fix: resolve typescript configs and finish merge

Their three commits (730d0bd, 5a9b543, 387edfb) reached production by push and
auto-deployed. 387edfb expects a users.username column that the live database does
not have, so POST /api/v1/auth/login was returning HTTP 500. Their schema changes
never applied either (projects still has only id, name, description, start_date,
pm_user_id, created_at), so nothing depends on the reverted code.

This commit sets the tree back to exactly a02b3ea — verified with git diff against
it — while keeping history linear: the work itself is preserved on 'pm' at 387edfb.

README.md

@@ -1,3 +1,4 @@
+
 # Procurement Stack v1.3 — Dockerized (PostgreSQL + FastAPI + React + MinIO)
 
 Self-contained ship package: everything needed to run the stack is in this
@@ -12,19 +13,22 @@ folder — no external files or sibling folders required.
 | **frontend** | `procurement-frontend` | React 19 + Vite, served by nginx (internal) | via Traefik |
 | **traefik** | `procurement-traefik` | Traefik v3 — public reverse proxy (edge) | `80` (web), `443` (websecure) |
 
+
 ```
+
 Browser ──► Traefik :80 (edge)
-                │
-                ├── Host(localhost) ──► frontend (nginx SPA :80)
-                │                            │
-                │                            └── /api/* proxy ──► api :8000 (/api/v1)
-                │
-                ├── Host(api.localhost) ──► api :8000
-                ├── Host(auth.localhost) ──► casdoor :8000 (OIDC login)
-                └── Host(s3/storage.localhost) ──► minio (API / console)
-                                  │
-                                  ├── postgres :5432 (procurement + casdoor DBs)
-                                  └── minio :9000 (invoice/proforma files)
+│
+├── Host(localhost) ──► frontend (nginx SPA :80)
+│                            │
+│                            └── /api/* proxy ──► api :8000 (/api/v1)
+│
+├── Host(api.localhost) ──► api :8000
+├── Host(auth.localhost) ──► casdoor :8000 (OIDC login)
+└── Host(s3/storage.localhost) ──► minio (API / console)
+│
+├── postgres :5432 (procurement + casdoor DBs)
+└── minio :9000 (invoice/proforma files)
+
 ```
 
 ---
@@ -74,6 +78,7 @@ v1.3/
             ├── Projects/     (projects)
             ├── Units/        (unit conversions)
             └── Inventory/    (warehouse management panel — React port)
+
 ```
 
 ---
@@ -86,12 +91,12 @@ the form (username / password) is sent to
 (password grant), verifies the returned JWT, and starts the session —
 no browser redirect to Casdoor.
 
-- **مدیر پروژه (PM)** → lands in the inventory panel (their project) — can record
-  stock changes, manage the project's warehouses and confirm arrivals («کالاهای در راه»).
-- **مدیر تدارکات / ادمین** → lands in the procurement office — can manage
-  quotes, suppliers, projects, and in the inventory panel: dashboard, daily control,
-  «کالاهای در راه» (receiving included) and «سازمان‌دهی» (users, PMs, warehouses).
-  The «انبارها» and «تغییر موجودی» sections are PM-only.
+* **مدیر پروژه (PM)** → lands in the inventory panel (their project) — can record
+stock changes, manage the project's warehouses and confirm arrivals («کالاهای در راه»).
+* **مدیر تدارکات / ادمین** → lands in the procurement office — can manage
+quotes, suppliers, projects, and in the inventory panel: dashboard, daily control,
+«کالاهای در راه» (receiving included) and «سازمان‌دهی» (users, PMs, warehouses).
+The «انبارها» and «تغییر موجودی» sections are PM-only.
 
 **Developer Mode** (top-left button on the login page) is a 3-step flow for
 the admin (super user): ① superuser auth gate (admin credentials only) →
@@ -103,7 +108,7 @@ controlled by the `VITE_ENABLE_DEV_LOGIN` env var (in Docker: the
 for production builds).
 
 | What | Where | Credentials |
-|---|---|---|
+| --- | --- | --- |
 | App | http://localhost (via Traefik) | — |
 | Casdoor console | http://localhost:8080 | admin credentials are set when you run the seeder (`CASDOOR_ADMIN_PW`) — never commit them |
 | Seeded app users (org `inventory`) | `razaei` (admin), `mousavi` (مدیر تدارکات), `mohaghegh` (مدیر پروژه), `tester` (مدیر پروژه، پروژه «تست») | password from `CASDOOR_SEED_PASSWORD` (bcrypt-hashed at rest — see `backend/tools/seed_casdoor.py`) |
@@ -111,11 +116,11 @@ for production builds).
 Run `backend/tools/seed_casdoor.py` once after the first boot to create the
 Casdoor organization, application and users (idempotent). Full details —
 addresses, credentials, role model, failure scenarios and the checklist —
-are in [`docs/casdoor-auth.md`](docs/casdoor-auth.md).
+are in [`docs/casdoor-auth.md`](https://www.google.com/search?q=docs/casdoor-auth.md).
 
 > The **currently committed seed** (`backups/علی محقق/`) instead ships a
 > single admin — `ali.mohaghegh` («علی محقق») — see
-> [Restoring the committed seed data](#restoring-the-committed-seed-data).
+> [Restoring the committed seed data](https://www.google.com/search?q=%23restoring-the-committed-seed-data).
 
 ---
 
@@ -125,13 +130,13 @@ The production deployment of this stack runs on the server and is reachable
 at these public addresses (HTTPS):
 
 | What | Address |
-|---|---|
+| --- | --- |
 | **App (ERP)** | https://aramesh.bennu-api-bahrestan.ir/ |
 | **Casdoor admin panel** | https://casdoor.bennu-api-bahrestan.ir/ |
 
 Log in to the app with your Casdoor account (org `inventory`); the role is
 assigned inside the app (`users.role` — see «Login» above and
-[`docs/casdoor-auth.md`](docs/casdoor-auth.md)).
+[`docs/casdoor-auth.md`](https://www.google.com/search?q=docs/casdoor-auth.md)).
 
 ### MinIO console on the server (SSH tunnel)
 
@@ -140,21 +145,20 @@ The MinIO console is deliberately **loopback-only** on the server
 is an SSH tunnel from your machine:
 
 1. Open PowerShell and start the tunnel (**keep the window open** while you
-   use the panel):
+use the panel):
+```powershell
+ssh -L 9001:127.0.0.1:9001 <user>@<server-host>
 
-   ```powershell
-   ssh -L 9001:127.0.0.1:9001 <user>@<server-host>
-   ```
+```
 
-   You will also land in a normal SSH session — that is fine; the tunnel
-   lives as long as the window stays open.
 
+You will also land in a normal SSH session — that is fine; the tunnel
+lives as long as the window stays open.
 2. In your browser, open: **http://localhost:9001**
-
 3. Log in with the production MinIO root credentials from the server's
-   `/srv/erp/.env` (`MINIO_ROOT_USER` / `MINIO_ROOT_PASSWORD`) — they are
-   **never** written in this repo or its history. See
-   [`docs/SECRET-MANAGEMENT.md`](docs/SECRET-MANAGEMENT.md).
+`/srv/erp/.env` (`MINIO_ROOT_USER` / `MINIO_ROOT_PASSWORD`) — they are
+**never** written in this repo or its history. See
+[`docs/SECRET-MANAGEMENT.md`](https://www.google.com/search?q=docs/SECRET-MANAGEMENT.md).
 
 You will see the **`procurement-files`** bucket — the invoices/proformas the
 ERP stores, browsable and downloadable from there.
@@ -168,22 +172,22 @@ tunnel.
 
 Notes from the server setup:
 
-- The panel is published only on the server's loopback, so the internet
-  cannot reach it at all — the tunnel is what carries it to your browser.
-- Host port `9000` stays reserved for the deploy-webhook receiver, which is
-  why the console uses `9001`.
-- If you ever need the raw S3 API from your machine, or a clickable URL for
-  the console (e.g. `storage.aramesh.bennu-api-bahrestan.ir` behind Traefik
-  with a password prompt on top), that can be arranged on request — the
-  tunnel remains the safer default.
+* The panel is published only on the server's loopback, so the internet
+cannot reach it at all — the tunnel is what carries it to your browser.
+* Host port `9000` stays reserved for the deploy-webhook receiver, which is
+why the console uses `9001`.
+* If you ever need the raw S3 API from your machine, or a clickable URL for
+the console (e.g. `storage.aramesh.bennu-api-bahrestan.ir` behind Traefik
+with a password prompt on top), that can be arranged on request — the
+tunnel remains the safer default.
 
 ---
 
 ## Prerequisites (target machine)
 
-- **Docker Desktop** (Windows) or Docker Engine + Compose plugin (Linux/macOS)
-- ~3–4 GB free disk for images (`postgres:18`, `python:3.13-slim`, `node:22-alpine`, `nginx:alpine`, `minio/minio`, `minio/mc`)
-- Internet access on first build (image + `npm ci` downloads)
+* **Docker Desktop** (Windows) or Docker Engine + Compose plugin (Linux/macOS)
+* ~3–4 GB free disk for images (`postgres:18`, `python:3.13-slim`, `node:22-alpine`, `nginx:alpine`, `minio/minio`, `minio/mc`)
+* Internet access on first build (image + `npm ci` downloads)
 
 ---
 
@@ -192,6 +196,7 @@ Notes from the server setup:
 ```powershell
 cd <this-folder>
 docker compose up -d --build
+
 ```
 
 First run downloads base images and builds the frontend (takes a few minutes).
@@ -201,6 +206,7 @@ Wait until all services are up:
 
 ```powershell
 docker compose ps
+
 ```
 
 All should show `Up` (postgres also `(healthy)`).
@@ -210,7 +216,7 @@ All should show `Up` (postgres also `(healthy)`).
 ## Verify
 
 | What | Where |
-|---|---|
+| --- | --- |
 | Frontend UI | http://localhost |
 | API docs (Swagger) | http://localhost:8000/docs |
 | API health | http://localhost:8000/health → `{"status":"ok","service":"procurement-api"}` |
@@ -225,23 +231,24 @@ Automated end-to-end checks (authenticates via `SMOKE_USER` /
 ```powershell
 backend\tools\smoke_test.py   # read paths
 backend\tools\smoke_test_write.py / smoke_test_misc.py
+
 ```
 
 > Every API route now requires a Casdoor JWT — a bare
 > `curl http://localhost/api/v1/quotes` returns **401** by design.
-> Day-2 operations (deploys, backups, monitoring): [`docs/OPERATIONS.md`](docs/OPERATIONS.md).
+> Day-2 operations (deploys, backups, monitoring): [`docs/OPERATIONS.md`](https://www.google.com/search?q=docs/OPERATIONS.md).
 
 ---
 
 ## MinIO (object storage for invoice / proforma files)
 
 | Item | Value |
-|---|---|
+| --- | --- |
 | S3 API endpoint | `localhost:9000` (from the API container: `minio:9000`) |
 | Web console | http://localhost:9001 |
 | Root user / password | `minioadmin` / `minioadmin` (dev — change for production) |
 | Bucket | `procurement-files` (created automatically by the `minio-init` container) |
-| Object key layout | `{quote_id}/{kind}/{attachment_id}` where kind = `invoice` \| `proforma` |
+| Object key layout | `{quote_id}/{kind}/{attachment_id}` where kind = `invoice` | `proforma` |
 
 File **bytes** live in MinIO; the `quote_attachments` table holds the metadata.
 
@@ -249,6 +256,7 @@ Ad-hoc bucket inspection from the host (see `mc.cmd`):
 
 ```powershell
 .\mc.cmd ls --recursive
+
 ```
 
 ---
@@ -261,10 +269,12 @@ Port:     5433
 Database: procurement
 Username: postgres
 Password: postgres
+
 ```
 
 ```powershell
 docker exec -it procurement-postgres psql -U postgres -d procurement
+
 ```
 
 ---
@@ -276,26 +286,28 @@ database dumps must never be committed (they contain user rows and signing
 material). Two supported ways to bring a fresh stack up:
 
 1. **Empty boot** — schema v2.6 auto-applies on the first boot of an empty
-   `postgres_data` volume; then run the seeders:
+`postgres_data` volume; then run the seeders:
+```powershell
+# Casdoor org + app + users (prints/generates credentials — do not commit them)
+docker compose run --rm -e CASDOOR_BASE=http://casdoor:8000 api python tools/seed_casdoor.py
+# Demo dataset (optional):
+docker exec procurement-api sh -c "cd /srv/backend && python -m tools.seed"
+
+```
 
-   ```powershell
-   # Casdoor org + app + users (prints/generates credentials — do not commit them)
-   docker compose run --rm -e CASDOOR_BASE=http://casdoor:8000 api python tools/seed_casdoor.py
-   # Demo dataset (optional):
-   docker exec procurement-api sh -c "cd /srv/backend && python -m tools.seed"
-   ```
 
 2. **Restore your own dump** — create dumps on the server (kept server-side,
-   e.g. `/srv/erp/backups/`), never in git:
+e.g. `/srv/erp/backups/`), never in git:
+```powershell
+docker exec procurement-postgres pg_dump -U postgres -d procurement -Fc > /srv/erp/backups/procurement-$(date +%F).dump
+docker exec procurement-postgres pg_dump -U postgres -d casdoor    -Fc > /srv/erp/backups/casdoor-$(date +%F).dump
 
-   ```powershell
-   docker exec procurement-postgres pg_dump -U postgres -d procurement -Fc > /srv/erp/backups/procurement-$(date +%F).dump
-   docker exec procurement-postgres pg_dump -U postgres -d casdoor    -Fc > /srv/erp/backups/casdoor-$(date +%F).dump
-   ```
+```
 
-   Restore with `pg_restore --clean --if-exists` (stop `api` + `casdoor`
-   first — this **replaces all data**). The scheduled backup sidecar
-   (see `docs/OPERATIONS.md`) automates this.
+
+Restore with `pg_restore --clean --if-exists` (stop `api` + `casdoor`
+first — this **replaces all data**). The scheduled backup sidecar
+(see `docs/OPERATIONS.md`) automates this.
 
