا</b> — «کالای جدید میلگرد A3 با واحد کیلوگرم»\n"
+    "📊 <b>پرس‌وجو</b> — «استعلام‌های در انتظار؟»، «کدام‌ها به‌زودی منقضی می‌شوند؟»\n"
+    "✔️ <b>پذیرش استعلام</b> — «استعلام سازان نو را قبول کن»\n"
+    "🚚 <b>اعلام رسیدن</b> — «اقلام سازان نو رسید، ۵۰۰ کیلو»\n\n"
+    "هر ثبت فقط با دکمه ✅ انجام می‌شود. با /cancel هر چیز نیمه‌کاره را لغو کن."
+)
+
+LINK_START = (
+    "برای اتصال حساب Bale به حساب ERP، <b>نام کاربری Casdoor</b> خود را بفرست "
+    "(یا اگر رمز جدا داری همان نام کاربری سامانه). برای لغو: /cancel"
+)
+LINK_ASK_PASSWORD = "ممنون. حالا <b>رمز عبور</b> را بفرست (فقط برای یک بار ورود؛ ذخیره نمی‌شود). /cancel برای لغو"
+LINK_OK = "✅ اتصال انجام شد: <b>{name}</b> ({role})\nحالا می‌توانی فعالیت‌ها را بفرستی. /help را ببین."
+LINK_FAIL = "ورود ناموفق بود: {detail}\nدوباره /start بزن یا نام کاربری را بفرست."
+ADMIN_NO_LINK = "حالت ادمین (بدون اتصال) فعال است؛ ثبت‌ها بدون انتساب کاربر انجام می‌شود."
+
+DRAFTS_LIST_HEADER = "📋 پیش‌نویس‌های باز:"
+DRAFTS_EMPTY = "پیش‌نویس بازی نداری. یک فعالیت را با متن یا وویس بفرست."
+NOTHING_TO_COMMIT = "پیش‌نویس بازی برای ثبت نیست؛ اول یک فعالیت بفرست."
+CANCELLED = "لغو شد. ✔️"
+UNKNOWN_HINT = (
+    "متوجه منظورت نشد 🤔\n"
+    "می‌توانی مثلاً بگویی: «ثبت استعلام از سازان نو برای ۲۰۰ عدد شیر فلکه» یا /help را ببینی."
+)
+UNLINKED = "ابتدا حساب خود را متصل کن: /start"
+AI_NOT_CONFIGURED = (
+    "پردازش هوشمند تنظیم نشده است (متغیرهای PROCUREMENT_BOT_AI_*). "
+    "با مدیر سیستم تماس بگیر."
+)
+STT_FAILED = "نتوانستم پیام صوتی را تبدیل کنم: {detail}"
+VOICE_EMPTY = "از پیام صوتی متنی شنیده نشد؛ دوباره بگو یا با متن بفرست."
+ERR_GENERIC = "خطا: {detail}"
+PICK_QUOTE = "چند استعلام پیدا شد؛ کدام را می‌خواهی؟"
+QUOTE_NOT_FOUND = "استعلامی برای «{q}» پیدا نکردم."
+ACCEPT_REPORT = (
+    "✅ پذیرش انجام شد\n"
+    "استعلام #{id}\n"
+    "وضعیت: {status}\n"
+    "اقلام تصمیم‌گیری‌شده: {count}"
+)
+ARRIVE_REPORT = (
+    "🚚 ثبت رسید انجام شد\n"
+    "استعلام #{id} — وضعیت: {status}\n{lines}"
+)
+ACCEPT_DONE_TS = "شرایط انتخاب‌شده: {label}"
+
+
+def missing_block(missing: list[dict]) -> str:
+    """✅/❌ list of what's captured vs. still empty (⚠️ = nice-to-have)."""
+    if not missing:
+        return "همه فیلدها کامل است ✅"
+    lines = []
+    for m in missing:
+        mark = MISSING_MARKS[m["ok"]] if m["blocking"] else (MISSING_MARKS.get(m["ok"], WARNING_MARK))
+        if not m["blocking"] and not m["ok"]:
+            mark = WARNING_MARK
+        lines.append(f"{mark} {m['label']}")
+    return "\n".join(lines)
+
+
+def quote_review_text(payload: dict, missing: list[dict], status_note: str | None = None) -> str:
+    lines = ["🧾 پیش‌نویس استعلام:"]
+    if status_note:
+        lines.append(status_note)
+    sup = payload.get("supplier_name") or "—"
+    if payload.get("supplier_id"):
+        sup_label = f"{esc(sup)} ✅"
+    elif payload.get("supplier_name"):
+        sup_label = f"{esc(sup)} ✨ (تأمین‌کننده جدید)"
+    else:
+        sup_label = "—"
+    lines.append(f"تأمین‌کننده: {sup_label}")
+    proj_names = payload.get("project_names") or ([payload["project_name"]] if payload.get("project_name") else [])
+    if proj_names:
+        lines.append(f"پروژه(ها): {esc('، '.join(proj_names))}")
+    lines.append(f"نوع: {'رسمی' if payload.get('is_official', True) else 'برآوردی'}")
+    if payload.get("expiry_date"):
+        lines.append(f"اعتبار تا: {fa_date(payload['expiry_date'])}")
+
+    items = payload.get("items") or []
+    if items:
+        lines.append("\n📦 اقلام:")
+        for i, it in enumerate(items, start=1):
+            name = it.get('material_name') or '?'
+            if it.get('brand_name'):
+                name += f" ({it['brand_name']})"
+            parts = [f"{i}. {esc(name)}"]
+            if it.get('specs'):
+                parts.append(esc("، ".join(it['specs'])))
+            if it.get("quantity"):
+                parts.append(f"مقدار {esc(it['quantity'])}")
+            unit = it.get("unit_name") or ("(واحد کالا)" if it.get("unit_id") else None)
+            if unit:
+                parts.append(str(unit))
+            if it.get("unit_price"):
+                parts.append(f"قیمت {esc(it['unit_price'])}")
+            if not it.get("material_id"):
+                parts.append("✨ کالای جدید")
+            lines.append(" — ".join(str(p) for p in parts))
+    else:
+        lines.append("\nاقلام: هنوز چیزی ثبت نشده ❌")
+
+    sheets = payload.get("termsheets") or []
+    if sheets:
+        ts_parts = []
+        for t in sheets:
+            lbl = esc(t.get('label'))
+            if t.get("milestones"):
+                steps_txt = " + ".join(f"{fa_date(m.get('due_date'))}: {esc(m.get('amount'))}" for m in t["milestones"] if m.get("amount"))
+                if steps_txt:
+                    lbl += f" [{steps_txt}]"
+            elif t.get("discount_value"):
+                lbl += f" (تخفیف {esc(t.get('discount_value'))})"
+            ts_parts.append(lbl)
+        lines.append("\n💳 شرایط پرداخت: " + "؛ ".join(ts_parts))
+    if payload.get("notes"):
+        lines.append(f"یادداشت: {esc(payload['notes'])}")
+
+    lines.append("\n📋 وضعیت فیلدها:")
+    lines.append(missing_block(missing))
+    lines.append("\nبا پیام بعدی می‌توانی چیزهای خالی را تکمیل کنی، یا با دکمه‌ها ثبت/لغو کنی.")
+    return "\n".join(lines)
+
+
+def supplier_review_text(payload: dict, missing: list[dict]) -> str:
+    lines = ["🏢 <b>پیش‌نویس تأمین‌کننده جدید</b>", f"نام: <b>{esc(payload.get('name'))}</b>"]
+    lines.append(f"دسته: {esc(payload.get('category_name'))}")
+    if payload.get("phone"):
+        lines.append(f"تلفن: {esc(payload['phone'])}")
+    if payload.get("location"):
+        lines.append(f"موقعیت: {esc(payload['location'])}")
+    if payload.get("contact_person"):
+        lines.append(f"رابط: {esc(payload['contact_person'])}")
+    lines.append("\n<b>وضعیت فیلدها:</b>")
+    lines.append(missing_block(missing))
+    return "\n".join(lines)
+
+
+def material_review_text(payload: dict, missing: list[dict]) -> str:
+    lines = ["📦 <b>پیش‌نویس کالای جدید</b>", f"نام: <b>{esc(payload.get('name'))}</b>"]
+    lines.append(f"واحد اصلی: {esc(payload.get('unit_name'))}")
+    if payload.get("topic"):
+        lines.append(f"تاپیک: {esc(payload['topic'])}")
+    lines.append("\n<b>وضعیت فیلدها:</b>")
+    lines.append(missing_block(missing))
+    return "\n".join(lines)
+
+
+def quote_committed_report(created: dict, payload: dict, remaining: list[str]) -> str:
+    lines = [f"✅ <b>ثبت شد</b> — استعلام #{esc(created.get('id'))}"]
+    sup = (created.get("supplier") or {}).get("name") or payload.get("supplier_name")
+    if sup:
+        lines.append(f"تأمین‌کننده: {esc(sup)}")
+    items = created.get("line_items") or []
+    if items:
+        lines.append(f"اقلام: {len(items)}")
+    sheets = created.get("termsheets") or []
+    if sheets:
+        lines.append(f"شرایط پرداخت: {len(sheets)}")
+    if payload.get("project_id"):
+        lines.append("پروژه: پیوست شد")
+    if remaining:
+        lines.append("\n<b>خالی مانده‌ها (بعداً می‌توانی در برنامه تکمیل کنی):</b>")
+        lines += [f"⚠️ {esc(r)}" for r in remaining]
+    lines.append("\nمرحله بعد: وقتی تصمیم گرفتی، بگو «استعلام را قبول کن» تا پذیرش را با هم انجام دهیم.")
+    return "\n".join(lines)
+
+
+def supplier_committed_report(created: dict) -> str:
+    return (
+        f"✅ <b>تأمین‌کننده ثبت شد</b> — {esc(created.get('name'))}\n"
+        f"دسته: {esc((created.get('category') or {}).get('name'))}"
+    )
+
+
+def material_committed_report(created: dict) -> str:
+    return f"✅ <b>کالا ثبت شد</b> — {esc(created.get('name'))}"
+
+
+def quote_line(quote: dict) -> str:
+    sup = (quote.get("supplier") or {}).get("name") or quote.get("supplier_id") or "—"
+    items = quote.get("line_items") or []
+    item_names = []
+    for it in items:
+        mat = (it.get("material") or {}).get("name")
+        if mat:
+            qty = it.get("quantity")
+            item_names.append(f"{mat} ({qty})" if qty else mat)
+    tail = f" — {'، '.join(item_names[:3])}" + ("…" if len(item_names) > 3 else "") if item_names else ""
+    return (
+        f"#{str(quote.get('id'))[:8]} — {esc(sup)} — {STATUS_FA.get(quote.get('status'), quote.get('status'))} — "
+        f"{fa_date(quote.get('quote_date'))}{tail}"
+    )
+
+
+def status_report(kind: str, quotes: list[dict], extra_note: str | None = None) -> str:
+    titles = {
+        "pending": "🔵 استعلام‌های در انتظار بررسی",
+        "accepted": "🟢 پذیرفته‌شده (در انتظار تحویل)",
+        "arrived": "✅ رسیده",
+        "expiring": "⏳ به‌زودی منقضی می‌شوند (۷ روز آینده)",
+        "recent": "🕘 آخرین استعلام‌ها",
+    }
+    if not quotes:
+        return f"{titles.get(kind, 'نتیجه‌ای')}\nموردی نیست."
+    lines = [titles.get(kind, "استعلام‌ها")]
+    if extra_note:
+        lines.append(extra_note)
+    lines += [f"• {quote_line(q)}" for q in quotes[:10]]
+    return "\n".join(lines)

ai procurement/docs/SETUP.md

@@ -0,0 +1,172 @@
+# Setup & Operations Guide
+
+A Bale messenger bot that turns Persian **chat messages and voice notes** into
+procurement actions in the ERP. It works **draft-first**: it captures what it
+understood, tells you exactly **what it did** and **what is still empty**, and
+**commits only after you approve** with a ✅ button.
+
+Bale's Bot API is a Telegram-compatible clone hosted at `tapi.bale.ai`, so the
+bot uses the familiar `getUpdates` long-polling — **no public port, no webhook,
+no TLS setup**.
+
+---
+
+## What it can do (v1)
+
+| Activity | Example (voice or text) | Committed via |
+|---|---|---|
+| Register a supplier quote | «سازان نو برای پروژه برج آسمان ۵۰۰ کیلو میلگرد A3 سایز ۱۴، هر کیلو ۴۵ تومن، پرداخت ۳ فاز» | `POST /quotes` (nested create) |
+| Add a supplier | «تأمین‌کننده جدید پروفیل بر، دسته لوله و اتصالات، تلفن ۰۹۱۲…» | `POST /suppliers` |
+| Add a material | «کالای جدید میلگرد A3 سایز ۱۸ با واحد کیلوگرم» | `POST /materials` |
+| Status queries | «استعلام‌های در انتظار؟» / «کدام‌ها به‌زودی منقضی می‌شوند؟» | `GET /quotes?…` |
+| Accept a quote | «استعلام سازان نو را قبول کن» | `PATCH /quotes/{id}/accept` |
+| Announce a delivery | «اقلام سازان نو رسید، ۵۰۰ و ۲۰۰» | `PATCH /quotes/{id}/arrive-items` |
+
+### The draft → approve loop (the core idea)
+
+1. You send a message (or voice note). The bot converts voice to text
+   (STT) and extracts an **intent + entities** (LLM).
+2. Names are fuzzy-matched against the ERP (supplier / material / unit /
+   project). Multiple candidates → inline **pick buttons**; no match → it is
+   listed as missing.
+3. The bot replies with a **review card**: everything it captured, plus a
+   ✅/⚠️/❌ **list of what is still empty** («یادآوری چیزهای خالی»).
+4. You keep chatting to refine («قیمت میلگرد ۴۷ شد», «پروژه برج آسمان») — the
+   open draft is updated and re-rendered.
+5. **Nothing is written to the ERP until you tap ✅ ثبت نهایی.** Partial
+   commits are possible («ثبت فقط اقلام مشخص») because the API deliberately
+   tolerates incomplete quotes. After commit you get the created quote id and
+   the list of fields that were left empty.
+
+### Team access & attribution
+
+- Every user links their Bale chat to their ERP account once: `/start` →
+  Casdoor **username** → **password** (validated through the real
+  `POST /auth/login`; the password is used once and never stored).
+- Mutating API calls carry `X-Actor-Id: <users.id>` so `quote_events.actor`
+  records the **human** who asked, not the bot. (The bot's container talks to
+  the api in-network: `http://api:8000/api/v1`.)
+- `BALE_ADMIN_CHAT_IDS` may list chat ids that bypass linking.
+
+### Commands
+
+`/start` · `/help` · `/drafts` (open drafts) · `/cancel` (abort draft/flow) ·
+`/whoami` · `/unlink`
+
+---
+
+## Setup
+
+1. **Create the bot** in Bale's BotFather and copy the token.
+2. **Configure an AI provider** — any OpenAI-compatible endpoint works for
+   both STT (`POST {base}/audio/transcriptions`, Persian) and the LLM
+   (`POST {base}/chat/completions`, JSON mode). Examples: OpenAI `whisper-1`
+   + `gpt-4o-mini`, or any proxy/provider you already use.
+3. **Compose** (dev):
+
+   ```powershell
+   # env passed at compose level (or a .env next to docker-compose.yml)
+   $env:BALE_BOT_TOKEN = "<token>"
+   $env:AI_BASE_URL    = "https://api.openai.com/v1"
+   $env:AI_API_KEY     = "<key>"
+
+   docker compose up -d --build bot
+   docker compose logs -f bot
+   ```
+
+   For Coolify (`docker-compose.coolify.yml`) set the same variables as
+   service-level env vars; the bot container needs no domain/labels.
+
+### Environment variables (prefix `PROCUREMENT_BOT_`)
+
+| Variable | Default | Purpose |
+|---|---|---|
+| `BOT_TOKEN` | — (required) | token from Bale's BotFather |
+| `BALE_API_BASE` | `https://tapi.bale.ai` | Bot API base (overridable for tests) |
+| `API_BASE_URL` | `http://localhost:8000/api/v1` | ERP api (in Docker: `http://api:8000/api/v1`) |
+| `DATABASE_URL` | same postgres as the api | bot's own tables (`bot_*`) |
+| `AI_BASE_URL` / `AI_API_KEY` | — | OpenAI-compatible STT+LLM provider |
+| `STT_MODEL` / `LLM_MODEL` | `whisper-1` / `gpt-4o-mini` | model names at the provider |
+| `ADMIN_CHAT_IDS` | — | comma-separated Bale chat ids allowed without linking |
+| `SERVICE_TOKEN` | — | optional bearer for the day procurement endpoints enforce auth |
+| `DRAFT_TTL_HOURS` | `24` | drafts older than this are marked expired |
+
+In compose these are fed from `BALE_BOT_TOKEN`, `BALE_API_BASE`, `AI_BASE_URL`,
+`AI_API_KEY`, `AI_STT_MODEL`, `AI_LLM_MODEL`, `BALE_ADMIN_CHAT_IDS`,
+`BALE_SERVICE_TOKEN`.
+
+---
+
+## How it's built
+
+```
+bot/
+├── Dockerfile                  python:3.13-slim + ffmpeg (voice conversion)
+├── app/
+│   ├── main.py                 ensure tables → sweeper task → poll loop
+│   ├── config.py               pydantic-settings, PROCUREMENT_BOT_ prefix
+│   ├── bale/client.py          getUpdates/sendMessage/edit/callbacks/getFile+download
+│   ├── api/client.py           ERP /api/v1 client (X-Actor-Id attribution)
+│   ├── stt.py                  ffmpeg (OGG/Opus → MP3) → /audio/transcriptions
+│   ├── nlu.py                  Persian intent+entity extraction (JSON mode)
+│   ├── resolve.py              fuzzy name→id matching (difflib + ilike search)
+│   ├── drafts.py               draft store + QuoteCreate payload builder + missing-field logic
+│   ├── keyboards.py            inline keyboards (callback_data ≤ 64 B op-codes)
+│   ├── texts.py                Persian message templates
+│   ├── runtime.py              context, link store, in-memory pending flows
+│   ├── models.py / db_init.py  bot_links / bot_drafts / bot_messages / bot_meta (idempotent DDL)
+│   └── handlers/               dispatch, commands, callbacks, links,
+│                               quote, supplier, material, queries, decisions
+└── tools/smoke_test.py         offline end-to-end harness (fake Bale/ERP/AI, in-memory store)
+```
+
+Design notes:
+
+- **Draft state lives in postgres** (`bot_drafts.payload` JSONB in the shape of
+  the eventual API request), so drafts survive bot restarts; short-lived
+  interactions (linking, quote picking, accept/arrive confirmations) are
+  in-memory with a 30-minute TTL.
+- **Callback grammar** fits Bale's 64-byte `callback_data`:
+  `q:ok:{draft8}` (commit), `pk:{draft8}:{field}:{idx}` (pick candidate),
+  `ac:ts:{i}` (choose payment terms), `ar:full` / `ar:ok` (delivery)…
+- **Persian handling**: Persian/Arabic digits are normalized before parsing;
+  fuzzy matching folds ZWNJ and Arabic ya/ka; all user-facing text is Persian.
+- **Voice notes** arrive as OGG/Opus; ffmpeg converts to mono 16 kHz MP3
+  before hitting the STT endpoint (accepted by essentially all providers).
+- The **accept flow echoes the termsheet's existing `schedule_steps`** back to
+  `PATCH /quotes/{id}/accept` (the API replaces steps with what you send, so
+  the bot must send the current ones).
+
+### Attribution tweak in the api (backward compatible)
+
+`backend/app/utils/security.py::get_actor` now prefers an `X-Actor-Id` header
+over the raw bearer token when attributing `quote_events.actor`. Requests
+without that header behave exactly as before.
+
+---
+
+## Testing
+
+Offline harness (no Bale token, no DB, no AI key — stubs everything and drives
+the real handler pipeline with fake updates):
+
+```powershell
+docker compose run --rm bot python tools/smoke_test.py
+# or, with the requirements installed locally:
+cd bot && python tools/smoke_test.py
+```
+
+Covers: linking, voice→draft, ambiguous-material pick buttons, unit fallback,
+draft refinement, commit payload shape (temp_id cross-references), supplier /
+material commits, status digest, accept payload (steps echoed, per-item price),
+arrival quantities («۵۰۰ و ۲۰۰»), cancel and unknown-intent handling.
+
+## Troubleshooting
+
+| Symptom | Likely cause |
+|---|---|
+| Bot silent | wrong `BALE_BOT_TOKEN`; check `docker compose logs bot` |
+| «پردازش هوشمند تنظیم نشده است» | `AI_BASE_URL` / `AI_API_KEY` missing |
+| Voice → «نتوانستم پیام صوتی را تبدیل کنم» | provider rejected the model name (`STT_MODEL`) or key |
+| «ERP API unreachable» | api container not up / wrong `API_BASE_URL` |
+| Draft disappears | TTL expiry (`DRAFT_TTL_HOURS`) or someone pressed ❌ / `/cancel` |

ai procurement/integration/README.md

@@ -0,0 +1,44 @@
+# ERP integration pack
+
+The agent is a **standalone container** — it talks to the ERP exclusively over
+HTTP and keeps its own state in its own `bot_*` tables. Integrating it into the
+[ERP stack](https://git.bennu-api-bahrestan.ir/ali_mohaghegh/ERP) needs exactly
+two things:
+
+## 1. Compose service
+
+Add [`erp-compose-service.yml`](erp-compose-service.yml) to the ERP's
+`docker-compose.yml` (and the Coolify variant). The bot long-polls Bale, so it
+needs **no ports, no webhook, no TLS** — it joins the compose `default` network
+and reaches `http://api:8000/api/v1` in-network.
+
+Credentials/env are passed at compose level from a `.env` next to the compose
+file: `BALE_BOT_TOKEN`, `AI_BASE_URL`, `AI_API_KEY`, `AI_LLM_MODEL`
+(see [`../.env.example`](../.env.example) for the full list).
+
+> If your stack is started with multiple `-f` files (e.g. a prod_v2 checkout +
+> port-remap override), keep using the same chain — the `bot` service merges in
+> like any other service and the override's host-port remaps don't affect it.
+
+## 2. Per-user attribution in the API
+
+Apply [`x-actor-id.patch`](x-actor-id.patch) — a ~6-line, fully
+backward-compatible change to `backend/app/utils/security.py`:
+
+- before: `get_actor` returns the raw `Authorization: Bearer …` string and
+  `quote_events.actor` stores the bot's token;
+- after: an `X-Actor-Id: <users.id>` header (sent by the bot for every mutating
+  call, carrying the **linked ERP user's id**) takes precedence, so the audit
+  trail records the human who asked, not the bot.
+
+Requests without the header behave exactly as before.
+
+## What the agent does NOT touch
+
+- No ERP code is imported by the bot (HTTP-only, own postgres tables
+  `bot_links` / `bot_drafts` / `bot_messages` / `bot_meta`, created idempotently
+  at startup with `CREATE TABLE IF NOT EXISTS`).
+- No Alembic migration needed — the bot owns its schema.
+- The ERP's data model stays untouched; committed drafts flow through the
+  ordinary public endpoints (`POST /quotes`, `PATCH /quotes/{id}/accept`,
+  `PATCH /quotes/{id}/arrive-items`, `POST /suppliers`, `POST /materials`).

ai procurement/integration/erp-compose-service.yml

@@ -0,0 +1,39 @@
+# ==========================================================================
+# Add this service to the ERP stack's docker-compose.yml (and mirror it in
+# docker-compose.coolify.yml with `container_name: procurement-bot`).
+#
+# It expects THIS repository checked out (or vendored) next to the ERP repo
+# as `./bot` — either `git clone … bot` inside the ERP checkout, or change
+# `context:` to an absolute/relative path to this repo.
+#
+# In-container URLs are unaffected by host port remaps (postgres/api are
+# reached over the compose network, not host ports).
+# ==========================================================================
+services:
+  bot:
+    build:
+      context: ./bot           # ← path to this repository
+      dockerfile: Dockerfile
+    container_name: procurement-bot
+
+    environment:
+      PROCUREMENT_BOT_BOT_TOKEN: ${BALE_BOT_TOKEN:-}
+      PROCUREMENT_BOT_BALE_API_BASE: ${BALE_API_BASE:-https://tapi.bale.ai}
+      PROCUREMENT_BOT_API_BASE_URL: http://api:8000/api/v1
+      PROCUREMENT_BOT_DATABASE_URL: postgresql+asyncpg://postgres:postgres@postgres:5432/procurement
+      PROCUREMENT_BOT_AI_BASE_URL: ${AI_BASE_URL:-}
+      PROCUREMENT_BOT_AI_API_KEY: ${AI_API_KEY:-}
+      PROCUREMENT_BOT_STT_MODEL: ${AI_STT_MODEL:-whisper-1}
+      PROCUREMENT_BOT_STT_BASE_URL: ${AI_STT_BASE_URL:-}
+      PROCUREMENT_BOT_STT_API_KEY: ${AI_STT_API_KEY:-}
+      PROCUREMENT_BOT_LLM_MODEL: ${AI_LLM_MODEL:-gpt-4o-mini}
+      PROCUREMENT_BOT_ADMIN_CHAT_IDS: ${BALE_ADMIN_CHAT_IDS:-}
+      PROCUREMENT_BOT_SERVICE_TOKEN: ${BALE_SERVICE_TOKEN:-}
+
+    depends_on:
+      postgres:
+        condition: service_healthy
+      api:
+        condition: service_started
+
+    restart: unless-stopped

ai procurement/integration/x-actor-id.patch

@@ -0,0 +1,18 @@
+diff --git a/backend/app/utils/security.py b/backend/app/utils/security.py
+index a78c1cb..75e7349 100644
+--- a/backend/app/utils/security.py
++++ b/backend/app/utils/security.py
+@@ -7,7 +7,13 @@ def get_actor(request: Request) -> str | None:
+ 
+     This is the reserved placeholder from the contract — no authentication
+     or authorization is enforced yet.
++
++    Services acting on behalf of a user (the Bale bot) pass ``X-Actor-Id``
++    (users.id); it wins over the raw token so the audit trail shows the human.
+     """
++    actor_id = request.headers.get("X-Actor-Id")
++    if actor_id:
++        return actor_id.strip()
+     auth = request.headers.get("Authorization")
+     if auth and auth.lower().startswith("bearer "):
+         return auth[7:].strip() or None

ai procurement/requirements.txt

@@ -0,0 +1,5 @@
+httpx>=0.27.0
+sqlalchemy[asyncio]>=2.0.30
+asyncpg>=0.29.0
+pydantic>=2.7.0
+pydantic-settings>=2.2.0