 ## Common operations
 
@@ -304,40 +316,44 @@ docker compose logs -f api          # see logs
 docker compose down                 # stop (keep data)
 docker compose up -d --build        # rebuild after code changes
 docker compose down -v              # ⚠️ full reset — wipes DB + MinIO volumes
+
 ```
 
 ---
 
 ## Known behavior
 
-- Authentication is Casdoor-based (JWT verified via JWKS) and **required on
-  every API route** except `/health`, `/health/ready` and `/auth/login`
-  (401 without a token, 403 without a role). The former dev-header fallback
-  (`X-User-Role` / `X-User-Name-B64`) is disabled unless
-  `PROCUREMENT_DEV_LOGIN_ENABLED=true` — never enable it in production.
-- Roles live in the app's `users` table (Casdoor is identity-only): `pm`,
-  `procurement_manager`, `admin`. Role changes are **admin-only** (RBAC);
-  the procurement manager can only assign projects to project managers.
-  The admin has a dedicated panel at `/admin` (user sync from Casdoor +
-  grant/revoke «مدیر تدارکات»).
-- **Partial goods receipt** («رسید جزیی») is supported in «کالاهای در راه»:
-  at least one item with a valid quantity is enough to submit; other items
-  stay in transit. The procurement ledger shows «رسیده X از Y» / «در راه Z»
-  badges and a «رسید جزیی» badge on the quote.
-- **One PostgreSQL instance** serves both the app (`procurement`) and Casdoor
-  (`casdoor`) — the separate casdoor-postgres container is gone (data was
-  dumped/restored; see `docs/casdoor-auth.md`).
-- **Traefik v3** is the public edge (ports 80/443); the frontend nginx only
-  serves the SPA and proxies `/api` internally. Production (real domains,
-  HTTPS via Let's Encrypt, HTTP→HTTPS redirect):
-  `docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build`
-  (see the prod file header for the required env vars).
-- Schema runs automatically ONLY on the first boot of an empty `postgres_data` volume
-  (see `docker-entrypoint-initdb.d`); the API also runs `CREATE TABLE IF NOT EXISTS`
-  for the units-dashboard tables and `quote_attachments` at startup.
-- Invoice upload requires an `accepted`/`arrived` quote; proforma has no restriction.
-- The supplier detail page (`/suppliers/:id`) shows the purchase history with
-  invoice/proforma download links from MinIO.
-- If builds fail with disk-full errors: `docker system prune -a`, then rebuild.
-- If the frontend shows «اتصال به سرور برقرار نشد» → the api container is not
-  reachable; check `docker compose ps` and `docker compose logs api`.
+* Authentication is Casdoor-based (JWT verified via JWKS) and **required on
+every API route** except `/health`, `/health/ready` and `/auth/login`
+(401 without a token, 403 without a role). The former dev-header fallback
+(`X-User-Role` / `X-User-Name-B64`) is disabled unless
+`PROCUREMENT_DEV_LOGIN_ENABLED=true` — never enable it in production.
+* Roles live in the app's `users` table (Casdoor is identity-only): `pm`,
+`procurement_manager`, `admin`. Role changes are **admin-only** (RBAC);
+the procurement manager can only assign projects to project managers.
+The admin has a dedicated panel at `/admin` (user sync from Casdoor +
+grant/revoke «مدیر تدارکات»).
+* **Partial goods receipt** («رسید جزیی») is supported in «کالاهای در راه»:
+at least one item with a valid quantity is enough to submit; other items
+stay in transit. The procurement ledger shows «رسیده X از Y» / «در راه Z»
+badges and a «رسید جزیی» badge on the quote.
+* **One PostgreSQL instance** serves both the app (`procurement`) and Casdoor
+(`casdoor`) — the separate casdoor-postgres container is gone (data was
+dumped/restored; see `docs/casdoor-auth.md`).
+* **Traefik v3** is the public edge (ports 80/443); the frontend nginx only
+serves the SPA and proxies `/api` internally. Production (real domains,
+HTTPS via Let's Encrypt, HTTP→HTTPS redirect):
+`docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build`
+(see the prod file header for the required env vars).
+* Schema runs automatically ONLY on the first boot of an empty `postgres_data` volume
+(see `docker-entrypoint-initdb.d`); the API also runs `CREATE TABLE IF NOT EXISTS`
+for the units-dashboard tables and `quote_attachments` at startup.
+* Invoice upload requires an `accepted`/`arrived` quote; proforma has no restriction.
+* The supplier detail page (`/suppliers/:id`) shows the purchase history with
+invoice/proforma download links from MinIO.
+* **Material-Supplier Lookup**: Clicking a material in the catalog (e.g., on the `/units` page) dynamically fetches its assigned suppliers (`GET /api/materials/{id}/suppliers`). The backend uses an atomic JOIN to guarantee accurate supplier data (avoiding SQLAlchemy identity-map mismatches), and the UI displays a clean empty state («تامین‌کننده‌ای برای این متریال ثبت نشده است») if none exist.
+* If builds fail with disk-full errors: `docker system prune -a`, then rebuild.
+* If the frontend shows «اتصال به سرور برقرار نشد» → the api container is not
+reachable; check `docker compose ps` and `docker compose logs api`.
+
+```

backend/app/auth.py

@@ -27,7 +27,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.config import settings
 from app.db.engine import AsyncSessionLocal
-from app.models.procurement import Project, User, UserPanel, UserProjectMembership
+from app.models.procurement import Project, User
 from app.utils.errors import (
     ForbiddenError,
     ServiceUnavailableError,
@@ -106,10 +106,6 @@ class UserContext:
     project_id: object | None  # uuid.UUID | None — default (first) project of a PM
     project_ids: list  # every project this PM manages (1:N — empty for non-PMs)
     display_name: str
-    # لایه پنل‌ها (جایگزین نقش‌ها): {'procurement': 'full'|'limited', 'inventory': ...}
-    panels: dict | None = None
-    # عضویت M:N در پروژه‌ها — محدوده داده سطح limited (جدا از مسئولیت PM)
-    member_project_ids: list | None = None
 
 
 async def context_from_claims(claims: dict, db: AsyncSession) -> UserContext:
@@ -123,12 +119,10 @@ async def context_from_claims(claims: dict, db: AsyncSession) -> UserContext:
     if not casdoor_id:
         raise UnauthorizedError("توکن فاقد شناسه کاربر است", field="authorization")
 
-    username = str(claims.get("name") or claims.get("preferred_username") or "")
     user = await db.scalar(select(User).where(User.casdoor_id == casdoor_id))
     if user is None:
         user = User(
             casdoor_id=casdoor_id,
-            username=username or None,
             first_name=str(
                 claims.get("firstName")
                 or claims.get("firstname")
@@ -141,42 +135,17 @@ async def context_from_claims(claims: dict, db: AsyncSession) -> UserContext:
         )
         db.add(user)
         await db.flush()
-    elif username and not user.username:
-        user.username = username
-        await db.flush()
 
-    # لایه پنل‌ها: تخصیص پنل + سطح دسترسی و عضویت پروژه‌ای (جدا از نقش)
-    panels: dict = {}
-    panel_rows = (
-        await db.execute(
-            select(UserPanel).where(UserPanel.user_id == user.id).order_by(UserPanel.created_at)
-        )
-    ).scalars().all()
-    for row in panel_rows:
-        panels[row.panel] = row.level
-
-    member_project_ids: list = [
-        row.project_id
-        for row in (
-            await db.execute(
-                select(UserProjectMembership)
-                .where(UserProjectMembership.user_id == user.id)
-                .order_by(UserProjectMembership.created_at)
-            )
-        ).scalars().all()
-    ]
-
-    pm_projects = (
+    project_ids: list = []
+    if user.role == "pm":
+        projects = (
             await db.execute(
                 select(Project)
                 .where(Project.pm_user_id == user.id)
                 .order_by(Project.created_at, Project.id)
             )
         ).scalars().all()
-    pm_project_ids_list = [p.id for p in pm_projects]
-
-    # ترکیب پروژه‌های تحت مدیریت مستقیم و پروژه‌های عضویت با حفظ اولویت و بدون تکرار
-    project_ids = list(dict.fromkeys(pm_project_ids_list + member_project_ids))
+        project_ids = [p.id for p in projects]
     project_id = project_ids[0] if project_ids else None
 
     display_name = f"{user.first_name} {user.last_name}".strip() or user.casdoor_id
@@ -186,28 +155,19 @@ async def context_from_claims(claims: dict, db: AsyncSession) -> UserContext:
         project_id=project_id,
         project_ids=project_ids,
         display_name=display_name,
-        panels=panels,
-        member_project_ids=member_project_ids,
     )
 
 
 async def pm_project_ids(db: AsyncSession, user: User) -> list:
-    """Every project id managed or assigned to the given PM/supervisor user (oldest first)."""
-    pm_rows = (
+    """Every project id managed by the given PM user (oldest first)."""
+    rows = (
         await db.execute(
             select(Project.id)
             .where(Project.pm_user_id == user.id)
             .order_by(Project.created_at, Project.id)
         )
     ).scalars().all()
-    member_rows = (
-        await db.execute(
-            select(UserProjectMembership.project_id)
-            .where(UserProjectMembership.user_id == user.id)
-            .order_by(UserProjectMembership.created_at)
-        )
-    ).scalars().all()
-    return list(dict.fromkeys(list(pm_rows) + list(member_rows)))
+    return list(rows)
 
 
 async def get_optional_user(request: Request, db: AsyncSession | None = None) -> UserContext | None:
@@ -257,31 +217,3 @@ def require_role(*roles: str):
             raise ForbiddenError("دسترسی به این بخش برای نقش شما مجاز نیست")
         return ctx
     return _dep
-
-
-def require_procurement_writer():
-    """نوشتن در پنل تدارکات — ادمین، پنل تدارکات 'full'، یا نقش میراث مدیر تدارکات
-    (دوره مهاجرت از مدل نقش به مدل پنل)."""
-
-    async def _dep(ctx: UserContext = Depends(get_current_user)) -> UserContext:
-        if ctx.role in ("admin", "procurement_manager"):
-            return ctx
-        if (ctx.panels or {}).get("procurement") == "full":
-            return ctx
-        raise ForbiddenError("دسترسی نوشتن در پنل تدارکات را ندارید")
-
-    return _dep
-
-
-def allow_quote_create():
-    """افزودن استعلام — علاوه بر «نوشتن»، پنل تدارکات 'limited' هم مجاز است
-    (محدود به پروژه‌های عضویت؛ اعتبارسنجی عضویت در خود endpoint انجام می‌شود)."""
-
-    async def _dep(ctx: UserContext = Depends(get_current_user)) -> UserContext:
-        if ctx.role in ("admin", "procurement_manager"):
-            return ctx
-        if (ctx.panels or {}).get("procurement") in ("full", "limited"):
-            return ctx
-        raise ForbiddenError("دسترسی افزودن استعلام ندارید")
-
-    return _dep

backend/app/db/init_db.py

@@ -174,7 +174,7 @@ _V26_DDL = [
     """,
     """
     DO $$ BEGIN
-        CREATE TYPE user_role AS ENUM ('pm', 'procurement_manager', 'admin', 'supervisor');
+        CREATE TYPE user_role AS ENUM ('pm', 'procurement_manager', 'admin');
     EXCEPTION WHEN duplicate_object THEN NULL; END $$
     """,
     """

backend/app/models/procurement.py

@@ -26,7 +26,7 @@ from app.db.base import Base
 from app.models.catalog import Material, Unit, _timestamptz, _uuid_pk
 
 user_role_enum = Enum(
-    "pm", "procurement_manager", "admin", "supervisor",
+    "pm", "procurement_manager", "admin",
     name="user_role", native_enum=True,
 )
 quote_status_enum = Enum(
@@ -58,7 +58,6 @@ class User(Base):
 
     id: Mapped[uuid.UUID] = _uuid_pk()
     casdoor_id: Mapped[str] = mapped_column(Text, nullable=False, unique=True)
-    username: Mapped[str | None] = mapped_column(Text)
     first_name: Mapped[str] = mapped_column(Text, nullable=False)
     last_name: Mapped[str] = mapped_column(Text, nullable=False)
     phone: Mapped[str | None] = mapped_column(Text)
@@ -66,47 +65,6 @@ class User(Base):
     created_at: Mapped[datetime] = _timestamptz()
 
 
-class UserPanel(Base):
-    """user_panels — تخصیص پنل + سطح دسترسی به کاربر (جایگزین مدل نقش).
-
-    panel:  'procurement' | 'inventory' | 'pm'
-    level:  'full'    — تدارکات: تغییر کامل در کل پنل؛ انبار: همه پروژه‌ها
-                        (به‌جز تغییر موجودی)
-            'limited' — تدارکات: فقط افزودن استعلام برای پروژه‌های عضویت؛
-                        انبار: فقط پروژه‌های عضویت + امکان تغییر موجودی
-    """
-
-    __tablename__ = "user_panels"
-
-    id: Mapped[uuid.UUID] = _uuid_pk()
-    user_id: Mapped[uuid.UUID] = mapped_column(
-        ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
-    )
-    panel: Mapped[str] = mapped_column(Text, nullable=False)
-    level: Mapped[str] = mapped_column(Text, nullable=False)
-    created_at: Mapped[datetime] = _timestamptz()
-
-    __table_args__ = (UniqueConstraint("user_id", "panel", name="uq_user_panel"),)
-
-
-class UserProjectMembership(Base):
-    """user_project_members — عضویت M:N کاربر در پروژه‌ها، جدا از مسئولیت
-    پروژه (projects.pm_user_id). محدوده‌ی داده‌ی سطح limited را تعیین می‌کند."""
-
-    __tablename__ = "user_project_members"
-
-    id: Mapped[uuid.UUID] = _uuid_pk()
-    user_id: Mapped[uuid.UUID] = mapped_column(
-        ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
-    )
-    project_id: Mapped[uuid.UUID] = mapped_column(
-        ForeignKey("projects.id", ondelete="CASCADE"), nullable=False, index=True
-    )
-    created_at: Mapped[datetime] = _timestamptz()
-
-    __table_args__ = (UniqueConstraint("user_id", "project_id", name="uq_user_project_member"),)
-
-
 class Supplier(Base):
     __tablename__ = "suppliers"
 
@@ -190,23 +148,12 @@ class Project(Base):
     id: Mapped[uuid.UUID] = _uuid_pk()
     name: Mapped[str] = mapped_column(Text, nullable=False)
     description: Mapped[str | None] = mapped_column(Text)
-    location: Mapped[str | None] = mapped_column(Text, server_default=text("''"))
-    project_manager: Mapped[str | None] = mapped_column(Text, server_default=text("''"))
     start_date: Mapped[date | None] = mapped_column(Date)
-    planned_start: Mapped[date | None] = mapped_column(Date)
-    planned_end: Mapped[date | None] = mapped_column(Date)
-    actual_start: Mapped[date | None] = mapped_column(Date)
-    actual_end: Mapped[date | None] = mapped_column(Date)
-    status: Mapped[str | None] = mapped_column(Text, server_default=text("'ACTIVE'"))
-    progress: Mapped[float | None] = mapped_column(Numeric(5, 2), server_default=text("0.0"))
     # v2.6: the single PM responsible for this project (confirms arrivals).
     pm_user_id: Mapped[uuid.UUID | None] = mapped_column(
         ForeignKey("users.id", ondelete="SET NULL")
     )
     created_at: Mapped[datetime] = _timestamptz()
-    updated_at: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), server_default=func.now(), onupdate=func.now()
-    )
 
 
 class Quote(Base):

backend/app/routers/attribute_definitions.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import AttributeDefinition, MaterialAttributeValue, Unit
 from app.models.procurement import LineItemSpec
@@ -14,7 +13,6 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/attribute-definitions", tags=["attribute-definitions"])
-_procurement_writer = require_procurement_writer()
 
 
 def attr_def_to_dict(ad: AttributeDefinition, unit: Unit | None = None) -> dict:
@@ -71,11 +69,7 @@ async def list_attribute_definitions(
 
 
 @router.post("", status_code=201)
-async def create_attribute_definition(
-    payload: AttributeDefinitionCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def create_attribute_definition(payload: AttributeDefinitionCreate, db: AsyncSession = Depends(get_db)):
     duplicate = await db.scalar(select(AttributeDefinition.id).where(AttributeDefinition.attribute_key == payload.attribute_key))
     if duplicate is not None:
         raise ConflictError("ویژگی با این attribute_key قبلاً ثبت شده است", field="attribute_key")
@@ -108,10 +102,7 @@ async def get_attribute_definition(
 
 @router.patch("/{definition_id}")
 async def update_attribute_definition(
-    definition_id,
-    payload: AttributeDefinitionUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    definition_id, payload: AttributeDefinitionUpdate, db: AsyncSession = Depends(get_db)
 ):
     ad = await db.get(AttributeDefinition, definition_id)
     if ad is None:
@@ -145,11 +136,7 @@ async def update_attribute_definition(
 
 
 @router.delete("/{definition_id}")
-async def delete_attribute_definition(
-    definition_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_attribute_definition(definition_id, db: AsyncSession = Depends(get_db)):
     ad = await db.get(AttributeDefinition, definition_id)
     if ad is None:
         raise NotFoundError("تعریف ویژگی یافت نشد")

backend/app/routers/auth.py

@@ -22,7 +22,7 @@ from app.config import settings
 from app.db.engine import get_db
 from app.routers.users import _user_projects, user_to_dict
 from app.services import analytics
-from app.utils.errors import ForbiddenError, ServiceUnavailableError, UnauthorizedError
+from app.utils.errors import ServiceUnavailableError, UnauthorizedError
 from app.utils.ratelimit import limiter
 
 logger = logging.getLogger("procurement.auth")
@@ -78,9 +78,6 @@ async def login(request: Request, payload: LoginRequest, db: AsyncSession = Depe
     claims = await _verify_token(access_token)
     ctx = await context_from_claims(claims, db)
     projects = await _user_projects(db, ctx.user)
-    has_projects = bool(projects) or bool(ctx.project_ids) or bool(ctx.member_project_ids)
-    if ctx.role == "supervisor" and not has_projects:
-        raise ForbiddenError("پروژه تخصیص داده نشده است — تا زمان تخصیص پروژه، اجازه ورود به سامانه را ندارید")
     await analytics.track(
         "login_success",
         {"username": payload.username, "role": ctx.role},
@@ -95,6 +92,6 @@ async def login(request: Request, payload: LoginRequest, db: AsyncSession = Depe
             "access_token": access_token,
             "token_type": "bearer",
             "expires_in": body.get("expires_in"),
-            "user": await user_to_dict(ctx.user, projects, db),
+            "user": user_to_dict(ctx.user, projects),
         }
     }

backend/app/routers/brand_materials.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import Brand, BrandMaterial, Material
 from app.models.procurement import LineItem
@@ -13,7 +12,6 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/brand-materials", tags=["brand-materials"])
-_procurement_writer = require_procurement_writer()
 
 
 def bm_to_dict(bm: BrandMaterial, expand: set[str] = frozenset()) -> dict:
@@ -72,11 +70,7 @@ async def list_brand_materials(
 
 
 @router.post("", status_code=201)
-async def create_brand_material(
-    payload: BrandMaterialCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def create_brand_material(payload: BrandMaterialCreate, db: AsyncSession = Depends(get_db)):
     if await db.get(Brand, payload.brand_id) is None:
         raise NotFoundError("برند یافت نشد", field="brand_id")
     if await db.get(Material, payload.material_id) is None:
@@ -113,12 +107,7 @@ async def get_brand_material(bm_id, expand: str | None = None, db: AsyncSession
 
 
 @router.patch("/{bm_id}")
-async def update_brand_material(
-    bm_id,
-    payload: BrandMaterialUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def update_brand_material(bm_id, payload: BrandMaterialUpdate, db: AsyncSession = Depends(get_db)):
     bm = await db.get(BrandMaterial, bm_id)
     if bm is None:
         raise NotFoundError("ارتباط برند-متریال یافت نشد")
@@ -131,11 +120,7 @@ async def update_brand_material(
 
 
 @router.delete("/{bm_id}")
-async def delete_brand_material(
-    bm_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_brand_material(bm_id, db: AsyncSession = Depends(get_db)):
     bm = await db.get(BrandMaterial, bm_id)
     if bm is None:
         raise NotFoundError("ارتباط برند-متریال یافت نشد")

backend/app/routers/brands.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import Brand, BrandMaterial
 from app.schemas.catalog import BrandCreate, BrandUpdate
@@ -12,7 +11,6 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/brands", tags=["brands"])
-_procurement_writer = require_procurement_writer()
 
 
 def brand_to_dict(brand: Brand) -> dict:
@@ -44,11 +42,7 @@ async def list_brands(
 
 
 @router.post("", status_code=201)
-async def create_brand(
-    payload: BrandCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def create_brand(payload: BrandCreate, db: AsyncSession = Depends(get_db)):
     rows = (await db.execute(select(Brand).where(Brand.name == payload.name))).scalars().all()
     if any(b.country == payload.country for b in rows):
         raise ConflictError("برندی با این نام و کشور قبلاً ثبت شده است")
@@ -67,12 +61,7 @@ async def get_brand(brand_id, db: AsyncSession = Depends(get_db)):
 
 
 @router.patch("/{brand_id}")
-async def update_brand(
-    brand_id,
-    payload: BrandUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def update_brand(brand_id, payload: BrandUpdate, db: AsyncSession = Depends(get_db)):
     brand = await db.get(Brand, brand_id)
     if brand is None:
         raise NotFoundError("برند یافت نشد")
@@ -90,11 +79,7 @@ async def update_brand(
 
 
 @router.delete("/{brand_id}")
-async def delete_brand(
-    brand_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_brand(brand_id, db: AsyncSession = Depends(get_db)):
     brand = await db.get(Brand, brand_id)
     if brand is None:
         raise NotFoundError("برند یافت نشد")

backend/app/routers/files.py

@@ -29,10 +29,9 @@ from app.utils.preview_token import make_preview_token, verify_preview_token
 
 router = APIRouter(prefix="/quotes", tags=["files"])
 
-# حذف و بارگذاری پیوست‌ها = عملیات تدارکات (ادمین / مدیر تدارکات)؛ دانلود
+# حذف پیوست‌ها = عملیات تدارکات (ادمین / مدیر تدارکات)؛ بارگذاری و دانلود
 # برای هر کاربر واردشده آزاد است.
 _attachment_deleter = require_role("procurement_manager", "admin")
-_attachment_writer = require_role("procurement_manager", "admin")
 
 ALLOWED_MIME_TYPES = {
     "image/png", "image/jpeg", "image/webp", "image/gif", "application/pdf",
@@ -126,7 +125,7 @@ async def _attachment_or_404(
 # Invoice — قابل بارگذاری در هر وضعیتی (از صفحه‌ی ویرایش)
 # ---------------------------------------------------------------------------
 
-@router.post("/{quote_id}/invoice", status_code=201, dependencies=[Depends(_attachment_writer)])
+@router.post("/{quote_id}/invoice", status_code=201, dependencies=[Depends(get_current_user)])
 async def upload_invoice(quote_id: uuid.UUID, file: UploadFile = File(...), db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     mime = _validate_upload(file)
@@ -209,7 +208,7 @@ async def delete_invoice(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: Asyn
 # Proforma — no status restriction
 # ---------------------------------------------------------------------------
 
-@router.post("/{quote_id}/proforma", status_code=201, dependencies=[Depends(_attachment_writer)])
+@router.post("/{quote_id}/proforma", status_code=201, dependencies=[Depends(get_current_user)])
 async def upload_proforma(quote_id: uuid.UUID, file: UploadFile = File(...), db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     mime = _validate_upload(file)

backend/app/routers/inventory.py

@@ -58,7 +58,6 @@ class Scope:
     role: str
     project_id: uuid.UUID | None
     actor: str | None
-    project_ids: list[uuid.UUID] | None = None
 
 
 async def inventory_scope(
@@ -76,41 +75,25 @@ async def inventory_scope(
     if request.headers.get("authorization"):
         user: UserContext = await get_optional_user(request, db)
         if user is not None:
-            panels = user.panels or {}
-            if user.role is None and not panels:
-                raise ForbiddenError("دسترسی شما هنوز در سیستم تعیین نشده است")
-            # ادمین: دست‌نخورده — همه‌چیز از جمله تغییر موجودی
-            if user.role == "admin":
+            if user.role is None:
+                raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
+            # v2.6: مدیر تدارکات = ادمین دفتر — دسترسی فقط‌خواندنی به پنل انبار.
+            if user.role == "procurement_manager":
                 return Scope(role="admin", project_id=project_id, actor=user.display_name)
-            # لایه پنل‌ها (جایگزین نقش‌ها): پنل انبار اولویت دارد
-            if "inventory" in panels:
-                if panels["inventory"] == "full":
-                    # کل سیستم و تمام پروژه‌ها — به‌جز تغییر موجودی
-                    return Scope(role="manager", project_id=project_id, actor=user.display_name, project_ids=list(user.member_project_ids or []))
-                # limited: فقط پروژه‌های عضویت + امکان تغییر موجودی
-                allowed = list(user.member_project_ids or [])
-                if not allowed:
-                    raise ForbiddenError("پروژه‌ای به شما تخصیص داده نشده است")
-                if project_id is not None:
-                    if project_id not in allowed:
-                        raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
-                    return Scope(role="supervisor", project_id=project_id, actor=user.display_name, project_ids=allowed)
-                return Scope(role="supervisor", project_id=allowed[0], actor=user.display_name, project_ids=allowed)
-            # مدیر تدارکات و مدیر پروژه (میراث): دسترسی کامل به پنل انبار، اما فقط‌خواندنی در تغییر موجودی
-            if user.role in ("procurement_manager", "pm"):
-                return Scope(role="manager", project_id=project_id, actor=user.display_name, project_ids=list(user.project_ids or []))
-            if user.role == "supervisor":
+            if user.role not in ("pm", "admin"):
+                raise ValidationError("نقش نامعتبر است — فقط pm یا admin برای موجودی", field="role")
+            if user.role == "pm":
                 allowed = list(user.project_ids or [])
-                if not allowed:
-                    raise ForbiddenError("پروژه تخصیص داده نشده است")
                 if project_id is not None:
                     if project_id not in allowed:
                         raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
-                    return Scope(role="supervisor", project_id=project_id, actor=user.display_name, project_ids=allowed)
-                return Scope(role="supervisor", project_id=allowed[0], actor=user.display_name, project_ids=allowed)
-            if user.role == "admin":
+                    return Scope(role="pm", project_id=project_id, actor=user.display_name)
+                if not allowed:
+                    raise ValidationError(
+                        "کاربر PM به هیچ پروژه‌ای متصل نیست (projects.pm_user_id)", field="project_id"
+                    )
+                return Scope(role="pm", project_id=allowed[0], actor=user.display_name)
             return Scope(role="admin", project_id=project_id, actor=user.display_name)
-            raise ValidationError("نقش نامعتبر است", field="role")
 
     # Dev fallback: header-based identity (fork's placeholder mode) — only
     # when DEV_LOGIN_ENABLED is explicitly turned on (local testing without
@@ -145,9 +128,9 @@ async def inventory_scope(
     return Scope(role=role, project_id=project_id, actor=actor)
 
 
-def _require_inventory_modifier(scope: Scope) -> None:
-    if scope.role not in (ROLE_ADMIN, "admin", "supervisor", ROLE_PM):
-        raise ForbiddenError("مدیر تدارکات و مدیر پروژه امکان تغییر موجودی انبار را ندارند — فقط سرپرست پروژه و ادمین مجاز هستند")
+def _require_pm(scope: Scope) -> None:
+    if scope.role != ROLE_PM:
+        raise ForbiddenError("دسترسی ادمین فقط خواندنی است — ثبت/تغییر موجودی مجاز نیست")
 
 
 # ---------------------------------------------------------------------------
@@ -232,16 +215,8 @@ async def list_warehouses(
     db: AsyncSession = Depends(get_db),
 ):
     stmt = select(Warehouse)
-    if scope.role in (ROLE_PM, "supervisor"):
-        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
-        if project_id is not None:
-            if project_id not in allowed:
-                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
-            stmt = stmt.where(Warehouse.project_id == project_id)
-        elif allowed:
-            stmt = stmt.where(Warehouse.project_id.in_(allowed))
-        else:
-            stmt = stmt.where(Warehouse.project_id == scope.project_id)
+    if scope.role == ROLE_PM:
+        stmt = stmt.where(Warehouse.project_id == scope.project_id)  # force PM scope
     elif project_id is not None:
         stmt = stmt.where(Warehouse.project_id == project_id)
     stmt = stmt.order_by(Warehouse.name)
@@ -273,11 +248,9 @@ async def create_warehouse(
     scope: Scope = Depends(inventory_scope),
     db: AsyncSession = Depends(get_db),
 ):
-    # PM / سرپرست: فقط پروژه خودش — Admin: ساختار را مدیریت می‌کند (هر پروژه)
-    if scope.role in (ROLE_PM, "supervisor"):
-        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
-        if payload.project_id not in allowed:
-            raise ValidationError("شما فقط می‌توانید برای پروژه تخصیص‌یافته به خود انبار بسازید", field="project_id")
+    # PM: فقط پروژه خودش — Admin: ساختار را مدیریت می‌کند (هر پروژه)
+    if scope.role == ROLE_PM and payload.project_id != scope.project_id:
+        raise ValidationError("PM فقط می‌تواند برای پروژه خودش انبار بسازد", field="project_id")
     if await db.get(Project, payload.project_id) is None:
         raise NotFoundError("پروژه یافت نشد", field="project_id")
     wh = Warehouse(project_id=payload.project_id, name=payload.name, description=payload.description)
@@ -294,9 +267,8 @@ async def update_warehouse(
     db: AsyncSession = Depends(get_db),
 ):
     wh = await get_warehouse_or_404(db, warehouse_id)
-    if scope.role in (ROLE_PM, "supervisor"):
-        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
-        if wh.project_id not in allowed:
+    if scope.role == ROLE_PM:
+        if scope.project_id != wh.project_id:
             raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
     if payload.name is not None:
         wh.name = payload.name
@@ -320,9 +292,7 @@ async def delete_warehouse(
     db: AsyncSession = Depends(get_db),
 ):
     wh = await get_warehouse_or_404(db, warehouse_id)
-    if scope.role in (ROLE_PM, "supervisor"):
-        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
-        if wh.project_id not in allowed:
+    if scope.role == ROLE_PM and scope.project_id != wh.project_id:
         raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
     # inventory rows cascade via DDL; transactions are RESTRICTed through
     # inventory cascade — block deletion if any stock history exists.
@@ -353,19 +323,7 @@ async def list_inventory(
     db: AsyncSession = Depends(get_db),
 ):
     stmt = select(InventoryItem)
-    if scope.role in (ROLE_PM, "supervisor"):
-        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
-        if project_id is not None:
-            if project_id not in allowed:
-                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
-            stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
-                Warehouse.project_id == project_id
-            )
-        elif allowed:
-            stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
-                Warehouse.project_id.in_(allowed)
-            )
-        else:
+    if scope.role == ROLE_PM:
         stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
             Warehouse.project_id == scope.project_id
         )
@@ -430,15 +388,7 @@ async def list_transactions(
     stmt = select(InventoryTransaction).join(
         InventoryItem, InventoryItem.id == InventoryTransaction.inventory_id
     ).join(Warehouse, Warehouse.id == InventoryItem.warehouse_id)
-    if scope.role in (ROLE_PM, "supervisor"):
-        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
-        if project_id is not None:
-            if project_id not in allowed:
-                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
-            stmt = stmt.where(Warehouse.project_id == project_id)
-        elif allowed:
-            stmt = stmt.where(Warehouse.project_id.in_(allowed))
-        else:
+    if scope.role == ROLE_PM:
         stmt = stmt.where(Warehouse.project_id == scope.project_id)
     elif project_id is not None:
         stmt = stmt.where(Warehouse.project_id == project_id)
@@ -504,9 +454,7 @@ async def inventory_history(
     if item is None:
         raise NotFoundError("موجودی یافت نشد")
     wh = await get_warehouse_or_404(db, item.warehouse_id)
-    if scope.role in (ROLE_PM, "supervisor"):
-        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
-        if wh.project_id not in allowed:
+    if scope.role == ROLE_PM and wh.project_id != scope.project_id:
         raise ForbiddenError("این موجودی متعلق به پروژه شما نیست")
     txs = (await db.execute(
         select(InventoryTransaction)
@@ -526,19 +474,17 @@ async def create_transaction(
     scope: Scope = Depends(inventory_scope),
     db: AsyncSession = Depends(get_db),
 ):
-    _require_inventory_modifier(scope)
+    _require_pm(scope)
     # No explicit db.begin(): the session may already be inside an implicit
     # transaction (inventory_scope read from it in the JWT path); get_db
     # commits on success / rolls back on failure.
     with nullcontext():
         wh = await get_warehouse_or_404(db, payload.warehouse_id)
-        allowed = scope.project_ids or ([scope.project_id] if scope.project_id else [])
-        if scope.role in (ROLE_PM, "supervisor"):
-            if wh.project_id not in allowed:
+        if wh.project_id != scope.project_id:
             raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
         if payload.dest_warehouse_id is not None:
             dest = await get_warehouse_or_404(db, payload.dest_warehouse_id)
-                if dest.project_id not in allowed:
+            if dest.project_id != scope.project_id:
                 raise ForbiddenError("انبار مقصد متعلق به پروژه شما نیست")
         txs = await apply_transaction(db, payload, performed_by=scope.actor)
         await audit_record(

backend/app/routers/item_receipts.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.procurement import ItemDecision, ItemReceipt, LineItem
 from app.schemas.procurement import ReceiptCreate, ReceiptUpdate
@@ -15,7 +14,6 @@ router = APIRouter(
     prefix="/quotes/{quote_id}/line-items/{line_item_id}/receipt",
     tags=["item-receipts"],
 )
-_procurement_writer = require_procurement_writer()
 
 
 async def _line_item_or_404(db: AsyncSession, quote_id, line_item_id) -> LineItem:
@@ -47,13 +45,7 @@ async def get_receipt(quote_id, line_item_id, db: AsyncSession = Depends(get_db)
 
 
 @router.post("", status_code=201)
-async def create_receipt(
-    quote_id,
-    line_item_id,
-    payload: ReceiptCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def create_receipt(quote_id, line_item_id, payload: ReceiptCreate, db: AsyncSession = Depends(get_db)):
     await _line_item_or_404(db, quote_id, line_item_id)
     decision = await _decision_or_404(db, line_item_id)
     existing = await db.scalar(select(ItemReceipt).where(ItemReceipt.item_decision_id == decision.id))
@@ -73,13 +65,7 @@ async def create_receipt(
 
 
 @router.patch("")
-async def update_receipt(
-    quote_id,
-    line_item_id,
-    payload: ReceiptUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def update_receipt(quote_id, line_item_id, payload: ReceiptUpdate, db: AsyncSession = Depends(get_db)):
     await _line_item_or_404(db, quote_id, line_item_id)
     decision = await db.scalar(select(ItemDecision).where(ItemDecision.line_item_id == line_item_id))
     if decision is None:

backend/app/routers/item_termsheets.py

@@ -7,7 +7,6 @@ from fastapi import APIRouter, Depends
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.procurement import (
     ItemDecision,
@@ -24,7 +23,6 @@ router = APIRouter(
     prefix="/quotes/{quote_id}/line-items/{line_item_id}/termsheets",
     tags=["item-termsheets"],
 )
-_procurement_writer = require_procurement_writer()
 
 
 async def _line_item_or_404(db: AsyncSession, quote_id, line_item_id) -> LineItem:
@@ -60,11 +58,7 @@ async def list_item_termsheets(quote_id, line_item_id, db: AsyncSession = Depend
 
 @router.post("", status_code=201)
 async def create_item_termsheet(
-    quote_id,
-    line_item_id,
-    payload: ItemTermsheetCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    quote_id, line_item_id, payload: ItemTermsheetCreate, db: AsyncSession = Depends(get_db)
 ):
     async with db.begin():
         li = await _line_item_or_404(db, quote_id, line_item_id)
@@ -99,12 +93,7 @@ async def create_item_termsheet(
 
 @router.patch("/{item_termsheet_id}")
 async def update_item_termsheet(