ai procurement/tools/smoke_test.py

@@ -0,0 +1,448 @@
+"""Offline smoke test for the Bale bot — no Bale network, no postgres, no AI keys.
+
+It stubs the Bale client, the ERP API client, STT and the NLU module, replaces
+the draft store with an in-memory fake, then drives the real handler pipeline
+end-to-end through fake updates (text, voice, inline-button callbacks).
+
+Run inside the bot container (or anywhere the requirements are installed):
+
+    python tools/smoke_test.py
+
+Exit code 0 = all checks passed.
+"""
+import asyncio
+import os
+import sys
+import types
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+
+# asyncpg is only needed when a real connection opens; stub it so app.db imports.
+try:
+    import asyncpg  # noqa: F401
+except ImportError:
+    sys.modules.setdefault("asyncpg", types.ModuleType("asyncpg"))
+
+CHAT = 100200300
+
+_passed = _failed = 0
+
+
+def check(name: str, ok: bool, detail: str = "") -> None:
+    global _passed, _failed
+    ok = bool(ok)
+    mark = "PASS" if ok else "FAIL"
+    print(f"[{mark}] {name}" + (f" — {detail}" if detail and not ok else ""))
+    _passed += ok
+    _failed += (not ok)
+
+
+# ---------------------------------------------------------------------------
+# fakes
+# ---------------------------------------------------------------------------
+
+class FakeBale:
+    def __init__(self):
+        self.sent: list[dict] = []
+        self.edited: list[dict] = []
+        self.answered: list[str] = []
+        self._mid = 0
+
+    async def send_message(self, chat_id, text, reply_markup=None, reply_to=None):
+        self._mid += 1
+        self.sent.append({"chat_id": chat_id, "text": text, "reply_markup": reply_markup})
+        return {"message_id": self._mid, "chat": {"id": chat_id}}
+
+    async def edit_message_text(self, chat_id, message_id, text, reply_markup=None):
+        self.edited.append({"chat_id": chat_id, "message_id": message_id, "text": text,
+                            "reply_markup": reply_markup})
+        return {"message_id": message_id}
+
+    async def answer_callback_query(self, callback_query_id, text=None):
+        self.answered.append(callback_query_id)
+
+    async def send_chat_action(self, chat_id, action="typing"):
+        pass
+
+    async def download_file(self, file_id):
+        return b"fake-ogg-bytes"
+
+    def last_text(self) -> str:
+        return self.sent[-1]["text"] if self.sent else ""
+
+    def last_markup(self) -> dict | None:
+        return self.sent[-1]["reply_markup"] if self.sent else None
+
+
+class FakeApi:
+    """Canned ERP responses + captured mutation payloads."""
+
+    def __init__(self):
+        self.created_quotes: list[dict] = []
+        self.created_suppliers: list[dict] = []
+        self.created_materials: list[dict] = []
+        self.accept_payloads: list[dict] = []
+        self.arrive_payloads: list[dict] = []
+        self.login_calls: list[dict] = []
+
+    async def login(self, username, password):
+        self.login_calls.append({"username": username, "password": password})
+        if username == "mohaghegh" and password == "secret":
+            return {"access_token": "jwt", "user": {"id": "user-1", "first_name": "علی",
+                                                    "last_name": "محقق", "role": "procurement_manager"}}
+        raise RuntimeError("invalid credentials")
+
+    async def list_suppliers(self, q=None, page_size=20):
+        return [{"id": "sup-1", "name": "سازان نو", "category_id": "cat-2"}]
+
+    async def create_supplier(self, payload, actor_id=None):
+        self.created_suppliers.append(payload)
+        return {"id": "sup-new", "name": payload["name"],
+                "category": {"id": payload["category_id"], "name": "لوله و اتصالات"}}
+
+    async def list_materials(self, q=None, page_size=20):
+        return [
+            {"id": "mat-1", "name": "میلگرد A3 سایز ۱۴", "canonical_unit_id": 3},
+            {"id": "mat-2", "name": "میلگرد A3 سایز ۱۶", "canonical_unit_id": 3},
+            {"id": "mat-3", "name": "شیر فلکه چهارطرفه", "canonical_unit_id": 2},
+        ]
+
+    async def create_material(self, payload, actor_id=None):
+        self.created_materials.append(payload)
+        return {"id": "mat-new", "name": payload["name"]}
+
+    async def list_units(self, q=None, page_size=100):
+        return [{"id": 2, "code": "adad", "name_fa": "عدد"},
+                {"id": 3, "code": "kg", "name_fa": "کیلوگرم"}]
+
+    async def list_projects(self, page_size=100):
+        return [{"id": "prj-1", "name": "برج آسمان"}]
+
+    async def list_categories(self, page_size=100):
+        return [{"id": "cat-1", "name": "تأسیسات مکانیکی و آبی"},
+                {"id": "cat-2", "name": "لوله و اتصالات"}]
+
+    def _expanded(self, quote_id, status):
+        """Realistic GET /quotes?expand=line_items,termsheets,supplier shape."""
+        return {
+            "id": quote_id, "supplier": {"name": "سازان نو"}, "project_id": None, "status": status,
+            "quote_date": "2026-09-10T00:00:00Z", "expiry_date": "2026-09-20",
+            "line_items": [
+                {"id": "li-1", "material": {"name": "میلگرد A3 سایز ۱۴"}, "unit": {"name_fa": "کیلوگرم"},
+                 "quantity": 500, "unit_price": 45000, "projects": [],
+                 "decision": {"status": "chosen"} if status == "accepted" else None, "receipt": None},
+                {"id": "li-2", "material": {"name": "شیر فلکه چهارطرفه"}, "unit": {"name_fa": "عدد"},
+                 "quantity": 200, "unit_price": 90000, "projects": [],
+                 "decision": {"status": "chosen"} if status == "accepted" else None, "receipt": None},
+            ],
+            "termsheets": [{"id": "ts-1", "label": "۳ فاز", "discount_type": "none", "discount_value": 0,
+                            "schedule_steps": [{"step_no": 1, "due_date": "2026-10-01", "amount": 1000}]}],
+        }
+
+    async def list_quotes(self, *, status=None, q=None, expand=None, sort=None, page=1, page_size=10):
+        if status == "offered":
+            return [self._expanded("q-aaaa1111", "offered")], {"total": 1}
+        if status == "accepted":
+            return [self._expanded("q-bbbb2222", "accepted")], {"total": 1}
+        return [], {"total": 0}
+
+    async def get_quote(self, quote_id, expand=None, actor_id=None):
+        return self._expanded(quote_id, "accepted" if quote_id.startswith("q-bbbb") else "offered")
+
+    async def create_quote(self, payload, actor_id=None):
+        self.created_quotes.append(payload)
+        return {"id": "q-new", "supplier": {"name": "سازان نو"},
+                "line_items": payload.get("line_items") or [],
+                "termsheets": payload.get("termsheets") or []}
+
+    async def accept_quote(self, quote_id, payload, actor_id=None):
+        self.accept_payloads.append({"quote_id": quote_id, "payload": payload})
+        return {"id": quote_id, "status": "accepted", "line_items": [{"id": "li-1", "decision": {}}]}
+
+    async def arrive_items(self, quote_id, payload, actor_id=None):
+        self.arrive_payloads.append({"quote_id": quote_id, "payload": payload})
+        return {"id": quote_id, "status": "arrived",
+                "items": [{"line_item_id": it["line_item_id"], "received_qty": float(it["received_qty"])}
+                          for it in payload["items"]]}
+
+
+# ---------------------------------------------------------------------------
+# in-memory draft store + link store
+# ---------------------------------------------------------------------------
+
+MEM: dict = {"drafts": {}, "links": {}}
+
+
+def _install_fake_stores() -> None:
+    import uuid as _uuid
+
+    import app.drafts as drafts
+    import app.runtime as runtime
+
+    async def create(chat_id, kind, payload, source=None):
+        draft_id = _uuid.uuid4()
+        draft = types.SimpleNamespace(id=str(draft_id), chat_id=chat_id, kind=kind, payload=payload,
+                                      missing=None, status="active", source=source,
+                                      review_message_id=None)
+        MEM["drafts"][str(draft_id)] = draft
+        return draft
+
+    async def get_active(chat_id, kind=None):
+        found = [d for d in MEM["drafts"].values()
+                 if d.chat_id == chat_id and d.status == "active" and (kind is None or d.kind == kind)]
+        return max(found, key=lambda d: d.id) if found else None
+
+    async def get_by_prefix(prefix, chat_id=None):
+        for draft in MEM["drafts"].values():
+            if draft.id.startswith(prefix) and (chat_id is None or draft.chat_id == chat_id):
+                return draft
+        return None
+
+    async def save_payload(draft, missing=None, review_message_id=None):
+        draft.missing = missing
+        if review_message_id:
+            draft.review_message_id = review_message_id
+
+    async def set_status(draft_id, status):
+        if draft_id in MEM["drafts"]:
+            MEM["drafts"][draft_id].status = status
+
+    async def expire_stale(ttl_hours):
+        return 0
+
+    drafts.create, drafts.get_active, drafts.get_by_prefix = create, get_active, get_by_prefix
+    drafts.save_payload, drafts.set_status, drafts.expire_stale = save_payload, set_status, expire_stale
+
+    async def link_get(self, chat_id):
+        return MEM["links"].get(chat_id)
+
+    async def link_upsert(self, chat_id, user_id, username, display_name, role):
+        MEM["links"][chat_id] = types.SimpleNamespace(chat_id=chat_id, user_id=user_id,
+                                                      casdoor_username=username,
+                                                      display_name=display_name, role=role)
+        return MEM["links"][chat_id]
+
+    async def link_delete(self, chat_id):
+        return MEM["links"].pop(chat_id, None) is not None
+
+    runtime.LinkStore.get, runtime.LinkStore.upsert, runtime.LinkStore.delete = link_get, link_upsert, link_delete
+
+
+async def fake_log(self, chat_id, direction, kind, body=None):
+    pass
+
+
+NLU_QUEUE: list[dict] = []
+
+
+async def fake_understand(settings, text, draft_summary=None):
+    return NLU_QUEUE.pop(0) if NLU_QUEUE else {"intent": "unknown", "patch": {}, "confidence": 0}
+
+
+async def fake_transcribe(settings, audio, mime_type=None, filename=None):
+    return ("سازان نو برای پروژه برج آسمان ۵۰۰ کیلو میلگرد A3 سایز ۱۴ هر کیلو ۴۵ هزار تومن "
+            "پرداخت سه فاز")
+
+
+# ---------------------------------------------------------------------------
+# driver
+# ---------------------------------------------------------------------------
+
+def build_ctx():
+    import app.handlers as H
+    from app.resolve import Resolver
+    from app.runtime import BotContext
+
+    bale, api = FakeBale(), FakeApi()
+    ctx = BotContext(bale, api)
+    ctx.bale = bale
+    ctx.api = api
+    ctx.resolver = Resolver(api)
+    ctx._log = types.MethodType(fake_log, ctx)
+    H.understand = fake_understand
+    H.transcribe = fake_transcribe
+    return ctx, bale, api
+
+
+def text_update(update_id, text):
+    return {"update_id": update_id, "message": {"chat": {"id": CHAT}, "text": text, "from": {"id": CHAT}}}
+
+
+def voice_update(update_id):
+    return {"update_id": update_id,
+            "message": {"chat": {"id": CHAT}, "voice": {"file_id": "v1", "mime_type": "audio/ogg", "duration": 6}}}
+
+
+def callback_update(update_id, data):
+    return {"update_id": update_id, "callback_query": {"id": f"cb{update_id}", "data": data,
+                                                       "message": {"chat": {"id": CHAT}}}}
+
+
+async def main() -> int:
+    _install_fake_stores()
+    from app.drafts import build_quote_request, compute_quote_missing, merge_quote_patch, new_quote_payload
+    import app.handlers as H
+    from app.nlu import _extract_json, normalize_digits
+
+    # ---- pure logic -------------------------------------------------------
+    check("digits: ۵۰۰→500", normalize_digits("۵۰۰ کیلو") == "500 کیلو")
+    check("json extract: fenced", (_extract_json('```json\n{"a": 1}\n```') or {}) == {"a": 1})
+
+    payload = new_quote_payload()
+    merge_quote_patch(payload, {
+        "supplier_name": "سازان نو",
+        "items": [{"material_name": "میلگرد A3", "quantity": 500, "unit_price": 45000}],
+        "payment_terms": [{"label": "۳ فاز"}],
+    })
+    merge_quote_patch(payload, {"items": [{"material_name": "میلگرد A3", "quantity": 600}]})
+    check("merge: no dup item", len(payload["items"]) == 1)
+    check("merge: qty updated", payload["items"][0]["quantity"] == 600)
+    check("merge: terms added", payload["termsheets"][0]["label"] == "۳ فاز")
+    missing = compute_quote_missing(payload)
+    check("missing: supplier empty", any(m["key"] == "supplier" and not m["ok"] for m in missing))
+    body, problems = build_quote_request(payload)
+    check("build: blocked without supplier", body is None)
+
+    # ---- pipeline: linking gate -------------------------------------------
+    ctx, bale, api = build_ctx()
+    await H.handle_update(ctx, text_update(1, "سلام"))
+    check("gate: unlinked asked username", "نام کاربری" in bale.last_text())
+
+    await H.handle_update(ctx, text_update(2, "mohaghegh"))
+    await H.handle_update(ctx, text_update(3, "secret"))
+    check("link: login called", api.login_calls and api.login_calls[0]["username"] == "mohaghegh")
+    check("link: linked greeting", "اتصال انجام شد" in bale.last_text())
+
+    # ---- voice → draft quote ----------------------------------------------
+    NLU_QUEUE.append({"intent": "register_quote", "confidence": 0.9, "patch": {
+        "supplier_name": "سازان نو", "project_name": "برج آسمان",
+        "items": [{"material_name": "میلگرد", "quantity": 500, "unit_name": "کیلوگرم",
+                   "unit_price": 45000}],
+        "payment_terms": [{"label": "۳ فاز", "description": "سه قسط"}],
+    }})
+    await H.handle_update(ctx, voice_update(4))
+    draft = await _active("quote")
+    check("voice: draft created", draft is not None)
+    check("voice: supplier resolved", draft.payload.get("supplier_id") == "sup-1")
+    check("voice: project resolved", draft.payload.get("project_id") == "prj-1")
+    item = (draft.payload.get("items") or [{}])[0]
+    check("voice: material ambiguous → pick buttons", "mat1" in (draft.payload.get("options") or {}))
+    check("voice: review shows missing list", "وضعیت فیلدها" in bale.last_text())
+    check("voice: review mentions unit", "کیلوگرم" in bale.last_text())
+
+    # pick the material via inline button
+    markup = bale.last_markup() or {}
+    pick_data = _first_callback(markup, "pk:")
+    check("voice: pick callback present", pick_data is not None and ":mat1:0" in pick_data)
+    await H.handle_update(ctx, callback_update(5, pick_data))
+    item = (draft.payload.get("items") or [{}])[0]
+    check("pick: material resolved", item.get("material_id") == "mat-1")
+    check("pick: unit resolved from spoken name", str(item.get("unit_id")) == "3" and item.get("unit_explicit") is True)
+
+    # refine price via follow-up text
+    NLU_QUEUE.append({"intent": "update_draft", "confidence": 0.8, "patch": {
+        "items": [{"material_name": "میلگرد", "unit_price": 47000}]}})
+    await H.handle_update(ctx, text_update(6, "قیمت میلگرد ۴۷ شد"))
+    draft = await _active("quote")
+    check("refine: price updated", (draft.payload["items"][0]["unit_price"]) == 47000)
+
+    # commit via ✅
+    await H.handle_update(ctx, callback_update(7, f"q:ok:{draft.id[:8]}"))
+    check("commit: quote posted", len(api.created_quotes) == 1)
+    body = api.created_quotes[0]
+    check("commit: supplier id", body.get("supplier_id") == "sup-1")
+    check("commit: line item temp/refs", body["line_items"][0]["temp_id"] == "t1"
+          and body["item_termsheets"][0]["line_item_temp_id"] == "t1")
+    check("commit: price linked", body["item_termsheets"][0]["unit_price"] == 47000)
+    check("commit: termsheet carried", body["termsheets"][0]["label"] == "۳ فاز")
+    check("commit: report sent", "ثبت شد" in bale.last_text())
+    check("commit: draft committed", (await _active("quote")) is None)
+
+    # ---- add supplier ------------------------------------------------------
+    NLU_QUEUE.append({"intent": "add_supplier", "confidence": 0.9, "patch": {
+        "supplier": {"name": "پروفیل بر", "category_name": "لوله و اتصالات", "phone": "0912"}}})
+    await H.handle_update(ctx, text_update(8, "تأمین‌کننده جدید پروفیل بر دسته لوله و اتصالات تلفن 0912"))
+    draft = await _active("supplier")
+    check("supplier: draft created", draft is not None)
+    check("supplier: category resolved", draft.payload.get("category_id") == "cat-2")
+    await H.handle_update(ctx, callback_update(9, f"s:ok:{draft.id[:8]}"))
+    check("supplier: posted", api.created_suppliers and api.created_suppliers[0]["name"] == "پروفیل بر")
+    check("supplier: report", "تأمین‌کننده ثبت شد" in bale.last_text())
+
+    # ---- status query ------------------------------------------------------
+    NLU_QUEUE.append({"intent": "status_query", "confidence": 0.9,
+                      "patch": {"query": {"kind": "pending"}}})
+    await H.handle_update(ctx, text_update(10, "استعلام‌های در انتظار چیه؟"))
+    check("query: pending digest", "در انتظار بررسی" in bale.last_text() and "#q-aaaa11" in bale.last_text())
+
+    # ---- accept flow -------------------------------------------------------
+    NLU_QUEUE.append({"intent": "accept_quote", "confidence": 0.9,
+                      "patch": {"target": {"supplier_name": "سازان نو"}}})
+    await H.handle_update(ctx, text_update(11, "استعلام سازان نو را قبول کن"))
+    check("accept: summary shown", "پذیرش استعلام" in bale.last_text())
+    flow = ctx.pending.get(CHAT)
+    check("accept: pending flow", flow is not None and flow.kind == "accept")
+    await H.handle_update(ctx, callback_update(12, "ac:ok"))
+    check("accept: payload posted", len(api.accept_payloads) == 1)
+    payload = api.accept_payloads[0]["payload"]
+    check("accept: termsheet echoed with steps",
+          payload["accepted_termsheets"][0]["id"] == "ts-1" and payload["accepted_termsheets"][0]["schedule_steps"])
+    check("accept: decision price", payload["item_decisions"][0]["adjusted_unit_price"] == 45000)
+    check("accept: decision index", payload["item_decisions"][0]["accepted_termsheet_index"] == 0)
+    check("accept: report", "پذیرش انجام شد" in bale.last_text())
+
+    # ---- arrive flow -------------------------------------------------------
+    NLU_QUEUE.append({"intent": "arrive_items", "confidence": 0.9,
+                      "patch": {"target": {"supplier_name": "سازان نو"}}})
+    await H.handle_update(ctx, text_update(13, "اقلام سازان نو رسید"))
+    check("arrive: items shown", "اعلام رسیدن" in bale.last_text())
+    await H.handle_update(ctx, text_update(14, "۵۰۰ و ۲۰۰"))
+    flow = ctx.pending.get(CHAT)
+    check("arrive: quantities parsed", flow is not None and flow.kind == "arrive_confirm"
+          and flow.data["quantities"] == {"li-1": 500.0, "li-2": 200.0})
+    await H.handle_update(ctx, callback_update(15, "ar:ok"))
+    check("arrive: payload posted", len(api.arrive_payloads) == 1
+          and api.arrive_payloads[0]["payload"]["items"][0]["received_qty"] == 500)
+    check("arrive: report", "ثبت رسید انجام شد" in bale.last_text())
+
+    # ---- add material ------------------------------------------------------
+    NLU_QUEUE.append({"intent": "add_material", "confidence": 0.9,
+                      "patch": {"material": {"name": "میلگرد A3 سایز ۱۸", "unit_name": "کیلوگرم"}}})
+    await H.handle_update(ctx, text_update(16, "کالای جدید میلگرد A3 سایز ۱۸ با واحد کیلوگرم"))
+    draft = await _active("material")
+    check("material: draft created", draft is not None)
+    check("material: unit resolved", str(draft.payload.get("canonical_unit_id")) == "3")
+    await H.handle_update(ctx, callback_update(17, f"m:ok:{draft.id[:8]}"))
+    check("material: posted", api.created_materials
+          and api.created_materials[0]["canonical_unit_id"] == 3)
+
+    # ---- cancel / unknown --------------------------------------------------
+    NLU_QUEUE.append({"intent": "register_quote", "confidence": 0.9, "patch": {"supplier_name": "سازان نو"}})
+    await H.handle_update(ctx, text_update(18, "استعلام از سازان نو"))
+    await H.handle_update(ctx, text_update(19, "/cancel"))
+    check("cancel: draft dropped", (await _active("quote")) is None and "لغو شد" in bale.last_text())
+
+    NLU_QUEUE.append({"intent": "unknown", "confidence": 0.0, "patch": {}})
+    await H.handle_update(ctx, text_update(20, "اسپاگتی بپز"))
+    check("unknown: hint sent", "متوجه منظورت نشد" in bale.last_text())
+
+    print(f"\n{['FAILED', 'ALL PASSED'][int(_failed == 0)]}: {_passed} passed, {_failed} failed")
+    return 1 if _failed else 0
+
+
+async def _active(kind):
+    from app import drafts as draft_store
+    return await draft_store.get_active(CHAT, kind)
+
+
+def _first_callback(markup: dict | None, prefix: str) -> str | None:
+    for row in (markup or {}).get("inline_keyboard") or []:
+        for btn in row:
+            if btn.get("callback_data", "").startswith(prefix):
+                return btn["callback_data"]
+    return None
+
+
+if __name__ == "__main__":
+    sys.exit(asyncio.run(main()))

backend/app/auth.py

@@ -119,12 +119,10 @@ async def context_from_claims(claims: dict, db: AsyncSession) -> UserContext:
     if not casdoor_id:
         raise UnauthorizedError("توکن فاقد شناسه کاربر است", field="authorization")
 
-    username = str(claims.get("name") or claims.get("preferred_username") or "")
     user = await db.scalar(select(User).where(User.casdoor_id == casdoor_id))
     if user is None:
         user = User(
             casdoor_id=casdoor_id,
-            username=username or None,
             first_name=str(
                 claims.get("firstName")
                 or claims.get("firstname")
@@ -137,12 +135,9 @@ async def context_from_claims(claims: dict, db: AsyncSession) -> UserContext:
         )
         db.add(user)
         await db.flush()
-    elif username and not user.username:
-        user.username = username
-        await db.flush()
 
     project_ids: list = []
-    if user.role in ("supervisor", "pm"):
+    if user.role == "pm":
         projects = (
             await db.execute(
                 select(Project)
@@ -164,7 +159,7 @@ async def context_from_claims(claims: dict, db: AsyncSession) -> UserContext:
 
 
 async def pm_project_ids(db: AsyncSession, user: User) -> list:
-    """Every project id managed by the given PM/supervisor user (oldest first)."""
+    """Every project id managed by the given PM user (oldest first)."""
     rows = (
         await db.execute(
             select(Project.id)

backend/app/db/init_db.py

@@ -174,7 +174,7 @@ _V26_DDL = [
     """,
     """
     DO $$ BEGIN
-        CREATE TYPE user_role AS ENUM ('pm', 'procurement_manager', 'admin', 'supervisor');
+        CREATE TYPE user_role AS ENUM ('pm', 'procurement_manager', 'admin');
     EXCEPTION WHEN duplicate_object THEN NULL; END $$
     """,
     """
@@ -432,3 +432,37 @@ async def ensure_audit_table(engine: AsyncEngine) -> None:
         for stmt in indexes:
             await conn.execute(text(stmt))
     logger.info("audit_log table ensured")
+
+
+async def ensure_bot_drafts_table(engine: AsyncEngine) -> None:
+    """Ensure bot_drafts table and indexes exist for Bale bot quote sync."""
+    ddl = """
+    CREATE TABLE IF NOT EXISTS bot_drafts (
+        id                  UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        chat_id             BIGINT NOT NULL,
+        kind                VARCHAR(16) NOT NULL,
+        payload             JSONB NOT NULL DEFAULT '{}'::jsonb,
+        missing             JSONB,
+        status              VARCHAR(16) NOT NULL DEFAULT 'active',
+        source              VARCHAR(16),
+        source_message_id   BIGINT,
+        review_message_id   BIGINT,
+        last_bale_update_at TIMESTAMPTZ,
+        created_at          TIMESTAMPTZ NOT NULL DEFAULT now(),
+        updated_at          TIMESTAMPTZ NOT NULL DEFAULT now()
+    )
+    """
+    indexes = (
+        "CREATE INDEX IF NOT EXISTS ix_bot_drafts_chat_id ON bot_drafts(chat_id)",
+        "CREATE INDEX IF NOT EXISTS ix_bot_drafts_chat_status ON bot_drafts(chat_id, status)",
+        "ALTER TABLE bot_drafts ADD COLUMN IF NOT EXISTS last_bale_update_at TIMESTAMPTZ",
+        "ALTER TABLE bot_drafts ADD COLUMN IF NOT EXISTS source_message_id BIGINT",
+        "CREATE INDEX IF NOT EXISTS ix_bot_drafts_review_msg ON bot_drafts(review_message_id)",
+        "CREATE INDEX IF NOT EXISTS ix_bot_drafts_source_msg ON bot_drafts(source_message_id)",
+    )
+    async with engine.begin() as conn:
+        await conn.execute(text(ddl))
+        for stmt in indexes:
+            await conn.execute(text(stmt))
+    logger.info("bot_drafts table ensured")
+

backend/app/main.py

@@ -27,6 +27,7 @@ from app.db.engine import AsyncSessionLocal, engine
 from app.db.init_db import (
     ensure_attachment_table,
     ensure_audit_table,
+    ensure_bot_drafts_table,
     ensure_drop_category_tables,
     ensure_dashboard_tables,
     ensure_material_topic_column,
@@ -107,6 +108,7 @@ async def lifespan(_app: FastAPI):
     await ensure_v26(engine)
     await ensure_audit_table(engine)
     await ensure_drop_category_tables(engine)
+    await ensure_bot_drafts_table(engine)
     task = asyncio.create_task(_auto_expire_loop()) if settings.AUTO_EXPIRE_ENABLED else None
     try:
         yield
@@ -233,12 +235,15 @@ from app.routers.auth import router as _auth_router  # noqa: E402
 # attach an Authorization header to <iframe>/<img> loads, so the two file GET
 # routes accept a short-lived signed ?t= token as well as a Bearer session.
 from app.routers.files import router as _files_router  # noqa: E402
+from app.routers.drafts import router as _drafts_router  # noqa: E402
 
 for router in ROUTERS:
     if router is _auth_router:
         app.include_router(router, prefix=API_V1_PREFIX)
     elif router is _files_router:
         app.include_router(router, prefix=API_V1_PREFIX)
+    elif router is _drafts_router:
+        app.include_router(router, prefix=API_V1_PREFIX)
     else:
         app.include_router(router, prefix=API_V1_PREFIX, dependencies=[Depends(get_current_user)])
 

backend/app/models/draft.py

@@ -0,0 +1,21 @@
+from datetime import datetime
+from uuid import UUID
+from sqlalchemy import BigInteger, Column, DateTime, String, func
+from sqlalchemy.dialects.postgresql import JSONB, UUID as PG_UUID
+from app.db.base import Base
+
+class BotDraft(Base):
+    __tablename__ = "bot_drafts"
+
+    id = Column(PG_UUID(as_uuid=True), primary_key=True, server_default=func.gen_random_uuid())
+    chat_id = Column(BigInteger, nullable=False)
+    kind = Column(String(16), nullable=False)
+    payload = Column(JSONB, nullable=False, default=dict)
+    missing = Column(JSONB)
+    status = Column(String(16), nullable=False, default="active")
+    source = Column(String(16))
+    source_message_id = Column(BigInteger)
+    review_message_id = Column(BigInteger)
+    last_bale_update_at = Column(DateTime(timezone=True))
+    created_at = Column(DateTime(timezone=True), server_default=func.now())
+    updated_at = Column(DateTime(timezone=True), onupdate=func.now())

backend/app/models/procurement.py

@@ -26,7 +26,7 @@ from app.db.base import Base
 from app.models.catalog import Material, Unit, _timestamptz, _uuid_pk
 
 user_role_enum = Enum(
-    "pm", "procurement_manager", "admin", "supervisor",
+    "pm", "procurement_manager", "admin",
     name="user_role", native_enum=True,
 )
 quote_status_enum = Enum(
@@ -58,7 +58,6 @@ class User(Base):
 
     id: Mapped[uuid.UUID] = _uuid_pk()
     casdoor_id: Mapped[str] = mapped_column(Text, nullable=False, unique=True)
-    username: Mapped[str | None] = mapped_column(Text)
     first_name: Mapped[str] = mapped_column(Text, nullable=False)
     last_name: Mapped[str] = mapped_column(Text, nullable=False)
     phone: Mapped[str | None] = mapped_column(Text)
@@ -149,23 +148,12 @@ class Project(Base):
     id: Mapped[uuid.UUID] = _uuid_pk()
     name: Mapped[str] = mapped_column(Text, nullable=False)
     description: Mapped[str | None] = mapped_column(Text)
-    location: Mapped[str | None] = mapped_column(Text, server_default=text("''"))
-    project_manager: Mapped[str | None] = mapped_column(Text, server_default=text("''"))
     start_date: Mapped[date | None] = mapped_column(Date)
-    planned_start: Mapped[date | None] = mapped_column(Date)
-    planned_end: Mapped[date | None] = mapped_column(Date)
-    actual_start: Mapped[date | None] = mapped_column(Date)
-    actual_end: Mapped[date | None] = mapped_column(Date)
-    status: Mapped[str | None] = mapped_column(Text, server_default=text("'ACTIVE'"))
-    progress: Mapped[float | None] = mapped_column(Numeric(5, 2), server_default=text("0.0"))
     # v2.6: the single PM responsible for this project (confirms arrivals).
     pm_user_id: Mapped[uuid.UUID | None] = mapped_column(
         ForeignKey("users.id", ondelete="SET NULL")
     )
     created_at: Mapped[datetime] = _timestamptz()
-    updated_at: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), server_default=func.now(), onupdate=func.now()
-    )
 
 
 class Quote(Base):

backend/app/routers/__init__.py

@@ -4,6 +4,7 @@ from app.routers import (
     auth,
     brand_materials,
     brands,
+    drafts,
     files,
     inventory,
     item_decisions,
@@ -51,4 +52,5 @@ ROUTERS = [
     inventory.router,
     pm.router,
     users.router,
+    drafts.router,
 ]

backend/app/routers/attribute_definitions.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import AttributeDefinition, MaterialAttributeValue, Unit
 from app.models.procurement import LineItemSpec
@@ -14,7 +13,6 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/attribute-definitions", tags=["attribute-definitions"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 def attr_def_to_dict(ad: AttributeDefinition, unit: Unit | None = None) -> dict:
@@ -71,11 +69,7 @@ async def list_attribute_definitions(
 
 
 @router.post("", status_code=201)
-async def create_attribute_definition(
+async def create_attribute_definition(payload: AttributeDefinitionCreate, db: AsyncSession = Depends(get_db)):
-    payload: AttributeDefinitionCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     duplicate = await db.scalar(select(AttributeDefinition.id).where(AttributeDefinition.attribute_key == payload.attribute_key))
     if duplicate is not None:
         raise ConflictError("ویژگی با این attribute_key قبلاً ثبت شده است", field="attribute_key")
@@ -108,10 +102,7 @@ async def get_attribute_definition(
 
 @router.patch("/{definition_id}")
 async def update_attribute_definition(
-    definition_id,
+    definition_id, payload: AttributeDefinitionUpdate, db: AsyncSession = Depends(get_db)
-    payload: AttributeDefinitionUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     ad = await db.get(AttributeDefinition, definition_id)
     if ad is None:
@@ -145,11 +136,7 @@ async def update_attribute_definition(
 
 
 @router.delete("/{definition_id}")
-async def delete_attribute_definition(
+async def delete_attribute_definition(definition_id, db: AsyncSession = Depends(get_db)):
-    definition_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     ad = await db.get(AttributeDefinition, definition_id)
     if ad is None:
         raise NotFoundError("تعریف ویژگی یافت نشد")

backend/app/routers/auth.py

@@ -22,7 +22,7 @@ from app.config import settings
 from app.db.engine import get_db
 from app.routers.users import _user_projects, user_to_dict
 from app.services import analytics
-from app.utils.errors import ForbiddenError, ServiceUnavailableError, UnauthorizedError
+from app.utils.errors import ServiceUnavailableError, UnauthorizedError
 from app.utils.ratelimit import limiter
 
 logger = logging.getLogger("procurement.auth")
@@ -78,8 +78,6 @@ async def login(request: Request, payload: LoginRequest, db: AsyncSession = Depe
     claims = await _verify_token(access_token)
     ctx = await context_from_claims(claims, db)
     projects = await _user_projects(db, ctx.user)
-    if ctx.role == "supervisor" and not projects:
-        raise ForbiddenError("پروژه تخصیص داده نشده است — تا زمان تخصیص پروژه، اجازه ورود به سامانه را ندارید")
     await analytics.track(
         "login_success",
         {"username": payload.username, "role": ctx.role},

backend/app/routers/brand_materials.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import Brand, BrandMaterial, Material
 from app.models.procurement import LineItem
@@ -13,7 +12,6 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/brand-materials", tags=["brand-materials"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 def bm_to_dict(bm: BrandMaterial, expand: set[str] = frozenset()) -> dict:
@@ -72,11 +70,7 @@ async def list_brand_materials(
 