-    quote_id,
-    line_item_id,
-    item_termsheet_id,
-    payload: ItemTermsheetUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    quote_id, line_item_id, item_termsheet_id, payload: ItemTermsheetUpdate, db: AsyncSession = Depends(get_db)
 ):
     li = await _line_item_or_404(db, quote_id, line_item_id)
     quote = await db.get(Quote, quote_id)
@@ -125,11 +114,7 @@ async def update_item_termsheet(
 
 @router.delete("/{item_termsheet_id}")
 async def delete_item_termsheet(
-    quote_id,
-    line_item_id,
-    item_termsheet_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    quote_id, line_item_id, item_termsheet_id, db: AsyncSession = Depends(get_db)
 ):
     it = await db.scalar(
         select(ItemTermsheet).where(ItemTermsheet.id == item_termsheet_id, ItemTermsheet.line_item_id == line_item_id)

backend/app/routers/line_item_specs.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import AttributeDefinition, Unit
 from app.models.procurement import LineItem, LineItemSpec, Quote
@@ -13,7 +12,6 @@ from app.services.eav_service import flatten_eav_values
 from app.utils.errors import ConflictError, NotFoundError
 
 router = APIRouter(prefix="/quotes/{quote_id}/line-items/{line_item_id}/specs", tags=["line-item-specs"])
-_procurement_writer = require_procurement_writer()
 
 
 async def _line_item_or_404(db: AsyncSession, quote_id, line_item_id) -> LineItem:
@@ -55,13 +53,7 @@ async def get_line_item_specs(quote_id, line_item_id, db: AsyncSession = Depends
 
 
 @router.put("")
-async def put_line_item_specs(
-    quote_id,
-    line_item_id,
-    payload: SpecsPutIn,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def put_line_item_specs(quote_id, line_item_id, payload: SpecsPutIn, db: AsyncSession = Depends(get_db)):
     """FULL replacement — specs not in the payload are DELETED (P1-19)."""
     async with db.begin():
         li = await _line_item_or_404(db, quote_id, line_item_id)

backend/app/routers/line_items.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import Material, Unit
 from app.models.procurement import ItemDecision, LineItem, Quote
@@ -15,7 +14,6 @@ from app.utils.errors import ConflictError, NotFoundError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/quotes/{quote_id}/line-items", tags=["line-items"])
-_procurement_writer = require_procurement_writer()
 
 
 async def _quote_or_404(db: AsyncSession, quote_id) -> Quote:
@@ -52,12 +50,7 @@ async def list_line_items(
 
 
 @router.post("", status_code=201)
-async def create_line_item(
-    quote_id,
-    payload: LineItemCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def create_line_item(quote_id, payload: LineItemCreate, db: AsyncSession = Depends(get_db)):
     async with db.begin():
         quote = await _quote_or_404(db, quote_id)
         if quote.status != "offered":
@@ -96,11 +89,7 @@ async def get_line_item(
 
 @router.patch("/{line_item_id}")
 async def update_line_item(
-    quote_id,
-    line_item_id,
-    payload: LineItemUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    quote_id, line_item_id, payload: LineItemUpdate, db: AsyncSession = Depends(get_db)
 ):
     li = await _line_item_or_404(db, quote_id, line_item_id)
     quote = await _quote_or_404(db, quote_id)
@@ -142,12 +131,7 @@ async def update_line_item(
 
 
 @router.delete("/{line_item_id}")
-async def delete_line_item(
-    quote_id,
-    line_item_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_line_item(quote_id, line_item_id, db: AsyncSession = Depends(get_db)):
     li = await _line_item_or_404(db, quote_id, line_item_id)
     quote = await _quote_or_404(db, quote_id)
     if quote.status != "offered":

backend/app/routers/material_categories.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import MaterialCategory
 from app.models.procurement import Supplier
@@ -13,7 +12,6 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/material-categories", tags=["material-categories"])
-_procurement_writer = require_procurement_writer()
 
 
 def category_to_dict(category: MaterialCategory) -> dict:
@@ -48,11 +46,7 @@ async def list_categories(
 
 
 @router.post("", status_code=201)
-async def create_category(
-    payload: MaterialCategoryCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def create_category(payload: MaterialCategoryCreate, db: AsyncSession = Depends(get_db)):
     duplicate = await db.scalar(select(MaterialCategory.id).where(MaterialCategory.slug == payload.slug))
     if duplicate is not None:
         raise ConflictError("دسته‌بندی با این slug قبلاً ثبت شده است", field="slug")
@@ -76,12 +70,7 @@ async def get_category(category_id, db: AsyncSession = Depends(get_db)):
 
 
 @router.patch("/{category_id}")
-async def update_category(
-    category_id,
-    payload: MaterialCategoryUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def update_category(category_id, payload: MaterialCategoryUpdate, db: AsyncSession = Depends(get_db)):
     category = await db.get(MaterialCategory, category_id)
     if category is None:
         raise NotFoundError("دسته‌بندی یافت نشد")
@@ -103,11 +92,7 @@ async def update_category(
 
 
 @router.delete("/{category_id}")
-async def delete_category(
-    category_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_category(category_id, db: AsyncSession = Depends(get_db)):
     category = await db.get(MaterialCategory, category_id)
     if category is None:
         raise NotFoundError("دسته‌بندی یافت نشد")

backend/app/routers/materials.py

@@ -9,7 +9,6 @@ from fastapi import APIRouter, Depends, Query, Request
 from sqlalchemy import exists, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import (
     AttributeDefinition,
@@ -39,7 +38,6 @@ from app.utils.errors import ConflictError, NotFoundError, ValidationError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/materials", tags=["materials"])
-_procurement_writer = require_procurement_writer()
 
 
 def _coerce_filter_value(data_type: str, raw: str):
@@ -127,10 +125,7 @@ async def list_materials(
 
 @router.post("", status_code=201)
 async def create_material(
-    payload: MaterialCreate,
-    expand: str | None = None,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    payload: MaterialCreate, expand: str | None = None, db: AsyncSession = Depends(get_db)
 ):
     material = await material_service.create_material(db, payload)
     return {"data": await serialize_material(db, material, parse_expand(expand))}
@@ -145,12 +140,7 @@ async def get_material(material_id, expand: str | None = None, db: AsyncSession
 
 
 @router.patch("/{material_id}")
-async def update_material(
-    material_id,
-    payload: MaterialUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def update_material(material_id, payload: MaterialUpdate, db: AsyncSession = Depends(get_db)):
     material = await db.get(Material, material_id)
     if material is None:
         raise NotFoundError("متریال یافت نشد")
@@ -159,11 +149,7 @@ async def update_material(
 
 
 @router.delete("/{material_id}")
-async def delete_material(
-    material_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_material(material_id, db: AsyncSession = Depends(get_db)):
     material = await db.get(Material, material_id)
     if material is None:
         raise NotFoundError("متریال یافت نشد")
@@ -262,10 +248,7 @@ async def list_material_units(
 
 @router.post("/{material_id}/units", status_code=201)
 async def create_material_unit(
-    material_id,
-    payload: MaterialUnitCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    material_id, payload: MaterialUnitCreate, db: AsyncSession = Depends(get_db)
 ):
     async with db.begin():
         await _material_or_404(db, material_id)
@@ -304,11 +287,7 @@ async def create_material_unit(
 
 @router.patch("/{material_id}/units/{mu_id}")
 async def update_material_unit(
-    material_id,
-    mu_id,
-    payload: MaterialUnitUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    material_id, mu_id, payload: MaterialUnitUpdate, db: AsyncSession = Depends(get_db)
 ):
     async with db.begin():
         mu = await db.scalar(
@@ -340,12 +319,7 @@ async def update_material_unit(
 
 
 @router.delete("/{material_id}/units/{mu_id}")
-async def delete_material_unit(
-    material_id,
-    mu_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_material_unit(material_id, mu_id, db: AsyncSession = Depends(get_db)):
     mu = await db.scalar(
         select(MaterialUnit).where(MaterialUnit.id == mu_id, MaterialUnit.material_id == material_id)
     )
@@ -391,10 +365,7 @@ async def get_material_attribute_values(
 
 @router.put("/{material_id}/attribute-values")
 async def put_material_attribute_values(
-    material_id,
-    payload: MaterialAttributeValuesPut,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    material_id, payload: MaterialAttributeValuesPut, db: AsyncSession = Depends(get_db)
 ):
     """FULL replacement of a material's EAV values (empty array deletes all)."""
     async with db.begin():

backend/app/routers/pm.py

@@ -71,17 +71,16 @@ class ArrivalScope:
     user_id: uuid.UUID | None
     project_id: uuid.UUID | None  # PM's active project; admin: optional filter
     display_name: str
-    project_ids: list[uuid.UUID] | None = None
 
 
 async def arrivals_scope(
     request: Request,
-    project_id: uuid.UUID | None = Query(default=None, description="پروژه فعال (PM / سرپرست: داده‌های پروژه)"),
+    project_id: uuid.UUID | None = Query(default=None, description="پروژه فعال (PM: الزامی برای داده‌های پروژه)"),
     db: AsyncSession = Depends(get_db),
 ) -> ArrivalScope:
     """Resolve the arrivals caller — Casdoor JWT first, dev headers as fallback.
 
-    PM / supervisor → scoped to the requested project, which must be one they manage
+    PM → scoped to the requested project, which must be one they manage
     (projects.pm_user_id, 1:N); without the param, their first project.
     Admin / procurement manager → all projects (param = optional filter).
     """
@@ -90,19 +89,19 @@ async def arrivals_scope(
         if ctx is not None:
             if ctx.role is None:
                 raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
-            if ctx.role in ("pm", "supervisor"):
+            if ctx.role == "pm":
                 allowed = list(ctx.project_ids or [])
                 if project_id is not None:
                     if project_id not in allowed:
                         raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
-                    return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name, project_ids=allowed)
+                    return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
                 if not allowed:
                     raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
-                return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=allowed[0], display_name=ctx.display_name, project_ids=allowed)
+                return ArrivalScope(role="pm", user_id=ctx.user.id, project_id=allowed[0], display_name=ctx.display_name)
             if ctx.role in ("admin", "procurement_manager"):
                 return ArrivalScope(role="admin", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
-            raise ForbiddenError("این بخش فقط برای مدیر یا سرپرست پروژه و مدیر تدارکات است")
-    # Dev fallback: X-User-Role: pm | supervisor | admin (procurement_manager maps to
+            raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است")
+    # Dev fallback: X-User-Role: pm | admin (procurement_manager maps to
     # admin) — ONLY when DEV_LOGIN_ENABLED (local testing without Casdoor).
     # Disabled by default: an ungated header identity in production would
     # let anyone confirm receipts as PM.
@@ -111,10 +110,8 @@ async def arrivals_scope(
     role = (request.headers.get("x-user-role") or "").strip().lower()
     if role == "procurement_manager":
         role = "admin"
-    elif role == "supervisor":
-        role = "pm"
     if role not in ("pm", "admin"):
-        raise ForbiddenError("این بخش فقط برای مدیر یا سرپرست پروژه و مدیر تدارکات است — هدر X-User-Role را بفرستید")
+        raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است — هدر X-User-Role را بفرستید")
     # The explicit query param wins; otherwise the dev header carries it.
     if project_id is None and role == "pm":
         raw_project = request.headers.get("x-project-id")
@@ -192,17 +189,10 @@ async def pm_on_the_way(
         .outerjoin(Project, Project.id == ItemDecision.project_id)
         .where(ItemDecision.status == "chosen")
     )
-    if ctx.role == "pm":
-        allowed = ctx.project_ids or ([ctx.project_id] if ctx.project_id else [])
-        if not allowed:
+    if ctx.role == "pm" and ctx.project_id is None:
         raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
     if ctx.project_id is not None:
-            if ctx.project_id not in allowed:
-                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
-            stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
-        else:
-            stmt = stmt.where(ItemDecision.project_id.in_(allowed))
-    elif ctx.project_id is not None:
+        # PM: active project; admin/manager: optional project filter
         stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
     decisions = (await db.execute(stmt.order_by(ItemDecision.decided_at.desc().nulls_last()))).all()
 
@@ -253,10 +243,6 @@ async def pm_confirm_receipt(
         decision = await db.get(ItemDecision, payload.item_decision_id)
         if decision is None or decision.status != "chosen":
             raise NotFoundError("تصمیم خرید یافت نشد", field="item_decision_id")
-        if ctx.role == "pm":
-            allowed = ctx.project_ids or ([ctx.project_id] if ctx.project_id else [])
-            if decision.project_id not in allowed:
-                raise ForbiddenError("این قلم متعلق به پروژه شما نیست")
         if ctx.project_id is not None and decision.project_id != ctx.project_id:
             raise ForbiddenError("این قلم متعلق به پروژه فعال نیست")
 
@@ -465,17 +451,10 @@ async def pm_receipts(
         .join(Quote, Quote.id == LineItem.quote_id)
         .join(Project, Project.id == ItemDecision.project_id)
     )
-    if ctx.role == "pm":
-        allowed = ctx.project_ids or ([ctx.project_id] if ctx.project_id else [])
-        if not allowed:
+    if ctx.role == "pm" and ctx.project_id is None:
         raise ForbiddenError("شما به هیچ پروژه‌ای متصل نیستید (projects.pm_user_id)")
     if ctx.project_id is not None:
-            if ctx.project_id not in allowed:
-                raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
-            stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
-        else:
-            stmt = stmt.where(ItemDecision.project_id.in_(allowed))
-    elif ctx.project_id is not None:
+        # PM: active project; admin/manager: optional project filter
         stmt = stmt.where(ItemDecision.project_id == ctx.project_id)
     rows = (await db.execute(stmt.order_by(ItemReceipt.received_at.desc()))).all()
     receipts = [r.ItemReceipt for r in rows]

backend/app/routers/projects.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query, Request
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import UserContext, get_optional_user, require_procurement_writer, require_role
+from app.auth import UserContext, get_optional_user
 from app.db.engine import get_db
 from app.models.procurement import Project, Quote, User
 from app.schemas.procurement import ProjectCreate, ProjectUpdate
@@ -13,7 +13,6 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_date, to_iso
 
 router = APIRouter(prefix="/projects", tags=["projects"])
-_procurement_writer = require_procurement_writer()
 
 
 async def _optional_ctx(request: Request, db: AsyncSession = Depends(get_db)) -> UserContext | None:
@@ -34,12 +33,8 @@ async def project_to_dict(db: AsyncSession, project: Project) -> dict:
     d = {
         "id": str(project.id),
         "name": project.name,
-        "location": project.location or "",
-        "project_manager": project.project_manager or "",
-        "description": project.description or "",
+        "description": project.description,
         "start_date": to_date(project.start_date),
-        "status": project.status or "ACTIVE",
-        "progress": float(project.progress) if project.progress is not None else 0.0,
         "pm_user_id": str(project.pm_user_id) if project.pm_user_id else None,
         "created_at": to_iso(project.created_at),
     }
@@ -47,8 +42,6 @@ async def project_to_dict(db: AsyncSession, project: Project) -> dict:
         pm = await db.get(User, project.pm_user_id)
         if pm:
             d["pm_name"] = f"{pm.first_name} {pm.last_name}".strip() or pm.casdoor_id
-    elif project.project_manager:
-        d["pm_name"] = project.project_manager
     return d
 
 
@@ -62,14 +55,7 @@ async def list_projects(
 ):
     stmt = select(Project)
     if q:
-        stmt = stmt.where(
-            or_(
-                Project.name.ilike(f"%{q}%"),
-                Project.description.ilike(f"%{q}%"),
-                Project.location.ilike(f"%{q}%"),
-                Project.project_manager.ilike(f"%{q}%"),
-            )
-        )
+        stmt = stmt.where(or_(Project.name.ilike(f"%{q}%"), Project.description.ilike(f"%{q}%")))
     stmt = sort_query(stmt, Project, sort)
     items, meta = await paginate(stmt, page, page_size, db)
     pm_map = await _pm_map(db, items)
@@ -78,38 +64,24 @@ async def list_projects(
         d = {
             "id": str(p.id),
             "name": p.name,
-            "location": p.location or "",
-            "project_manager": p.project_manager or "",
-            "description": p.description or "",
+            "description": p.description,
             "start_date": to_date(p.start_date),
-            "status": p.status or "ACTIVE",
-            "progress": float(p.progress) if p.progress is not None else 0.0,
             "pm_user_id": str(p.pm_user_id) if p.pm_user_id else None,
             "created_at": to_iso(p.created_at),
         }
         pm = pm_map.get(p.pm_user_id)
         if pm:
             d["pm_name"] = f"{pm.first_name} {pm.last_name}".strip() or pm.casdoor_id
-        elif p.project_manager:
-            d["pm_name"] = p.project_manager
         data.append(d)
     return {"data": data, "meta": meta}
 
 
 @router.post("", status_code=201)
-async def create_project(
-    payload: ProjectCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def create_project(payload: ProjectCreate, db: AsyncSession = Depends(get_db)):
     project = Project(
-        name=payload.name.strip(),
-        location=payload.location.strip() if payload.location else "",
-        project_manager=payload.project_manager.strip() if payload.project_manager else "",
-        description=payload.description.strip() if payload.description else "",
+        name=payload.name,
+        description=payload.description,
         start_date=payload.start_date,
-        planned_start=payload.start_date,
-        status="ACTIVE",
     )
     db.add(project)
     await db.flush()
@@ -131,51 +103,37 @@ async def update_project(
     request: Request,
     ctx: UserContext | None = Depends(_optional_ctx),
     db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     project = await db.get(Project, project_id)
     if project is None:
         raise NotFoundError("پروژه یافت نشد")
     if payload.name is not None:
-        project.name = payload.name.strip()
-    if payload.location is not None:
-        project.location = payload.location.strip()
-    if payload.project_manager is not None:
-        project.project_manager = payload.project_manager.strip()
+        project.name = payload.name
     if payload.description is not None:
-        project.description = payload.description.strip()
+        project.description = payload.description
     if payload.start_date is not None:
         project.start_date = payload.start_date
-        project.planned_start = payload.start_date
-    if payload.status is not None:
-        project.status = payload.status
     # PM assignment (1:N): one PM per project, a PM may own many projects.
     # Admin / procurement manager only (same rule as the Organization panel).
     if "pm_user_id" in payload.model_fields_set:
         role = ctx.role if ctx else (request.headers.get("x-user-role") or "").strip().lower()
-        if role not in ("admin", "procurement_manager", "pm"):
-            raise ForbiddenError("تعیین سرپرست پروژه فقط برای مدیر تدارکات، مدیر پروژه و ادمین مجاز است")
+        if role not in ("admin", "procurement_manager"):
+            raise ForbiddenError("تعیین مدیر پروژه فقط برای ادمین / مدیر تدارکات مجاز است")
         if payload.pm_user_id is None:
             project.pm_user_id = None
         else:
             pm_user = await db.get(User, payload.pm_user_id)
             if pm_user is None:
                 raise NotFoundError("کاربر یافت نشد", field="pm_user_id")
-            if pm_user.role not in ("supervisor", "pm"):
-                raise ValidationError("ابتدا نقش این کاربر را «سرپرست پروژه» کنید", field="pm_user_id")
+            if pm_user.role != "pm":
+                raise ValidationError("ابتدا نقش این کاربر را «مدیر پروژه» کنید", field="pm_user_id")
             project.pm_user_id = pm_user.id
-            if not project.project_manager:
-                project.project_manager = f"{pm_user.first_name} {pm_user.last_name}".strip()
     await db.flush()
     return {"data": await project_to_dict(db, project)}
 
 
 @router.delete("/{project_id}")
-async def delete_project(
-    project_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_project(project_id, db: AsyncSession = Depends(get_db)):
     project = await db.get(Project, project_id)
     if project is None:
         raise NotFoundError("پروژه یافت نشد")

backend/app/routers/quote_events.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.procurement import Quote, QuoteEvent
 from app.schemas.procurement import NoteEventIn
@@ -12,7 +11,6 @@ from app.utils.errors import NotFoundError, ValidationError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/quotes/{quote_id}/events", tags=["quote-events"])
-_procurement_writer = require_procurement_writer()
 
 
 @router.get("")
@@ -36,12 +34,7 @@ async def list_events(
 
 
 @router.post("", status_code=201)
-async def create_event(
-    quote_id,
-    payload: NoteEventIn,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def create_event(quote_id, payload: NoteEventIn, db: AsyncSession = Depends(get_db)):
     quote = await db.get(Quote, quote_id)
     if quote is None:
         raise NotFoundError("پیشنهاد (استعلام) یافت نشد")

backend/app/routers/quotes.py

@@ -8,7 +8,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import exists, func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import UserContext, allow_quote_create, require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import Material
 from app.models.procurement import (
@@ -37,15 +36,12 @@ from app.services.expand_service import (
     serialize_quote_with_children,
     serialize_quotes,
 )
-from app.utils.errors import ForbiddenError, NotFoundError, ValidationError
+from app.utils.errors import NotFoundError
 from app.utils.pagination import sort_query
 from app.utils.security import get_actor
 
 router = APIRouter(prefix="/quotes", tags=["quotes"])
 
-# عملیات نوشتنی تدارکات — فقط ادمین و مدیر تدارکات (مدیر پروژه فقط خواندن دارد)
-_procurement_writer = require_procurement_writer()
-
 
 # --- list filter helpers ---------------------------------------------------
 
@@ -160,24 +156,7 @@ async def get_quote(quote_id, expand: str | None = None, db: AsyncSession = Depe
 # ---------------------------------------------------------------------------
 
 @router.post("", status_code=201)
-async def create_quote(
-    payload: QuoteCreate,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    ctx: UserContext = Depends(allow_quote_create()),
-    _auth=None,
-):
-    # سطح limited: استعلام فقط برای پروژه‌های عضویت خودش
-    if (ctx.panels or {}).get("procurement") == "limited" and ctx.role != "admin":
-        allowed = set(ctx.project_ids or []) | set(ctx.member_project_ids or [])
-        if ctx.project_id:
-            allowed.add(ctx.project_id)
-        allowed_str = {str(pid) for pid in allowed if pid}
-        wanted = {str(pid) for pid in ([payload.project_id] + list(payload.project_ids or [])) if pid}
-        if not wanted:
-            raise ValidationError("برای افزودن استعلام، پروژه الزامی است")
-        if not wanted <= allowed_str:
-            raise ForbiddenError("استعلام فقط برای پروژه‌های تخصیص‌یافته به شما مجاز است")
+async def create_quote(payload: QuoteCreate, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)):
     quote = await quote_service.create_quote(db, payload, actor)
     return {"data": await serialize_quote_with_children(db, quote)}
 
@@ -188,11 +167,7 @@ async def create_quote(
 
 @router.patch("/{quote_id}")
 async def update_quote(
-    quote_id,
-    payload: QuoteUpdate,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
+    quote_id, payload: QuoteUpdate, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
 ):
     quote = await quote_service.update_quote(db, quote_id, payload, actor)
     return {"data": await serialize_quote(db, quote, set())}
@@ -200,11 +175,7 @@ async def update_quote(
 
 @router.patch("/{quote_id}/children")
 async def replace_quote_children(
-    quote_id,
-    payload: QuoteChildrenReplaceIn,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
+    quote_id, payload: QuoteChildrenReplaceIn, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
 ):
     """Full replacement of a quote's line items + termsheets (edit modal)."""
     quote = await quote_service.replace_quote_children(db, quote_id, payload, actor)
@@ -217,11 +188,7 @@ async def replace_quote_children(
 
 @router.patch("/{quote_id}/accept")
 async def accept_quote(
-    quote_id,
-    payload: AcceptQuoteIn,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
+    quote_id, payload: AcceptQuoteIn, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
 ):
     quote = await quote_service.accept_quote(db, quote_id, payload, actor)
     return {"data": await _accept_response(db, quote)}
@@ -257,12 +224,7 @@ async def _accept_response(db: AsyncSession, quote: Quote) -> dict:
 
 
 @router.patch("/{quote_id}/arrive")
-async def arrive_quote(
-    quote_id,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
-):
+async def arrive_quote(quote_id, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)):
     quote = await quote_service.arrive_quote(db, quote_id, actor)
     return {
         "data": {
@@ -275,11 +237,7 @@ async def arrive_quote(
 
 @router.patch("/{quote_id}/arrive-items")
 async def arrive_items(
-    quote_id,
-    payload: ArriveItemsIn,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
+    quote_id, payload: ArriveItemsIn, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
 ):
     quote = await quote_service.arrive_items(db, quote_id, payload, actor)
     return {
@@ -301,23 +259,14 @@ async def arrive_items(
 
 @router.patch("/{quote_id}/reject")
 async def reject_quote(
-    quote_id,
-    payload: RejectQuoteIn | None = None,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
+    quote_id, payload: RejectQuoteIn | None = None, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
 ):
     quote = await quote_service.reject_quote(db, quote_id, payload or RejectQuoteIn(), actor)
     return {"data": {"id": str(quote.id), "status": quote.status}}
 
 
 @router.patch("/{quote_id}/expire")
-async def expire_quote(
-    quote_id,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
-):
+async def expire_quote(quote_id, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)):
     quote = await quote_service.expire_quote(db, quote_id, actor)
     return {"data": {"id": str(quote.id), "status": quote.status}}
 
@@ -327,10 +276,6 @@ async def expire_quote(
 # ---------------------------------------------------------------------------
 
 @router.delete("/{quote_id}")
-async def delete_quote(
-    quote_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_quote(quote_id, db: AsyncSession = Depends(get_db)):
     result = await quote_service.delete_quote(db, quote_id)
     return {"data": result}

backend/app/routers/schedule_steps.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.procurement import Termsheet, TermsheetScheduleStep
 from app.schemas.procurement import ScheduleStepCreate, ScheduleStepUpdate
@@ -16,7 +15,6 @@ router = APIRouter(
     prefix="/quotes/{quote_id}/termsheets/{termsheet_id}/schedule-steps",
     tags=["schedule-steps"],
 )
-_procurement_writer = require_procurement_writer()
 
 
 async def _termsheet_or_404(db: AsyncSession, quote_id, termsheet_id) -> Termsheet:
@@ -59,11 +57,7 @@ async def list_schedule_steps(
 
 @router.post("", status_code=201)
 async def create_schedule_step(
-    quote_id,
-    termsheet_id,
-    payload: ScheduleStepCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    quote_id, termsheet_id, payload: ScheduleStepCreate, db: AsyncSession = Depends(get_db)
 ):
     ts = await _termsheet_or_404(db, quote_id, termsheet_id)
     step_no = payload.step_no
@@ -90,12 +84,7 @@ async def create_schedule_step(
 
 @router.patch("/{step_id}")
 async def update_schedule_step(
-    quote_id,
-    termsheet_id,
-    step_id,
-    payload: ScheduleStepUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    quote_id, termsheet_id, step_id, payload: ScheduleStepUpdate, db: AsyncSession = Depends(get_db)
 ):
     step = await _step_or_404(db, termsheet_id, step_id)
     if payload.step_no is not None and payload.step_no != step.step_no:
@@ -120,13 +109,7 @@ async def update_schedule_step(
 
 
 @router.delete("/{step_id}")
-async def delete_schedule_step(
-    quote_id,
-    termsheet_id,
-    step_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_schedule_step(quote_id, termsheet_id, step_id, db: AsyncSession = Depends(get_db)):
     step = await _step_or_404(db, termsheet_id, step_id)
     count = await db.scalar(
         select(func.count()).select_from(TermsheetScheduleStep).where(

backend/app/routers/standard_conversions.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import StandardConversion
 from app.schemas.catalog import StandardConversionCreate, StandardConversionUpdate
@@ -12,7 +11,6 @@ from app.utils.pagination import paginate
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/standard-conversions", tags=["standard-conversions"])
-_procurement_writer = require_procurement_writer()
 
 
 def sc_to_dict(sc: StandardConversion) -> dict:
@@ -43,11 +41,7 @@ async def list_standard_conversions(
 
 
 @router.post("", status_code=201)
-async def create_standard_conversion(
-    payload: StandardConversionCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def create_standard_conversion(payload: StandardConversionCreate, db: AsyncSession = Depends(get_db)):
     duplicate = await db.scalar(
         select(StandardConversion.id).where(
             StandardConversion.from_unit == payload.from_unit,
@@ -73,12 +67,7 @@ async def get_standard_conversion(sc_id, db: AsyncSession = Depends(get_db)):
 
 
 @router.patch("/{sc_id}")
-async def update_standard_conversion(
-    sc_id,
-    payload: StandardConversionUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def update_standard_conversion(sc_id, payload: StandardConversionUpdate, db: AsyncSession = Depends(get_db)):
     sc = await db.get(StandardConversion, sc_id)
     if sc is None:
         raise NotFoundError("تبدیل استاندارد یافت نشد")
@@ -105,11 +94,7 @@ async def update_standard_conversion(
 
 
 @router.delete("/{sc_id}")
-async def delete_standard_conversion(
-    sc_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_standard_conversion(sc_id, db: AsyncSession = Depends(get_db)):
     sc = await db.get(StandardConversion, sc_id)
     if sc is None:
         raise NotFoundError("تبدیل استاندارد یافت نشد")

backend/app/routers/supplier_materials.py

@@ -2,13 +2,14 @@
 
 GET/POST /suppliers/{id}/materials — manage a supplier's catalog.
 DELETE /suppliers/{id}/materials/{material_id} — unlink.
-GET /materials/{id}/suppliers — price-comparison data source.
+GET /materials/{id}/suppliers — suppliers linked to a material.
 """
+from uuid import UUID
+
 from fastapi import APIRouter, Depends, Query
-from sqlalchemy import select
+from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import Material, MaterialCategory
 from app.models.procurement import Supplier, SupplierMaterial
@@ -19,32 +20,53 @@ from app.utils.pagination import paginate
 from app.utils.serialization import to_iso
 
 router = APIRouter(tags=["supplier-materials"])
-_procurement_writer = require_procurement_writer()
 
 
-def link_to_dict(link: SupplierMaterial, material: Material | None = None,
+def link_to_dict(
+    link: SupplierMaterial,
+    material: Material | None = None,
     category: MaterialCategory | None = None,
-                 supplier: Supplier | None = None) -> dict:
+    supplier: Supplier | None = None,
+) -> dict:
+<<<<<<< Updated upstream
+    """Serialize a SupplierMaterial ORM row to a plain dict for the API envelope."""
+=======
+    """Serialize a SupplierMaterial ORM row to a plain dict."""
+>>>>>>> Stashed changes
     return {
         "id": str(link.id),
         "supplier_id": str(link.supplier_id),
         "material_id": str(link.material_id),
         "is_active": link.is_active,
-        "last_quoted_price": float(link.last_quoted_price) if link.last_quoted_price is not None else None,
+        "last_quoted_price": (
+            float(link.last_quoted_price) if link.last_quoted_price is not None else None
+        ),
         "last_quoted_at": to_iso(link.last_quoted_at) if link.last_quoted_at else None,
         "created_at": to_iso(link.created_at),
-        "material": {
+        "material": (
+            {
                 "id": str(material.id),
                 "name": material.name,
-            "category": {"id": str(category.id), "name": category.name} if category else None,
-        } if material else None,
-        "supplier": {"id": str(supplier.id), "name": supplier.name} if supplier else None,
+                "category": (
+                    {"id": str(category.id), "name": category.name} if category else None
+                ),
+            }
+            if material
+            else None
+        ),
+        "supplier": (
+            {"id": str(supplier.id), "name": supplier.name} if supplier else None
+        ),
     }
 
 
+# ---------------------------------------------------------------------------
+# GET /suppliers/{supplier_id}/materials
+# ---------------------------------------------------------------------------
+
 @router.get("/suppliers/{supplier_id}/materials")
 async def list_supplier_materials(
-    supplier_id,
+    supplier_id: UUID,
     page: int = Query(1, ge=1),
     page_size: int = Query(20, ge=1, le=100),
     db: AsyncSession = Depends(get_db),
@@ -58,52 +80,210 @@ async def list_supplier_materials(
         .order_by(SupplierMaterial.created_at)
     )
     items, meta = await paginate(stmt, page, page_size, db)
-    mat_ids = {l.material_id for l in items}
-    materials = {m.id: m for m in (await db.execute(select(Material).where(Material.id.in_(mat_ids)))).scalars()}
-    return {"data": [link_to_dict(l, materials.get(l.material_id), None) for l in items], "meta": meta}
+    mat_ids = [lnk.material_id for lnk in items]
+    materials: dict = {}
+    if mat_ids:
+        result = await db.execute(select(Material).where(Material.id.in_(mat_ids)))
+        materials = {m.id: m for m in result.scalars()}
+    return {
+        "data": [link_to_dict(lnk, materials.get(lnk.material_id)) for lnk in items],
+        "meta": meta,
+    }
 
 
+# ---------------------------------------------------------------------------
+# POST /suppliers/{supplier_id}/materials
+# ---------------------------------------------------------------------------
+
 @router.post("/suppliers/{supplier_id}/materials", status_code=201)
 async def create_supplier_material(
-    supplier_id,
+    supplier_id: UUID,
     payload: SupplierMaterialCreate,
     db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     async with db.begin():
         link = await link_supplier_material(db, supplier_id, payload.material_id)
         material = await db.get(Material, payload.material_id)
-    return {"data": link_to_dict(link, material, None)}
+    return {"data": link_to_dict(link, material)}
 
 
+# ---------------------------------------------------------------------------