 
 @router.post("", status_code=201)
-async def create_brand_material(
+async def create_brand_material(payload: BrandMaterialCreate, db: AsyncSession = Depends(get_db)):
-    payload: BrandMaterialCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     if await db.get(Brand, payload.brand_id) is None:
         raise NotFoundError("برند یافت نشد", field="brand_id")
     if await db.get(Material, payload.material_id) is None:
@@ -113,12 +107,7 @@ async def get_brand_material(bm_id, expand: str | None = None, db: AsyncSession
 
 
 @router.patch("/{bm_id}")
-async def update_brand_material(
+async def update_brand_material(bm_id, payload: BrandMaterialUpdate, db: AsyncSession = Depends(get_db)):
-    bm_id,
-    payload: BrandMaterialUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     bm = await db.get(BrandMaterial, bm_id)
     if bm is None:
         raise NotFoundError("ارتباط برند-متریال یافت نشد")
@@ -131,11 +120,7 @@ async def update_brand_material(
 
 
 @router.delete("/{bm_id}")
-async def delete_brand_material(
+async def delete_brand_material(bm_id, db: AsyncSession = Depends(get_db)):
-    bm_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     bm = await db.get(BrandMaterial, bm_id)
     if bm is None:
         raise NotFoundError("ارتباط برند-متریال یافت نشد")

backend/app/routers/brands.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import Brand, BrandMaterial
 from app.schemas.catalog import BrandCreate, BrandUpdate
@@ -12,7 +11,6 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/brands", tags=["brands"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 def brand_to_dict(brand: Brand) -> dict:
@@ -44,11 +42,7 @@ async def list_brands(
 
 
 @router.post("", status_code=201)
-async def create_brand(
+async def create_brand(payload: BrandCreate, db: AsyncSession = Depends(get_db)):
-    payload: BrandCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     rows = (await db.execute(select(Brand).where(Brand.name == payload.name))).scalars().all()
     if any(b.country == payload.country for b in rows):
         raise ConflictError("برندی با این نام و کشور قبلاً ثبت شده است")
@@ -67,12 +61,7 @@ async def get_brand(brand_id, db: AsyncSession = Depends(get_db)):
 
 
 @router.patch("/{brand_id}")
-async def update_brand(
+async def update_brand(brand_id, payload: BrandUpdate, db: AsyncSession = Depends(get_db)):
-    brand_id,
-    payload: BrandUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     brand = await db.get(Brand, brand_id)
     if brand is None:
         raise NotFoundError("برند یافت نشد")
@@ -90,11 +79,7 @@ async def update_brand(
 
 
 @router.delete("/{brand_id}")
-async def delete_brand(
+async def delete_brand(brand_id, db: AsyncSession = Depends(get_db)):
-    brand_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     brand = await db.get(Brand, brand_id)
     if brand is None:
         raise NotFoundError("برند یافت نشد")

backend/app/routers/drafts.py

@@ -0,0 +1,106 @@
+"""Drafts router — exposes bot_drafts to frontend for Wizard pre-population and bi-directional sync."""
+from typing import Any
+from uuid import UUID
+from fastapi import APIRouter, Depends
+from pydantic import BaseModel
+from sqlalchemy import func, select, update
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.db.engine import get_db
+from app.models.draft import BotDraft
+from app.utils.errors import NotFoundError
+
+router = APIRouter(prefix="/drafts", tags=["drafts"])
+
+
+class DraftUpdateIn(BaseModel):
+    payload: dict[str, Any] | None = None
+    status: str | None = None
+
+
+class DraftCommitIn(BaseModel):
+    quote_id: str | None = None
+
+
+def _serialize_draft(draft: BotDraft) -> dict:
+    return {
+        "id": str(draft.id),
+        "chat_id": draft.chat_id,
+        "kind": draft.kind,
+        "status": draft.status,
+        "payload": draft.payload or {},
+        "missing": draft.missing or [],
+        "source": draft.source,
+        "review_message_id": draft.review_message_id,
+        "last_bale_update_at": draft.last_bale_update_at.isoformat() if draft.last_bale_update_at else None,
+        "created_at": draft.created_at.isoformat() if draft.created_at else None,
+        "updated_at": draft.updated_at.isoformat() if draft.updated_at else None,
+    }
+
+
+@router.get("/{draft_id}")
+async def get_draft(draft_id: UUID, db: AsyncSession = Depends(get_db)):
+    stmt = select(BotDraft).where(BotDraft.id == draft_id)
+    draft = (await db.execute(stmt)).scalar_one_or_none()
+    if not draft:
+        raise NotFoundError("پیش‌نویس استعلام یافت نشد")
+
+    return {"data": _serialize_draft(draft)}
+
+
+@router.patch("/{draft_id}")
+async def update_draft(draft_id: UUID, body: DraftUpdateIn, db: AsyncSession = Depends(get_db)):
+    stmt = select(BotDraft).where(BotDraft.id == draft_id)
+    draft = (await db.execute(stmt)).scalar_one_or_none()
+    if not draft:
+        raise NotFoundError("پیش‌نویس استعلام یافت نشد")
+
+    if body.payload is not None:
+        merged = dict(draft.payload or {})
+        merged.update(body.payload)
+        draft.payload = merged
+
+    if body.status is not None:
+        draft.status = body.status
+
+    draft.updated_at = func.now()
+    await db.commit()
+    await db.refresh(draft)
+
+    return {"data": _serialize_draft(draft)}
+
+
+@router.post("/{draft_id}/commit")
+async def commit_draft(draft_id: UUID, body: DraftCommitIn, db: AsyncSession = Depends(get_db)):
+    stmt = select(BotDraft).where(BotDraft.id == draft_id)
+    draft = (await db.execute(stmt)).scalar_one_or_none()
+    if not draft:
+        raise NotFoundError("پیش‌نویس استعلام یافت نشد")
+
+    draft.status = "committed"
+    payload = dict(draft.payload or {})
+    if body.quote_id:
+        payload["committed_quote_id"] = body.quote_id
+    draft.payload = payload
+    draft.updated_at = func.now()
+
+    await db.commit()
+    await db.refresh(draft)
+
+    return {"data": _serialize_draft(draft)}
+
+
+@router.post("/{draft_id}/cancel")
+async def cancel_draft(draft_id: UUID, db: AsyncSession = Depends(get_db)):
+    stmt = select(BotDraft).where(BotDraft.id == draft_id)
+    draft = (await db.execute(stmt)).scalar_one_or_none()
+    if not draft:
+        raise NotFoundError("پیش‌نویس استعلام یافت نشد")
+
+    draft.status = "cancelled"
+    draft.updated_at = func.now()
+
+    await db.commit()
+    await db.refresh(draft)
+
+    return {"data": _serialize_draft(draft)}

backend/app/routers/files.py

@@ -29,10 +29,9 @@ from app.utils.preview_token import make_preview_token, verify_preview_token
 
 router = APIRouter(prefix="/quotes", tags=["files"])
 
-# حذف و بارگذاری پیوست‌ها = عملیات تدارکات (ادمین / مدیر تدارکات)؛ دانلود
+# حذف پیوست‌ها = عملیات تدارکات (ادمین / مدیر تدارکات)؛ بارگذاری و دانلود
 # برای هر کاربر واردشده آزاد است.
 _attachment_deleter = require_role("procurement_manager", "admin")
-_attachment_writer = require_role("procurement_manager", "admin")
 
 ALLOWED_MIME_TYPES = {
     "image/png", "image/jpeg", "image/webp", "image/gif", "application/pdf",
@@ -126,7 +125,7 @@ async def _attachment_or_404(
 # Invoice — قابل بارگذاری در هر وضعیتی (از صفحه‌ی ویرایش)
 # ---------------------------------------------------------------------------
 
-@router.post("/{quote_id}/invoice", status_code=201, dependencies=[Depends(_attachment_writer)])
+@router.post("/{quote_id}/invoice", status_code=201, dependencies=[Depends(get_current_user)])
 async def upload_invoice(quote_id: uuid.UUID, file: UploadFile = File(...), db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     mime = _validate_upload(file)
@@ -209,7 +208,7 @@ async def delete_invoice(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: Asyn
 # Proforma — no status restriction
 # ---------------------------------------------------------------------------
 
-@router.post("/{quote_id}/proforma", status_code=201, dependencies=[Depends(_attachment_writer)])
+@router.post("/{quote_id}/proforma", status_code=201, dependencies=[Depends(get_current_user)])
 async def upload_proforma(quote_id: uuid.UUID, file: UploadFile = File(...), db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     mime = _validate_upload(file)

backend/app/routers/inventory.py

@@ -77,21 +77,23 @@ async def inventory_scope(
         if user is not None:
             if user.role is None:
                 raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
-            # مدیر تدارکات و مدیر پروژه: دسترسی کامل به پنل انبار، اما فقط‌خواندنی در تغییر موجودی
+            # v2.6: مدیر تدارکات = ادمین دفتر — دسترسی فقط‌خواندنی به پنل انبار.
-            if user.role in ("procurement_manager", "pm"):
+            if user.role == "procurement_manager":
-                return Scope(role="manager", project_id=project_id, actor=user.display_name)
+                return Scope(role="admin", project_id=project_id, actor=user.display_name)
-            if user.role == "supervisor":
+            if user.role not in ("pm", "admin"):
+                raise ValidationError("نقش نامعتبر است — فقط pm یا admin برای موجودی", field="role")
+            if user.role == "pm":
                 allowed = list(user.project_ids or [])
-                if not allowed:
-                    raise ForbiddenError("پروژه تخصیص داده نشده است")
                 if project_id is not None:
                     if project_id not in allowed:
                         raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
-                    return Scope(role="supervisor", project_id=project_id, actor=user.display_name)
+                    return Scope(role="pm", project_id=project_id, actor=user.display_name)
-                return Scope(role="supervisor", project_id=allowed[0], actor=user.display_name)
+                if not allowed:
-            if user.role == "admin":
+                    raise ValidationError(
-                return Scope(role="admin", project_id=project_id, actor=user.display_name)
+                        "کاربر PM به هیچ پروژه‌ای متصل نیست (projects.pm_user_id)", field="project_id"
-            raise ValidationError("نقش نامعتبر است", field="role")
+                    )
+                return Scope(role="pm", project_id=allowed[0], actor=user.display_name)
+            return Scope(role="admin", project_id=project_id, actor=user.display_name)
 
     # Dev fallback: header-based identity (fork's placeholder mode) — only
     # when DEV_LOGIN_ENABLED is explicitly turned on (local testing without
@@ -126,9 +128,9 @@ async def inventory_scope(
     return Scope(role=role, project_id=project_id, actor=actor)
 
 
-def _require_inventory_modifier(scope: Scope) -> None:
+def _require_pm(scope: Scope) -> None:
-    if scope.role not in (ROLE_ADMIN, "admin", "supervisor", ROLE_PM):
+    if scope.role != ROLE_PM:
-        raise ForbiddenError("مدیر تدارکات و مدیر پروژه امکان تغییر موجودی انبار را ندارند — فقط سرپرست پروژه و ادمین مجاز هستند")
+        raise ForbiddenError("دسترسی ادمین فقط خواندنی است — ثبت/تغییر موجودی مجاز نیست")
 
 
 # ---------------------------------------------------------------------------
@@ -213,8 +215,8 @@ async def list_warehouses(
     db: AsyncSession = Depends(get_db),
 ):
     stmt = select(Warehouse)
-    if scope.role in (ROLE_PM, "supervisor"):
+    if scope.role == ROLE_PM:
-        stmt = stmt.where(Warehouse.project_id == scope.project_id)  # force PM / supervisor scope
+        stmt = stmt.where(Warehouse.project_id == scope.project_id)  # force PM scope
     elif project_id is not None:
         stmt = stmt.where(Warehouse.project_id == project_id)
     stmt = stmt.order_by(Warehouse.name)
@@ -321,7 +323,7 @@ async def list_inventory(
     db: AsyncSession = Depends(get_db),
 ):
     stmt = select(InventoryItem)
-    if scope.role in (ROLE_PM, "supervisor"):
+    if scope.role == ROLE_PM:
         stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
             Warehouse.project_id == scope.project_id
         )
@@ -386,7 +388,7 @@ async def list_transactions(
     stmt = select(InventoryTransaction).join(
         InventoryItem, InventoryItem.id == InventoryTransaction.inventory_id
     ).join(Warehouse, Warehouse.id == InventoryItem.warehouse_id)
-    if scope.role in (ROLE_PM, "supervisor"):
+    if scope.role == ROLE_PM:
         stmt = stmt.where(Warehouse.project_id == scope.project_id)
     elif project_id is not None:
         stmt = stmt.where(Warehouse.project_id == project_id)
@@ -452,7 +454,7 @@ async def inventory_history(
     if item is None:
         raise NotFoundError("موجودی یافت نشد")
     wh = await get_warehouse_or_404(db, item.warehouse_id)
-    if scope.role in (ROLE_PM, "supervisor") and wh.project_id != scope.project_id:
+    if scope.role == ROLE_PM and wh.project_id != scope.project_id:
         raise ForbiddenError("این موجودی متعلق به پروژه شما نیست")
     txs = (await db.execute(
         select(InventoryTransaction)
@@ -472,17 +474,17 @@ async def create_transaction(
     scope: Scope = Depends(inventory_scope),
     db: AsyncSession = Depends(get_db),
 ):
-    _require_inventory_modifier(scope)
+    _require_pm(scope)
     # No explicit db.begin(): the session may already be inside an implicit
     # transaction (inventory_scope read from it in the JWT path); get_db
     # commits on success / rolls back on failure.
     with nullcontext():
         wh = await get_warehouse_or_404(db, payload.warehouse_id)
-        if scope.project_id is not None and wh.project_id != scope.project_id:
+        if wh.project_id != scope.project_id:
             raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
         if payload.dest_warehouse_id is not None:
             dest = await get_warehouse_or_404(db, payload.dest_warehouse_id)
-            if scope.project_id is not None and dest.project_id != scope.project_id:
+            if dest.project_id != scope.project_id:
                 raise ForbiddenError("انبار مقصد متعلق به پروژه شما نیست")
         txs = await apply_transaction(db, payload, performed_by=scope.actor)
         await audit_record(

backend/app/routers/item_receipts.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.procurement import ItemDecision, ItemReceipt, LineItem
 from app.schemas.procurement import ReceiptCreate, ReceiptUpdate
@@ -15,7 +14,6 @@ router = APIRouter(
     prefix="/quotes/{quote_id}/line-items/{line_item_id}/receipt",
     tags=["item-receipts"],
 )
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 async def _line_item_or_404(db: AsyncSession, quote_id, line_item_id) -> LineItem:
@@ -47,13 +45,7 @@ async def get_receipt(quote_id, line_item_id, db: AsyncSession = Depends(get_db)
 
 
 @router.post("", status_code=201)
-async def create_receipt(
+async def create_receipt(quote_id, line_item_id, payload: ReceiptCreate, db: AsyncSession = Depends(get_db)):
-    quote_id,
-    line_item_id,
-    payload: ReceiptCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     await _line_item_or_404(db, quote_id, line_item_id)
     decision = await _decision_or_404(db, line_item_id)
     existing = await db.scalar(select(ItemReceipt).where(ItemReceipt.item_decision_id == decision.id))
@@ -73,13 +65,7 @@ async def create_receipt(
 
 
 @router.patch("")
-async def update_receipt(
+async def update_receipt(quote_id, line_item_id, payload: ReceiptUpdate, db: AsyncSession = Depends(get_db)):
-    quote_id,
-    line_item_id,
-    payload: ReceiptUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     await _line_item_or_404(db, quote_id, line_item_id)
     decision = await db.scalar(select(ItemDecision).where(ItemDecision.line_item_id == line_item_id))
     if decision is None:

backend/app/routers/item_termsheets.py

@@ -7,7 +7,6 @@ from fastapi import APIRouter, Depends
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.procurement import (
     ItemDecision,
@@ -24,7 +23,6 @@ router = APIRouter(
     prefix="/quotes/{quote_id}/line-items/{line_item_id}/termsheets",
     tags=["item-termsheets"],
 )
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 async def _line_item_or_404(db: AsyncSession, quote_id, line_item_id) -> LineItem:
@@ -60,11 +58,7 @@ async def list_item_termsheets(quote_id, line_item_id, db: AsyncSession = Depend
 
 @router.post("", status_code=201)
 async def create_item_termsheet(
-    quote_id,
+    quote_id, line_item_id, payload: ItemTermsheetCreate, db: AsyncSession = Depends(get_db)
-    line_item_id,
-    payload: ItemTermsheetCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     async with db.begin():
         li = await _line_item_or_404(db, quote_id, line_item_id)
@@ -99,12 +93,7 @@ async def create_item_termsheet(
 
 @router.patch("/{item_termsheet_id}")
 async def update_item_termsheet(
-    quote_id,
+    quote_id, line_item_id, item_termsheet_id, payload: ItemTermsheetUpdate, db: AsyncSession = Depends(get_db)
-    line_item_id,
-    item_termsheet_id,
-    payload: ItemTermsheetUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     li = await _line_item_or_404(db, quote_id, line_item_id)
     quote = await db.get(Quote, quote_id)
@@ -125,11 +114,7 @@ async def update_item_termsheet(
 
 @router.delete("/{item_termsheet_id}")
 async def delete_item_termsheet(
-    quote_id,
+    quote_id, line_item_id, item_termsheet_id, db: AsyncSession = Depends(get_db)
-    line_item_id,
-    item_termsheet_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     it = await db.scalar(
         select(ItemTermsheet).where(ItemTermsheet.id == item_termsheet_id, ItemTermsheet.line_item_id == line_item_id)

backend/app/routers/line_item_specs.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import AttributeDefinition, Unit
 from app.models.procurement import LineItem, LineItemSpec, Quote
@@ -13,7 +12,6 @@ from app.services.eav_service import flatten_eav_values
 from app.utils.errors import ConflictError, NotFoundError
 
 router = APIRouter(prefix="/quotes/{quote_id}/line-items/{line_item_id}/specs", tags=["line-item-specs"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 async def _line_item_or_404(db: AsyncSession, quote_id, line_item_id) -> LineItem:
@@ -55,13 +53,7 @@ async def get_line_item_specs(quote_id, line_item_id, db: AsyncSession = Depends
 
 
 @router.put("")
-async def put_line_item_specs(
+async def put_line_item_specs(quote_id, line_item_id, payload: SpecsPutIn, db: AsyncSession = Depends(get_db)):
-    quote_id,
-    line_item_id,
-    payload: SpecsPutIn,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     """FULL replacement — specs not in the payload are DELETED (P1-19)."""
     async with db.begin():
         li = await _line_item_or_404(db, quote_id, line_item_id)

backend/app/routers/line_items.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import Material, Unit
 from app.models.procurement import ItemDecision, LineItem, Quote
@@ -15,7 +14,6 @@ from app.utils.errors import ConflictError, NotFoundError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/quotes/{quote_id}/line-items", tags=["line-items"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 async def _quote_or_404(db: AsyncSession, quote_id) -> Quote:
@@ -52,12 +50,7 @@ async def list_line_items(
 
 
 @router.post("", status_code=201)
-async def create_line_item(
+async def create_line_item(quote_id, payload: LineItemCreate, db: AsyncSession = Depends(get_db)):
-    quote_id,
-    payload: LineItemCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     async with db.begin():
         quote = await _quote_or_404(db, quote_id)
         if quote.status != "offered":
@@ -96,11 +89,7 @@ async def get_line_item(
 
 @router.patch("/{line_item_id}")
 async def update_line_item(
-    quote_id,
+    quote_id, line_item_id, payload: LineItemUpdate, db: AsyncSession = Depends(get_db)
-    line_item_id,
-    payload: LineItemUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     li = await _line_item_or_404(db, quote_id, line_item_id)
     quote = await _quote_or_404(db, quote_id)
@@ -142,12 +131,7 @@ async def update_line_item(
 
 
 @router.delete("/{line_item_id}")
-async def delete_line_item(
+async def delete_line_item(quote_id, line_item_id, db: AsyncSession = Depends(get_db)):
-    quote_id,
-    line_item_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     li = await _line_item_or_404(db, quote_id, line_item_id)
     quote = await _quote_or_404(db, quote_id)
     if quote.status != "offered":

backend/app/routers/material_categories.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import MaterialCategory
 from app.models.procurement import Supplier
@@ -13,7 +12,6 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/material-categories", tags=["material-categories"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 def category_to_dict(category: MaterialCategory) -> dict:
@@ -48,11 +46,7 @@ async def list_categories(
 
 
 @router.post("", status_code=201)
-async def create_category(
+async def create_category(payload: MaterialCategoryCreate, db: AsyncSession = Depends(get_db)):
-    payload: MaterialCategoryCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     duplicate = await db.scalar(select(MaterialCategory.id).where(MaterialCategory.slug == payload.slug))
     if duplicate is not None:
         raise ConflictError("دسته‌بندی با این slug قبلاً ثبت شده است", field="slug")
@@ -76,12 +70,7 @@ async def get_category(category_id, db: AsyncSession = Depends(get_db)):
 
 
 @router.patch("/{category_id}")
-async def update_category(
+async def update_category(category_id, payload: MaterialCategoryUpdate, db: AsyncSession = Depends(get_db)):
-    category_id,
-    payload: MaterialCategoryUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     category = await db.get(MaterialCategory, category_id)
     if category is None:
         raise NotFoundError("دسته‌بندی یافت نشد")
@@ -103,11 +92,7 @@ async def update_category(
 
 
 @router.delete("/{category_id}")
-async def delete_category(
+async def delete_category(category_id, db: AsyncSession = Depends(get_db)):
-    category_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     category = await db.get(MaterialCategory, category_id)
     if category is None:
         raise NotFoundError("دسته‌بندی یافت نشد")

backend/app/routers/materials.py

@@ -9,7 +9,6 @@ from fastapi import APIRouter, Depends, Query, Request
 from sqlalchemy import exists, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import (
     AttributeDefinition,
@@ -39,7 +38,6 @@ from app.utils.errors import ConflictError, NotFoundError, ValidationError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/materials", tags=["materials"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 def _coerce_filter_value(data_type: str, raw: str):
@@ -127,10 +125,7 @@ async def list_materials(
 
 @router.post("", status_code=201)
 async def create_material(
-    payload: MaterialCreate,
+    payload: MaterialCreate, expand: str | None = None, db: AsyncSession = Depends(get_db)
-    expand: str | None = None,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     material = await material_service.create_material(db, payload)
     return {"data": await serialize_material(db, material, parse_expand(expand))}
@@ -145,12 +140,7 @@ async def get_material(material_id, expand: str | None = None, db: AsyncSession
 
 
 @router.patch("/{material_id}")
-async def update_material(
+async def update_material(material_id, payload: MaterialUpdate, db: AsyncSession = Depends(get_db)):
-    material_id,
-    payload: MaterialUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     material = await db.get(Material, material_id)
     if material is None:
         raise NotFoundError("متریال یافت نشد")
@@ -159,11 +149,7 @@ async def update_material(
 
 
 @router.delete("/{material_id}")
-async def delete_material(
+async def delete_material(material_id, db: AsyncSession = Depends(get_db)):
-    material_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     material = await db.get(Material, material_id)
     if material is None:
         raise NotFoundError("متریال یافت نشد")
@@ -262,10 +248,7 @@ async def list_material_units(
 
 @router.post("/{material_id}/units", status_code=201)
 async def create_material_unit(
-    material_id,
+    material_id, payload: MaterialUnitCreate, db: AsyncSession = Depends(get_db)
-    payload: MaterialUnitCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     async with db.begin():
         await _material_or_404(db, material_id)
@@ -304,11 +287,7 @@ async def create_material_unit(
 
 @router.patch("/{material_id}/units/{mu_id}")
 async def update_material_unit(
-    material_id,
+    material_id, mu_id, payload: MaterialUnitUpdate, db: AsyncSession = Depends(get_db)
-    mu_id,
-    payload: MaterialUnitUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     async with db.begin():
         mu = await db.scalar(
@@ -340,12 +319,7 @@ async def update_material_unit(
 
 
 @router.delete("/{material_id}/units/{mu_id}")
-async def delete_material_unit(
+async def delete_material_unit(material_id, mu_id, db: AsyncSession = Depends(get_db)):
-    material_id,
-    mu_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     mu = await db.scalar(
         select(MaterialUnit).where(MaterialUnit.id == mu_id, MaterialUnit.material_id == material_id)
     )
@@ -391,10 +365,7 @@ async def get_material_attribute_values(
 
 @router.put("/{material_id}/attribute-values")
 async def put_material_attribute_values(
-    material_id,
+    material_id, payload: MaterialAttributeValuesPut, db: AsyncSession = Depends(get_db)
-    payload: MaterialAttributeValuesPut,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     """FULL replacement of a material's EAV values (empty array deletes all)."""
     async with db.begin():

backend/app/routers/projects.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query, Request
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import UserContext, get_optional_user, require_role
+from app.auth import UserContext, get_optional_user
 from app.db.engine import get_db
 from app.models.procurement import Project, Quote, User
 from app.schemas.procurement import ProjectCreate, ProjectUpdate
@@ -13,7 +13,6 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_date, to_iso
 
 router = APIRouter(prefix="/projects", tags=["projects"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 async def _optional_ctx(request: Request, db: AsyncSession = Depends(get_db)) -> UserContext | None:
@@ -34,12 +33,8 @@ async def project_to_dict(db: AsyncSession, project: Project) -> dict:
     d = {
         "id": str(project.id),
         "name": project.name,
-        "location": project.location or "",
+        "description": project.description,
-        "project_manager": project.project_manager or "",
-        "description": project.description or "",
         "start_date": to_date(project.start_date),
-        "status": project.status or "ACTIVE",
-        "progress": float(project.progress) if project.progress is not None else 0.0,
         "pm_user_id": str(project.pm_user_id) if project.pm_user_id else None,
         "created_at": to_iso(project.created_at),
     }
@@ -47,8 +42,6 @@ async def project_to_dict(db: AsyncSession, project: Project) -> dict:
         pm = await db.get(User, project.pm_user_id)
         if pm:
             d["pm_name"] = f"{pm.first_name} {pm.last_name}".strip() or pm.casdoor_id
-    elif project.project_manager:
-        d["pm_name"] = project.project_manager
     return d
 
 
@@ -62,14 +55,7 @@ async def list_projects(
 ):
     stmt = select(Project)
     if q:
-        stmt = stmt.where(
+        stmt = stmt.where(or_(Project.name.ilike(f"%{q}%"), Project.description.ilike(f"%{q}%")))
-            or_(
-                Project.name.ilike(f"%{q}%"),
-                Project.description.ilike(f"%{q}%"),
-                Project.location.ilike(f"%{q}%"),
-                Project.project_manager.ilike(f"%{q}%"),
-            )
-        )
     stmt = sort_query(stmt, Project, sort)
     items, meta = await paginate(stmt, page, page_size, db)
     pm_map = await _pm_map(db, items)
@@ -78,38 +64,24 @@ async def list_projects(
         d = {
             "id": str(p.id),
             "name": p.name,
-            "location": p.location or "",
+            "description": p.description,
-            "project_manager": p.project_manager or "",
-            "description": p.description or "",
             "start_date": to_date(p.start_date),
-            "status": p.status or "ACTIVE",
-            "progress": float(p.progress) if p.progress is not None else 0.0,
             "pm_user_id": str(p.pm_user_id) if p.pm_user_id else None,
             "created_at": to_iso(p.created_at),
         }
         pm = pm_map.get(p.pm_user_id)
         if pm:
             d["pm_name"] = f"{pm.first_name} {pm.last_name}".strip() or pm.casdoor_id
-        elif p.project_manager:
-            d["pm_name"] = p.project_manager
         data.append(d)
     return {"data": data, "meta": meta}
 
 
 @router.post("", status_code=201)
-async def create_project(
+async def create_project(payload: ProjectCreate, db: AsyncSession = Depends(get_db)):
-    payload: ProjectCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     project = Project(
-        name=payload.name.strip(),
+        name=payload.name,
-        location=payload.location.strip() if payload.location else "",
+        description=payload.description,
-        project_manager=payload.project_manager.strip() if payload.project_manager else "",
-        description=payload.description.strip() if payload.description else "",
         start_date=payload.start_date,
-        planned_start=payload.start_date,
-        status="ACTIVE",
     )
     db.add(project)
     await db.flush()
@@ -131,51 +103,37 @@ async def update_project(
     request: Request,
     ctx: UserContext | None = Depends(_optional_ctx),
     db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     project = await db.get(Project, project_id)
     if project is None:
         raise NotFoundError("پروژه یافت نشد")
     if payload.name is not None:
-        project.name = payload.name.strip()
+        project.name = payload.name
-    if payload.location is not None:
-        project.location = payload.location.strip()
-    if payload.project_manager is not None:
-        project.project_manager = payload.project_manager.strip()
     if payload.description is not None:
-        project.description = payload.description.strip()
+        project.description = payload.description
     if payload.start_date is not None:
         project.start_date = payload.start_date
-        project.planned_start = payload.start_date
-    if payload.status is not None:
-        project.status = payload.status
     # PM assignment (1:N): one PM per project, a PM may own many projects.
     # Admin / procurement manager only (same rule as the Organization panel).
     if "pm_user_id" in payload.model_fields_set:
         role = ctx.role if ctx else (request.headers.get("x-user-role") or "").strip().lower()
-        if role not in ("admin", "procurement_manager", "pm"):
+        if role not in ("admin", "procurement_manager"):
-            raise ForbiddenError("تعیین سرپرست پروژه فقط برای مدیر تدارکات، مدیر پروژه و ادمین مجاز است")
+            raise ForbiddenError("تعیین مدیر پروژه فقط برای ادمین / مدیر تدارکات مجاز است")
         if payload.pm_user_id is None:
             project.pm_user_id = None
         else:
             pm_user = await db.get(User, payload.pm_user_id)
             if pm_user is None:
                 raise NotFoundError("کاربر یافت نشد", field="pm_user_id")
-            if pm_user.role not in ("supervisor", "pm"):
+            if pm_user.role != "pm":
-                raise ValidationError("ابتدا نقش این کاربر را «سرپرست پروژه» کنید", field="pm_user_id")
+                raise ValidationError("ابتدا نقش این کاربر را «مدیر پروژه» کنید", field="pm_user_id")
             project.pm_user_id = pm_user.id
-            if not project.project_manager:
-                project.project_manager = f"{pm_user.first_name} {pm_user.last_name}".strip()
     await db.flush()
     return {"data": await project_to_dict(db, project)}
 