+# DELETE /suppliers/{supplier_id}/materials/{material_id}
+# ---------------------------------------------------------------------------
+
 @router.delete("/suppliers/{supplier_id}/materials/{material_id}")
 async def delete_supplier_material(
-    supplier_id,
-    material_id,
+    supplier_id: UUID,
+    material_id: UUID,
+<<<<<<< Updated upstream
     db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
 ):
     async with db.begin():
         await unlink_supplier_material(db, supplier_id, material_id)
-    return {"data": {"supplier_id": str(supplier_id), "material_id": str(material_id), "deleted": True}}
+    return {
+        "data": {
+            "supplier_id": str(supplier_id),
+            "material_id": str(material_id),
+            "deleted": True,
+        }
+    }
 
 
-@router.get("/materials/{material_id}/suppliers")
+# ---------------------------------------------------------------------------
+# GET /materials/{material_id}/suppliers
+# ---------------------------------------------------------------------------
+
+@router.get(
+    "/materials/{material_id}/suppliers",
+    summary="List all suppliers linked to a material",
+)
 async def list_material_suppliers(
-    material_id,
+    material_id: UUID,
+    db: AsyncSession = Depends(get_db),
+):
+    """Return the suppliers linked to a material, straight from PostgreSQL.
+
+    The path parameter is typed as UUID so FastAPI validates and coerces it
+    before the handler runs; a malformed id is rejected with 422, an unknown
+    material with 404.
+
+    Atomic JOIN — a supplier is returned only through its supplier_materials
+    link, so the response can never contain a supplier that is not actually
+    linked to this material:
+
+        select(Supplier)
+        .join(SupplierMaterial, Supplier.id == SupplierMaterial.supplier_id)
+        .where(SupplierMaterial.material_id == material_id)
+
+    Response envelope (frontend MaterialSupplier binds these fields directly):
+        {
+          "data": [
+            {
+              "id":             "<supplier_uuid>",
+              "name":           "فولاد ناب آریا",
+              "phone":          "021-..." | null,
+              "contact_person": "علی محمدی" | null,
+              "location":       "تهران" | null
+            }
+          ]
+=======
+    db: AsyncSession = Depends(get_db),
+):
+    async with db.begin():
+        await unlink_supplier_material(db, supplier_id, material_id)
+    return {
+        "data": {
+            "supplier_id": str(supplier_id),
+            "material_id": str(material_id),
+            "deleted": True,
+        }
+    }
+
+
+# ---------------------------------------------------------------------------
+# GET /materials/{material_id}/suppliers
+# ---------------------------------------------------------------------------
+
+@router.get(
+    "/materials/{material_id}/suppliers",
+    summary="List all suppliers linked to a material",
+)
+async def list_material_suppliers(
+    material_id: UUID,
     page: int = Query(1, ge=1),
     page_size: int = Query(20, ge=1, le=100),
     db: AsyncSession = Depends(get_db),
 ):
+    """Return a paginated list of suppliers for a given material.
+
+    Uses explicit column-level SELECT with named labels so SQLAlchemy returns
+    plain Row tuples — no ORM identity-map involvement — eliminating the
+    string-vs-UUID comparison bug and the stale-entity collision that occurred
+    when selecting two mapped entities in the same session.
+
+    Response shape (matched by the frontend RawMaterialSupplier interface):
+        {
+          "data": [
+            {
+              "id": "<supplier_uuid>",
+              "name": "فولاد ناب آریا",
+              "phone": "021-..." | null,
+              "contact_person": "علی محمدی" | null,
+              "location": "تهران" | null
+            }
+          ],
+          "meta": {"total": 1, "page": 1, "page_size": 20}
+>>>>>>> Stashed changes
+        }
+    """
     material = await db.get(Material, material_id)
     if material is None:
         raise NotFoundError("متریال یافت نشد")
+
+<<<<<<< Updated upstream
     stmt = (
-        select(SupplierMaterial)
+        select(Supplier)
+        .join(SupplierMaterial, Supplier.id == SupplierMaterial.supplier_id)
+        .where(SupplierMaterial.material_id == material_id)
+        .order_by(Supplier.name)
+    )
+    suppliers = (await db.execute(stmt)).scalars().all()
+
+    return {
+        "data": [
+            {
+                "id": str(supplier.id),
+                "name": supplier.name,
+                "phone": supplier.phone,
+                "contact_person": supplier.contact_person,
+                "location": supplier.location,
+            }
+            for supplier in suppliers
+        ]
+=======
+    total: int = (
+        await db.scalar(
+            select(func.count(SupplierMaterial.id)).where(
+                SupplierMaterial.material_id == material_id
+            )
+        )
+    ) or 0
+
+    if total == 0:
+        return {"data": [], "meta": {"total": 0, "page": page, "page_size": page_size}}
+
+    # Explicit column-level SELECT — returns plain Row objects keyed by label,
+    # never ORM entities, so no identity-map collision is possible.
+    stmt = (
+        select(
+            Supplier.id.label("sup_id"),
+            Supplier.name.label("sup_name"),
+            Supplier.phone.label("sup_phone"),
+            Supplier.contact_person.label("sup_contact_person"),
+            Supplier.location.label("sup_location"),
+        )
+        .join(SupplierMaterial, Supplier.id == SupplierMaterial.supplier_id)
         .where(SupplierMaterial.material_id == material_id)
         .order_by(SupplierMaterial.last_quoted_at.desc().nulls_last())
+        .offset((page - 1) * page_size)
+        .limit(page_size)
     )
-    items, meta = await paginate(stmt, page, page_size, db)
-    sup_ids = {l.supplier_id for l in items}
-    suppliers = {s.id: s for s in (await db.execute(select(Supplier).where(Supplier.id.in_(sup_ids)))).scalars()}
-    return {"data": [link_to_dict(l, supplier=suppliers.get(l.supplier_id)) for l in items], "meta": meta}
+
+    rows = (await db.execute(stmt)).all()
+
+    data = [
+        {
+            "id": str(row.sup_id),
+            "name": row.sup_name,
+            "phone": row.sup_phone,
+            "contact_person": row.sup_contact_person,
+            "location": row.sup_location,
+        }
+        for row in rows
+    ]
+
+    return {
+        "data": data,
+        "meta": {"total": total, "page": page, "page_size": page_size},
+>>>>>>> Stashed changes
+    }

backend/app/routers/suppliers.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import MaterialCategory
 from app.models.procurement import Quote, Supplier
@@ -13,7 +12,6 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/suppliers", tags=["suppliers"])
-_procurement_writer = require_procurement_writer()
 
 
 def supplier_to_dict(supplier: Supplier, category: MaterialCategory | None = None) -> dict:
@@ -73,11 +71,7 @@ async def list_suppliers(
 
 
 @router.post("", status_code=201)
-async def create_supplier(
-    payload: SupplierCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def create_supplier(payload: SupplierCreate, db: AsyncSession = Depends(get_db)):
     category = await _category_or_404(db, payload.category_id)
     supplier = Supplier(
         name=payload.name,
@@ -102,12 +96,7 @@ async def get_supplier(supplier_id, db: AsyncSession = Depends(get_db)):
 
 
 @router.patch("/{supplier_id}")
-async def update_supplier(
-    supplier_id,
-    payload: SupplierUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def update_supplier(supplier_id, payload: SupplierUpdate, db: AsyncSession = Depends(get_db)):
     supplier = await db.get(Supplier, supplier_id)
     if supplier is None:
         raise NotFoundError("تأمین‌کننده یافت نشد")
@@ -131,11 +120,7 @@ async def update_supplier(
 
 
 @router.delete("/{supplier_id}")
-async def delete_supplier(
-    supplier_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_supplier(supplier_id, db: AsyncSession = Depends(get_db)):
     supplier = await db.get(Supplier, supplier_id)
     if supplier is None:
         raise NotFoundError("تأمین‌کننده یافت نشد")

backend/app/routers/termsheets.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.procurement import (
     ItemDecision,
@@ -27,7 +26,6 @@ from app.utils.errors import ConflictError, NotFoundError, ValidationError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/quotes/{quote_id}/termsheets", tags=["termsheets"])
-_procurement_writer = require_procurement_writer()
 
 
 async def _quote_or_404(db: AsyncSession, quote_id) -> Quote:
@@ -82,12 +80,7 @@ async def list_termsheets(
 
 
 @router.post("", status_code=201)
-async def create_termsheet(
-    quote_id,
-    payload: TermsheetCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def create_termsheet(quote_id, payload: TermsheetCreate, db: AsyncSession = Depends(get_db)):
     async with db.begin():
         quote = await _quote_or_404(db, quote_id)
         if quote.status != "offered":
@@ -117,11 +110,7 @@ async def get_termsheet(
 
 @router.patch("/{termsheet_id}")
 async def update_termsheet(
-    quote_id,
-    termsheet_id,
-    payload: TermsheetUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    quote_id, termsheet_id, payload: TermsheetUpdate, db: AsyncSession = Depends(get_db)
 ):
     ts = await _termsheet_or_404(db, quote_id, termsheet_id)
     if ts.status != "offered":
@@ -138,11 +127,7 @@ async def update_termsheet(
 
 @router.patch("/{termsheet_id}/status")
 async def update_termsheet_status(
-    quote_id,
-    termsheet_id,
-    payload: TermsheetStatusUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    quote_id, termsheet_id, payload: TermsheetStatusUpdate, db: AsyncSession = Depends(get_db)
 ):
     async with db.begin():
         ts = await _termsheet_or_404(db, quote_id, termsheet_id)
@@ -154,12 +139,7 @@ async def update_termsheet_status(
 
 
 @router.delete("/{termsheet_id}")
-async def delete_termsheet(
-    quote_id,
-    termsheet_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_termsheet(quote_id, termsheet_id, db: AsyncSession = Depends(get_db)):
     ts = await _termsheet_or_404(db, quote_id, termsheet_id)
     quote = await _quote_or_404(db, quote_id)
     if quote.status != "offered":

backend/app/routers/units.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import AttributeDefinition, Material, MaterialUnit, Unit
 from app.models.procurement import LineItem, LineItemSpec
@@ -12,7 +11,6 @@ from app.utils.errors import ConflictError, NotFoundError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/units", tags=["units"])
-_procurement_writer = require_procurement_writer()
 
 
 def unit_full_to_dict(unit: Unit) -> dict:
@@ -47,11 +45,7 @@ async def list_units(
 
 
 @router.post("", status_code=201)
-async def create_unit(
-    payload: UnitCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def create_unit(payload: UnitCreate, db: AsyncSession = Depends(get_db)):
     duplicate = await db.scalar(select(Unit.id).where(Unit.code == payload.code))
     if duplicate is not None:
         raise ConflictError("واحدی با این کد قبلاً ثبت شده است", field="code")
@@ -76,12 +70,7 @@ async def get_unit(unit_id: int, db: AsyncSession = Depends(get_db)):
 
 
 @router.patch("/{unit_id}")
-async def update_unit(
-    unit_id: int,
-    payload: UnitUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def update_unit(unit_id: int, payload: UnitUpdate, db: AsyncSession = Depends(get_db)):
     unit = await db.get(Unit, unit_id)
     if unit is None:
         raise NotFoundError("واحد یافت نشد")
@@ -103,11 +92,7 @@ async def update_unit(
 
 
 @router.delete("/{unit_id}")
-async def delete_unit(
-    unit_id: int,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_unit(unit_id: int, db: AsyncSession = Depends(get_db)):
     unit = await db.get(Unit, unit_id)
     if unit is None:
         raise NotFoundError("واحد یافت نشد")

backend/app/routers/users.py

@@ -17,21 +17,15 @@ import uuid
 
 import httpx
 from fastapi import APIRouter, Depends
-from sqlalchemy import delete, select, update, text, or_
+from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.auth import UserContext, get_current_user, require_role
 from app.utils.audit import record as audit_record
 from app.config import settings
 from app.db.engine import get_db
-from app.models.procurement import Project, User, UserPanel, UserProjectMembership
-from app.schemas.procurement import (
-    UserCreate,
-    UserPanelsUpdate,
-    UserPanelProjectsUpdate,
-    UserProjectUpdate,
-    UserRoleUpdate,
-)
+from app.models.procurement import Project, User
+from app.schemas.procurement import UserCreate, UserProjectUpdate, UserRoleUpdate
 from app.utils.errors import (
     ConflictError,
     ForbiddenError,
@@ -47,47 +41,17 @@ USER_ROLE_LABELS = {
     "pm": "مدیر پروژه",
     "procurement_manager": "مدیر تدارکات",
     "admin": "ادمین",
-    # کاربر فقطِ پنل مدیریت پروژه (PM) — به انبار/تدارکات دسترسی ندارد
-    "supervisor": "سرپرست پروژه",
 }
 
 
-PANEL_LEVELS = ("full", "limited")
-PANELS = ("procurement", "inventory", "pm")
-
-
-async def _panels_of(db: AsyncSession, user_id) -> dict:
-    """panel -> level map for the user (لایه پنل‌ها — جایگزین نقش‌ها)."""
-    rows = (
-        await db.execute(
-            select(UserPanel).where(UserPanel.user_id == user_id).order_by(UserPanel.created_at)
-        )
-    ).scalars().all()
-    return {row.panel: row.level for row in rows}
-
-
-async def _member_project_ids_of(db: AsyncSession, user_id) -> list[str]:
-    """عضویت M:N کاربر در پروژه‌ها (جدا از مسئولیت) — رشته."""
-    rows = (
-        await db.execute(
-            select(UserProjectMembership.project_id)
-            .where(UserProjectMembership.user_id == user_id)
-            .order_by(UserProjectMembership.created_at)
-        )
-    ).scalars().all()
-    return [str(pid) for pid in rows]
-
-
-async def user_to_dict(user: User, projects: list[Project] | None = None, db: AsyncSession | None = None) -> dict:
+def user_to_dict(user: User, projects: list[Project] | None = None) -> dict:
     """Serialize a user. `projects` = every project the PM manages (1:N);
-    project_id/project_name stay as the first (oldest) one for compatibility.
-    با db، پنل‌های تخصیصی و عضویت پروژه‌ای هم برمی‌گردند."""
+    project_id/project_name stay as the first (oldest) one for compatibility."""
     projects = projects or []
     first = projects[0] if projects else None
-    out = {
+    return {
         "id": str(user.id),
         "casdoor_id": user.casdoor_id,
-        "username": user.username,
         "first_name": user.first_name,
         "last_name": user.last_name,
         "phone": user.phone,
@@ -98,39 +62,23 @@ async def user_to_dict(user: User, projects: list[Project] | None = None, db: As
         "projects": [{"id": str(p.id), "name": p.name} for p in projects],
         "created_at": to_iso(user.created_at),
     }
-    if db is not None:
-        out["panels"] = await _panels_of(db, user.id)
-        member_pids = await _member_project_ids_of(db, user.id)
-        all_pids = list(dict.fromkeys(member_pids + [str(p.id) for p in projects]))
-        out["member_project_ids"] = all_pids
-    return out
 
 
 async def _org_manager(ctx: UserContext = Depends(get_current_user)) -> UserContext:
-    """Admin, procurement manager, or project manager — organization management."""
-    if ctx.role not in ("admin", "procurement_manager", "pm"):
+    """Admin OR procurement manager (the same person) — organization management."""
+    if ctx.role not in ("admin", "procurement_manager"):
         raise ForbiddenError("دسترسی به این بخش برای نقش شما مجاز نیست")
     return ctx
 
 
 async def _user_projects(db: AsyncSession, user: User) -> list[Project]:
-    """Every project assigned to the user (supervisor or PM) (oldest first).
-    Includes both direct PM assignments (pm_user_id) and member projects (UserProjectMembership).
-    """
-    if user.role not in ("supervisor", "pm"):
+    """Every project the user manages as PM (oldest first; [] for non-PMs)."""
+    if user.role != "pm":
         return []
-    member_subq = select(UserProjectMembership.project_id).where(
-        UserProjectMembership.user_id == user.id
-    )
     rows = (
         await db.execute(
             select(Project)
-            .where(
-                or_(
-                    Project.pm_user_id == user.id,
-                    Project.id.in_(member_subq),
-                )
-            )
+            .where(Project.pm_user_id == user.id)
             .order_by(Project.created_at, Project.id)
         )
     ).scalars().all()
@@ -179,7 +127,7 @@ async def _casdoor_users() -> list[dict]:
 @router.get("/me")
 async def me(ctx: UserContext = Depends(get_current_user), db: AsyncSession = Depends(get_db)):
     projects = await _user_projects(db, ctx.user)
-    return {"data": await user_to_dict(ctx.user, projects, db)}
+    return {"data": user_to_dict(ctx.user, projects)}
 
 
 @router.get("/me/projects")
@@ -190,18 +138,6 @@ async def my_projects(ctx: UserContext = Depends(get_current_user), db: AsyncSes
     active project against this list and falls back gracefully when a
     project is revoked."""
     projects = await _user_projects(db, ctx.user)
-    # عضویت‌های M:N (لایه پنل‌ها) هم به فهرست اضافه می‌شود
-    member_ids = set(ctx.member_project_ids or [])
-    have = {p.id for p in projects}
-    if member_ids:
-        extra = (
-            await db.execute(
-                select(Project)
-                .where(Project.id.in_(member_ids))
-                .order_by(Project.created_at, Project.id)
-            )
-        ).scalars().all()
-        projects = list(projects) + [p for p in extra if p.id not in have]
     return {"data": [{"id": str(p.id), "name": p.name} for p in projects]}
 
 
@@ -212,20 +148,20 @@ async def list_users(
 ):
     """Every user (with role + assigned projects) — Organization panel."""
     users = (await db.execute(select(User).order_by(User.created_at))).scalars().all()
-    supervisor_ids = {u.id for u in users if u.role in ("supervisor", "pm")}
+    pm_ids = {u.id for u in users if u.role == "pm"}
     by_user: dict = {}
-    if supervisor_ids:
+    if pm_ids:
         projs = (
             await db.execute(
                 select(Project)
-                .where(Project.pm_user_id.in_(supervisor_ids))
+                .where(Project.pm_user_id.in_(pm_ids))
                 .order_by(Project.created_at, Project.id)
             )
         ).scalars().all()
         for p in projs:
             by_user.setdefault(p.pm_user_id, []).append(p)
     return {
-        "data": [await user_to_dict(u, by_user.get(u.id, []), db) for u in users],
+        "data": [user_to_dict(u, by_user.get(u.id, [])) for u in users],
         "meta": {"total": len(users)},
     }
 
@@ -251,30 +187,30 @@ async def create_user(
     db.add(user)
     await db.flush()
     await audit_record(db, actor=ctx.display_name, action="user.created", entity="user", entity_id=str(user.id), details={"role": payload.role})
-    return {"data": await user_to_dict(user)}
+    return {"data": user_to_dict(user)}
 
 
 @router.patch("/{user_id}")
 async def update_user_role(
     user_id,
     payload: UserRoleUpdate,
-    ctx: UserContext = Depends(_org_manager),
+    ctx: UserContext = Depends(require_role("admin")),
     db: AsyncSession = Depends(get_db),
 ):
-    """Set/clear a role — organization management (admin, procurement manager, PM)."""
-    if payload.role == "admin" and ctx.role != "admin":
-        raise ForbiddenError("فقط ادمین می‌تواند نقش ادمین تعیین کند")
+    """Set/clear a role — ADMIN ONLY (RBAC): procurement managers must not
+    assign or elevate roles. Revoking (or switching away from «pm») also
+    unassigns the user from their project."""
     user = await db.get(User, user_id)
     if user is None:
         raise NotFoundError("کاربر یافت نشد")
     previous_role = user.role
-    if user.role in ("supervisor", "pm") and payload.role not in ("supervisor", "pm"):
+    if user.role == "pm" and payload.role != "pm":
         await _unassign_projects(db, user.id)
     user.role = payload.role
     await db.flush()
     await audit_record(db, actor=ctx.display_name, action="user.role_changed", entity="user", entity_id=str(user.id), details={"from": previous_role, "to": payload.role})
     projects = await _user_projects(db, user)
-    return {"data": await user_to_dict(user, projects)}
+    return {"data": user_to_dict(user, projects)}
 
 
 @router.post("/sync")
@@ -295,15 +231,8 @@ async def sync_casdoor_users(
             continue
         existing = await db.scalar(select(User).where(User.casdoor_id == cid))
         if existing is None:
-            uname = str(cu.get("name") or cu.get("preferred_username") or "") or None
-            if uname:
-                by_uname = await db.scalar(select(User).where(User.username == uname))
-                if by_uname is not None:
-                    by_uname.casdoor_id = cid
-                    continue
             db.add(User(
                 casdoor_id=cid,
-                username=uname,
                 first_name=str(
                     cu.get("firstName")
                     or cu.get("displayName")
@@ -314,27 +243,23 @@ async def sync_casdoor_users(
                 phone=str(cu.get("phone") or "") or None,
             ))
             created += 1
-        elif not existing.username:
-            uname = str(cu.get("name") or cu.get("preferred_username") or "") or None
-            if uname:
-                existing.username = uname
     await db.flush()
 
     users = (await db.execute(select(User).order_by(User.created_at))).scalars().all()
-    supervisor_ids = {u.id for u in users if u.role in ("supervisor", "pm")}
+    pm_ids = {u.id for u in users if u.role == "pm"}
     by_user: dict = {}
-    if supervisor_ids:
+    if pm_ids:
         projs = (
             await db.execute(
                 select(Project)
-                .where(Project.pm_user_id.in_(supervisor_ids))
+                .where(Project.pm_user_id.in_(pm_ids))
                 .order_by(Project.created_at, Project.id)
             )
         ).scalars().all()
         for p in projs:
             by_user.setdefault(p.pm_user_id, []).append(p)
     return {
-        "data": [await user_to_dict(u, by_user.get(u.id, []), db) for u in users],
+        "data": [user_to_dict(u, by_user.get(u.id, [])) for u in users],
         "meta": {"total": len(users), "created": created},
     }
 
@@ -357,97 +282,17 @@ async def assign_user_project(
     user = await db.get(User, user_id)
     if user is None:
         raise NotFoundError("کاربر یافت نشد")
-    if user.role not in ("supervisor", "pm"):
-        raise ValidationError("ابتدا نقش این کاربر را «سرپرست پروژه» کنید", field="role")
+    if user.role != "pm":
+        raise ValidationError("ابتدا نقش این کاربر را «مدیر پروژه» کنید", field="role")
 
     if payload.project_id is None:
         await _unassign_projects(db, user.id)
-        if user.username:
-            await db.execute(
-                text("DELETE FROM project_assignments WHERE user_id IN (SELECT id FROM pm_users WHERE username = :uname)"),
-                {"uname": user.username}
-            )
         await db.flush()
-        return {"data": await user_to_dict(user)}
+        return {"data": user_to_dict(user)}
 
     project = await db.get(Project, payload.project_id)
     if project is None:
         raise NotFoundError("پروژه یافت نشد", field="project_id")
     project.pm_user_id = user.id
-    if user.username:
-        await db.execute(
-            text("""
-                INSERT INTO project_assignments (id, user_id, project_id)
-                SELECT gen_random_uuid(), pu.id, :pid
-                FROM pm_users pu
-                WHERE pu.username = :uname
-                AND NOT EXISTS (
-                    SELECT 1 FROM project_assignments pa
-                    WHERE pa.user_id = pu.id AND pa.project_id = :pid
-                )
-            """),
-            {"pid": project.id, "uname": user.username}
-        )
     await db.flush()
-    return {"data": await user_to_dict(user, await _user_projects(db, user))}
-
-
-# ---------------------------------------------------------------------------
-# پنل‌ها و سطوح دسترسی — جایگزین مدل نقش برای کاربران عادی
-# ---------------------------------------------------------------------------
-
-
-@router.put("/{user_id}/panels")
-@router.patch("/{user_id}/panels")
-async def set_user_panels(
-    user_id,
-    payload: UserPanelsUpdate,
-    _: UserContext = Depends(_org_manager),
-    db: AsyncSession = Depends(get_db),
-):
-    """تخصیص پنل + سطح دسترسی به کاربر — مدیران سازمان (ادمین، مدیر تدارکات، مدیر پروژه)."""
-    user = await db.get(User, user_id)
-    if user is None:
-        raise NotFoundError("کاربر یافت نشد")
-    for panel, level in payload.panels.items():
-        if panel not in PANELS:
-            raise ValidationError(f"پنل نامعتبر: {panel}", field="panels")
-        if level not in PANEL_LEVELS:
-            raise ValidationError(f"سطح دسترسی نامعتبر: {level}", field="panels")
-    await db.execute(delete(UserPanel).where(UserPanel.user_id == user.id))
-    for panel, level in payload.panels.items():
-        db.add(UserPanel(user_id=user.id, panel=panel, level=level))
-    await db.flush()
-    return {"data": await user_to_dict(user, await _user_projects(db, user), db)}
-
-
-@router.put("/{user_id}/panel-projects")
-@router.patch("/{user_id}/panel-projects")
-async def set_user_panel_projects(
-    user_id,
-    payload: UserPanelProjectsUpdate,
-    _: UserContext = Depends(_org_manager),
-    db: AsyncSession = Depends(get_db),
-):
-    """عضویت پروژه‌ای کاربر (M:N) — محدوده داده‌ی سطح limited."""
-    user = await db.get(User, user_id)
-    if user is None:
-        raise NotFoundError("کاربر یافت نشد")
-    wanted = list(dict.fromkeys(payload.project_ids))
-    if wanted:
-        found = (
-            await db.execute(select(Project).where(Project.id.in_(wanted)))
-        ).scalars().all()
-        found_ids = {p.id for p in found}
-        unknown = [str(pid) for pid in wanted if pid not in found_ids]
-        if unknown:
-            raise ValidationError(
-                "پروژه(های) نامعتبر: " + "، ".join(unknown), field="project_ids"
-            )
-    await db.execute(
-        delete(UserProjectMembership).where(UserProjectMembership.user_id == user.id)
-    )
-    for pid in wanted:
-        db.add(UserProjectMembership(user_id=user.id, project_id=pid))
-    await db.flush()
-    return {"data": await user_to_dict(user, await _user_projects(db, user), db)}
+    return {"data": user_to_dict(user, await _user_projects(db, user))}

backend/app/schemas/procurement.py

@@ -44,19 +44,14 @@ class SupplierMaterialCreate(APIModel):
 
 class ProjectCreate(APIModel):
     name: str = Field(min_length=1)
-    location: str | None = None
-    project_manager: str | None = None
     description: str | None = None
     start_date: date | None = None
 
 
 class ProjectUpdate(APIModel):
     name: str | None = Field(default=None, min_length=1)
-    location: str | None = None
-    project_manager: str | None = None
     description: str | None = None
     start_date: date | None = None
-    status: str | None = None
     # PM assignment (1:N — one PM per project, a PM may own many projects).
     # Admin / procurement manager only; None unassigns this project's PM.
     pm_user_id: UUID | None = None
@@ -208,13 +203,13 @@ class UserCreate(APIModel):
     last_name: str = ""
     phone: str | None = None
     casdoor_id: str | None = None
-    role: Literal["pm", "procurement_manager", "admin", "supervisor"] | None = None
+    role: Literal["pm", "procurement_manager", "admin"] | None = None
 
 
 class UserRoleUpdate(APIModel):
     """role=None revokes the role (and any project assignment)."""
 
-    role: Literal["pm", "procurement_manager", "admin", "supervisor"] | None = None
+    role: Literal["pm", "procurement_manager", "admin"] | None = None
 
 
 class UserProjectUpdate(APIModel):
@@ -346,16 +341,3 @@ class ReceiptUpdate(APIModel):
     received_qty: Decimal | None = Field(default=None, gt=0)
     on_time: bool | None = None
     quality_note: str | None = None
-
-
-class UserPanelsUpdate(APIModel):
-    """Replace the user's panel assignments. هر پنل: 'full' | 'limited' —
-    پنل غایب یعنی تخصیص نداشتن و کلید آن حذف می‌شود."""
-
-    panels: dict[str, str] = Field(default_factory=dict)
-
-
-class UserPanelProjectsUpdate(APIModel):
-    """Replace the user's project memberships (M:N — جدا از مسئولیت پروژه)."""
-
-    project_ids: list[UUID] = Field(default_factory=list)

docker-compose.yml

@@ -248,9 +248,6 @@ services:
     ports:
       - "8000:8000"
 
-    volumes:
-      - ./backend/app:/srv/backend/app
-
     networks:
       - traefik_network
       - default

frontend/index.html

@@ -13,7 +13,7 @@
       href="https://fonts.googleapis.com/css2?family=Vazirmatn:wght@400;500;600;700;800&display=swap"
       rel="stylesheet"
     />
-    <title>سامانه جامع مدیریت پروژه، تدارکات و انبار</title>
+    <title>دفتر پیشنهادهای خرید — دفترچه تأمین</title>
   </head>
   <body>
     <div id="root"></div>

frontend/public/manifest.webmanifest

@@ -1,7 +1,7 @@
 {
-  "name": "سامانه جامع مدیریت پروژه، تدارکات و انبار",
-  "short_name": "مدیریت پروژه و تأمین",
-  "description": "سامانه جامع مدیریت عملیات پروژه، تدارکات و انبارداری",
+  "name": "دفترچه تأمین — سامانه تدارکات و انبار",
+  "short_name": "دفترچه تأمین",
+  "description": "سامانه تدارکات و مدیریت انبار پروژه‌های ساختمانی",
   "dir": "rtl",
   "lang": "fa",
   "start_url": "/",

frontend/src/App.tsx

@@ -1,5 +1,5 @@
 import { lazy, Suspense } from "react";
-import { Navigate, Route, Routes, useLocation } from "react-router-dom";
+import { Navigate, Route, Routes } from "react-router-dom";
 import { useAuthStore } from "./store/auth";
 import { ErrorBoundary } from "./components/ErrorBoundary";
 import { RequirePmProjects } from "./components/RequirePmProjects";
@@ -38,14 +38,11 @@ const WarehousesPage = lazy(() =>
   import("./pages/Inventory/WarehousesPage").then((m) => ({ default: m.WarehousesPage })),
 );
 const OrganizationPage = lazy(() =>
-  import("./pages/Organization/OrganizationPage").then((m) => ({ default: m.OrganizationPage })),
+  import("./pages/Inventory/OrganizationPage").then((m) => ({ default: m.OrganizationPage })),
 );
 const AdminPanelPage = lazy(() =>
   import("./pages/Admin/AdminPanel").then((m) => ({ default: m.AdminPanel })),
 );
-const RequesterHome = lazy(() =>
-  import("./pages/Dashboard/RequesterHome").then((m) => ({ default: m.RequesterHome })),
-);
 
 function Loading() {
   return (
@@ -58,251 +55,15 @@ function Loading() {
 // همه‌ی صفحات پشت ورود هستند — بدون نشست، به صفحه‌ی ورود می‌رویم.
 function RequireAuth({ children }: { children: React.ReactNode }) {
   const user = useAuthStore((s) => s.user);
-  const { pathname } = useLocation();
   if (!user) return <Navigate to="/login" replace />;
-  if (user.role === "supervisor") {
-    // اگر سرپرست پروژه‌ای نداشته باشد، دسترسی مسدود می‌شود
-    const hasProjects =
-      (Boolean(user.projects && user.projects.length > 0)) ||
-      (Boolean(user.member_project_ids && user.member_project_ids.length > 0));
-    if (!hasProjects) {
-      return (
-        <div className="flex min-h-screen items-center justify-center bg-bg px-4">
-          <div className="w-full max-w-md rounded-2xl border border-line bg-panel p-8 text-center shadow-sm">
-            <h1 className="text-[16px] font-extrabold text-red">پروژه تخصیص داده نشده است</h1>
-            <p className="mt-2 text-[12.5px] leading-6 text-muted">
-              شما به عنوان سرپرست پروژه در سیستم ثبت شده‌اید اما هنوز هیچ پروژه‌ای به شما تخصیص داده نشده است.
-              تا زمان تخصیص پروژه توسط مدیر سیستم، اجازه ورود به سامانه را ندارید.
-            </p>
-            <button
-              type="button"
-              onClick={() => {
-                useAuthStore.getState().logout();
-                window.location.href = "/login";
-              }}
-              className="mt-5 inline-flex h-10 w-full cursor-pointer items-center justify-center rounded-lg bg-accent px-4 text-[13px] font-bold text-white transition-colors hover:bg-accent-dark"
-            >
-              خروج از حساب
-            </button>
-          </div>
-        </div>
-      );
-    }
-  }
-
-  // بررسی دسترسی به مسیرها بر اساس ترکیب نقش سازمانی و پنل‌های تخصیصی:
-  const panels = user.panels ?? {};
-  const isAdmin = user.role === "admin";
-  const hasPanelsConfig = Boolean(user.panels && Object.keys(user.panels).length > 0);
-
-  const hasProcurement =
-    isAdmin ||
-    (hasPanelsConfig
-      ? Boolean(panels.procurement)
-      : user.role === "procurement_manager");
-
-  const hasInventory =
-    isAdmin ||
-    (hasPanelsConfig
-      ? Boolean(panels.inventory)
-      : user.role === "pm" || user.role === "supervisor");
-
-  const hasPm =
-    isAdmin ||
-    (hasPanelsConfig
-      ? Boolean(panels.pm)
-      : user.role === "pm" || user.role === "supervisor");
-
-  const isProcurementRoute =
-    pathname === "/" ||
-    pathname.startsWith("/wizard") ||
-    pathname.startsWith("/suppliers") ||
-    pathname.startsWith("/projects") ||
-    pathname.startsWith("/units") ||
-    pathname.startsWith("/requester");
-
-  if (isProcurementRoute && !hasProcurement) {
-    if (hasInventory) return <Navigate to="/inventory" replace />;
-    if (hasPm) return <Navigate to="/panel/pm" replace />;
-    return <Navigate to="/login" replace />;
-  }
-
-  if (pathname.startsWith("/inventory") && !hasInventory) {
-    if (hasProcurement) return <Navigate to={panels.procurement === "limited" && !isAdmin ? "/wizard" : "/"} replace />;
-    if (hasPm) return <Navigate to="/panel/pm" replace />;
-    return <Navigate to="/login" replace />;
-  }
-
   return <>{children}</>;
 }
 
-// صفحه‌ی اصلی بر اساس لایه پنل‌ها (جایگزین نقش‌ها):
+// صفحه‌ی اصلی بر اساس نقش: مدیر پروژه → پنل انبار؛ مدیر تدارکات/ادمین → دفتر
 function HomeRoute() {
   const user = useAuthStore((s) => s.user);
-  const panels = user?.panels ?? {};
-  const isAdmin = user?.role === "admin";
-  const hasPanelsConfig = Boolean(user?.panels && Object.keys(user.panels).length > 0);
-
-  const hasProcurement =
-    isAdmin ||
-    (hasPanelsConfig
-      ? Boolean(panels.procurement)
-      : user?.role === "procurement_manager");
-
-  const hasInventory =
-    isAdmin ||
-    (hasPanelsConfig
-      ? Boolean(panels.inventory)
-      : user?.role === "pm" || user?.role === "supervisor");
-
-  const hasPm =
-    isAdmin ||
-    (hasPanelsConfig
-      ? Boolean(panels.pm)
-      : user?.role === "pm" || user?.role === "supervisor");
-
-  // ۱. اگر پنل تدارکات دارد:
-  if (hasProcurement) {
-    if (panels.procurement === "limited" && !isAdmin) {
-      return <Navigate to="/wizard" replace />;
-    }
+  if (user?.role === "pm") return <Navigate to="/inventory" replace />;
   return <DashboardPage />;
-  }
-
-  // ۲. اگر پنل انبار دارد:
-  if (hasInventory) return <Navigate to="/inventory" replace />;
-
-  // ۳. اگر پنل PM دارد:
-  if (hasPm) return <Navigate to="/panel/pm" replace />;
-
-  // در صورتی که کاربر به هیچ پنلی دسترسی ندارد:
-  return (
-    <div className="flex min-h-screen items-center justify-center p-4">
-      <div className="w-full max-w-md rounded-2xl border border-line bg-panel p-6 text-center shadow-lg">
-        <h3 className="text-base font-bold text-slate-800">عدم دسترسی به پنل‌های سامانه</h3>
-        <p className="mt-2 text-xs text-muted leading-6">
-          حساب کاربری شما فعال است اما در حال حاضر به هیچ‌یک از پنل‌های سامانه دسترسی ندارد. لطفاً با مدیر سیستم تماس بگیرید.
-        </p>
-      </div>
-    </div>
-  );
-}
-
-// دسترسی ایجاد استعلام/پیشنهاد (ویزارد): ادمین، نقش‌های تدارکات و پنل‌های تدارکات (full یا limited)
-function RequireProcurementWrite({ children }: { children: React.ReactNode }) {
-  const user = useAuthStore((s) => s.user);
-  const panels = user?.panels ?? {};
-  const isAdmin = user?.role === "admin";
-  const hasPanelsConfig = Boolean(user?.panels && Object.keys(user.panels).length > 0);
-  const hasProcurement =
-    isAdmin ||
-    (hasPanelsConfig
-      ? Boolean(panels.procurement)
-      : user?.role === "procurement_manager" || user?.role === "pm");
-
-  if (hasProcurement) {
-    return <>{children}</>;
-  }
-
-  const hasInventory =