 
 @router.delete("/{project_id}")
-async def delete_project(
+async def delete_project(project_id, db: AsyncSession = Depends(get_db)):
-    project_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     project = await db.get(Project, project_id)
     if project is None:
         raise NotFoundError("پروژه یافت نشد")

backend/app/routers/quote_events.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.procurement import Quote, QuoteEvent
 from app.schemas.procurement import NoteEventIn
@@ -12,7 +11,6 @@ from app.utils.errors import NotFoundError, ValidationError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/quotes/{quote_id}/events", tags=["quote-events"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 @router.get("")
@@ -36,12 +34,7 @@ async def list_events(
 
 
 @router.post("", status_code=201)
-async def create_event(
+async def create_event(quote_id, payload: NoteEventIn, db: AsyncSession = Depends(get_db)):
-    quote_id,
-    payload: NoteEventIn,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     quote = await db.get(Quote, quote_id)
     if quote is None:
         raise NotFoundError("پیشنهاد (استعلام) یافت نشد")

backend/app/routers/quotes.py

@@ -8,7 +8,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import exists, func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import Material
 from app.models.procurement import (
@@ -43,9 +42,6 @@ from app.utils.security import get_actor
 
 router = APIRouter(prefix="/quotes", tags=["quotes"])
 
-# عملیات نوشتنی تدارکات — فقط ادمین و مدیر تدارکات (مدیر پروژه فقط خواندن دارد)
-_procurement_writer = require_role("admin", "procurement_manager")
-
 
 # --- list filter helpers ---------------------------------------------------
 
@@ -160,12 +156,7 @@ async def get_quote(quote_id, expand: str | None = None, db: AsyncSession = Depe
 # ---------------------------------------------------------------------------
 
 @router.post("", status_code=201)
-async def create_quote(
+async def create_quote(payload: QuoteCreate, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)):
-    payload: QuoteCreate,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
-):
     quote = await quote_service.create_quote(db, payload, actor)
     return {"data": await serialize_quote_with_children(db, quote)}
 
@@ -176,11 +167,7 @@ async def create_quote(
 
 @router.patch("/{quote_id}")
 async def update_quote(
-    quote_id,
+    quote_id, payload: QuoteUpdate, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
-    payload: QuoteUpdate,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
 ):
     quote = await quote_service.update_quote(db, quote_id, payload, actor)
     return {"data": await serialize_quote(db, quote, set())}
@@ -188,11 +175,7 @@ async def update_quote(
 
 @router.patch("/{quote_id}/children")
 async def replace_quote_children(
-    quote_id,
+    quote_id, payload: QuoteChildrenReplaceIn, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
-    payload: QuoteChildrenReplaceIn,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
 ):
     """Full replacement of a quote's line items + termsheets (edit modal)."""
     quote = await quote_service.replace_quote_children(db, quote_id, payload, actor)
@@ -205,11 +188,7 @@ async def replace_quote_children(
 
 @router.patch("/{quote_id}/accept")
 async def accept_quote(
-    quote_id,
+    quote_id, payload: AcceptQuoteIn, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
-    payload: AcceptQuoteIn,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
 ):
     quote = await quote_service.accept_quote(db, quote_id, payload, actor)
     return {"data": await _accept_response(db, quote)}
@@ -245,12 +224,7 @@ async def _accept_response(db: AsyncSession, quote: Quote) -> dict:
 
 
 @router.patch("/{quote_id}/arrive")
-async def arrive_quote(
+async def arrive_quote(quote_id, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)):
-    quote_id,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
-):
     quote = await quote_service.arrive_quote(db, quote_id, actor)
     return {
         "data": {
@@ -263,11 +237,7 @@ async def arrive_quote(
 
 @router.patch("/{quote_id}/arrive-items")
 async def arrive_items(
-    quote_id,
+    quote_id, payload: ArriveItemsIn, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
-    payload: ArriveItemsIn,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
 ):
     quote = await quote_service.arrive_items(db, quote_id, payload, actor)
     return {
@@ -289,23 +259,14 @@ async def arrive_items(
 
 @router.patch("/{quote_id}/reject")
 async def reject_quote(
-    quote_id,
+    quote_id, payload: RejectQuoteIn | None = None, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
-    payload: RejectQuoteIn | None = None,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
 ):
     quote = await quote_service.reject_quote(db, quote_id, payload or RejectQuoteIn(), actor)
     return {"data": {"id": str(quote.id), "status": quote.status}}
 
 
 @router.patch("/{quote_id}/expire")
-async def expire_quote(
+async def expire_quote(quote_id, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)):
-    quote_id,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
-):
     quote = await quote_service.expire_quote(db, quote_id, actor)
     return {"data": {"id": str(quote.id), "status": quote.status}}
 
@@ -315,10 +276,6 @@ async def expire_quote(
 # ---------------------------------------------------------------------------
 
 @router.delete("/{quote_id}")
-async def delete_quote(
+async def delete_quote(quote_id, db: AsyncSession = Depends(get_db)):
-    quote_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     result = await quote_service.delete_quote(db, quote_id)
     return {"data": result}

backend/app/routers/schedule_steps.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.procurement import Termsheet, TermsheetScheduleStep
 from app.schemas.procurement import ScheduleStepCreate, ScheduleStepUpdate
@@ -16,7 +15,6 @@ router = APIRouter(
     prefix="/quotes/{quote_id}/termsheets/{termsheet_id}/schedule-steps",
     tags=["schedule-steps"],
 )
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 async def _termsheet_or_404(db: AsyncSession, quote_id, termsheet_id) -> Termsheet:
@@ -59,11 +57,7 @@ async def list_schedule_steps(
 
 @router.post("", status_code=201)
 async def create_schedule_step(
-    quote_id,
+    quote_id, termsheet_id, payload: ScheduleStepCreate, db: AsyncSession = Depends(get_db)
-    termsheet_id,
-    payload: ScheduleStepCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     ts = await _termsheet_or_404(db, quote_id, termsheet_id)
     step_no = payload.step_no
@@ -90,12 +84,7 @@ async def create_schedule_step(
 
 @router.patch("/{step_id}")
 async def update_schedule_step(
-    quote_id,
+    quote_id, termsheet_id, step_id, payload: ScheduleStepUpdate, db: AsyncSession = Depends(get_db)
-    termsheet_id,
-    step_id,
-    payload: ScheduleStepUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     step = await _step_or_404(db, termsheet_id, step_id)
     if payload.step_no is not None and payload.step_no != step.step_no:
@@ -120,13 +109,7 @@ async def update_schedule_step(
 
 
 @router.delete("/{step_id}")
-async def delete_schedule_step(
+async def delete_schedule_step(quote_id, termsheet_id, step_id, db: AsyncSession = Depends(get_db)):
-    quote_id,
-    termsheet_id,
-    step_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     step = await _step_or_404(db, termsheet_id, step_id)
     count = await db.scalar(
         select(func.count()).select_from(TermsheetScheduleStep).where(

backend/app/routers/standard_conversions.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import StandardConversion
 from app.schemas.catalog import StandardConversionCreate, StandardConversionUpdate
@@ -12,7 +11,6 @@ from app.utils.pagination import paginate
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/standard-conversions", tags=["standard-conversions"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 def sc_to_dict(sc: StandardConversion) -> dict:
@@ -43,11 +41,7 @@ async def list_standard_conversions(
 
 
 @router.post("", status_code=201)
-async def create_standard_conversion(
+async def create_standard_conversion(payload: StandardConversionCreate, db: AsyncSession = Depends(get_db)):
-    payload: StandardConversionCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     duplicate = await db.scalar(
         select(StandardConversion.id).where(
             StandardConversion.from_unit == payload.from_unit,
@@ -73,12 +67,7 @@ async def get_standard_conversion(sc_id, db: AsyncSession = Depends(get_db)):
 
 
 @router.patch("/{sc_id}")
-async def update_standard_conversion(
+async def update_standard_conversion(sc_id, payload: StandardConversionUpdate, db: AsyncSession = Depends(get_db)):
-    sc_id,
-    payload: StandardConversionUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     sc = await db.get(StandardConversion, sc_id)
     if sc is None:
         raise NotFoundError("تبدیل استاندارد یافت نشد")
@@ -105,11 +94,7 @@ async def update_standard_conversion(
 
 
 @router.delete("/{sc_id}")
-async def delete_standard_conversion(
+async def delete_standard_conversion(sc_id, db: AsyncSession = Depends(get_db)):
-    sc_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     sc = await db.get(StandardConversion, sc_id)
     if sc is None:
         raise NotFoundError("تبدیل استاندارد یافت نشد")

backend/app/routers/supplier_materials.py

@@ -8,7 +8,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import Material, MaterialCategory
 from app.models.procurement import Supplier, SupplierMaterial
@@ -19,7 +18,6 @@ from app.utils.pagination import paginate
 from app.utils.serialization import to_iso
 
 router = APIRouter(tags=["supplier-materials"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 def link_to_dict(link: SupplierMaterial, material: Material | None = None,
@@ -65,10 +63,7 @@ async def list_supplier_materials(
 
 @router.post("/suppliers/{supplier_id}/materials", status_code=201)
 async def create_supplier_material(
-    supplier_id,
+    supplier_id, payload: SupplierMaterialCreate, db: AsyncSession = Depends(get_db)
-    payload: SupplierMaterialCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     async with db.begin():
         link = await link_supplier_material(db, supplier_id, payload.material_id)
@@ -77,12 +72,7 @@ async def create_supplier_material(
 
 
 @router.delete("/suppliers/{supplier_id}/materials/{material_id}")
-async def delete_supplier_material(
+async def delete_supplier_material(supplier_id, material_id, db: AsyncSession = Depends(get_db)):
-    supplier_id,
-    material_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     async with db.begin():
         await unlink_supplier_material(db, supplier_id, material_id)
     return {"data": {"supplier_id": str(supplier_id), "material_id": str(material_id), "deleted": True}}

backend/app/routers/suppliers.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import MaterialCategory
 from app.models.procurement import Quote, Supplier
@@ -13,7 +12,6 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/suppliers", tags=["suppliers"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 def supplier_to_dict(supplier: Supplier, category: MaterialCategory | None = None) -> dict:
@@ -73,11 +71,7 @@ async def list_suppliers(
 
 
 @router.post("", status_code=201)
-async def create_supplier(
+async def create_supplier(payload: SupplierCreate, db: AsyncSession = Depends(get_db)):
-    payload: SupplierCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     category = await _category_or_404(db, payload.category_id)
     supplier = Supplier(
         name=payload.name,
@@ -102,12 +96,7 @@ async def get_supplier(supplier_id, db: AsyncSession = Depends(get_db)):
 
 
 @router.patch("/{supplier_id}")
-async def update_supplier(
+async def update_supplier(supplier_id, payload: SupplierUpdate, db: AsyncSession = Depends(get_db)):
-    supplier_id,
-    payload: SupplierUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     supplier = await db.get(Supplier, supplier_id)
     if supplier is None:
         raise NotFoundError("تأمین‌کننده یافت نشد")
@@ -131,11 +120,7 @@ async def update_supplier(
 
 
 @router.delete("/{supplier_id}")
-async def delete_supplier(
+async def delete_supplier(supplier_id, db: AsyncSession = Depends(get_db)):
-    supplier_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     supplier = await db.get(Supplier, supplier_id)
     if supplier is None:
         raise NotFoundError("تأمین‌کننده یافت نشد")

backend/app/routers/termsheets.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.procurement import (
     ItemDecision,
@@ -27,7 +26,6 @@ from app.utils.errors import ConflictError, NotFoundError, ValidationError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/quotes/{quote_id}/termsheets", tags=["termsheets"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 async def _quote_or_404(db: AsyncSession, quote_id) -> Quote:
@@ -82,12 +80,7 @@ async def list_termsheets(
 
 
 @router.post("", status_code=201)
-async def create_termsheet(
+async def create_termsheet(quote_id, payload: TermsheetCreate, db: AsyncSession = Depends(get_db)):
-    quote_id,
-    payload: TermsheetCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     async with db.begin():
         quote = await _quote_or_404(db, quote_id)
         if quote.status != "offered":
@@ -117,11 +110,7 @@ async def get_termsheet(
 
 @router.patch("/{termsheet_id}")
 async def update_termsheet(
-    quote_id,
+    quote_id, termsheet_id, payload: TermsheetUpdate, db: AsyncSession = Depends(get_db)
-    termsheet_id,
-    payload: TermsheetUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     ts = await _termsheet_or_404(db, quote_id, termsheet_id)
     if ts.status != "offered":
@@ -138,11 +127,7 @@ async def update_termsheet(
 
 @router.patch("/{termsheet_id}/status")
 async def update_termsheet_status(
-    quote_id,
+    quote_id, termsheet_id, payload: TermsheetStatusUpdate, db: AsyncSession = Depends(get_db)
-    termsheet_id,
-    payload: TermsheetStatusUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     async with db.begin():
         ts = await _termsheet_or_404(db, quote_id, termsheet_id)
@@ -154,12 +139,7 @@ async def update_termsheet_status(
 
 
 @router.delete("/{termsheet_id}")
-async def delete_termsheet(
+async def delete_termsheet(quote_id, termsheet_id, db: AsyncSession = Depends(get_db)):
-    quote_id,
-    termsheet_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     ts = await _termsheet_or_404(db, quote_id, termsheet_id)
     quote = await _quote_or_404(db, quote_id)
     if quote.status != "offered":

backend/app/routers/units.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import AttributeDefinition, Material, MaterialUnit, Unit
 from app.models.procurement import LineItem, LineItemSpec
@@ -12,7 +11,6 @@ from app.utils.errors import ConflictError, NotFoundError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/units", tags=["units"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 def unit_full_to_dict(unit: Unit) -> dict:
@@ -47,11 +45,7 @@ async def list_units(
 
 
 @router.post("", status_code=201)
-async def create_unit(
+async def create_unit(payload: UnitCreate, db: AsyncSession = Depends(get_db)):
-    payload: UnitCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     duplicate = await db.scalar(select(Unit.id).where(Unit.code == payload.code))
     if duplicate is not None:
         raise ConflictError("واحدی با این کد قبلاً ثبت شده است", field="code")
@@ -76,12 +70,7 @@ async def get_unit(unit_id: int, db: AsyncSession = Depends(get_db)):
 
 
 @router.patch("/{unit_id}")
-async def update_unit(
+async def update_unit(unit_id: int, payload: UnitUpdate, db: AsyncSession = Depends(get_db)):
-    unit_id: int,
-    payload: UnitUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     unit = await db.get(Unit, unit_id)
     if unit is None:
         raise NotFoundError("واحد یافت نشد")
@@ -103,11 +92,7 @@ async def update_unit(
 
 
 @router.delete("/{unit_id}")
-async def delete_unit(
+async def delete_unit(unit_id: int, db: AsyncSession = Depends(get_db)):
-    unit_id: int,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
     unit = await db.get(Unit, unit_id)
     if unit is None:
         raise NotFoundError("واحد یافت نشد")

backend/app/routers/users.py

@@ -17,7 +17,7 @@ import uuid
 
 import httpx
 from fastapi import APIRouter, Depends
-from sqlalchemy import select, update, text
+from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.auth import UserContext, get_current_user, require_role
@@ -41,8 +41,6 @@ USER_ROLE_LABELS = {
     "pm": "مدیر پروژه",
     "procurement_manager": "مدیر تدارکات",
     "admin": "ادمین",
-    # کاربر فقطِ پنل مدیریت پروژه (PM) — به انبار/تدارکات دسترسی ندارد
-    "supervisor": "سرپرست پروژه",
 }
 
 
@@ -54,7 +52,6 @@ def user_to_dict(user: User, projects: list[Project] | None = None) -> dict:
     return {
         "id": str(user.id),
         "casdoor_id": user.casdoor_id,
-        "username": user.username,
         "first_name": user.first_name,
         "last_name": user.last_name,
         "phone": user.phone,
@@ -68,15 +65,15 @@ def user_to_dict(user: User, projects: list[Project] | None = None) -> dict:
 
 
 async def _org_manager(ctx: UserContext = Depends(get_current_user)) -> UserContext:
-    """Admin, procurement manager, or project manager — organization management."""
+    """Admin OR procurement manager (the same person) — organization management."""
-    if ctx.role not in ("admin", "procurement_manager", "pm"):
+    if ctx.role not in ("admin", "procurement_manager"):
         raise ForbiddenError("دسترسی به این بخش برای نقش شما مجاز نیست")
     return ctx
 
 
 async def _user_projects(db: AsyncSession, user: User) -> list[Project]:
-    """Every project assigned to the user (supervisor or PM) (oldest first)."""
+    """Every project the user manages as PM (oldest first; [] for non-PMs)."""
-    if user.role not in ("supervisor", "pm"):
+    if user.role != "pm":
         return []
     rows = (
         await db.execute(
@@ -151,13 +148,13 @@ async def list_users(
 ):
     """Every user (with role + assigned projects) — Organization panel."""
     users = (await db.execute(select(User).order_by(User.created_at))).scalars().all()
-    supervisor_ids = {u.id for u in users if u.role in ("supervisor", "pm")}
+    pm_ids = {u.id for u in users if u.role == "pm"}
     by_user: dict = {}
-    if supervisor_ids:
+    if pm_ids:
         projs = (
             await db.execute(
                 select(Project)
-                .where(Project.pm_user_id.in_(supervisor_ids))
+                .where(Project.pm_user_id.in_(pm_ids))
                 .order_by(Project.created_at, Project.id)
             )
         ).scalars().all()
@@ -207,7 +204,7 @@ async def update_user_role(
     if user is None:
         raise NotFoundError("کاربر یافت نشد")
     previous_role = user.role
-    if user.role in ("supervisor", "pm") and payload.role not in ("supervisor", "pm"):
+    if user.role == "pm" and payload.role != "pm":
         await _unassign_projects(db, user.id)
     user.role = payload.role
     await db.flush()
@@ -234,15 +231,8 @@ async def sync_casdoor_users(
             continue
         existing = await db.scalar(select(User).where(User.casdoor_id == cid))
         if existing is None:
-            uname = str(cu.get("name") or cu.get("preferred_username") or "") or None
-            if uname:
-                by_uname = await db.scalar(select(User).where(User.username == uname))
-                if by_uname is not None:
-                    by_uname.casdoor_id = cid
-                    continue
             db.add(User(
                 casdoor_id=cid,
-                username=uname,
                 first_name=str(
                     cu.get("firstName")
                     or cu.get("displayName")
@@ -253,20 +243,16 @@ async def sync_casdoor_users(
                 phone=str(cu.get("phone") or "") or None,
             ))
             created += 1
-        elif not existing.username:
-            uname = str(cu.get("name") or cu.get("preferred_username") or "") or None
-            if uname:
-                existing.username = uname
     await db.flush()
 
     users = (await db.execute(select(User).order_by(User.created_at))).scalars().all()
-    supervisor_ids = {u.id for u in users if u.role in ("supervisor", "pm")}
+    pm_ids = {u.id for u in users if u.role == "pm"}
     by_user: dict = {}
-    if supervisor_ids:
+    if pm_ids:
         projs = (
             await db.execute(
                 select(Project)
-                .where(Project.pm_user_id.in_(supervisor_ids))
+                .where(Project.pm_user_id.in_(pm_ids))
                 .order_by(Project.created_at, Project.id)
             )
         ).scalars().all()
@@ -296,16 +282,11 @@ async def assign_user_project(
     user = await db.get(User, user_id)
     if user is None:
         raise NotFoundError("کاربر یافت نشد")
-    if user.role not in ("supervisor", "pm"):
+    if user.role != "pm":
-        raise ValidationError("ابتدا نقش این کاربر را «سرپرست پروژه» کنید", field="role")
+        raise ValidationError("ابتدا نقش این کاربر را «مدیر پروژه» کنید", field="role")
 
     if payload.project_id is None:
         await _unassign_projects(db, user.id)
-        if user.username:
-            await db.execute(
-                text("DELETE FROM project_assignments WHERE user_id IN (SELECT id FROM pm_users WHERE username = :uname)"),
-                {"uname": user.username}
-            )
         await db.flush()
         return {"data": user_to_dict(user)}
 
@@ -313,19 +294,5 @@ async def assign_user_project(
     if project is None:
         raise NotFoundError("پروژه یافت نشد", field="project_id")
     project.pm_user_id = user.id
-    if user.username:
-        await db.execute(
-            text("""
-                INSERT INTO project_assignments (id, user_id, project_id)
-                SELECT gen_random_uuid(), pu.id, :pid
-                FROM pm_users pu
-                WHERE pu.username = :uname
-                AND NOT EXISTS (
-                    SELECT 1 FROM project_assignments pa
-                    WHERE pa.user_id = pu.id AND pa.project_id = :pid
-                )
-            """),
-            {"pid": project.id, "uname": user.username}
-        )
     await db.flush()
     return {"data": user_to_dict(user, await _user_projects(db, user))}

backend/app/schemas/procurement.py

@@ -44,19 +44,14 @@ class SupplierMaterialCreate(APIModel):
 
 class ProjectCreate(APIModel):
     name: str = Field(min_length=1)
-    location: str | None = None
-    project_manager: str | None = None
     description: str | None = None
     start_date: date | None = None
 
 
 class ProjectUpdate(APIModel):
     name: str | None = Field(default=None, min_length=1)
-    location: str | None = None
-    project_manager: str | None = None
     description: str | None = None
     start_date: date | None = None
-    status: str | None = None
     # PM assignment (1:N — one PM per project, a PM may own many projects).
     # Admin / procurement manager only; None unassigns this project's PM.
     pm_user_id: UUID | None = None
@@ -208,13 +203,13 @@ class UserCreate(APIModel):
     last_name: str = ""
     phone: str | None = None
     casdoor_id: str | None = None
-    role: Literal["pm", "procurement_manager", "admin", "supervisor"] | None = None
+    role: Literal["pm", "procurement_manager", "admin"] | None = None
 
 
 class UserRoleUpdate(APIModel):
     """role=None revokes the role (and any project assignment)."""
 
-    role: Literal["pm", "procurement_manager", "admin", "supervisor"] | None = None
+    role: Literal["pm", "procurement_manager", "admin"] | None = None
 
 
 class UserProjectUpdate(APIModel):

docker-compose.yml

@@ -11,7 +11,7 @@ services:
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
 
     ports:
-      - "5433:5432"
+      - "5455:5432"
 
     networks:
       - default
@@ -208,6 +208,7 @@ services:
     mem_limit: 768m
 
   api:
+    image: v15-api:latest
     build:
       context: ./backend
       dockerfile: Dockerfile
@@ -248,9 +249,6 @@ services:
     ports:
       - "8000:8000"
 
-    volumes:
-      - ./backend/app:/srv/backend/app
-
     networks:
       - traefik_network
       - default
@@ -279,6 +277,7 @@ services:
     mem_limit: 768m
 
   frontend:
+    image: v15-frontend:latest
     build:
       context: ./frontend
       args:
@@ -314,6 +313,40 @@ services:
     restart: unless-stopped
     mem_limit: 128m
 
+  bot:
+    image: v15-bot:latest
+    build:
+      context: ./bot
+      dockerfile: Dockerfile
+    container_name: procurement-bot
+
+    volumes:
+      - ./bot/app:/srv/bot/app
+
+    environment:
+      PROCUREMENT_BOT_BOT_TOKEN: ${BALE_BOT_TOKEN:-1354444845:yhVMnKZBFuKaU3UW5fP1bHmknEHx99mipWw}
+      PROCUREMENT_BOT_BALE_API_BASE: ${BALE_API_BASE:-https://tapi.bale.ai}
+      PROCUREMENT_BOT_API_BASE_URL: http://api:8000/api/v1
+      PROCUREMENT_BOT_DATABASE_URL: postgresql+asyncpg://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/procurement
+      PROCUREMENT_BOT_AI_BASE_URL: ${AI_BASE_URL:-https://api.deepseek.com}
+      PROCUREMENT_BOT_AI_API_KEY: ${AI_API_KEY:-sk-a671eab15be846d494bf0839070a3b32}
+      PROCUREMENT_BOT_LLM_MODEL: ${AI_LLM_MODEL:-deepseek-flash}
+      PROCUREMENT_BOT_ADMIN_CHAT_IDS: ${BALE_ADMIN_CHAT_IDS:-1461166742,1839839922}
+      PROCUREMENT_BOT_SERVICE_TOKEN: ${BALE_SERVICE_TOKEN:-}
+      PROCUREMENT_BOT_FRONTEND_URL: ${APP_HOST:-http://localhost}
+
+    depends_on:
+      postgres:
+        condition: service_healthy
+      api:
+        condition: service_started
+
+    networks:
+      - default
+
+    restart: unless-stopped
+    mem_limit: 512m
+
 networks:
   # شبکه‌ی عمومی: فقط ترافیک و سرویس‌های عمومی. postgres روی شبکه‌ی
   # پیش‌فرض می‌ماند و از بیرون قابل دسترسی نیست.

frontend/src/App.tsx

@@ -38,7 +38,7 @@ const WarehousesPage = lazy(() =>
   import("./pages/Inventory/WarehousesPage").then((m) => ({ default: m.WarehousesPage })),
 );
 const OrganizationPage = lazy(() =>
-  import("./pages/Organization/OrganizationPage").then((m) => ({ default: m.OrganizationPage })),
+  import("./pages/Inventory/OrganizationPage").then((m) => ({ default: m.OrganizationPage })),
 );
 const AdminPanelPage = lazy(() =>
   import("./pages/Admin/AdminPanel").then((m) => ({ default: m.AdminPanel })),
@@ -52,105 +52,32 @@ function Loading() {
   );
 }
 
-// همه‌ی صفحات پشت ورود هستند — بدون نشست، به صفحه‌ی ورود می‌رویم.
+// همه‌ی صفحات پشت ورود هستند — به جز پیش‌نویس‌های ویزارد از ربات یا بدون نشست که به صفحه‌ی ورود می‌روند.
 function RequireAuth({ children }: { children: React.ReactNode }) {
   const user = useAuthStore((s) => s.user);
-  const { pathname } = useLocation();
+  const location = useLocation();
-  if (!user) return <Navigate to="/login" replace />;
+
-  if (user.role === "supervisor") {
+  // در صورت داشتن شناسه پیش‌نویس (از ربات بله)، دسترسی مستقیم به ویزارد بدون لاگین مجاز است
-    // اگر سرپرست پروژه‌ای نداشته باشد، دسترسی مسدود می‌شود
+  const searchParams = new URLSearchParams(location.search);
-    if (!user.projects || user.projects.length === 0) {
+  const hasDraft = searchParams.has("draft") || searchParams.has("draft_id");
-      return (
+  if (location.pathname === "/wizard" && hasDraft) {
-        <div className="flex min-h-screen items-center justify-center bg-bg px-4">
+    return <>{children}</>;
-          <div className="w-full max-w-md rounded-2xl border border-line bg-panel p-8 text-center shadow-sm">
+  }
-            <h1 className="text-[16px] font-extrabold text-red">پروژه تخصیص داده نشده است</h1>
+
-            <p className="mt-2 text-[12.5px] leading-6 text-muted">
+  if (!user) {
-              شما به عنوان سرپرست پروژه در سیستم ثبت شده‌اید اما هنوز هیچ پروژه‌ای به شما تخصیص داده نشده است.
+    const returnUrl = encodeURIComponent(location.pathname + location.search);
-              تا زمان تخصیص پروژه توسط مدیر سیستم، اجازه ورود به سامانه را ندارید.
+    return <Navigate to={`/login?returnUrl=${returnUrl}`} replace />;
-            </p>
-            <button
-              type="button"
-              onClick={() => {
-                useAuthStore.getState().logout();
-                window.location.href = "/login";
-              }}
-              className="mt-5 inline-flex h-10 w-full cursor-pointer items-center justify-center rounded-lg bg-accent px-4 text-[13px] font-bold text-white transition-colors hover:bg-accent-dark"
-            >
-              خروج از حساب
-            </button>
-          </div>
-        </div>
-      );
-    }
-    // سرپرست پروژه فقط به انبار و PM دسترسی دارد
-    if (!pathname.startsWith("/inventory") && pathname !== "/panel/pm") {
-      return <Navigate to="/panel/pm" replace />;
-    }
   }
   return <>{children}</>;
 }
 
-// صفحه‌ی اصلی بر اساس نقش: سرپرست پروژه → پنل مدیریت پروژه (PM)؛ مدیران و ادمین → دفتر تدارکات
+// صفحه‌ی اصلی بر اساس نقش: مدیر پروژه → پنل انبار؛ مدیر تدارکات/ادمین → دفتر
 function HomeRoute() {
   const user = useAuthStore((s) => s.user);
-  if (user?.role === "supervisor") return <Navigate to="/panel/pm" replace />;
+  if (user?.role === "pm") return <Navigate to="/inventory" replace />;
   return <DashboardPage />;
 }
 
-// دسترسی ایجاد استعلام/پیشنهاد (ویزارد): مدیر تدارکات، مدیر پروژه و ادمین
-function RequireProcurementWrite({ children }: { children: React.ReactNode }) {
-  const user = useAuthStore((s) => s.user);
-  if (user?.role !== "admin" && user?.role !== "procurement_manager" && user?.role !== "pm") {
-    return <Navigate to={user?.role === "supervisor" ? "/inventory" : "/"} replace />;
-  }
-  return <>{children}</>;
-}
-
-// پنل «مدیریت پروژه (PM)» — اپ PM روی همان دامنه زیر مسیر /pm سرو می‌شود
-function PmPanelPage() {
-  return (
-    <iframe
-      src="/pm/"
-      title="مدیریت پروژه (PM)"
-      className="h-dvh w-full border-0"
-    />
-  );
-}
-
-// دسترسی پنل PM: همه نقش‌ها دسترسی دارند
-function RequirePmPanel({ children }: { children: React.ReactNode }) {
-  const user = useAuthStore((s) => s.user);
-  const allowed = user?.role === "admin" || user?.role === "procurement_manager" || user?.role === "pm" || user?.role === "supervisor";
-  if (!allowed) return <Navigate to="/" replace />;
-  return <>{children}</>;
-}
-
-// دسترسی پنل سازمان‌دهی: فقط ادمین، مدیر تدارکات و مدیر پروژه
-function RequireOrganization({ children }: { children: React.ReactNode }) {
-  const user = useAuthStore((s) => s.user);
-  const allowed = user?.role === "admin" || user?.role === "procurement_manager" || user?.role === "pm";
-  if (!allowed) return <Navigate to={user?.role === "supervisor" ? "/inventory" : "/"} replace />;
-  return <>{children}</>;
-}
-
-// دسترسی تغییر موجودی انبار: فقط سرپرست پروژه و ادمین (مدیر تدارکات و مدیر پروژه نمی‌توانند موجودی تغییر دهند)
-function RequireInventoryChange({ children }: { children: React.ReactNode }) {
-  const user = useAuthStore((s) => s.user);
-  if (user?.role !== "admin" && user?.role !== "supervisor") {
-    return <Navigate to="/inventory" replace />;
-  }
-  return <>{children}</>;
-}
-
-// دسترسی مدیریت انبارها: فقط مدیران و ادمین (سرپرست پروژه فقط می‌تواند موجودی تغییر دهد)
-function RequireWarehouseManage({ children }: { children: React.ReactNode }) {
-  const user = useAuthStore((s) => s.user);
-  if (user?.role === "supervisor") {
-    return <Navigate to="/inventory" replace />;
-  }
-  return <>{children}</>;
-}
-
 export default function App() {
   return (
     <ErrorBoundary>
@@ -169,9 +96,7 @@ export default function App() {
           path="/wizard"
           element={
             <RequireAuth>
-              <RequireProcurementWrite>
+              <WizardPage />
-                <WizardPage />
-              </RequireProcurementWrite>
             </RequireAuth>
           }
         />
@@ -251,9 +176,7 @@ export default function App() {
           element={
             <RequireAuth>
               <RequirePmProjects>
-                <RequireInventoryChange>
+                <ChangeInventoryPage />
-                  <ChangeInventoryPage />
-                </RequireInventoryChange>
               </RequirePmProjects>
             </RequireAuth>
           }
@@ -273,24 +196,18 @@ export default function App() {
           element={
             <RequireAuth>
               <RequirePmProjects>
-                <RequireWarehouseManage>
+                <WarehousesPage />
-                  <WarehousesPage />
-                </RequireWarehouseManage>
               </RequirePmProjects>
             </RequireAuth>
           }
         />
         <Route
           path="/inventory/org"
-          element={<Navigate to="/organization" replace />}
-        />
-        <Route
-          path="/organization"
           element={
             <RequireAuth>
-              <RequireOrganization>
+              <RequirePmProjects>
                 <OrganizationPage />
-              </RequireOrganization>
+              </RequirePmProjects>
             </RequireAuth>
           }
         />
@@ -302,17 +219,6 @@ export default function App() {
             </RequireAuth>
           }
         />
-        {/* پنل مدیریت پروژه — فقط ادمین و مدیر پروژه */}
-        <Route
-          path="/panel/pm"
-          element={
-            <RequireAuth>
-              <RequirePmPanel>
-                <PmPanelPage />
-              </RequirePmPanel>
-            </RequireAuth>
-          }
-        />
         <Route path="*" element={<Navigate to="/" replace />} />
         </Routes>
       </Suspense>

frontend/src/components/AppSwitcherMenu.tsx

@@ -1,72 +1,48 @@
-
+import { useLocation } from "react-router-dom";
 import { PanelMenu, type MenuItem } from "./PanelMenu";
 import { useLogout } from "../pages/Inventory/panelMenu";
 import { useAuthStore } from "../store/auth";
 
-// منوی همبرگری مشترک بین ۴ پنل اصلی سامانه:
+// منوی همبرگری مشترک بین دو ماژول (پنل انبار / دفتر تدارکات) —
-// ۱. مدیریت انبار (/inventory)
+// دقیقاً مثل منوی دفتر: عنوان «پنل‌ها»، ماژول فعلی با استایل فعال (پر)
-// ۲. مدیریت تدارکات (/)
+// + «✓ فعلی»، ماژول دیگر به‌عنوان سوییچر، و در پایان جداکننده + خروج.
-// ۳. مدیریت پروژه (/panel/pm)
+// مدیر پروژه (1:N): زیر «مدیریت انبار» یک آکاردئون باز می‌شود که همه‌ی
-// ۴. سازمان‌دهی (/organization)
+// پروژه‌های تخصیص‌یافته را نشان می‌دهد؛ پروژه‌ی فعال با «✓ فعلی» مشخص است و
+// انتخاب هر پروژه فقط «پروژه‌ی فعال» را عوض می‌کند (نشست/توکن دست‌نخورده).
 export function AppSwitcherMenu({
   activeModule,
   canSwitchToProcurement = true,
 }: {
-  activeModule: "warehouse" | "procurement" | "organization";
+  activeModule: "warehouse" | "procurement";
-  canSwitchToProcurement?: boolean;
+  canSwitchToProcurement?: boolean; // مدیر پروژه به دفتر تدارکات دسترسی ندارد
 }) {
   const logout = useLogout();
+  const { pathname } = useLocation();
   const user = useAuthStore((s) => s.user);
-  const isSupervisor = user?.role === "supervisor";
+  const setActiveProject = useAuthStore((s) => s.setActiveProject);
+  const items: MenuItem[] = [];
 
-  // سرپرست پروژه: منحصراً دو پنل «انبار» و «مدیریت پروژه» نمایش داده می‌شود
+  const isPm = user?.role === "pm";
-  if (isSupervisor) {
+  const pmProjects = isPm ? user?.projects ?? [] : [];
-    const supervisorItems: MenuItem[] = [
+  const projectChildren: MenuItem[] | undefined =
-      {
+    activeModule === "warehouse" && isPm
-        label: "انبار",
+      ? pmProjects.map((p) => ({
-        to: "/inventory",
+          label: p.name,
-        active: activeModule === "warehouse",
+          to: pathname, // همان بخش فعلی؛ فقط پروژه عوض می‌شود
-      },
+          active: p.id === user?.project_id,
-      {
+          onClick: () => setActiveProject(p.id),
-        label: "مدیریت پروژه",
+        }))
-        to: "/panel/pm",
+      : undefined;
-      },
+
-      { divider: true },
+  if (activeModule === "procurement") {
-      { label: "خروج از حساب", onClick: logout },
+    items.push({ label: "مدیریت انبار", to: "/inventory" });
-    ];
+    items.push({ label: "مدیریت تدارکات", to: "/", active: true });
-    return <PanelMenu title="پنل‌ها" items={supervisorItems} />;
+  } else {
+    items.push({ label: "مدیریت انبار", to: "/inventory", active: true, children: projectChildren });
+    if (canSwitchToProcurement) {
+      items.push({ label: "مدیریت تدارکات", to: "/" });
+    }
   }
-
-  const canManage = user?.role === "admin" || user?.role === "procurement_manager" || user?.role === "pm";
-  const items: MenuItem[] = [
-    {
-      label: "انبار",
-      to: "/inventory",
-      active: activeModule === "warehouse",
-    },
-  ];
-
-  if (canSwitchToProcurement) {
-    items.push({
-      label: "تدارکات",
-      to: "/",
-      active: activeModule === "procurement",
-    });
-  }
-
-  items.push({
-    label: "مدیریت پروژه",
-    to: "/panel/pm",
-  });
-
-  if (canManage) {
-    items.push({
-      label: "سازمان‌دهی",
-      to: "/organization",
-      active: activeModule === "organization",
-    });
-  }
-
   items.push({ divider: true });
   items.push({ label: "خروج از حساب", onClick: logout });
   return <PanelMenu title="پنل‌ها" items={items} />;

frontend/src/components/PanelMenu.tsx

@@ -6,8 +6,6 @@ import { cn } from "../lib/utils";
 export interface MenuItem {
   label?: string;
   to?: string;
-  // لینک خارجی (اپ جداگانه، مثل سامانه PM) — در تب جدید باز می‌شود
-  href?: string;
   active?: boolean;
   divider?: boolean;
   onClick?: () => void;
@@ -114,21 +112,6 @@ export function PanelMenu({ items, title }: { items: MenuItem[]; title?: string
                   </div>
                 )}
               </div>
-            ) : it.href ? (
-              <a
-                key={i}
-                href={it.href}
-                target="_blank"
-                rel="noopener noreferrer"
-                onClick={() => setOpen(false)}
-                className={cn(
-                  "flex items-center justify-between gap-3 rounded-lg px-3 py-2 text-[13px] no-underline",
-                  it.active ? "bg-accent font-bold text-white" : "text-ink hover:bg-slate-bg",
-                )}
-              >
-                {it.label}
-                <span aria-hidden className="text-[10px] opacity-60">↗</span>
-              </a>
             ) : it.to ? (
               <Link
                 key={i}

frontend/src/components/RequirePmProjects.tsx

@@ -16,11 +16,11 @@ export function RequirePmProjects({ children }: { children: ReactNode }) {
   const setProjects = useAuthStore((s) => s.setProjects);
   const logout = useLogout();
 
-  const isSupervisor = user?.role === "supervisor";
+  const isPm = user?.role === "pm";
-  const [state, setState] = useState<"loading" | "ok" | "empty">(isSupervisor ? "loading" : "ok");
+  const [state, setState] = useState<"loading" | "ok" | "empty">(isPm ? "loading" : "ok");
 
   useEffect(() => {
-    if (!user || user.role !== "supervisor") {
+    if (!user || user.role !== "pm") {
       setState("ok");
       return;
     }

frontend/src/components/layout/Header.tsx

@@ -2,23 +2,6 @@ import type { ReactNode } from "react";
 import { useLocation, useNavigate } from "react-router-dom";
 import { ChevronRight, ClipboardList } from "lucide-react";
 import { cn } from "../../lib/utils";
-import { useAuthStore, type AuthUser } from "../../store/auth";
-
-const ROLE_LABELS: Record<string, string> = {
-  admin: "ادمین",
-  procurement_manager: "مدیر تدارکات",
-  pm: "مدیر پروژه",
-  supervisor: "سرپرست پروژه",
-};
-
-export function userSubtitle(user: AuthUser | null | undefined): string {
-  if (!user) return "";
-  const fullName = `${user.first_name || ""} ${user.last_name || ""}`.trim() || user.display_name || "کاربر";
-  const username = user.username || user.casdoor_id || "-";
-  const role = user.role_label || (user.role ? ROLE_LABELS[user.role] : "بدون نقش");
-  const proj = user.role === "supervisor" && user.project_name ? ` – پروژه: ${user.project_name}` : "";
-  return `${fullName} | نام کاربری: ${username} | نقش: ${role}${proj}`;
-}
 
 interface HeaderProps {
   title: string;
@@ -35,10 +18,6 @@ interface HeaderProps {
 export function Header({ title, sub, backTo, backLabel = "بازگشت", actions, brand, icon, menu }: HeaderProps) {
   const navigate = useNavigate();
   const location = useLocation();
-  const user = useAuthStore((s) => s.user);
-
-  const userSub = userSubtitle(user);
-  const displaySub = sub !== undefined ? sub : userSub;
 
   // اگر کاربر از داخل برنامه به این صفحه آمده، یک قدم برمی‌گردیم؛
   // اگر مستقیم باز شده (بدون سابقه‌ی داخلی)، به backTo می‌رویم.
@@ -68,7 +47,7 @@ export function Header({ title, sub, backTo, backLabel = "بازگشت", actions
       <div className="flex min-w-0 items-center gap-2.5">
         <div className="min-w-0">
           <h1 className="text-[17px] font-extrabold leading-6">{title}</h1>
-          {displaySub && <div className="text-[11.5px] text-muted font-normal mt-0.5">{displaySub}</div>}
+          {sub && <div className="text-[11px] text-muted">{sub}</div>}
         </div>
       </div>
       <div className="ms-auto flex flex-wrap items-center gap-2">{actions}</div>

frontend/src/components/layout/MobileTabBar.tsx

@@ -8,6 +8,7 @@ import {
   PackageSearch,
   Scale,
   Truck,
+  UsersRound,
   type LucideIcon,
 } from "lucide-react";
 import { cn } from "../../lib/utils";
@@ -36,12 +37,12 @@ const PM_INV_TABS: TabDef[] = [
   { to: "/inventory/arrivals", label: "کالاهای در راه", icon: PackageSearch },
 ];
 
-// تب‌های پنل انبار برای ادمین / مدیر تدارکات / مدیر پروژه (آینه‌ی ناوبری بالای دسکتاپ)
+// تب‌های پنل انبار برای ادمین / مدیر تدارکات (آینه‌ی ناوبری بالای دسکتاپ)
 const ADMIN_INV_TABS: TabDef[] = [
   { to: "/inventory", label: "انبار", icon: Boxes, end: true },
   { to: "/inventory/daily", label: "کنترل روزانه", icon: CalendarDays },
-  { to: "/inventory/warehouses", label: "انبارها", icon: Building2 },
   { to: "/inventory/arrivals", label: "کالاهای در راه", icon: PackageSearch },
+  { to: "/inventory/org", label: "سازمان‌دهی", icon: UsersRound },
 ];
 
 function TabBar({ tabs }: { tabs: TabDef[] }) {
@@ -80,10 +81,6 @@ export function MobileTabBar() {
   const { pathname } = useLocation();
 
   if (pathname === "/login" || pathname === "/admin") return null;
-  // پنل مدیریت پروژه: iframe تمام‌صفحه‌ی PM است و خودش تب‌بار داخلی دارد
-  if (pathname === "/panel/pm") return null;
-  // سرپرست پروژه فقطِ پنل PM است و هیچ تب ERP ندارد
-  if (role === "supervisor") return null;
   const isPM = role === "pm";
   const isOffice = role === "admin" || role === "procurement_manager";
 

frontend/src/hooks/index.ts

@@ -2,5 +2,5 @@ export { useStoreData, useInvalidateStore, refreshProcurementStore } from "./use
 export { useQuotes, useCreateQuote, useUpdateQuote, useDeleteQuote } from "./useQuotes";
 export { useSuppliers, useAddSupplier, useUpdateSupplier, useRemoveSupplier } from "./useSuppliers";
 export { useMaterials, useAddMaterial } from "./useMaterials";
-export { useProjects, useAddProject, useDeleteProject } from "./useProjects";
+export { useProjects, useAddProject } from "./useProjects";
 export { useUnits, useSaveStandardConversion, useDeleteStandardConversion } from "./useUnits";

frontend/src/hooks/useProjects.ts

@@ -21,15 +21,3 @@ export function useAddProject() {
     onSettled: () => invalidate(),
   });
 }
-
-export function useDeleteProject() {
-  const deleteProject = useAppStore((s) => s.deleteProject);
-  const invalidate = useInvalidateStore();
-  return useMutation({
-    mutationFn: (id: string) => api.projects.delete(id),
-    onMutate: (id) => deleteProject(id),
-    onSettled: () => invalidate(),
-  });
-}
-
-

frontend/src/lib/api.ts

@@ -87,7 +87,7 @@ function handle401(path: string, res: Response): void {
 // ادمین/مدیر تدارکات بدون پارامتر (همه‌ی پروژه‌ها) باقی می‌ماند.
 function activeProjectId(): string | null {
   const { user } = useAuthStore.getState();
-  return user?.role === "supervisor" || user?.role === "pm" ? user.project_id : null;
+  return user?.role === "pm" ? user.project_id : null;
 }
 
 function projectQuery(projectId?: string | null): string {
@@ -323,12 +323,6 @@ interface RawSupplier {
 interface RawProject {
   id: string;
   name: string;
-  location?: string | null;
-  project_manager?: string | null;
-  description?: string | null;
-  start_date?: string | null;
-  status?: string | null;
-  progress?: number | null;
 }
 interface RawSpec {
   attribute_key: string;
@@ -1026,6 +1020,41 @@ export const api = {
     },
   },
 
+  drafts: {
+    get: async (
+      id: string,
+    ): Promise<{
+      id: string;
+      chat_id: number;
+      kind: string;
+      status: string;
+      payload: Record<string, any>;
+      missing?: { fields?: { ok: boolean; key: string; label: string; blocking: boolean }[] } | null;
+      source?: string;
+      created_at?: string;
+      updated_at?: string;
+    }> => {
+      return getData(`/drafts/${id}`);
+    },
+    update: async (
+      id: string,
+      payload: Record<string, any>,
+    ): Promise<void> => {
+      await patchData(`/drafts/${id}`, { payload });
+    },
+    commit: async (
+      id: string,
+      quoteId?: string,
+    ): Promise<void> => {
+      await postData(`/drafts/${id}/commit`, { quote_id: quoteId });
+    },
+    cancel: async (
+      id: string,
+    ): Promise<void> => {
+      await postData(`/drafts/${id}/cancel`, {});
+    },
+  },
+
   suppliers: {
     list: async (): Promise<Supplier[]> => {
       const raw = await getData<RawSupplier[]>(`/suppliers?page_size=${PAGE_SIZE}`);
@@ -1137,36 +1166,11 @@ export const api = {
   projects: {
     list: async (): Promise<Project[]> => {
       const raw = await getData<RawProject[]>(`/projects?page_size=${PAGE_SIZE}`);
-      return raw.map((p) => ({
+      return raw.map((p) => ({ id: p.id, name: p.name }));
-        id: p.id,
-        name: p.name,
-        location: p.location || "",
-        project_manager: p.project_manager || "",
-        description: p.description || "",
-        start_date: p.start_date,
-        status: p.status || "ACTIVE",
-        progress: p.progress != null ? Number(p.progress) : 0,
-      }));
     },
     create: async (p: Project): Promise<Project> => {
-      const raw = await postData<RawProject>("/projects", {
+      const raw = await postData<RawProject>("/projects", { name: p.name });
-        name: p.name,
+      return { id: raw.id, name: raw.name };
-        location: p.location || "",
-        project_manager: p.project_manager || "",
-        description: p.description || "",
-      });
-      return {
-        id: raw.id,
-        name: raw.name,
-        location: raw.location || "",
-        project_manager: raw.project_manager || "",
-        description: raw.description || "",
-        status: raw.status || "ACTIVE",
-        progress: raw.progress != null ? Number(raw.progress) : 0,
-      };
-    },
-    delete: async (id: string): Promise<void> => {
-      await deleteData(`/projects/${id}`);
     },
   },
 
@@ -1556,11 +1560,10 @@ interface RawUnitL { id: number; code: string; name_fa: string | null; }
 export interface UserRow {
   id: string;
   casdoor_id: string;
-  username?: string | null;
   first_name: string;
   last_name: string;
   phone: string | null;
-  role: "pm" | "procurement_manager" | "admin" | "supervisor" | null;
+  role: "pm" | "procurement_manager" | "admin" | null;
   role_label: string | null;
   project_id: string | null;
   project_name: string | null;
@@ -1585,11 +1588,10 @@ export const apiV26 = {
           user: {
             id: string;
             casdoor_id: string;
-            username?: string;
             first_name: string;
             last_name: string;
             phone: string | null;
-            role: "pm" | "procurement_manager" | "admin" | "supervisor" | null;
+            role: "pm" | "procurement_manager" | "admin" | null;
             role_label: string | null;
             project_id: string | null;
             project_name: string | null;
@@ -1603,7 +1605,6 @@ export const apiV26 = {
         expires_in: res.data.expires_in,
         user: {
           ...u,
-          username: u.username || u.casdoor_id,
           display_name: `${u.first_name} ${u.last_name}`.trim() || u.casdoor_id,
         },
       };
@@ -1623,15 +1624,14 @@ export const apiV26 = {
   users: {
     me: async (): Promise<import("../store/auth").AuthUser> => {
       const data = await getData<{
-        id: string; casdoor_id: string; username?: string; first_name: string; last_name: string; phone: string | null;
+        id: string; casdoor_id: string; first_name: string; last_name: string; phone: string | null;
-        role: "pm" | "procurement_manager" | "admin" | "supervisor" | null; role_label: string | null;
+        role: "pm" | "procurement_manager" | "admin" | null; role_label: string | null;
         project_id: string | null; project_name: string | null;
         projects?: { id: string; name: string }[];
       }>("/users/me");
       return {
         id: data.id,
         casdoor_id: data.casdoor_id,
-        username: data.username || data.casdoor_id,
         first_name: data.first_name,
         last_name: data.last_name,
         phone: data.phone,
@@ -1655,7 +1655,7 @@ export const apiV26 = {
       first_name: string; last_name?: string; phone?: string | null;
       casdoor_id?: string | null; role?: "pm" | "procurement_manager" | "admin" | null;
     }): Promise<UserRow> => postData<UserRow>("/users", body),
-    updateRole: async (id: string, role: "pm" | "procurement_manager" | "admin" | "supervisor" | null): Promise<UserRow> =>
+    updateRole: async (id: string, role: "pm" | "procurement_manager" | "admin" | null): Promise<UserRow> =>
       patchData<UserRow>(`/users/${id}`, { role }),
     assignProject: async (id: string, projectId: string | null): Promise<UserRow> =>
       postData<UserRow>(`/users/${id}/project`, { project_id: projectId }),

frontend/src/lib/types.ts

@@ -31,12 +31,6 @@ export interface Material {
 export interface Project {
   id: string;
   name: string;
-  location?: string;
-  project_manager?: string;
-  description?: string;
-  start_date?: string | null;
-  status?: string;
-  progress?: number;
 }
 
 // مرحله‌ی پرداخت

frontend/src/pages/Admin/AdminPanel.tsx

@@ -15,7 +15,6 @@ const ROLE_LABELS: Record<string, string> = {
   pm: "مدیر پروژه",
   procurement_manager: "مدیر تدارکات",
   admin: "ادمین",
-  supervisor: "سرپرست پروژه",
 };
 
 // پنل مدیریت ادمین (فقط ادمین) — همگام‌سازی کاربران از Casdoor و
@@ -81,26 +80,6 @@ export function AdminPanel() {
     }
   };
 
-  // اعطا/لغو نقش «سرپرست پروژه» — کاربر فقطِ پنل مدیریت پروژه (PM)
-  const toggleSupervisor = async (u: UserRow) => {
-    setBusyId(u.id);
-    const target = u.role === "supervisor" ? null : "supervisor";
-    try {
-      await apiV26.users.updateRole(u.id, target as "supervisor" | null);
-      toast.success(
-        target === "supervisor"
-          ? `«${u.first_name} ${u.last_name}» سرپرست پروژه شد ✓`
-          : `نقش سرپرست پروژه از «${u.first_name} ${u.last_name}» گرفته شد`,
-      );
-      await load();
-      refreshProcurementStore();
-    } catch (err) {
-      toast.error(err instanceof Error ? err.message : "خطا در تغییر نقش");
-    } finally {
-      setBusyId(null);
-    }
-  };
-
   if (!isAdmin) {
     return (
       <div className="min-h-screen">
@@ -150,13 +129,12 @@ export function AdminPanel() {
                   <th className="py-2 pe-3">نام کامل</th>
                   <th className="py-2 pe-3">شناسه Casdoor</th>
                   <th className="py-2 pe-3">نقش فعلی</th>
-                  <th className="py-2">مدیریت نقش‌ها</th>
+                  <th className="py-2">مدیریت مدیر تدارکات</th>
                 </tr>
               </thead>
               <tbody>
                 {users.map((u) => {
                   const isPMgr = u.role === "procurement_manager";
-                  const isSup = u.role === "supervisor";
                   return (
                     <tr key={u.id} className="border-b border-line/50">
                       <td className="py-2 pe-3 font-semibold">
@@ -169,30 +147,17 @@ export function AdminPanel() {
                         </span>
                       </td>
                       <td className="py-2">
-                        <div className="flex flex-wrap items-center gap-1.5">
+                        <button
-                          <button
+                          disabled={busyId === u.id}
-                            disabled={busyId === u.id}
+                          onClick={() => void toggleProcurementManager(u)}
-                            onClick={() => void toggleProcurementManager(u)}
+                          className={`rounded-lg border px-3 py-1 text-[11.5px] font-bold ${
-                            className={`rounded-lg border px-3 py-1 text-[11.5px] font-bold ${
+                            isPMgr
-                              isPMgr
+                              ? "border-red/30 bg-red/5 text-red hover:bg-red/10"
-                                ? "border-red/30 bg-red/5 text-red hover:bg-red/10"
+                              : "border-green/30 bg-green/5 text-green hover:bg-green/10"
-                                : "border-green/30 bg-green/5 text-green hover:bg-green/10"
+                          } disabled:opacity-50`}
-                            } disabled:opacity-50`}
+                        >
-                          >
+                          {busyId === u.id ? "…" : isPMgr ? "لغو نقش مدیر تدارکات" : "اعطای نقش مدیر تدارکات"}
-                            {busyId === u.id ? "…" : isPMgr ? "لغو نقش مدیر تدارکات" : "اعطای نقش مدیر تدارکات"}
+                        </button>
-                          </button>
-                          <button
-                            disabled={busyId === u.id}
-                            onClick={() => void toggleSupervisor(u)}
-                            className={`rounded-lg border px-3 py-1 text-[11.5px] font-bold ${
-                              isSup
-                                ? "border-red/30 bg-red/5 text-red hover:bg-red/10"
-                                : "border-green/30 bg-green/5 text-green hover:bg-green/10"
-                            } disabled:opacity-50`}
-                          >
-                            {busyId === u.id ? "…" : isSup ? "لغو نقش سرپرست پروژه" : "اعطای نقش سرپرست پروژه"}
-                          </button>
-                        </div>
                       </td>
                     </tr>
                   );

frontend/src/pages/Auth/LoginPage.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useMemo, useState } from "react";
-import { useNavigate } from "react-router-dom";
+import { useNavigate, useSearchParams } from "react-router-dom";
 import { toast } from "sonner";
 import { ClipboardList, Eye, EyeOff, Loader2, Lock, ShieldCheck, Wrench, X } from "lucide-react";
 import { api, apiV26 } from "../../lib/api";
@@ -33,6 +33,8 @@ export function LoginPage() {
   const setUser = useAuthStore((s) => s.setUser);
   const setDevUser = useAuthStore((s) => s.setDevUser);
   const navigate = useNavigate();
+  const [params] = useSearchParams();
+  const returnUrl = params.get("returnUrl");
 
   // ---- فرم اصلی (Casdoor) ----
   const [username, setUsername] = useState("");
@@ -77,18 +79,18 @@ export function LoginPage() {
         toast.error("نقش شما هنوز در سیستم تعیین نشده است — با مدیر سیستم تماس بگیرید");
         return;
       }
-      if (user.role === "supervisor" && (!user.projects || user.projects.length === 0)) {
-        toast.error("پروژه تخصیص داده نشده است — تا زمان تخصیص پروژه اجازه ورود ندارید");
-        return;
-      }
       setToken(access_token);
       setUser(user);
       // تحلیل رفتار (no-op بدون تنظیمات VITE_OPENPANEL_*)
       identifyUser({ id: user.id, name: user.display_name, role: user.role });
       track("login_success", { role: user.role });
       toast.success(`خوش آمدید، ${user.display_name}`);
-      // سرپرست پروژه → پنل مدیریت پروژه (PM)؛ بقیه نقش‌ها → دفتر پیشنهادهای خرید
+      if (returnUrl) {
-      navigate(user.role === "supervisor" ? "/panel/pm" : "/");
+        navigate(decodeURIComponent(returnUrl));
+      } else {
+        // مدیر پروژه → پنل انبار؛ مدیر تدارکات/ادمین → دفتر پیشنهادهای خرید
+        navigate(user.role === "pm" ? "/inventory" : "/");
+      }
     } catch (err) {
       toast.error(err instanceof Error ? err.message : "خطا در ورود");
     } finally {
@@ -129,8 +131,9 @@ export function LoginPage() {
     }
     setDevUser(devRole, devRole === "pm" ? devProjectId : null, devRole === "pm" ? devProject?.name || null : null);
     toast.success(`ورود آزمایشی انجام شد — نقش: ${DEV_ROLE_LABELS[devRole]}`);
-    // ادمین → پنل مدیریت ادمین؛ مدیر تدارکات → دفتر؛ مدیر پروژه → پنل انبار
+    if (returnUrl) {
-    if (devRole === "admin") navigate("/admin");
+      navigate(decodeURIComponent(returnUrl));
+    } else if (devRole === "admin") navigate("/admin");
     else if (devRole === "pm") navigate("/inventory");
     else navigate("/");
   };

frontend/src/pages/Dashboard/DashboardPage.tsx

@@ -18,16 +18,12 @@ import { LedgerTable } from "./LedgerTable";
 import { AppSwitcherMenu } from "../../components/AppSwitcherMenu";
 import { AcceptModal } from "./AcceptModal";
 import { EditModal } from "./EditModal";
-import { useAuthStore } from "../../store/auth";
 
 const EMPTY_FILTERS: Filters = { supplier: "", status: "", search: "" };
 
 export function DashboardPage() {
   useStoreData();
 
-  const user = useAuthStore((s) => s.user);
-  const canWrite = user?.role === "admin" || user?.role === "procurement_manager";
-
   const quotes = useQuotes();
   const suppliers = useSuppliers();
   const materials = useMaterials();
@@ -89,7 +85,7 @@ export function DashboardPage() {
   return (
     <div className="min-h-screen pb-20 md:pb-6">
       <Header
-        title="مدیریت تدارکات"
+        title="دفتر پیشنهادهای خرید"
         brand
         menu={<AppSwitcherMenu activeModule="procurement" />}
         actions={
@@ -118,15 +114,13 @@ export function DashboardPage() {
             </Link>
 
             {/* دکمه اصلی: افزودن پیشنهاد جدید */}
-            {canWrite && (
+            <Link
-              <Link
+              to="/wizard"
-                to="/wizard"
+              className="inline-flex items-center gap-1.5 px-4 py-2 rounded-xl bg-blue-600 hover:bg-blue-700 active:bg-blue-800 text-white text-xs font-semibold shadow-sm hover:shadow transition-all no-underline"
-                className="inline-flex items-center gap-1.5 px-4 py-2 rounded-xl bg-blue-600 hover:bg-blue-700 active:bg-blue-800 text-white text-xs font-semibold shadow-sm hover:shadow transition-all no-underline"
+            >
-              >
+              <Plus className="h-4 w-4" />
-                <Plus className="h-4 w-4" />
+              <span>افزودن پیشنهاد جدید</span>
-                <span>افزودن پیشنهاد جدید</span>
+            </Link>
-              </Link>
-            )}
           </div>
         }
       />
@@ -154,20 +148,17 @@ export function DashboardPage() {
           onToggleExpand={toggleExpand}
           onAccept={setAcceptId}
           onEdit={setEditId}
-          canWrite={canWrite}
         />
       </PageLayout>
 
       {/* دکمه شناور اکشن (FAB) مخصوص نسخه موبایل */}
-      {canWrite && (
+      <Link
-        <Link
+        to="/wizard"
-          to="/wizard"
+        aria-label="افزودن پیشنهاد جدید"
-          aria-label="افزودن پیشنهاد جدید"
+        className="md:hidden fixed bottom-20 left-4 z-40 flex h-14 w-14 items-center justify-center rounded-full bg-accent text-white shadow-xl shadow-accent/30 active:scale-95 transition-transform"
-          className="md:hidden fixed bottom-20 left-4 z-40 flex h-14 w-14 items-center justify-center rounded-full bg-accent text-white shadow-xl shadow-accent/30 active:scale-95 transition-transform"
+      >
-        >
+        <Plus className="h-7 w-7" />
-          <Plus className="h-7 w-7" />
+      </Link>
-        </Link>
-      )}
 
       <AcceptModal quoteId={acceptId} onClose={() => setAcceptId(null)} />
       <EditModal quoteId={editId} onClose={() => setEditId(null)} />

frontend/src/pages/Dashboard/LedgerTable.tsx

@@ -10,7 +10,6 @@ export interface LedgerTableProps {
   onToggleExpand: (id: string) => void;
   onAccept: (id: string) => void;
   onEdit: (id: string) => void;
-  canWrite?: boolean;
 }
 
 // دفتر پیشنهادها — فهرست کارت‌ها (واکنش‌گرا و بهینه برای موبایل)
@@ -21,7 +20,6 @@ export function LedgerTable({
   onToggleExpand,
   onAccept,
   onEdit,
-  canWrite = true,
 }: LedgerTableProps) {
   if (!quotes.length) {
     return (
@@ -42,7 +40,6 @@ export function LedgerTable({
           onToggleExpand={() => onToggleExpand(q.id)}
           onAccept={() => onAccept(q.id)}
           onEdit={() => onEdit(q.id)}
-          canWrite={canWrite}
         />
       ))}
       <div className="px-2 py-3 text-center text-[10.5px] leading-5 text-muted sm:py-1 sm:text-[11px]">

frontend/src/pages/Dashboard/QuoteCard.tsx

@@ -24,7 +24,6 @@ export interface QuoteCardProps {
   onToggleExpand: () => void;
   onAccept: () => void;
   onEdit: () => void;
-  canWrite?: boolean;
 }
 
 function InfoCell({ label, children, className }: { label: string; children: React.ReactNode; className?: string }) {
@@ -36,7 +35,7 @@ function InfoCell({ label, children, className }: { label: string; children: Rea
   );
 }
 
-export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit, canWrite = true }: QuoteCardProps) {
+export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit }: QuoteCardProps) {
   const sup = supplierById(store.suppliers, q.supplier_id);
   const expired = isExpired(q);
   const total = quoteTotal(q);
@@ -47,7 +46,7 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
   // ستون / دکمه پذیرش
   let acceptedCell: React.ReactNode;
   if (q.status === "offered") {
-    acceptedCell = canWrite ? (
+    acceptedCell = (
       <button
         onClick={(e) => {
           e.stopPropagation();
@@ -58,8 +57,6 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
         <Check className="h-3.5 w-3.5" />
         <span>پذیرش</span>
       </button>
-    ) : (
-      <span className="text-muted text-xs font-medium">در انتظار پذیرش</span>
     );
   } else if (q.accepted_date) {
     acceptedCell = <span className="tabular-nums font-medium">{fmtDateTime(q.accepted_date)}</span>;
@@ -188,21 +185,19 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
           )}
 
           {/* دکمه ویرایش */}
-          {canWrite && (
+          <button
-            <button
+            type="button"
-              type="button"
+            className="inline-flex h-7 items-center justify-center gap-1 rounded-md border border-line bg-panel px-2 text-xs font-medium text-ink hover:bg-slate-50 dark:hover:bg-zinc-800 transition-colors sm:h-8 sm:px-2.5"
-              className="inline-flex h-7 items-center justify-center gap-1 rounded-md border border-line bg-panel px-2 text-xs font-medium text-ink hover:bg-slate-50 dark:hover:bg-zinc-800 transition-colors sm:h-8 sm:px-2.5"
+            onClick={(e) => {
-              onClick={(e) => {
+              e.stopPropagation();
-                e.stopPropagation();
+              onEdit();
-                onEdit();
+            }}
-              }}
+            title="ویرایش پیشنهاد"
-              title="ویرایش پیشنهاد"
+            aria-label="ویرایش"
-              aria-label="ویرایش"
+          >
-            >
+            <Pencil className="h-3 w-3 text-muted" />
-              <Pencil className="h-3 w-3 text-muted" />
+            <span className="hidden sm:inline">ویرایش</span>
-              <span className="hidden sm:inline">ویرایش</span>
+          </button>
-            </button>
-          )}
 
           {/* دکمه فلش اکسپند در هدر */}
           <button

frontend/src/pages/Inventory/ChangeInventoryPage.tsx

@@ -76,9 +76,8 @@ export function ChangeInventoryPage() {
     }
   }, [params]);
 
-  const isAdmin = user?.role === "admin";
+  const isAdmin = user?.role === "admin" || user?.role === "procurement_manager";
-  const isSupervisor = user?.role === "supervisor";
+  const isPM = user?.role === "pm";
-  const canModify = isSupervisor || isAdmin;
 
   const warehouses = data.warehouses;
   const whOpts = useMemo(
@@ -402,7 +401,7 @@ export function ChangeInventoryPage() {
 
   const meta = FORM_TYPES.find((f) => f.t === type)!;
 
-  if (!canModify) {
+  if (isAdmin) {
     return (
       <div className="min-h-screen">
         <Header title="تغییر موجودی" backTo="/inventory" backLabel="بازگشت به داشبورد" />
@@ -410,12 +409,22 @@ export function ChangeInventoryPage() {
           <div className="rounded-xl border border-line bg-panel p-8 text-center">
             <div className="text-3xl">🔒</div>
             <h3 className="mt-2 text-[15px] font-bold">دسترسی فقط‌خواندنی</h3>
-            <p className="mt-1 text-[12.5px] text-muted">امکان تغییر موجودی انبار منحصراً در اختیار سرپرست پروژه و ادمین است.</p>
+            <p className="mt-1 text-[12.5px] text-muted">نقش ادمین اجازه ثبت تغییر موجودی ندارد. این بخش برای مدیران پروژه فعال است.</p>
           </div>
         </PageLayout>
       </div>
     );
   }
+  if (!isPM) {
+    return (
+      <div className="min-h-screen">
+        <Header title="تغییر موجودی" backTo="/inventory" backLabel="بازگشت به داشبورد" />
+        <PageLayout>
+          <div className="text-[13px] text-muted">این بخش فقط برای مدیر پروژه است.</div>
+        </PageLayout>
+      </div>
+    );
+  }
 
   const isCount = type === "STOCK_COUNT";
   const isTransfer = type === "TRANSFER";

frontend/src/pages/Inventory/InventoryPage.tsx

@@ -51,10 +51,8 @@ export function InventoryPage() {
   const location = useLocation();
   const user = useAuthStore((s) => s.user);
   const { warehouses, inventory, transactions, lookup, loading } = useInventoryData();
-  const isManager = user?.role === "admin" || user?.role === "procurement_manager" || user?.role === "pm";
+  const isAdmin = user?.role === "admin" || user?.role === "procurement_manager";
-  const isSupervisor = user?.role === "supervisor";
+  const isPM = user?.role === "pm";
-  const isAdmin = user?.role === "admin";
-  const canModify = isSupervisor || isAdmin;
   const [params] = useSearchParams();
 
   const [filters, setFilters] = useState<{ warehouse: string; material: string; project: string }>({
@@ -69,10 +67,10 @@ export function InventoryPage() {
   const [expBrand, setExpBrand] = useState<string | null>(null);
 
   const visibleWarehouses = useMemo(() => {
-    if (isManager && filters.project) return warehouses.filter((w) => w.project_id === filters.project);
+    if (isAdmin && filters.project) return warehouses.filter((w) => w.project_id === filters.project);
-    if (isManager) return warehouses;
+    if (isAdmin) return warehouses;
     return warehouses.filter((w) => String(w.project_id) === String(user?.project_id || ""));
-  }, [warehouses, isManager, filters.project, user?.project_id]);
+  }, [warehouses, isAdmin, filters.project, user?.project_id]);
 
   const visibleIds = useMemo(() => new Set(visibleWarehouses.map((w) => w.id)), [visibleWarehouses]);
 
@@ -135,12 +133,12 @@ export function InventoryPage() {
   const hasFilter = !!(filters.warehouse || (isAdmin && filters.project));
 
   if (loading) return <div className="min-h-screen" />;
-  if (!user) {
+  if (!user || (!isAdmin && !isPM)) {
     return (
       <div className="min-h-screen">
-        <Header title="داشبورد انبار" backTo="/" backLabel="بازگشت" />
+        <Header title="داشبورد انبار" backTo="/inventory" backLabel="بازگشت به داشبورد" />
         <PageLayout>
-          <EmptyState emoji="🔒" text="لطفاً برای دسترسی به سامانه انبار وارد شوید." />
+          <EmptyState emoji="🔒" text="دسترسی به انبار فقط برای مدیر پروژه یا ادمین است." />
         </PageLayout>
       </div>
     );
@@ -152,10 +150,10 @@ export function InventoryPage() {
         title="سامانه مدیریت انبار"
         sub={inventorySubheader(user)}
         icon={<WarehouseIcon className="h-4.5 w-4.5" strokeWidth={2} />}
-        menu={<AppSwitcherMenu activeModule="warehouse" />}
+        menu={<AppSwitcherMenu activeModule="warehouse" canSwitchToProcurement={isAdmin} />}
         actions={
           <div className="hidden md:flex items-center gap-2">
-            <InventoryTopNav pathname={location.pathname} />
+            <InventoryTopNav pathname={location.pathname} variant={isAdmin ? "admin" : "pm"} />
           </div>
         }
       />
@@ -248,8 +246,8 @@ export function InventoryPage() {
           {/* فیلترهای پیشرفته — برچسب‌های لمسی بدون سلکت و بدون بیرون‌زدگی */}
           {showMobileFilters && (
             <div className="mt-2.5 border-t border-line/60 pt-2.5 flex flex-col gap-2.5">
-              {/* پروژه‌ها (مدیران و ادمین) */}
+              {/* پروژه‌ها (مخصوص ادمین) */}
-              {isManager && lookup.projects.length > 0 && (
+              {isAdmin && lookup.projects.length > 0 && (
                 <div>
                   <div className="mb-1.5 text-[11px] font-bold text-muted">پروژه:</div>
                   <div className="flex flex-wrap gap-1.5">
@@ -417,7 +415,7 @@ export function InventoryPage() {
       </PageLayout>
 
       {/* دکمه شناور تغییر موجودی */}
-      {canModify && (
+      {isPM && (
         <Link
           to="/inventory/change"
           className="fixed bottom-20 left-5 z-40 flex h-14 w-14 items-center justify-center rounded-full bg-blue-600 text-white shadow-xl shadow-blue-600/40 transition-all duration-200 hover:bg-blue-700 hover:scale-105 active:scale-90 md:bottom-8 md:left-8"

frontend/src/pages/Inventory/InventoryTopNav.tsx

@@ -1,32 +1,26 @@
 import { Link } from "react-router-dom";
 import { Button } from "../../components/ui/button";
 
-import { useAuthStore } from "../../store/auth";
-
 // ناوبری بالای صفحه در پنل انبار — هماهنگ با دیزاین‌سیستم دکمه‌ها
 export function InventoryTopNav({
   pathname,
+  variant = "pm",
 }: {
   pathname: string;
+  variant?: "pm" | "admin";
 }) {
-  const user = useAuthStore((s) => s.user);
+  const items =
-  const isAdmin = user?.role === "admin";
+    variant === "admin"
-  const isManager = user?.role === "procurement_manager" || user?.role === "pm" || isAdmin;
+      ? [
-
+          { label: "کنترل روزانه", to: "/inventory/daily", active: pathname.startsWith("/inventory/daily") },
-  const items: { label: string; to: string; active: boolean }[] = [];
+          { label: "کالاهای در راه", to: "/inventory/arrivals", active: pathname.startsWith("/inventory/arrivals") },
-  // سرپرست پروژه از دکمه شناور گرد (+) در پایین صفحه استفاده می‌کند و دکمه مستطیلی بالای صفحه برای او نمایش داده نمی‌شود
+          { label: "سازمان‌دهی", to: "/inventory/org", active: pathname.startsWith("/inventory/org") },
-  if (isAdmin) {
+        ]
-    items.push({
+      : [
-      label: "تغییر موجودی",
+          { label: "کنترل روزانه", to: "/inventory/daily", active: pathname.startsWith("/inventory/daily") },
-      to: "/inventory/change",
+          { label: "انبارها", to: "/inventory/warehouses", active: pathname.startsWith("/inventory/warehouses") },
-      active: pathname.startsWith("/inventory/change"),
+          { label: "کالاهای در راه", to: "/inventory/arrivals", active: pathname.startsWith("/inventory/arrivals") },
-    });
+        ];
-  }
-  if (isManager) {
-    items.push({ label: "کنترل روزانه", to: "/inventory/daily", active: pathname.startsWith("/inventory/daily") });
-    items.push({ label: "انبارها", to: "/inventory/warehouses", active: pathname.startsWith("/inventory/warehouses") });
-    items.push({ label: "کالاهای در راه", to: "/inventory/arrivals", active: pathname.startsWith("/inventory/arrivals") });
-  }
 
   return (
     <>

frontend/src/pages/Inventory/OrganizationPage.tsx

@@ -0,0 +1,354 @@
+import { useCallback, useEffect, useState } from "react";
+import { useNavigate } from "react-router-dom";
+import { toast } from "sonner";
+import { Header, PageLayout } from "../../components/layout/Header";
+import { useAuthStore } from "../../store/auth";
+import { inventorySubheader } from "./panelMenu";
+import { apiV26, type UserRow } from "../../lib/api";
+import { refreshProcurementStore } from "../../hooks";
+import { useInventoryData } from "./useInventoryData";
+import { faNum } from "../../lib/formatters";
+import { ProjectMultiSelect } from "../../components/ProjectMultiSelect";
+
+type Role = "pm" | "procurement_manager" | "admin" | null;
+
+const ROLE_LABELS: Record<string, string> = {
+  pm: "مدیر پروژه",
+  procurement_manager: "مدیر تدارکات",
+  admin: "ادمین",
+};
+
+// سازمان‌دهی (فقط ادمین / مدیر تدارکات) — کاربران، مدیران پروژه و انبارهای هر پروژه
+export function OrganizationPage() {
+    const navigate = useNavigate();
+  const user = useAuthStore((s) => s.user);
+  const data = useInventoryData();
+
+  const [users, setUsers] = useState<UserRow[]>([]);
+  const [loadingUsers, setLoadingUsers] = useState(true);
+  const [syncing, setSyncing] = useState(false);
+  const [busyId, setBusyId] = useState<string | null>(null);
+
+  const [newWh, setNewWh] = useState<Record<string, string>>({});
+  const [newWhDesc, setNewWhDesc] = useState<Record<string, string>>({});
+
+  const canManage = user?.role === "admin" || user?.role === "procurement_manager";
+  // فقط ادمین می‌تواند نقش‌ها را تغییر دهد/ارتقا دهد (RBAC) — مدیر تدارکات فقط
+  // پروژه‌ی مدیران پروژه را تعیین/جابه‌جا می‌کند.
+  const canChangeRoles = user?.role === "admin";
+
+  const loadUsers = useCallback(async () => {
+    try {
+      const list = await apiV26.users.list();
+      setUsers(list);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "خطا در دریافت کاربران");
+    } finally {
+      setLoadingUsers(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    if (canManage) void loadUsers();
+  }, [canManage, loadUsers]);
+
+  const syncUsers = async () => {
+    setSyncing(true);
+    try {
+      const { users: synced, created } = await apiV26.users.sync();
+      setUsers(synced);
+      toast.success(
+        created > 0
+          ? `همگام‌سازی انجام شد — ${faNum(created)} کاربر جدید از Casdoor اضافه شد ✓`
+          : "همگام‌سازی انجام شد — کاربر جدیدی یافت نشد",
+      );
+      await data.refresh();
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "خطا در همگام‌سازی با Casdoor");
+    } finally {
+      setSyncing(false);
+    }
+  };
+
+  if (!canManage) {
+    return (
+      <div className="min-h-screen">
+        <Header title="سازمان‌دهی" backTo="/inventory" backLabel="بازگشت به داشبورد" />
+        <PageLayout>
+          <div className="text-[13px] text-muted">این بخش فقط برای ادمین / مدیر تدارکات است.</div>
+        </PageLayout>
+      </div>
+    );
+  }
+
+  // ---------- actions: users ----------
+
+  const changeRole = async (u: UserRow, role: Role) => {
+    setBusyId(u.id);
+    try {
+      await apiV26.users.updateRole(u.id, role);
+      toast.success(`نقش «${ROLE_LABELS[role ?? ""] ?? "بدون نقش"}» برای ${u.first_name} ${u.last_name} ثبت شد ✓`);
+      await loadUsers();
+      refreshProcurementStore();
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "خطا در تغییر نقش");
+    } finally {
+      setBusyId(null);
+    }
+  };
+
+  // پروژه‌های متصل به یک کاربر (1:N) — با پشتیبانی از شکل قدیمیِ تک‌پروژه‌ای
+  const assignedProjectsOf = (u: UserRow) =>
+    u.projects ?? (u.project_id ? [{ id: u.project_id, name: u.project_name ?? "" }] : []);
+
+  // همگام‌سازی چند-انتخابیِ پروژه‌ها: افزودن/حذف هر اختلاف با یک PATCH
+  // (pm_user_id = کاربر برای اتصال، null برای جداسازی؛ مدیر قبلی جایگزین می‌شود)
+  const syncUserProjects = async (u: UserRow, nextIds: string[]) => {
+    const current = assignedProjectsOf(u).map((p) => p.id);
+    const added = nextIds.filter((id) => !current.includes(id));
+    const removed = current.filter((id) => !nextIds.includes(id));
+    if (!added.length && !removed.length) return;
+    setBusyId(u.id);
+    try {
+      for (const pid of added) await apiV26.projects.setPm(pid, u.id);
+      for (const pid of removed) await apiV26.projects.setPm(pid, null);
+      const names = nextIds
+        .map((id) => data.lookup.projects.find((p) => p.id === id)?.name)
+        .filter(Boolean)
+        .join("، ");
+      toast.success(
+        nextIds.length
+          ? `پروژه‌های «${u.first_name} ${u.last_name}» به‌روزرسانی شد: ${names} ✓`
+          : `«${u.first_name} ${u.last_name}» از همه‌ی پروژه‌ها جدا شد`,
+      );
+      await loadUsers();
+      await data.refresh();
+      refreshProcurementStore();
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "خطا در به‌روزرسانی پروژه‌ها");
+      await loadUsers(); // وضعیت واقعی سرور را برگردان
+    } finally {
+      setBusyId(null);
+    }
+  };
+
+  // ---------- actions: warehouses ----------
+
+  const addWarehouse = async (projectId: string) => {
+    const name = (newWh[projectId] || "").trim();
+    if (!name) return toast.error("نام انبار الزامی است");
+    try {
+      await apiV26.warehouses.create({ project_id: projectId, name, description: (newWhDesc[projectId] || "").trim() || null });
+      setNewWh((s) => ({ ...s, [projectId]: "" }));
+      setNewWhDesc((s) => ({ ...s, [projectId]: "" }));
+      toast.success(`انبار «${name}» اضافه شد ✓`);
+      await data.refresh();
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "خطا در افزودن انبار");
+    }
+  };
+
+  // انبار برای همیشه به پروژه‌ی والدش تعلق دارد — انتقال به پروژه‌ی دیگر وجود ندارد؛
+  // انبار فقط با حذف و ساخت دوباره زیر پروژه‌ی موردنظر جابه‌جا می‌شود.
+  const removeWarehouse = async (id: string) => {
+    if (!confirm("انبار حذف شود؟ (انبارهای دارای سابقه تراکنش قابل حذف نیستند)")) return;
+    try {
+      await apiV26.warehouses.delete(id);
+      toast.success("انبار حذف شد");
+      await data.refresh();
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "خطا در حذف انبار");
+    }
+  };
+
+  // مدیرِ مسئول یک پروژه (1:N — کاربر ممکن است مدیر چند پروژه باشد)
+  const pmOf = (projectId: string) =>
+    users.find(
+      (u) =>
+        u.role === "pm" &&
+        (u.projects?.some((p) => p.id === projectId) || u.project_id === projectId),
+    ) || null;
+
+  return (
+    <div className="min-h-screen">
+      <Header
+        title="سازمان‌دهی"
+        sub={inventorySubheader(user)}
+        backTo="/inventory"
+        backLabel="بازگشت به داشبورد"
+      />
+      <PageLayout className="flex flex-col gap-3">
+        <div className="rounded-lg border border-blue/20 bg-blue/5 px-3 py-2 text-[12px] leading-6 text-muted">
+          ℹ️ کاربران از Casdoor همگام می‌شوند و نقش‌ها اینجا (فقط توسط ادمین) تعیین می‌شوند؛
+          مدیر تدارکات فقط پروژه‌ی مدیران پروژه را تعیین/جابه‌جا می‌کند. پروژه‌ها از سیستم تدارکات می‌آیند و
+          هر مدیر پروژه به همه انبارهای پروژه خودش دسترسی دارد. همه تغییرات فوراً در داشبورد و فرم‌ها اعمال می‌شود.
+        </div>
+
+        {/* ---------- کاربران و مدیران پروژه ---------- */}
+        <div className="rounded-xl border border-line bg-panel p-4">
+          <div className="mb-2 flex flex-wrap items-center justify-between gap-2">
+            <h3 className="text-[14px] font-bold">👥 کاربران و مدیران پروژه</h3>
+            <button
+              onClick={() => void syncUsers()}
+              disabled={syncing}
+              className="rounded-lg border border-accent/40 bg-accent/5 px-3 py-1.5 text-[12px] font-bold text-accent disabled:opacity-50"
+            >
+              {syncing ? "در حال همگام‌سازی…" : "🔄 همگام‌سازی از Casdoor"}
+            </button>
+          </div>
+
+          {loadingUsers ? (
+            <div className="py-3 text-[12.5px] text-muted">در حال بارگذاری کاربران…</div>
+          ) : !users.length ? (
+            <div className="rounded-lg border border-dashed border-line px-3 py-3 text-[12px] text-muted">
+              کاربری ثبت نشده است — کاربران پس از اولین ورود (Casdoor) به‌صورت خودکار ساخته می‌شوند؛
+              یا دکمه‌ی «همگام‌سازی از Casdoor» را بزنید.
+            </div>
+          ) : (
+            <div className="overflow-x-auto">
+              <table className="w-full text-[12.5px]">
+                <thead>
+                  <tr className="border-b border-line text-right text-muted">
+                    <th className="py-2 pe-3">نام</th>
+                    <th className="py-2 pe-3">نقش</th>
+                    <th className="py-2 pe-3">پروژه (مدیر پروژه)</th>
+                    <th className="py-2">عملیات</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  {users.map((u) => (
+                    <tr key={u.id} className="border-b border-line/50">
+                      <td className="py-1.5 pe-3">
+                        <b>{u.first_name} {u.last_name}</b>
+                        <small className="block text-[10.5px] text-muted ltr">{u.casdoor_id}</small>
+                      </td>
+                      <td className="py-1.5 pe-3">
+                        {canChangeRoles ? (
+                          <select
+                            className="h-7 rounded-lg border border-line bg-panel px-2 text-[12px]"
+                            value={u.role ?? ""}
+                            disabled={busyId === u.id}
+                            onChange={(e) => void changeRole(u, (e.target.value || null) as Role)}
+                          >
+                            <option value="">— بدون نقش —</option>
+                            <option value="pm">مدیر پروژه</option>
+                            <option value="procurement_manager">مدیر تدارکات</option>
+                            <option value="admin">ادمین</option>
+                          </select>
+                        ) : (
+                          <span className={`rounded-lg px-2 py-1 text-[11px] font-bold ${u.role ? "bg-accent-bg text-accent" : "bg-slate-bg text-muted"}`}>
+                            {u.role ? ROLE_LABELS[u.role] : "بدون نقش"}
+                          </span>
+                        )}
+                        {!canChangeRoles && u.role && (
+                          <small className="block text-[10px] text-muted">(تغییر نقش فقط توسط ادمین)</small>
+                        )}
+                      </td>
+                      <td className="min-w-[240px] py-1.5 pe-3 align-top">
+                        {u.role === "pm" ? (
+                          <ProjectMultiSelect
+                            options={data.lookup.projects.map((p) => ({ id: p.id, name: p.name }))}
+                            values={assignedProjectsOf(u).map((p) => p.id)}
+                            onChange={(ids) => void syncUserProjects(u, ids)}
+                            disabled={busyId === u.id}
+                          />
+                        ) : (
+                          <span className="text-[11.5px] text-muted">—</span>
+                        )}
+                      </td>
+                      <td className="py-1.5">
+                        {u.role === "pm" && u.project_id && (
+                          <span className="rounded-lg bg-green/10 px-2 py-1 text-[10.5px] font-bold text-green">فعال</span>
+                        )}
+                      </td>
+                    </tr>
+                  ))}
+                </tbody>
+              </table>
+              <div className="mt-1 text-[11px] text-muted">
+                «بدون نقش» = حذف مدیر پروژه (از همه‌ی پروژه‌ها هم جدا می‌شود). هر مدیر پروژه می‌تواند به
+                چند پروژه متصل باشد؛ حذف هر چیپ (×)، فقط همان پروژه را جدا می‌کند و اتصال به یک پروژه، مدیرِ
+                قبلیِ آن پروژه را جابه‌جا می‌کند.
+              </div>
+            </div>
+          )}
+        </div>
+
+        {/* ---------- پروژه‌ها و انبارها ---------- */}
+        <div className="grid grid-cols-1 gap-3 lg:grid-cols-2">
+          {data.lookup.projects.map((p) => {
+            const whs = data.warehouses.filter((w) => w.project_id === p.id);
+            const pm = pmOf(p.id);
+            return (
+              <div key={p.id} className="rounded-xl border border-line bg-panel p-4">
+                <div className="mb-2 flex items-center justify-between">
+                  <h3 className="text-[14px] font-bold">🏢 {p.name}</h3>
+                  <span className="rounded-lg bg-panel px-2 py-1 text-[11px] text-muted">
+                    {faNum(whs.length)} انبار
+                  </span>
+                </div>
+
+                <div className="mb-3">
+                  <h4 className="mb-1 text-[12px] font-bold text-muted">👤 مدیر پروژه</h4>
+                  {pm ? (
+                    <div className="flex items-center gap-2 rounded-lg border border-line px-3 py-2 text-[12.5px]">
+                      <span className="font-semibold">{pm.first_name} {pm.last_name}</span>
+                      <span className="text-[10.5px] text-muted">(مدیر مسئول پروژه)</span>
+                    </div>
+                  ) : (
+                    <div className="rounded-lg border border-dashed border-line px-3 py-2 text-[11.5px] text-muted">
+                      مدیری تعیین نشده است — از جدول «کاربران و مدیران پروژه» بالا، نقش مدیر پروژه را بدهید و به این پروژه متصل کنید.
+                    </div>
+                  )}
+                </div>
+
+                <h4 className="mb-1 text-[12px] font-bold text-muted">🏬 انبارهای پروژه</h4>
+                {!whs.length ? (
+                  <div className="rounded-lg border border-dashed border-line px-3 py-2 text-[11.5px] text-muted">انباری ندارد — از فرم زیر اضافه کنید.</div>
+                ) : (
+                  <div className="mb-2 flex flex-col gap-1.5">
+                    {whs.map((w) => (
+                      <div key={w.id} className="flex items-center justify-between gap-2 rounded-lg border border-line px-3 py-2 text-[12.5px]">
+                        <div className="min-w-0 flex-1">
+                          <b>{w.name}</b>
+                          <small className="block truncate text-muted">{w.description || ""}</small>
+                        </div>
+                        <div className="flex flex-wrap items-center justify-end gap-1.5">
+                          <button
+                            className="rounded-lg border border-accent/40 bg-accent/5 px-2 py-1 text-[10.5px] font-bold text-accent"
+                            onClick={() => navigate(`/inventory?warehouse=${w.id}`)}
+                            title="داشبورد این انبار"
+                          >
+                            📊 داشبورد
+                          </button>
+                          <button className="text-muted hover:text-red" onClick={() => void removeWarehouse(w.id)} title="حذف انبار">✕</button>
+                        </div>
+                      </div>
+                    ))}
+                  </div>
+                )}
+                <div className="flex flex-col gap-2 sm:flex-row sm:items-center">
+                  <input
+                    className="h-8 w-full rounded-lg border border-line bg-panel px-2 text-sm sm:w-44"
+                    placeholder="نام انبار جدید"
+                    value={newWh[p.id] || ""}
+                    onChange={(e) => setNewWh((s) => ({ ...s, [p.id]: e.target.value }))}
+                  />
+                  <input
+                    className="h-8 w-full rounded-lg border border-line bg-panel px-2 text-sm sm:w-52"
+                    placeholder="توضیحات (اختیاری)"
+                    value={newWhDesc[p.id] || ""}
+                    onChange={(e) => setNewWhDesc((s) => ({ ...s, [p.id]: e.target.value }))}
+                  />
+                  <button className="w-full rounded-lg bg-accent px-3 py-2 text-[12px] font-bold text-white sm:w-auto sm:py-1.5" onClick={() => void addWarehouse(p.id)}>
+                    + افزودن انبار
+                  </button>
+                </div>
+              </div>
+            );
+          })}
+        </div>
+      </PageLayout>
+    </div>
+  );
+}

frontend/src/pages/Inventory/WarehousesPage.tsx

@@ -9,41 +9,52 @@ import { useInventoryData, projName } from "./useInventoryData";
 import { faNum } from "../../lib/formatters";
 import { isoToJalaliStr } from "../../lib/jalali";
 
-// انبارها — مدیریت انبارها برای مدیران (ادمین، مدیر تدارکات، مدیر پروژه)
+// انبارها — مدیر پروژه: مشاهده انبارهای پروژه خودش + افزودن/ویرایش/حذف (ادمین دسترسی ندارد)
 export function WarehousesPage() {
   const navigate = useNavigate();
   const user = useAuthStore((s) => s.user);
   const data = useInventoryData();
-  const canManage = user?.role === "admin" || user?.role === "procurement_manager" || user?.role === "pm";
+  const isAdmin = user?.role === "admin" || user?.role === "procurement_manager";
+  const isPM = user?.role === "pm";
 
   const [newName, setNewName] = useState("");
   const [newDesc, setNewDesc] = useState("");
-  const [selectedProjectId, setSelectedProjectId] = useState<string>("");
   const [editId, setEditId] = useState<string | null>(null);
   const [editName, setEditName] = useState("");
   const [editDesc, setEditDesc] = useState("");
 
-  if (!canManage) {
+  // ادمین / مدیر تدارکات به بخش «انبارها» دسترسی ندارد — مدیریت انبارها از «سازمان‌دهی»
+  if (isAdmin) {
     return (
       <div className="min-h-screen">
         <Header title="انبارها" backTo="/inventory" backLabel="بازگشت به داشبورد" />
         <PageLayout>
           <div className="rounded-xl border border-line bg-panel p-8 text-center">
             <div className="text-3xl">🔒</div>
-            <h3 className="mt-2 text-[15px] font-bold">دسترسی محدود</h3>
+            <h3 className="mt-2 text-[15px] font-bold">دسترسی ندارد</h3>
             <p className="mt-1 text-[12.5px] text-muted">
-              مدیریت و تعریف انبارها مخصوص مدیران سیستم است. سرپرست پروژه فقط به ثبت تغییرات موجودی دسترسی دارد.
+              بخش «انبارها» مخصوص مدیران پروژه است. مدیریت انبارها از بخش «سازمان‌دهی» انجام می‌شود.
             </p>
           </div>
         </PageLayout>
       </div>
     );
   }
+  if (!isPM) {
+    return (
+      <div className="min-h-screen">
+        <Header title="انبارها" backTo="/inventory" backLabel="بازگشت به داشبورد" />
+        <PageLayout>
+          <div className="text-[13px] text-muted">این بخش فقط برای مدیر پروژه است.</div>
+        </PageLayout>
+      </div>
+    );
+  }
 
   const addWarehouse = async () => {
     const name = newName.trim();
     if (!name) return toast.error("نام انبار الزامی است");
-    const projectId = selectedProjectId || user?.project_id || data.lookup.projects[0]?.id;
+    const projectId = user?.project_id;
     if (!projectId) return toast.error("پروژه انبار را انتخاب کنید");
     try {
       await apiV26.warehouses.create({ project_id: projectId, name, description: newDesc.trim() || null });
@@ -88,26 +99,13 @@ export function WarehousesPage() {
         backLabel="بازگشت به داشبورد"
       />
       <PageLayout className="flex flex-col gap-3">
-        {canManage && (
+        {isPM && (
           <div className="rounded-xl border border-line bg-panel p-3">
             <h3 className="mb-2 text-[13px] font-bold">+ افزودن انبار جدید</h3>
-            <div className="flex flex-wrap items-center gap-2">
+            <div className="flex flex-wrap gap-2">
-              {data.lookup.projects.length > 1 && (
-                <select
-                  className="h-9 rounded-lg border border-line bg-panel px-3 text-sm"
-                  value={selectedProjectId || user?.project_id || data.lookup.projects[0]?.id || ""}
-                  onChange={(e) => setSelectedProjectId(e.target.value)}
-                >
-                  {data.lookup.projects.map((p) => (
-                    <option key={p.id} value={p.id}>
-                      پروژه: {p.name}
-                    </option>
-                  ))}
-                </select>
-              )}
               <input
                 className="h-9 w-52 rounded-lg border border-line bg-panel px-3 text-sm"
-                placeholder="نام انبار (مثلاً انبار مرکزی)"
+                placeholder="نام انبار (مثلاً انبار موقت)"
                 value={newName}
                 onChange={(e) => setNewName(e.target.value)}
               />
@@ -150,7 +148,7 @@ export function WarehousesPage() {
                   >
                     📊 مشاهده داشبورد انبار
                   </button>
-                  {canManage && (
+                  {isPM && (
                     <>
                       <button
                         className="rounded-lg border border-line px-3 py-1 text-[11.5px]"
@@ -164,7 +162,7 @@ export function WarehousesPage() {
                     </>
                   )}
                 </div>
-                {editId === w.id && canManage && (
+                {editId === w.id && isPM && (
                   <div className="mt-2 flex flex-col gap-1.5 rounded-lg border border-dashed border-accent/40 p-2" onClick={(e) => e.stopPropagation()}>
                     <input
                       className="h-8 rounded-lg border border-line bg-panel px-2 text-sm"

frontend/src/pages/Inventory/panelMenu.ts

@@ -10,22 +10,20 @@ export function useLogout() {
 }
 
 const ROLE_LABELS: Record<string, string> = {
-  admin: "ادمین",
-  procurement_manager: "مدیر تدارکات",
   pm: "مدیر پروژه",
-  supervisor: "سرپرست پروژه",
+  procurement_manager: "مدیر تدارکات",
+  admin: "ادمین",
 };
 
 // زیرعنوان پویای سربرگ پنل انبار:
 //   [نام کاربر] | [نقش] – [پروژه / همه پروژه‌ها]
-// سرپرست پروژه → نام پروژه‌ی خودش؛ مدیران/ادمین → «همه پروژه‌ها».
+// مدیر پروژه → نام پروژه‌ی خودش؛ مدیر تدارکات/ادمین → «همه پروژه‌ها».
-export function inventorySubheader(user: { username?: string; casdoor_id?: string; display_name?: string; first_name: string; last_name: string; role: string | null; role_label: string | null; project_name: string | null } | null | undefined): string {
+export function inventorySubheader(user: { display_name?: string; first_name: string; last_name: string; role: string | null; role_label: string | null; project_name: string | null } | null | undefined): string {
   if (!user) return "در حال بارگذاری…";
-  const name = `${user.first_name || ""} ${user.last_name || ""}`.trim() || user.display_name || "کاربر";
+  const name = user.display_name || `${user.first_name} ${user.last_name}`.trim() || "کاربر";
-  const uname = user.username || user.casdoor_id || "-";
   const role = user.role_label || (user.role ? ROLE_LABELS[user.role] : "بدون نقش");
-  const proj = user.role === "supervisor" && user.project_name ? ` – پروژه: ${user.project_name}` : "";
+  const proj = user.role === "pm" ? user.project_name || "پروژه نامشخص" : "همه پروژه‌ها";
-  return `${name} | نام کاربری: ${uname} | نقش: ${role}${proj}`;
+  return `${name} | ${role} – ${proj}`;
 }
 
 // منوی همبرگریِ مختصر برای مدیر تدارکات/ادمین: بخش‌ها بالای صفحه هستند و
@@ -39,7 +37,8 @@ export function accountMenuItems(onLogout?: () => void): MenuItem[] {
   return items;
 }
 
-// منوی همبرگری سرپرست پروژه در پنل انبار
+// منوی همبرگری مدیر پروژه در پنل انبار — فقط «خروج از حساب»
+// (مدیر پروژه به دفتر تدارکات دسترسی ندارد و دکمه‌ی خروجِ تکی هم حذف شده).
 export function pmMenuItems(onLogout?: () => void): MenuItem[] {
   const items: MenuItem[] = [];
   if (onLogout) {
@@ -48,24 +47,33 @@ export function pmMenuItems(onLogout?: () => void): MenuItem[] {
   return items;
 }
 
-// آیتم‌های بخش‌های داخلی انبار
+// آیتم‌های منوی همبرگری پنل مدیریت انبار — با نشانگر پنل فعلی + «بازگشت به دفتر» + خروج
+//
+// دسترسی‌ها (v2.6):
+// - ادمین / مدیر تدارکات (یک نفر): داشبورد، کنترل روزانه، کالاهای در راه، سازمان‌دهی —
+//   بدون «تغییر موجودی» و بدون «انبارها».
+// - مدیر پروژه: داشبورد، تغییر موجودی، کنترل روزانه، انبارها، کالاهای در راه —
+//   بدون «سازمان‌دهی».
 export function panelMenuItems(pathname: string, role: string | null | undefined, onLogout?: () => void): MenuItem[] {
-  const isAdmin = role === "admin";
+  const isAdmin = role === "admin" || role === "procurement_manager";
-  const isManager = role === "procurement_manager" || role === "pm" || isAdmin;
+  const isPM = role === "pm";
-  const isSupervisor = role === "supervisor" || isAdmin;
-
   const items: MenuItem[] = [
     { label: "داشبورد انبار", to: "/inventory", active: pathname === "/inventory" },
   ];
-  // فقط سرپرست پروژه و ادمین می‌توانند تغییر موجودی بدهند
+  if (isPM) {
-  if (isSupervisor) {
     items.push({ label: "تغییر موجودی", to: "/inventory/change", active: pathname.startsWith("/inventory/change") });
   }
-  // کنترل روزانه و انبارها و کالاهای در راه برای مدیران
+  items.push({ label: "کنترل روزانه", to: "/inventory/daily", active: pathname.startsWith("/inventory/daily") });
-  if (isManager) {
+  if (isPM) {
-    items.push({ label: "کنترل روزانه", to: "/inventory/daily", active: pathname.startsWith("/inventory/daily") });
     items.push({ label: "انبارها", to: "/inventory/warehouses", active: pathname.startsWith("/inventory/warehouses") });
-    items.push({ label: "کالاهای در راه", to: "/inventory/arrivals", active: pathname.startsWith("/inventory/arrivals") });
+  }
+  items.push({ label: "کالاهای در راه", to: "/inventory/arrivals", active: pathname.startsWith("/inventory/arrivals") });
+  if (isAdmin) {
+    items.push({ label: "سازمان‌دهی", to: "/inventory/org", active: pathname.startsWith("/inventory/org") });
+  }
+  if (isAdmin) {
+    items.push({ divider: true });
+    items.push({ label: "بازگشت به دفتر", to: "/" });
   }
   if (onLogout) {
     items.push({ divider: true });

frontend/src/pages/Inventory/useInventoryData.ts

@@ -26,8 +26,8 @@ export interface InventoryData {
 
 export function useInventoryData(): InventoryData {
   const user = useAuthStore((s) => s.user);
-  const isSupervisor = user?.role === "supervisor";
+  const isPM = user?.role === "pm";
-  const projectId = isSupervisor || user?.role === "pm" ? user?.project_id || undefined : undefined;
+  const projectId = isPM ? user.project_id || undefined : undefined;
 
   const [warehouses, setWarehouses] = useState<Warehouse[]>([]);
   const [inventory, setInventory] = useState<InventoryRow[]>([]);

frontend/src/pages/Organization/OrganizationPage.tsx

@@ -1,291 +0,0 @@
-import { useCallback, useEffect, useState } from "react";
-import { toast } from "sonner";
-import { Header, PageLayout } from "../../components/layout/Header";
-import { useAuthStore } from "../../store/auth";
-import { apiV26, type UserRow } from "../../lib/api";
-import { refreshProcurementStore, useProjects } from "../../hooks";
-import { faNum } from "../../lib/formatters";
-import { ProjectMultiSelect } from "../../components/ProjectMultiSelect";
-import { AppSwitcherMenu } from "../../components/AppSwitcherMenu";
-
-type Role = "pm" | "procurement_manager" | "admin" | "supervisor" | null;
-
-const ROLE_LABELS: Record<string, string> = {
-  admin: "ادمین",
-  procurement_manager: "مدیر تدارکات",
-  pm: "مدیر پروژه",
-  supervisor: "سرپرست پروژه",
-};
-
-// پنل مستقل سازمان‌دهی (ادمین، مدیر تدارکات، مدیر پروژه) — مدیریت کاربران، نقش‌ها و تخصیص پروژه‌ها به سرپرستان
-export function OrganizationPage() {
-  const user = useAuthStore((s) => s.user);
-  const projects = useProjects();
-
-  const [users, setUsers] = useState<UserRow[]>([]);
-  const [loadingUsers, setLoadingUsers] = useState(true);
-  const [syncing, setSyncing] = useState(false);
-  const [busyId, setBusyId] = useState<string | null>(null);
-
-  const canManage = user?.role === "admin" || user?.role === "procurement_manager" || user?.role === "pm";
-  // فقط ادمین می‌تواند نقش‌ها را تغییر دهد؛ مدیران می‌توانند پروژه‌ها را به سرپرستان تخصیص دهند
-  const canChangeRoles = user?.role === "admin";
-
-  const loadUsers = useCallback(async () => {
-    try {
-      const list = await apiV26.users.list();
-      setUsers(list);
-    } catch (err) {
-      toast.error(err instanceof Error ? err.message : "خطا در دریافت کاربران");
-    } finally {
-      setLoadingUsers(false);
-    }
-  }, []);
-
-  useEffect(() => {
-    if (canManage) void loadUsers();
-  }, [canManage, loadUsers]);
-
-  const syncUsers = async () => {
-    setSyncing(true);
-    try {
-      const { users: synced, created } = await apiV26.users.sync();
-      setUsers(synced);
-      toast.success(
-        created > 0
-          ? `همگام‌سازی انجام شد — ${faNum(created)} کاربر جدید از Casdoor اضافه شد ✓`
-          : "همگام‌سازی انجام شد — کاربر جدیدی یافت نشد",
-      );
-      refreshProcurementStore();
-    } catch (err) {
-      toast.error(err instanceof Error ? err.message : "خطا در همگام‌سازی با Casdoor");
-    } finally {
-      setSyncing(false);
-    }
-  };
-
-  if (!canManage) {
-    return (
-      <div className="min-h-screen">
-        <Header title="سازمان‌دهی" backTo="/" backLabel="بازگشت به دفتر" />
-        <PageLayout>
-          <div className="text-[13px] text-muted">این بخش فقط برای ادمین، مدیر تدارکات و مدیر پروژه است.</div>
-        </PageLayout>
-      </div>
-    );
-  }
-
-  // ---------- actions: users ----------
-
-  const changeRole = async (u: UserRow, role: Role) => {
-    setBusyId(u.id);
-    try {
-      await apiV26.users.updateRole(u.id, role);
-      toast.success(`نقش «${ROLE_LABELS[role ?? ""] ?? "بدون نقش"}» برای ${u.first_name} ${u.last_name} ثبت شد ✓`);
-      await loadUsers();
-      refreshProcurementStore();
-    } catch (err) {
-      toast.error(err instanceof Error ? err.message : "خطا در تغییر نقش");
-    } finally {
-      setBusyId(null);
-    }
-  };
-
-  const assignedProjectsOf = (u: UserRow) =>
-    u.projects ?? (u.project_id ? [{ id: u.project_id, name: u.project_name ?? "" }] : []);
-
-  const syncUserProjects = async (u: UserRow, nextIds: string[]) => {
-    const current = assignedProjectsOf(u).map((p) => p.id);
-    const added = nextIds.filter((id) => !current.includes(id));
-    const removed = current.filter((id) => !nextIds.includes(id));
-    if (!added.length && !removed.length) return;
-    setBusyId(u.id);
-    try {
-      for (const pid of added) await apiV26.projects.setPm(pid, u.id);
-      for (const pid of removed) await apiV26.projects.setPm(pid, null);
-      const names = nextIds
-        .map((id) => projects.find((p) => p.id === id)?.name)
-        .filter(Boolean)
-        .join("، ");
-      toast.success(
-        nextIds.length
-          ? `پروژه‌های «${u.first_name} ${u.last_name}» به‌روزرسانی شد: ${names} ✓`
-          : `«${u.first_name} ${u.last_name}» از همه‌ی پروژه‌ها جدا شد`,
-      );
-      await loadUsers();
-      refreshProcurementStore();
-    } catch (err) {
-      toast.error(err instanceof Error ? err.message : "خطا در به‌روزرسانی پروژه‌ها");
-      await loadUsers();
-    } finally {
-      setBusyId(null);
-    }
-  };
-
-  // سرپرستان تخصیص‌یافته به یک پروژه
-  const supervisorsOf = (projectId: string) =>
-    users.filter(
-      (u) =>
-        (u.role === "supervisor" || u.role === "pm") &&
-        (u.projects?.some((p) => p.id === projectId) || u.project_id === projectId),
-    );
-
-  return (
-    <div className="min-h-screen">
-      <Header
-        title="سازمان‌دهی"
-        brand
-        menu={<AppSwitcherMenu activeModule="organization" />}
-      />
-      <PageLayout className="flex flex-col gap-4">
-        <div className="rounded-lg border border-blue/20 bg-blue/5 px-3 py-2 text-[12px] leading-6 text-muted">
-          ℹ️ کاربران در Casdoor تعریف شده و از طریق دکمه «همگام‌سازی» اضافه می‌شوند. نقش‌ها در این پنل توسط ادمین تعیین می‌گردند.
-          مدیران پروژه و تدارکات می‌توانند پروژه‌ها را به سرپرستان پروژه تخصیص دهند.
-        </div>
-
-        {/* ---------- بخش ۱: جدول کاربران و نقش‌ها ---------- */}
-        <div className="rounded-xl border border-line bg-panel p-4">
-          <div className="mb-3 flex flex-wrap items-center justify-between gap-2">
-            <div>
-              <h3 className="text-[14px] font-bold">👥 کاربران و نقش‌ها</h3>
-              <p className="mt-0.5 text-[11.5px] text-muted">
-                تعیین نقش کاربران و تخصیص پروژه‌ها به سرپرستان پروژه
-              </p>
-            </div>
-            <button
-              onClick={() => void syncUsers()}
-              disabled={syncing}
-              className="rounded-lg border border-accent/40 bg-accent/5 px-3 py-1.5 text-[12px] font-bold text-accent disabled:opacity-50"
-            >
-              {syncing ? "در حال همگام‌سازی…" : "🔄 همگام‌سازی از Casdoor"}
-            </button>
-          </div>
-
-          {loadingUsers ? (
-            <div className="py-3 text-[12.5px] text-muted">در حال بارگذاری کاربران…</div>
-          ) : !users.length ? (
-            <div className="rounded-lg border border-dashed border-line px-3 py-3 text-[12px] text-muted">
-              کاربری ثبت نشده است — دکمه‌ی «همگام‌سازی از Casdoor» را بزنید.
-            </div>
-          ) : (
-            <div className="overflow-x-auto">
-              <table className="w-full text-[12.5px]">
-                <thead>
-                  <tr className="border-b border-line text-right text-muted">
-                    <th className="py-2 pe-3">نام</th>
-                    <th className="py-2 pe-3">نام کاربری</th>
-                    <th className="py-2 pe-3">نقش</th>
-                    <th className="py-2 pe-3">پروژه‌های تخصیص‌یافته (سرپرست پروژه)</th>
-                    <th className="py-2">وضعیت</th>
-                  </tr>
-                </thead>
-                <tbody>
-                  {users.map((u) => (
-                    <tr key={u.id} className="border-b border-line/50">
-                      <td className="py-2.5 pe-3">
-                        <b>{u.first_name} {u.last_name}</b>
-                      </td>
-                      <td className="py-2.5 pe-3 font-mono text-[11px] text-muted">
-                        {u.username || "—"}
-                      </td>
-                      <td className="py-2.5 pe-3">
-                        {canChangeRoles ? (
-                          <select
-                            className="h-7 rounded-lg border border-line bg-panel px-2 text-[12px]"
-                            value={u.role ?? ""}
-                            disabled={busyId === u.id}
-                            onChange={(e) => void changeRole(u, (e.target.value || null) as Role)}
-                          >
-                            <option value="">— بدون نقش —</option>
-                            <option value="admin">ادمین</option>
-                            <option value="procurement_manager">مدیر تدارکات</option>
-                            <option value="pm">مدیر پروژه</option>
-                            <option value="supervisor">سرپرست پروژه</option>
-                          </select>
-                        ) : (
-                          <span className="rounded bg-panel px-2 py-0.5 text-[11px] font-semibold">
-                            {ROLE_LABELS[u.role ?? ""] ?? "بدون نقش"}
-                          </span>
-                        )}
-                      </td>
-                      <td className="py-2.5 pe-3">
-                        {u.role === "supervisor" || u.role === "pm" ? (
-                          <div className="w-72">
-                            <ProjectMultiSelect
-                              options={projects.map((p) => ({ id: p.id, name: p.name }))}
-                              values={assignedProjectsOf(u).map((p) => p.id)}
-                              onChange={(nextIds) => void syncUserProjects(u, nextIds)}
-                              disabled={busyId === u.id}
-                            />
-                          </div>
-                        ) : (
-                          <span className="text-[11px] text-muted">
-                            {u.role === "admin"
-                              ? "دسترسی کامل به همه پروژه‌ها"
-                              : u.role === "procurement_manager"
-                              ? "دسترسی کامل مدیریتی"
-                              : "—"}
-                          </span>
-                        )}
-                      </td>
-                      <td className="py-2.5 text-[11px] text-muted">
-                        {busyId === u.id ? (
-                          <span className="text-accent">در حال ذخیره…</span>
-                        ) : (
-                          <span className="text-emerald-600">✓ ثبت‌شده</span>
-                        )}
-                      </td>
-                    </tr>
-                  ))}
-                </tbody>
-              </table>
-              <div className="mt-2 text-[11px] text-muted">
-                سرپرستان پروژه‌ای که پروژه‌ای به آن‌ها تخصیص داده نشده باشد، تا زمان تخصیص پروژه اجازه ورود به سامانه را نخواهند داشت.
-              </div>
-            </div>
-          )}
-        </div>
-
-        {/* ---------- بخش ۲: کارت‌های پروژه‌ها و سرپرستان مسئول ---------- */}
-        <div>
-          <h3 className="mb-2 text-[14px] font-bold">🏢 پروژه‌ها و سرپرستان مسئول</h3>
-          <div className="grid grid-cols-1 gap-3 md:grid-cols-2 lg:grid-cols-3">
-            {projects.map((p) => {
-              const sups = supervisorsOf(p.id);
-              return (
-                <div key={p.id} className="rounded-xl border border-line bg-panel p-4">
-                  <div className="mb-2 flex items-center justify-between">
-                    <h4 className="text-[14px] font-bold">🏢 {p.name}</h4>
-                    <span className="rounded-lg bg-panel px-2 py-0.5 text-[11px] text-muted">
-                      {p.status || "پروژه فعال"}
-                    </span>
-                  </div>
-                  {p.description && (
-                    <p className="mb-3 text-[12px] text-muted line-clamp-2">{p.description}</p>
-                  )}
-                  <div>
-                    <h5 className="mb-1.5 text-[11.5px] font-bold text-muted">👤 سرپرست(های) پروژه:</h5>
-                    {!sups.length ? (
-                      <div className="rounded-lg border border-dashed border-line px-3 py-2 text-[11.5px] text-amber-600">
-                        ⚠️ سرپرستی تعیین نشده است — از جدول بالا پروژه را به سرپرست تخصیص دهید.
-                      </div>
-                    ) : (
-                      <div className="flex flex-col gap-1">
-                        {sups.map((s) => (
-                          <div key={s.id} className="flex items-center gap-2 rounded-lg border border-line px-2.5 py-1.5 text-[12px]">
-                            <span className="font-semibold">{s.first_name} {s.last_name}</span>
-                            <span className="text-[10px] text-muted font-mono">({s.username})</span>
-                          </div>
-                        ))}
-                      </div>
-                    )}
-                  </div>
-                </div>
-              );
-            })}
-          </div>
-        </div>
-      </PageLayout>
-    </div>
-  );
-}

frontend/src/pages/Projects/ProjectsPage.tsx

@@ -1,11 +1,11 @@
 import { useState } from "react";
 import { Link } from "react-router-dom";
 import { toast } from "sonner";
-import { Building2, Inbox, CheckCircle2, Truck, Phone, FolderKanban, MapPin, UserCircle2, Trash2, Plus, X } from "lucide-react";
+import { Building2, Inbox, CheckCircle2, Truck, Phone, FolderKanban } from "lucide-react";
 import type { Project, Quote, Store } from "../../lib/types";
+import { nextId } from "../../lib/api";
 import {
   useAddProject,
-  useDeleteProject,
   useMaterials,
   useProjects,
   useQuotes,
@@ -25,7 +25,6 @@ import { faNum, fmtDate } from "../../lib/formatters";
 import { Header, PageLayout } from "../../components/layout/Header";
 import { EmptyState } from "../../components/EmptyState";
 import { Button } from "../../components/ui/button";
-import { useAuthStore } from "../../store/auth";
 
 function projectQuotes(quotes: Quote[], name: string): Quote[] {
   return quotes.filter(
@@ -40,14 +39,23 @@ function projectQuotes(quotes: Quote[], name: string): Quote[] {
   );
 }
 
+// آیا این پیشنهاد برای «این» پروژه پذیرفته شده است؟
+// ملاک، پروژه‌ی هدفِ تصمیم خریدِ اقلام است (item_decisions.project_id) — نه
+// وضعیت سراسری پیشنهاد؛ پیشنهادی که فقط برای پروژه‌ی دیگری پذیرفته شده،
+// برای این پروژه همچنان «پیشنهاد شده» است.
 function acceptedForProject(q: Quote, name: string): boolean {
   return (q.line_items || []).some((li) => !li.rejected && li.target_project?.name === name);
 }
 
+// آیا اصلاً برای این پیشنهاد پروژه‌ی هدفی ثبت شده؟ (پیشنهادهای قدیمیِ
+// پیش از era تصمیم‌پروژه، طبق وضعیت سراسری دسته‌بندی می‌شوند)
 function hasTargets(q: Quote): boolean {
   return (q.line_items || []).some((li) => !!li.target_project);
 }
 
+// اقلام مربوط به این پروژه در یک quote:
+// اولویت با اقلامِ پذیرفته‌شده برای همین پروژه (تصمیم خرید)؛ سپس کاندیداهای
+// همین پروژه؛ و اگر هیچ اتصال قلم‌به‌قلمی نبود، همه‌ی اقلام فعال.
 function itemsForProject(q: Quote, name: string): Quote["line_items"] {
   const items = (q.line_items || []).filter((li) => !li.rejected);
   const targeted = items.filter((li) => li.target_project?.name === name);
@@ -65,97 +73,6 @@ function daysSince(iso: string | null): number | null {
   return Math.floor((Date.now() - d.getTime()) / 86400000);
 }
 
-// ----- مودال افزودن پروژه -----
-function AddProjectModal({
-  open,
-  onClose,
-  onSubmit,
-  loading,
-}: {
-  open: boolean;
-  onClose: () => void;
-  onSubmit: (p: Omit<Project, "id">) => void;
-  loading: boolean;
-}) {
-  const [name, setName] = useState("");
-  const [location, setLocation] = useState("");
-  const [projectManager, setProjectManager] = useState("");
-  const [description, setDescription] = useState("");
-  const [error, setError] = useState("");
-
-  const inputCls =
-    "w-full rounded-lg border border-line bg-surface px-3 py-2 text-sm shadow-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40";
-
-  const reset = () => {
-    setName(""); setLocation(""); setProjectManager(""); setDescription(""); setError("");
-  };
-
-  const handleClose = () => { reset(); onClose(); };
-
-  const handleSubmit = () => {
-    if (!name.trim()) { setError("نام پروژه الزامی است"); return; }
-    setError("");
-    onSubmit({ name: name.trim(), location: location.trim(), project_manager: projectManager.trim(), description: description.trim() });
-  };
-
-  if (!open) return null;
-
-  return (
-    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/40 backdrop-blur-sm" onClick={handleClose}>
-      <div
-        className="w-full max-w-lg rounded-2xl bg-panel shadow-2xl border border-line p-6"
-        onClick={(e) => e.stopPropagation()}
-      >
-        <div className="flex items-center justify-between mb-4">
-          <h2 className="text-base font-bold">افزودن پروژه جدید</h2>
-          <button type="button" onClick={handleClose} className="text-muted hover:text-on-surface transition-colors">
-            <X size={18} />
-          </button>
-        </div>
-
-        <div className="space-y-3">
-          {error && <p className="rounded-lg bg-red-50 border border-red-200 text-red-700 px-3 py-2 text-xs">{error}</p>}
-
-          <div>
-            <label className="mb-1 block text-xs font-semibold text-muted">نام پروژه *</label>
-            <input
-              value={name}
-              onChange={(e) => setName(e.target.value)}
-              onKeyDown={(e) => { if (e.key === "Enter") handleSubmit(); }}
-              placeholder="مثلاً: برج مسکونی آسمان"
-              className={inputCls}
-              autoFocus
-            />
-          </div>
-
-          <div className="grid grid-cols-2 gap-2">
-            <div>
-              <label className="mb-1 block text-xs font-semibold text-muted">محل پروژه</label>
-              <input value={location} onChange={(e) => setLocation(e.target.value)} placeholder="شهر / منطقه" className={inputCls} />
-            </div>
-            <div>
-              <label className="mb-1 block text-xs font-semibold text-muted">مدیر / سرپرست پروژه</label>
-              <input value={projectManager} onChange={(e) => setProjectManager(e.target.value)} placeholder="نام سرپرست" className={inputCls} />
-            </div>
-          </div>
-
-          <div>
-            <label className="mb-1 block text-xs font-semibold text-muted">توضیحات</label>
-            <textarea value={description} onChange={(e) => setDescription(e.target.value)} rows={2} placeholder="توضیحات تکمیلی پروژه..." className={`${inputCls} resize-none`} />
-          </div>
-
-          <div className="flex justify-end gap-2 pt-2">
-            <button type="button" onClick={handleClose} className="h-9 rounded-lg border border-line px-4 text-sm text-muted hover:bg-surface transition-colors">انصراف</button>
-            <button type="button" disabled={loading} onClick={handleSubmit} className="h-9 rounded-lg bg-accent px-4 text-sm font-semibold text-white hover:bg-accent/90 disabled:opacity-50 transition-colors">
-              {loading ? "در حال ذخیره..." : "افزودن پروژه"}
-            </button>
-          </div>
-        </div>
-      </div>
-    </div>
-  );
-}
-
 // صفحه‌ی پروژه‌ها — لیست + پنل جزئیات ۳ ستونه
 export function ProjectsPage() {
   useStoreData();
@@ -165,53 +82,54 @@ export function ProjectsPage() {
   const materials = useMaterials();
   const { standardConversions } = useUnits();
   const addProject = useAddProject();
-  const deleteProject = useDeleteProject();
   const topics = useAppStore((s) => s.topics);
-  const user = useAuthStore((s) => s.user);
-  const canManage = user?.role === "admin" || user?.role === "procurement_manager";
 
   const store: Store = { quotes, suppliers, materials, projects, standardConversions, topics };
 
   const [openProject, setOpenProject] = useState<string | null>(null);
-  const [showAddModal, setShowAddModal] = useState(false);
+  const [newName, setNewName] = useState("");
 
-  const handleAddProject = async (data: Omit<Project, "id">) => {
+  const addProj = () => {
-    const dup = projects.some((p) => normalize(p.name) === normalize(data.name));
+    const name = newName.trim();
-    if (dup) { toast.error("این پروژه قبلاً ثبت شده است."); return; }
+    if (!name) return;
-    try {
+    const dup = projects.some((p) => normalize(p.name) === normalize(name));
-      await addProject.mutateAsync({ id: "", ...data });
+    if (dup) {
-      setShowAddModal(false);
+      toast.error("این پروژه قبلاً ثبت شده است.");
-      setOpenProject(data.name);
+      return;
-      toast.success("پروژه با موفقیت اضافه شد.");
-    } catch {
-      toast.error("خطا در ثبت پروژه");
-    }
-  };
-
-  const handleDeleteProject = async (p: Project, e: React.MouseEvent) => {
-    e.stopPropagation();
-    if (!confirm(`آیا از حذف پروژه «${p.name}» مطمئن هستید؟`)) return;
-    try {
-      await deleteProject.mutateAsync(p.id);
-      toast.success("پروژه حذف شد.");
-      if (openProject === p.name) setOpenProject(null);
-    } catch (err: any) {
-      toast.error(err?.message || "این پروژه دارای پیشنهاد است و قابل حذف نیست");
     }
+    const p: Project = { id: nextId("p", projects), name };
+    void addProject.mutateAsync(p);
+    setNewName("");
+    setOpenProject(name);
+    toast.success("پروژه افزوده شد.");
   };
 
   return (
     <div className="min-h-screen">
-      <Header title="پروژه‌ها" sub="مدیریت پروژه‌های مشترک سامانه" backTo="/" backLabel="بازگشت به دفتر" />
+      <Header title="پروژه‌ها" sub="روی یک پروژه کلیک کنید تا جزئیات آن باز شود" backTo="/" backLabel="بازگشت به دفتر" />
       <PageLayout className="flex flex-col gap-4">
-        <div className="add-panel flex items-center justify-between">
+        <div className="add-panel">
-          <h4>پروژه‌های سامانه</h4>
+          <h4>＋ افزودن پروژه‌ی جدید</h4>
-          {canManage && (
+          <div className="grid max-w-md grid-cols-[1fr_auto] items-end gap-2">
-            <Button onClick={() => setShowAddModal(true)} className="flex items-center gap-1.5">
+            <div className="field">
-              <Plus size={15} />
+              <label>نام پروژه *</label>
-              افزودن پروژه
+              <input
-            </Button>
+                type="text"
-          )}
+                className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm shadow-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
+                placeholder="مثلاً برج آیتا - فاز ۳"
+                autoComplete="off"
+                value={newName}
+                onChange={(e) => setNewName(e.target.value)}
+                onKeyDown={(e) => {
+                  if (e.key === "Enter") {
+                    e.preventDefault();
+                    addProj();
+                  }
+                }}
+              />
+            </div>
+            <Button onClick={addProj}>افزودن پروژه</Button>
+          </div>
         </div>
 
         {!projects.length && !quotes.length ? (
@@ -223,37 +141,16 @@ export function ProjectsPage() {
               const open = openProject === p.name;
               return (
                 <div key={p.id} className="flex flex-col gap-1.5">
-                  <div className={`proj-item flex items-center gap-2 ${open ? "open" : ""}`}>
+                  <button
-                    <button
+                    type="button"
-                      type="button"
+                    className={`proj-item ${open ? "open" : ""}`}
-                      className="flex flex-1 items-center gap-2 min-w-0 text-right"
+                    onClick={() => setOpenProject(open ? null : p.name)}
-                      onClick={() => setOpenProject(open ? null : p.name)}
+                  >
-                    >
+                    <span className={open ? "text-accent" : "text-muted"}>{open ? "▾" : "▸"}</span>
-                      <span className={open ? "text-accent" : "text-muted"}>{open ? "▾" : "▸"}</span>
+                    <span className="font-medium">{p.name}</span>
-                      <span className="font-medium truncate">{p.name}</span>
+                    <span className="proj-count">{faNum(count)} پیشنهاد</span>
-                      {p.location && (
+                  </button>
-                        <span className="flex items-center gap-0.5 text-[11px] text-muted shrink-0">
+                  {/* جزئیات دقیقاً زیر همان پروژه باز می‌شود */}
-                          <MapPin size={10} />{p.location}
-                        </span>
-                      )}
-                      {p.project_manager && (
-                        <span className="flex items-center gap-0.5 text-[11px] text-muted shrink-0">
-                          <UserCircle2 size={10} />{p.project_manager}
-                        </span>
-                      )}
-                      <span className="proj-count ms-auto shrink-0">{faNum(count)} پیشنهاد</span>
-                    </button>
-                    {canManage && (
-                      <button
-                        type="button"
-                        onClick={(e) => handleDeleteProject(p, e)}
-                        title="حذف پروژه"
-                        className="text-muted hover:text-red-600 transition-colors p-1 rounded shrink-0"
-                      >
-                        <Trash2 size={13} />
-                      </button>
-                    )}
-                  </div>
                   {open && <div className="ms-2">{renderProjectDetail(store, p.name)}</div>}
                 </div>
               );
@@ -261,13 +158,6 @@ export function ProjectsPage() {
           </div>
         )}
       </PageLayout>
-
-      <AddProjectModal
-        open={showAddModal}
-        onClose={() => setShowAddModal(false)}
-        onSubmit={handleAddProject}
-        loading={addProject.isPending}
-      />
     </div>
   );
 }
@@ -276,6 +166,7 @@ export function ProjectsPage() {
 function renderProjectDetail(store: Store, name: string): React.ReactElement {
   const quotes = projectQuotes(store.quotes, name);
 
+  // جمع مبلغ هر ستون فقط روی اقلامِ همین پروژه
   const itemsTotal = (q: Quote) =>
     itemsForProject(q, name).reduce((s, li) => s + (lineItemTotal(li) || 0), 0);
   const sumBy = (list: Quote[]) => list.reduce((s, q) => s + itemsTotal(q), 0);
@@ -305,6 +196,10 @@ function renderProjectDetail(store: Store, name: string): React.ReactElement {
     );
   };
 
+  // دسته‌بندی ایزوله per-project:
+  // - پذیرفته/رسیده فقط وقتی حداقل یک قلمِ غیرردشده برای «این» پروژه پذیرفته شده باشد؛
+  // - پیشنهادی که صرفاً کاندیداست (یا فقط برای پروژه‌ی دیگری پذیرفته شده) → پیشنهاد شده.
+  // - پیشنهادهای قدیمیِ بدون پروژه‌ی هدف، طبق وضعیت سراسری می‌مانند.
   const offered = quotes
     .filter(
       (q) =>

frontend/src/pages/Suppliers/CategoryPage.tsx

@@ -14,7 +14,6 @@ import { Combobox } from "../../components/Combobox";
 import { SupplierCard, suppliersOfCategory } from "./supplierUtils";
 import { materialLabel } from "../../lib/quoteUtils";
 import { Button } from "../../components/ui/button";
-import { useAuthStore } from "../../store/auth";
 
 // صفحه‌ی تأمین‌کننده‌های یک دسته + فرم افزودن تأمین‌کننده
 export function CategoryPage() {
@@ -27,8 +26,6 @@ export function CategoryPage() {
   const addSupplier = useAddSupplier();
   const removeSupplier = useRemoveSupplier();
   const topics = useAppStore((s) => s.topics);
-  const user = useAuthStore((s) => s.user);
-  const canManage = user?.role === "admin" || user?.role === "procurement_manager";
 
   const cat = useMemo(() => topicByName(catParam, topics)?.name ?? null, [catParam, topics]);
 
@@ -124,7 +121,7 @@ export function CategoryPage() {
                 key={s.id}
                 s={s}
                 topic={cat}
-                deletable={canManage}
+                deletable
                 onDelete={removeSup}
                 materials={supMats.get(s.id) || []}
                 avgLeadTime={supLeadTimes.get(s.id)}
@@ -133,11 +130,10 @@ export function CategoryPage() {
           </div>
         )}
 
-        {canManage && (
+        <div className="add-panel">
-          <div className="add-panel">
+          <h4>
-            <h4>
+            <Plus className="me-1 inline h-4 w-4 text-accent" /> افزودن تأمین‌کننده‌ی جدید
-              <Plus className="me-1 inline h-4 w-4 text-accent" /> افزودن تأمین‌کننده‌ی جدید
+          </h4>
-            </h4>
           <div className="grid max-w-2xl grid-cols-2 gap-3 max-md:grid-cols-1">
             <div className="field">
               <label>نام تأمین‌کننده *</label>
@@ -186,7 +182,6 @@ export function CategoryPage() {
             ذخیره تأمین‌کننده
           </Button>
         </div>
-        )}
       </PageLayout>
     </div>
   );

frontend/src/pages/Suppliers/SupplierDetailPage.tsx

@@ -14,7 +14,6 @@ import { MultiSelectCombobox } from "../../components/MultiSelectCombobox";
 import { ConfirmDeleteDialog } from "../../components/ConfirmDeleteDialog";
 import { normalize } from "../../lib/normalize";
 import { PurchaseHistory } from "./PurchaseHistory";
-import { useAuthStore } from "../../store/auth";
 
 // تمیزکاری و استانداردسازی شماره برای شماره‌گیر خودکار موبایل (اندروید و iOS)
 function cleanPhoneForTel(phone?: string | null): string {
@@ -33,8 +32,6 @@ export function SupplierDetailPage() {
   const quotes = useQuotes();
   const materials = useMaterials();
   const topics = useAppStore((s) => s.topics);
-  const user = useAuthStore((s) => s.user);
-  const canManage = user?.role === "admin" || user?.role === "procurement_manager";
 
   const s = useMemo(() => suppliers.find((x) => x.id === id) || null, [suppliers, id]);
   const [pendingRemove, setPendingRemove] = useState<string | null>(null);
@@ -187,15 +184,13 @@ export function SupplierDetailPage() {
           </div>
 
           <div className="mt-4 flex items-center gap-2">
-            {canManage && (
+            <Link
-              <Link
+              to={`/wizard?topic=${encodeURIComponent(topicName)}&supplier=${encodeURIComponent(s.id)}`}
-                to={`/wizard?topic=${encodeURIComponent(topicName)}&supplier=${encodeURIComponent(s.id)}`}
+              className="btn-line-file no-underline bg-accent text-white hover:bg-accent-dark"
-                className="btn-line-file no-underline bg-accent text-white hover:bg-accent-dark"
+            >
-              >
+              <Plus className="h-3.5 w-3.5" />
-                <Plus className="h-3.5 w-3.5" />
+              پیشنهاد جدید
-                پیشنهاد جدید
+            </Link>
-              </Link>
-            )}
             {firstCat ? (
               <Link to={`/suppliers/category/${encodeURIComponent(firstCat)}`} className="btn-line-file no-underline">
                 ‹ بازگشت به دسته
@@ -221,23 +216,19 @@ export function SupplierDetailPage() {
               {linked.map((c) => (
                 <span key={c} className="spec-chip">
                   {c}
-                  {canManage && (
+                  <button type="button" className="spec-chip-x" title="حذف متریال" onClick={() => setPendingRemove(c)}>
-                    <button type="button" className="spec-chip-x" title="حذف متریال" onClick={() => setPendingRemove(c)}>
+                    <X className="h-3 w-3" />
-                      <X className="h-3 w-3" />
+                  </button>
-                    </button>
-                  )}
                 </span>
               ))}
             </div>
           )}
-          {canManage && (
+          <MultiSelectCombobox
-            <MultiSelectCombobox
+            values={[]}
-              values={[]}
+            onChange={(cats) => saveCategories(cats)}
-              onChange={(cats) => saveCategories(cats)}
+            options={materialOptions}
-              options={materialOptions}
+            placeholder="افزودن متریال..."
-              placeholder="افزودن متریال..."
+          />
-            />
-          )}
           {purchased.length > 0 && (
             <div className="mt-3 border-t border-line pt-2">
               <div className="mb-1 text-[11px] font-semibold text-muted">متریال‌های خریداری‌شده (از پیشنهادها):</div>

frontend/src/pages/Wizard/WizardPage.tsx

@@ -1,6 +1,6 @@
-import { useEffect, useMemo, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { track } from "../../lib/analytics";
-import { Link, useNavigate, useSearchParams } from "react-router-dom";
+import { useNavigate, useSearchParams } from "react-router-dom";
 import { ChevronRight, ChevronLeft, Check } from "lucide-react";
 import { toast } from "sonner";
 import type { LineItem, Quote } from "../../lib/types";
@@ -82,6 +82,120 @@ export function WizardPage() {
   const [proforma, setProforma] = useState<File | null>(null);
   const [emptyFields, setEmptyFields] = useState<{ label: string; step: number }[]>([]);
   const [confirmOpen, setConfirmOpen] = useState(false);
+  const [loadedDraftId, setLoadedDraftId] = useState<string | null>(null);
+  const draftFetchedRef = useRef(false);
+  const lastRemoteUpdatedAtRef = useRef<string | null>(null);
+  const isSelfUpdatingRef = useRef<boolean>(false);
+  const isCommittedOrCancelledRef = useRef<boolean>(false);
+  const initialLoadedRef = useRef<boolean>(false);
+
+  // ---------- تابع اعمال داده‌های پیش‌نویس به فیلدهای ویزارد ----------
+  const applyDraftPayloadToForm = useCallback(
+    (p: Record<string, any>) => {
+      if (!p) return;
+
+      // ۱. تأمین‌کننده و وضعیت رسمی
+      if (p.supplier_name !== undefined) {
+        setSupplierName(p.supplier_name || "");
+        setSupplierInvalid(false);
+      }
+      if (p.is_official !== undefined) {
+        setIsOfficial(Boolean(p.is_official));
+      }
+
+      // استنتاج تاپیک: ابتدا از اطلاعات تأمین‌کننده، سپس متریال، سپس اولین تاپیک موجود
+      let topicToSet = "";
+      if (p.supplier_name) {
+        const sup = suppliers.find((s) => normalize(s.name) === normalize(p.supplier_name));
+        if (sup?.topic) topicToSet = sup.topic;
+      }
+      if (!topicToSet && Array.isArray(p.items) && p.items.length > 0) {
+        for (const it of p.items) {
+          if (it.material_name) {
+            const mat = materials.find((m) => normalize(m.name) === normalize(it.material_name));
+            if (mat?.topic) {
+              topicToSet = mat.topic;
+              break;
+            }
+          }
+        }
+      }
+      if (!topicToSet && topics.length > 0) {
+        topicToSet = topics[0].name;
+      }
+      if (topicToSet) {
+        setSelectedTopic(topicToSet);
+      }
+
+      // ۲. اقلام (Step 2)
+      let newItems: ItemDraft[] = [];
+      if (Array.isArray(p.items) && p.items.length > 0) {
+        newItems = p.items.map((it: any, idx: number) => {
+          const qty = it.quantity != null ? Number(it.quantity) : null;
+          const price = it.unit_price != null ? Number(it.unit_price) : null;
+          return {
+            tempId: "it" + idx,
+            cat: it.material_name || "",
+            brand: it.brand_name || "",
+            specs: Array.isArray(it.specs) ? it.specs : [],
+            qty,
+            unit: it.unit_name || "",
+            price,
+            total: qty != null && price != null ? qty * price : null,
+          };
+        });
+        setItems(newItems);
+      }
+
+      // ۳. شرایط پرداخت / termsheet (Step 3)
+      if (Array.isArray(p.termsheets) && p.termsheets.length > 0) {
+        const newCards: TsCardDraft[] = p.termsheets.map((ts: any, idx: number) => ({
+          key: "ts" + idx,
+          milestones:
+            Array.isArray(ts.milestones) && ts.milestones.length > 0
+              ? ts.milestones.map((m: any) => ({
+                  when_iso: m.due_date || m.when_iso || null,
+                  amount: m.amount != null ? Number(m.amount) : null,
+                }))
+              : [{ when_iso: null, amount: null }],
+        }));
+        setCards(newCards);
+
+        const targetIds = (newItems.length > 0 ? newItems : items).map((i) => i.tempId);
+        const newCov: Record<string, string[]> = {};
+        newCards.forEach((c) => {
+          newCov[c.key] = targetIds;
+        });
+        setCoverage(newCov);
+      }
+
+      // ۴. پروژه (Step 4)
+      const projNames: string[] = [];
+      if (Array.isArray(p.project_names)) {
+        projNames.push(...p.project_names.filter(Boolean));
+      }
+      if (p.project_name && !projNames.includes(p.project_name)) {
+        projNames.push(p.project_name);
+      }
+      if (projNames.length > 0) {
+        const newAssignment: Record<string, string[]> = {};
+        const targetItems = newItems.length > 0 ? newItems : items;
+        targetItems.forEach((it) => {
+          newAssignment[it.tempId] = projNames;
+        });
+        setAssignment(newAssignment);
+      }
+
+      // ۵. یادداشت و تاریخ انقضا (Step 5)
+      if (p.notes !== undefined) {
+        setNotes(p.notes || "");
+      }
+      if (p.expiry_date !== undefined) {
+        setExpiryDate(p.expiry_date || null);
+      }
+    },
+    [suppliers, materials, topics, items],
+  );
 
   // ---------- prefill از لینک‌ها (?topic=&supplier=) ----------
   useEffect(() => {
@@ -100,6 +214,121 @@ export function WizardPage() {
     }
   }, [params, suppliers, topics]);
 
+  // ---------- بارگذاری اولیه پیش‌نویس ربات بله (?draft=&draft_id=) ----------
+  useEffect(() => {
+    const draftId = params.get("draft") || params.get("draft_id");
+    if (!draftId || draftFetchedRef.current) return;
+
+    draftFetchedRef.current = true;
+    void (async () => {
+      try {
+        const draft = await api.drafts.get(draftId);
+        if (!draft || !draft.payload) return;
+        setLoadedDraftId(draft.id);
+        lastRemoteUpdatedAtRef.current = draft.updated_at || null;
+
+        applyDraftPayloadToForm(draft.payload);
+        setHighestVisited(5);
+        initialLoadedRef.current = true;
+
+        toast.success("پیش‌نویس از ربات بله بارگذاری شد. لطفاً اطلاعات را بازبینی کنید.", {
+          duration: 6000,
+        });
+      } catch (err) {
+        toast.error(`خطا در فراخوانی پیش‌نویس از ربات: ${err instanceof Error ? err.message : "خطای ناشناخته"}`);
+      }
+    })();
+  }, [params, applyDraftPayloadToForm]);
+
+  // ---------- پولینگ دوره‌ای برای دریافت تغییرات یا ثبت از سمت ربات بله ----------
+  useEffect(() => {
+    const draftId = params.get("draft") || params.get("draft_id");
+    if (!draftId) return;
+
+    const interval = setInterval(async () => {
+      if (isCommittedOrCancelledRef.current || !initialLoadedRef.current) return;
+      try {
+        const draft = await api.drafts.get(draftId);
+        if (!draft) return;
+
+        if (draft.status === "committed") {
+          isCommittedOrCancelledRef.current = true;
+          toast.success("این پیشنهاد از طریق ربات بله با موفقیت ثبت نهایی شد.", { duration: 8000 });
+          navigate("/");
+          return;
+        }
+        if (draft.status === "cancelled") {
+          isCommittedOrCancelledRef.current = true;
+          toast.error("این پیش‌نویس از طریق ربات بله لغو شد.", { duration: 6000 });
+          navigate("/");
+          return;
+        }
+
+        if (
+          draft.updated_at &&
+          lastRemoteUpdatedAtRef.current &&
+          draft.updated_at > lastRemoteUpdatedAtRef.current &&
+          !isSelfUpdatingRef.current
+        ) {
+          lastRemoteUpdatedAtRef.current = draft.updated_at;
+          applyDraftPayloadToForm(draft.payload);
+        }
+      } catch {
+        /* خطای موقت شبکه در پولینگ نادیده گرفته می‌شود */
+      }
+    }, 2000);
+
+    return () => clearInterval(interval);
+  }, [params, navigate, applyDraftPayloadToForm]);
+
+  // ---------- همگام‌سازی خودکار تغییرات ویزارد به پیش‌نویس ربات (Debounced Auto-Save) ----------
+  useEffect(() => {
+    const draftId = params.get("draft") || params.get("draft_id");
+    if (!draftId || isCommittedOrCancelledRef.current || !initialLoadedRef.current) return;
+
+    const timer = setTimeout(async () => {
+      isSelfUpdatingRef.current = true;
+      try {
+        const payloadToSave: Record<string, any> = {
+          supplier_name: supplierName.trim() || null,
+          is_official: isOfficial,
+          items: items.map((it) => ({
+            material_name: it.cat.trim() || null,
+            brand_name: it.brand.trim() || null,
+            specs: it.specs,
+            quantity: it.qty,
+            unit_name: it.unit.trim() || null,
+            unit_price: it.price,
+          })),
+          termsheets: cards.map((c, i) => ({
+            label: "گزینه " + faNum(i + 1),
+            milestones: (c.milestones || []).map((m) => ({
+              due_date: m.when_iso,
+              amount: m.amount,
+            })),
+          })),
+          project_names: [...new Set(Object.values(assignment).flat())],
+          notes: notes.trim() || null,
+          expiry_date: expiryDate || null,
+        };
+
+        await api.drafts.update(draftId, payloadToSave);
+        const updated = await api.drafts.get(draftId);
+        if (updated?.updated_at) {
+          lastRemoteUpdatedAtRef.current = updated.updated_at;
+        }
+      } catch (err) {
+        console.warn("Auto-save to draft failed:", err);
+      } finally {
+        setTimeout(() => {
+          isSelfUpdatingRef.current = false;
+        }, 600);
+      }
+    }, 800);
+
+    return () => clearTimeout(timer);
+  }, [supplierName, isOfficial, items, cards, assignment, notes, expiryDate, params]);
+
   // ---------- اعتبارسنجی قبل از ترک هر مرحله ----------
   const completedSteps = useMemo(() => {
     const s = new Set<number>();
@@ -378,6 +607,15 @@ export function WizardPage() {
 
     try {
       const created = await createQuote.mutateAsync(quote);
+      const draftId = params.get("draft") || params.get("draft_id");
+      if (draftId) {
+        isCommittedOrCancelledRef.current = true;
+        try {
+          await api.drafts.commit(draftId, created.id);
+        } catch (err) {
+          console.warn("Could not commit draft:", err);
+        }
+      }
       if (proforma) {
         try {
           await api.files.upload(created.id, "proforma", proforma);
@@ -387,7 +625,7 @@ export function WizardPage() {
           });
         }
       }
-      toast.success("پیشنهاد ذخیره شد.");
+      toast.success("پیشنهاد ذخیره شد و در ربات بله تأیید گردید.");
       track("quote_submitted", { quote_id: created.id, items: lineItems.length });
       navigate("/");
     } catch (e) {
@@ -396,6 +634,19 @@ export function WizardPage() {
     }
   };
 
+  const handleCancel = async () => {
+    const draftId = params.get("draft") || params.get("draft_id");
+    if (draftId) {
+      isCommittedOrCancelledRef.current = true;
+      try {
+        await api.drafts.cancel(draftId);
+      } catch (err) {
+        console.warn("Could not cancel draft:", err);
+      }
+    }
+    navigate("/");
+  };
+
   const save = () => {
     const incomplete: { label: string; step: number }[] = [];
     if (!completedSteps.has(1)) incomplete.push({ label: "تأمین‌کننده", step: 1 });
@@ -419,6 +670,17 @@ export function WizardPage() {
         backLabel="بازگشت به دفتر"
       />
       <PageLayout>
+        {loadedDraftId && (
+          <div className="mb-4 flex items-center justify-between rounded-xl border border-blue-200 bg-blue-50/80 p-3.5 text-sm text-blue-900 dark:border-blue-900/50 dark:bg-blue-950/40 dark:text-blue-200 shadow-xs">
+            <div className="flex items-center gap-2">
+              <span className="inline-flex h-6 px-2.5 items-center justify-center rounded-full bg-blue-600 text-xs font-bold text-white">
+                ربات بله
+              </span>
+              <span>اطلاعات پیش‌نویس استعلام با هوش مصنوعی بارگذاری شد. لطفاً اقلام و شرایط را بازبینی فرمایید.</span>
+            </div>
+            <span className="text-xs text-blue-600 dark:text-blue-400 font-mono font-medium">#{loadedDraftId.slice(0, 8)}</span>
+          </div>
+        )}
         {/* نوار مراحل استپر */}
         <Stepper current={currentStep} highestVisited={highestVisited} completedSteps={completedSteps} onGoto={goToStep} />
 
@@ -508,13 +770,15 @@ export function WizardPage() {
             )}
           </div>
 
+          {/* دکمه‌های اقدام (انصراف + بعدی / ذخیره) */}
           <div className="flex items-center gap-2 sm:gap-3">
-            <Link
+            <button
-              to="/"
+              type="button"
-              className="inline-flex items-center justify-center px-3 sm:px-4 py-2 rounded-xl text-xs sm:text-sm font-medium text-slate-500 hover:text-slate-700 no-underline"
+              onClick={() => void handleCancel()}
+              className="inline-flex items-center justify-center px-3 sm:px-4 py-2 rounded-xl text-xs sm:text-sm font-medium text-slate-500 hover:text-slate-700 hover:bg-slate-100 dark:text-zinc-400 dark:hover:text-zinc-200 dark:hover:bg-zinc-800 transition-colors cursor-pointer border-none bg-transparent"
             >
               انصراف
-            </Link>
+            </button>
 
             {currentStep < TOTAL_STEPS && (
               <button

frontend/src/store/auth.ts

@@ -11,11 +11,10 @@ import { persist } from "zustand/middleware";
 export interface AuthUser {
   id: string;
   casdoor_id: string;
-  username?: string;
   first_name: string;
   last_name: string;
   phone: string | null;
-  role: "pm" | "procurement_manager" | "admin" | "supervisor" | null;
+  role: "pm" | "procurement_manager" | "admin" | null;
   role_label: string | null;
   project_id: string | null; // پروژه‌ی فعال (PM) — با سوییچر عوض می‌شود
   project_name: string | null;

frontend/src/store/index.ts

@@ -41,7 +41,6 @@ interface AppStore {
   deleteSupplier: (id: string) => void;
   addMaterial: (m: Material) => void;
   addProject: (p: Project) => void;
-  deleteProject: (id: string) => void;
   setStandardConversion: (sc: StandardConversion) => void;
   deleteStandardConversion: (id: string) => void;
 
@@ -86,7 +85,6 @@ export const useAppStore = create<AppStore>()((set) => ({
   deleteSupplier: (id) => set((s) => ({ suppliers: s.suppliers.filter((x) => x.id !== id) })),
   addMaterial: (m) => set((s) => ({ materials: [...s.materials, m] })),
   addProject: (p) => set((s) => ({ projects: [...s.projects, p] })),
-  deleteProject: (id) => set((s) => ({ projects: s.projects.filter((p) => p.id !== id) })),
   setStandardConversion: (sc) =>
     set((s) => {
       const idx = s.standardConversions.findIndex((x) => x.id === sc.id);