-    isAdmin ||
-    (hasPanelsConfig
-      ? Boolean(panels.inventory)
-      : user?.role === "pm" || user?.role === "supervisor");
-  if (hasInventory) return <Navigate to="/inventory" replace />;
-
-  const hasPm =
-    isAdmin ||
-    (hasPanelsConfig
-      ? Boolean(panels.pm)
-      : user?.role === "pm" || user?.role === "supervisor");
-  if (hasPm) return <Navigate to="/panel/pm" replace />;
-
-  return <Navigate to="/login" replace />;
-}
-
-// پنل «مدیریت پروژه (PM)» — اپ PM روی همان دامنه زیر مسیر /pm سرو می‌شود
-function PmPanelPage() {
-  return (
-    <iframe
-      src="/pm/"
-      title="مدیریت پروژه (PM)"
-      className="h-dvh w-full border-0"
-    />
-  );
-}
-
-// دسترسی پنل PM: ادمین، پنل pm (full/limited) و نقش‌های pm/supervisor
-function RequirePmPanel({ children }: { children: React.ReactNode }) {
-  const user = useAuthStore((s) => s.user);
-  const panels = user?.panels ?? {};
-  const isAdmin = user?.role === "admin";
-  const hasPanelsConfig = Boolean(user?.panels && Object.keys(user.panels).length > 0);
-  const hasPm =
-    isAdmin ||
-    (hasPanelsConfig
-      ? Boolean(panels.pm)
-      : user?.role === "pm" || user?.role === "supervisor");
-
-  if (!hasPm) {
-    const hasProcurement =
-      isAdmin ||
-      (hasPanelsConfig
-        ? Boolean(panels.procurement)
-        : user?.role === "procurement_manager");
-    if (hasProcurement) {
-      return <Navigate to={panels.procurement === "limited" && !isAdmin ? "/wizard" : "/"} replace />;
-    }
-    const hasInventory =
-      isAdmin ||
-      (hasPanelsConfig
-        ? Boolean(panels.inventory)
-        : user?.role === "pm" || user?.role === "supervisor");
-    if (hasInventory) return <Navigate to="/inventory" replace />;
-    return <Navigate to="/login" replace />;
-  }
-  return <>{children}</>;
-}
-
-// دسترسی پنل سازمان‌دهی: فقط ادمین، مدیر تدارکات و مدیر پروژه
-function RequireOrganization({ children }: { children: React.ReactNode }) {
-  const user = useAuthStore((s) => s.user);
-  const isAdmin = user?.role === "admin";
-  const allowed = isAdmin || user?.role === "procurement_manager" || user?.role === "pm";
-  if (!allowed) {
-    const panels = user?.panels ?? {};
-    const hasPanelsConfig = Boolean(user?.panels && Object.keys(user.panels).length > 0);
-    const hasProcurement = isAdmin || (hasPanelsConfig ? Boolean(panels.procurement) : user?.role === "procurement_manager");
-    if (hasProcurement) return <Navigate to={panels.procurement === "limited" && !isAdmin ? "/wizard" : "/"} replace />;
-    const hasInventory = isAdmin || (hasPanelsConfig ? Boolean(panels.inventory) : user?.role === "supervisor");
-    if (hasInventory) return <Navigate to="/inventory" replace />;
-    return <Navigate to="/panel/pm" replace />;
-  }
-  return <>{children}</>;
-}
-
-// دسترسی تغییر موجودی انبار: ادمین، سرپرست پروژه (میراث) و پنل انبار limited —
-// پنل انبار full طبق طراحی به تغییر موجودی دسترسی ندارد
-function RequireInventoryChange({ children }: { children: React.ReactNode }) {
-  const user = useAuthStore((s) => s.user);
-  const allowed =
-    user?.role === "admin" ||
-    user?.role === "supervisor" ||
-    user?.panels?.inventory === "limited";
-  if (!allowed) {
-    return <Navigate to="/inventory" replace />;
-  }
-  return <>{children}</>;
-}
-
-// دسترسی مدیریت انبارها: مدیران، ادمین و سرپرست پروژه (سرپرست پروژه منحصراً انبارهای پروژه خودش را می‌بیند)
-function RequireWarehouseManage({ children }: { children: React.ReactNode }) {
-  const user = useAuthStore((s) => s.user);
-  const allowed = user?.role === "admin" || user?.role === "procurement_manager" || user?.role === "pm" || user?.role === "supervisor";
-  if (!allowed) {
-    return <Navigate to="/inventory" replace />;
-  }
-  return <>{children}</>;
 }
 
 export default function App() {
@@ -323,13 +84,10 @@ export default function App() {
           path="/wizard"
           element={
             <RequireAuth>
-              <RequireProcurementWrite>
               <WizardPage />
-              </RequireProcurementWrite>
             </RequireAuth>
           }
         />
-        <Route path="/requester" element={<Navigate to="/wizard" replace />} />
         <Route
           path="/suppliers"
           element={
@@ -406,9 +164,7 @@ export default function App() {
           element={
             <RequireAuth>
               <RequirePmProjects>
-                <RequireInventoryChange>
                 <ChangeInventoryPage />
-                </RequireInventoryChange>
               </RequirePmProjects>
             </RequireAuth>
           }
@@ -428,24 +184,18 @@ export default function App() {
           element={
             <RequireAuth>
               <RequirePmProjects>
-                <RequireWarehouseManage>
                 <WarehousesPage />
-                </RequireWarehouseManage>
               </RequirePmProjects>
             </RequireAuth>
           }
         />
         <Route
           path="/inventory/org"
-          element={<Navigate to="/organization" replace />}
-        />
-        <Route
-          path="/organization"
           element={
             <RequireAuth>
-              <RequireOrganization>
+              <RequirePmProjects>
                 <OrganizationPage />
-              </RequireOrganization>
+              </RequirePmProjects>
             </RequireAuth>
           }
         />
@@ -457,26 +207,6 @@ export default function App() {
             </RequireAuth>
           }
         />
-        {/* خانه حداقلی استعلام — تدارکات سطح limited */}
-        <Route
-          path="/requester"
-          element={
-            <RequireAuth>
-              <RequesterHome />
-            </RequireAuth>
-          }
-        />
-        {/* پنل مدیریت پروژه — فقط ادمین و مدیر پروژه */}
-        <Route
-          path="/panel/pm"
-          element={
-            <RequireAuth>
-              <RequirePmPanel>
-                <PmPanelPage />
-              </RequirePmPanel>
-            </RequireAuth>
-          }
-        />
         <Route path="*" element={<Navigate to="/" replace />} />
         </Routes>
       </Suspense>

frontend/src/components/AppSwitcherMenu.tsx

@@ -1,84 +1,48 @@
-
+import { useLocation } from "react-router-dom";
 import { PanelMenu, type MenuItem } from "./PanelMenu";
 import { useLogout } from "../pages/Inventory/panelMenu";
 import { useAuthStore } from "../store/auth";
 
-// منوی همبرگری مشترک بین ۴ پنل اصلی سامانه:
-// ۱. مدیریت انبار (/inventory)
-// ۲. مدیریت تدارکات (/)
-// ۳. مدیریت پروژه (/panel/pm)
-// ۴. سازمان‌دهی (/organization)
+// منوی همبرگری مشترک بین دو ماژول (پنل انبار / دفتر تدارکات) —
+// دقیقاً مثل منوی دفتر: عنوان «پنل‌ها»، ماژول فعلی با استایل فعال (پر)
+// + «✓ فعلی»، ماژول دیگر به‌عنوان سوییچر، و در پایان جداکننده + خروج.
+// مدیر پروژه (1:N): زیر «مدیریت انبار» یک آکاردئون باز می‌شود که همه‌ی
+// پروژه‌های تخصیص‌یافته را نشان می‌دهد؛ پروژه‌ی فعال با «✓ فعلی» مشخص است و
+// انتخاب هر پروژه فقط «پروژه‌ی فعال» را عوض می‌کند (نشست/توکن دست‌نخورده).
 export function AppSwitcherMenu({
   activeModule,
   canSwitchToProcurement = true,
 }: {
-  activeModule: "warehouse" | "procurement" | "organization";
-  canSwitchToProcurement?: boolean;
+  activeModule: "warehouse" | "procurement";
+  canSwitchToProcurement?: boolean; // مدیر پروژه به دفتر تدارکات دسترسی ندارد
 }) {
   const logout = useLogout();
+  const { pathname } = useLocation();
   const user = useAuthStore((s) => s.user);
-  const panels = user?.panels ?? {};
-
-  const isAdmin = user?.role === "admin";
-  const hasPanelsConfig = Boolean(user?.panels && Object.keys(user.panels).length > 0);
-
-  const hasProcurement =
-    isAdmin ||
-    (hasPanelsConfig
-      ? Boolean(panels.procurement)
-      : user?.role === "procurement_manager");
-
-  const hasInventory =
-    isAdmin ||
-    (hasPanelsConfig
-      ? Boolean(panels.inventory)
-      : user?.role === "pm" || user?.role === "supervisor");
-
-  const hasPm =
-    isAdmin ||
-    (hasPanelsConfig
-      ? Boolean(panels.pm)
-      : user?.role === "pm" || user?.role === "supervisor");
-
-  // فقط نقش‌های ادمین، مدیر پروژه و مدیر تدارکات به پنل سازمان‌دهی دسترسی دارند
-  const canManageOrg =
-    isAdmin ||
-    user?.role === "procurement_manager" ||
-    user?.role === "pm";
-
+  const setActiveProject = useAuthStore((s) => s.setActiveProject);
   const items: MenuItem[] = [];
 
-  if (hasInventory) {
-    items.push({
-      label: "انبار",
-      to: "/inventory",
-      active: activeModule === "warehouse",
-    });
-  }
+  const isPm = user?.role === "pm";
+  const pmProjects = isPm ? user?.projects ?? [] : [];
+  const projectChildren: MenuItem[] | undefined =
+    activeModule === "warehouse" && isPm
+      ? pmProjects.map((p) => ({
+          label: p.name,
+          to: pathname, // همان بخش فعلی؛ فقط پروژه عوض می‌شود
+          active: p.id === user?.project_id,
+          onClick: () => setActiveProject(p.id),
+        }))
+      : undefined;
 
-  if (hasProcurement && canSwitchToProcurement) {
-    items.push({
-      label: "تدارکات",
-      to: panels.procurement === "limited" && !isAdmin ? "/wizard" : "/",
-      active: activeModule === "procurement",
-    });
+  if (activeModule === "procurement") {
+    items.push({ label: "مدیریت انبار", to: "/inventory" });
+    items.push({ label: "مدیریت تدارکات", to: "/", active: true });
+  } else {
+    items.push({ label: "مدیریت انبار", to: "/inventory", active: true, children: projectChildren });
+    if (canSwitchToProcurement) {
+      items.push({ label: "مدیریت تدارکات", to: "/" });
     }
-
-  if (hasPm) {
-    items.push({
-      label: "مدیریت پروژه",
-      to: "/panel/pm",
-    });
   }
-
-  if (canManageOrg) {
-    items.push({
-      label: "سازمان‌دهی",
-      to: "/organization",
-      active: activeModule === "organization",
-    });
-  }
-
   items.push({ divider: true });
   items.push({ label: "خروج از حساب", onClick: logout });
   return <PanelMenu title="پنل‌ها" items={items} />;

frontend/src/components/PanelMenu.tsx

@@ -6,8 +6,6 @@ import { cn } from "../lib/utils";
 export interface MenuItem {
   label?: string;
   to?: string;
-  // لینک خارجی (اپ جداگانه، مثل سامانه PM) — در تب جدید باز می‌شود
-  href?: string;
   active?: boolean;
   divider?: boolean;
   onClick?: () => void;
@@ -114,21 +112,6 @@ export function PanelMenu({ items, title }: { items: MenuItem[]; title?: string
                   </div>
                 )}
               </div>
-            ) : it.href ? (
-              <a
-                key={i}
-                href={it.href}
-                target="_blank"
-                rel="noopener noreferrer"
-                onClick={() => setOpen(false)}
-                className={cn(
-                  "flex items-center justify-between gap-3 rounded-lg px-3 py-2 text-[13px] no-underline",
-                  it.active ? "bg-accent font-bold text-white" : "text-ink hover:bg-slate-bg",
-                )}
-              >
-                {it.label}
-                <span aria-hidden className="text-[10px] opacity-60">↗</span>
-              </a>
             ) : it.to ? (
               <Link
                 key={i}

frontend/src/components/RequirePmProjects.tsx

@@ -16,13 +16,11 @@ export function RequirePmProjects({ children }: { children: ReactNode }) {
   const setProjects = useAuthStore((s) => s.setProjects);
   const logout = useLogout();
 
-  // پنل انبار limited هم مثل سرپرست: پروژه‌های فعالش از عضویت‌ها اعتبارسنجی می‌شود
-  const isSupervisor = user?.role === "supervisor" || user?.panels?.inventory === "limited";
-  const [state, setState] = useState<"loading" | "ok" | "empty">(isSupervisor ? "loading" : "ok");
+  const isPm = user?.role === "pm";
+  const [state, setState] = useState<"loading" | "ok" | "empty">(isPm ? "loading" : "ok");
 
   useEffect(() => {
-    const scoped = user?.role === "supervisor" || user?.panels?.inventory === "limited";
-    if (!user || !scoped) {
+    if (!user || user.role !== "pm") {
       setState("ok");
       return;
     }
@@ -47,7 +45,7 @@ export function RequirePmProjects({ children }: { children: ReactNode }) {
       alive = false;
     };
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [user?.id, user?.role, user?.panels, isDev]);
+  }, [user?.id, user?.role, isDev]);
 
   if (state === "loading") {
     return (

frontend/src/components/layout/Header.tsx

@@ -2,23 +2,6 @@ import type { ReactNode } from "react";
 import { useLocation, useNavigate } from "react-router-dom";
 import { ChevronRight, ClipboardList } from "lucide-react";
 import { cn } from "../../lib/utils";
-import { useAuthStore, type AuthUser } from "../../store/auth";
-
-const ROLE_LABELS: Record<string, string> = {
-  admin: "ادمین",
-  procurement_manager: "مدیر تدارکات",
-  pm: "مدیر پروژه",
-  supervisor: "سرپرست پروژه",
-};
-
-export function userSubtitle(user: AuthUser | null | undefined): string {
-  if (!user) return "";
-  const fullName = `${user.first_name || ""} ${user.last_name || ""}`.trim() || user.display_name || "کاربر";
-  const username = user.username || user.casdoor_id || "-";
-  const role = user.role_label || (user.role ? ROLE_LABELS[user.role] : "بدون نقش");
-  const proj = user.role === "supervisor" && user.project_name ? ` – پروژه: ${user.project_name}` : "";
-  return `${fullName} | نام کاربری: ${username} | نقش: ${role}${proj}`;
-}
 
 interface HeaderProps {
   title: string;
@@ -35,10 +18,6 @@ interface HeaderProps {
 export function Header({ title, sub, backTo, backLabel = "بازگشت", actions, brand, icon, menu }: HeaderProps) {
   const navigate = useNavigate();
   const location = useLocation();
-  const user = useAuthStore((s) => s.user);
-
-  const userSub = userSubtitle(user);
-  const displaySub = sub !== undefined ? sub : userSub;
 
   // اگر کاربر از داخل برنامه به این صفحه آمده، یک قدم برمی‌گردیم؛
   // اگر مستقیم باز شده (بدون سابقه‌ی داخلی)، به backTo می‌رویم.
@@ -68,7 +47,7 @@ export function Header({ title, sub, backTo, backLabel = "بازگشت", actions
       <div className="flex min-w-0 items-center gap-2.5">
         <div className="min-w-0">
           <h1 className="text-[17px] font-extrabold leading-6">{title}</h1>
-          {displaySub && <div className="text-[11.5px] text-muted font-normal mt-0.5">{displaySub}</div>}
+          {sub && <div className="text-[11px] text-muted">{sub}</div>}
         </div>
       </div>
       <div className="ms-auto flex flex-wrap items-center gap-2">{actions}</div>

frontend/src/components/layout/MobileTabBar.tsx

@@ -8,6 +8,7 @@ import {
   PackageSearch,
   Scale,
   Truck,
+  UsersRound,
   type LucideIcon,
 } from "lucide-react";
 import { cn } from "../../lib/utils";
@@ -36,12 +37,12 @@ const PM_INV_TABS: TabDef[] = [
   { to: "/inventory/arrivals", label: "کالاهای در راه", icon: PackageSearch },
 ];
 
-// تب‌های پنل انبار برای ادمین / مدیر تدارکات / مدیر پروژه (آینه‌ی ناوبری بالای دسکتاپ)
+// تب‌های پنل انبار برای ادمین / مدیر تدارکات (آینه‌ی ناوبری بالای دسکتاپ)
 const ADMIN_INV_TABS: TabDef[] = [
   { to: "/inventory", label: "انبار", icon: Boxes, end: true },
   { to: "/inventory/daily", label: "کنترل روزانه", icon: CalendarDays },
-  { to: "/inventory/warehouses", label: "انبارها", icon: Building2 },
   { to: "/inventory/arrivals", label: "کالاهای در راه", icon: PackageSearch },
+  { to: "/inventory/org", label: "سازمان‌دهی", icon: UsersRound },
 ];
 
 function TabBar({ tabs }: { tabs: TabDef[] }) {
@@ -80,24 +81,14 @@ export function MobileTabBar() {
   const { pathname } = useLocation();
 
   if (pathname === "/login" || pathname === "/admin") return null;
-  // خانه حداقلی استعلام (تدارکات limited): بدون تب ERP — PM هم تب‌بار خودش را دارد
-  if (pathname === "/requester" || pathname === "/panel/pm") return null;
-  // کاربر فقطِ تدارکات-limited: تب‌های انبار/دفتر ندارد
-  const panels = useAuthStore.getState().user?.panels ?? {};
-  if (panels.procurement === "limited" && !panels.inventory && !panels.pm) return null;
-  // پنل مدیریت پروژه: iframe تمام‌صفحه‌ی PM است و خودش تب‌بار داخلی دارد
-  if (pathname === "/panel/pm") return null;
   const isPM = role === "pm";
-  const isSupervisor = role === "supervisor";
   const isOffice = role === "admin" || role === "procurement_manager";
 
   if (pathname.startsWith("/inventory")) {
     if (isPM) return <TabBar tabs={PM_INV_TABS} />;
-    if (isOffice || isSupervisor) return <TabBar tabs={ADMIN_INV_TABS} />;
+    if (isOffice) return <TabBar tabs={ADMIN_INV_TABS} />;
     return null;
   }
-  // سرپرست پروژه به بخش‌های تدارکات/دفتر دسترسی ندارد
-  if (isSupervisor) return null;
   if (pathname === "/wizard") return null;
   const onOfficePage =
     pathname === "/" ||

frontend/src/hooks/index.ts

@@ -2,5 +2,5 @@ export { useStoreData, useInvalidateStore, refreshProcurementStore } from "./use
 export { useQuotes, useCreateQuote, useUpdateQuote, useDeleteQuote } from "./useQuotes";
 export { useSuppliers, useAddSupplier, useUpdateSupplier, useRemoveSupplier } from "./useSuppliers";
 export { useMaterials, useAddMaterial } from "./useMaterials";
-export { useProjects, useAddProject, useDeleteProject } from "./useProjects";
+export { useProjects, useAddProject } from "./useProjects";
 export { useUnits, useSaveStandardConversion, useDeleteStandardConversion } from "./useUnits";

frontend/src/hooks/useProjects.ts

@@ -21,15 +21,3 @@ export function useAddProject() {
     onSettled: () => invalidate(),
   });
 }
-
-export function useDeleteProject() {
-  const deleteProject = useAppStore((s) => s.deleteProject);
-  const invalidate = useInvalidateStore();
-  return useMutation({
-    mutationFn: (id: string) => api.projects.delete(id),
-    onMutate: (id) => deleteProject(id),
-    onSettled: () => invalidate(),
-  });
-}
-
-

frontend/src/lib/api.ts

@@ -87,7 +87,7 @@ function handle401(path: string, res: Response): void {
 // ادمین/مدیر تدارکات بدون پارامتر (همه‌ی پروژه‌ها) باقی می‌ماند.
 function activeProjectId(): string | null {
   const { user } = useAuthStore.getState();
-  return user?.role === "supervisor" || user?.role === "pm" ? user.project_id : null;
+  return user?.role === "pm" ? user.project_id : null;
 }
 
 function projectQuery(projectId?: string | null): string {
@@ -250,10 +250,6 @@ async function patchData<T>(path: string, body: unknown): Promise<T> {
   const res = await request<{ data: T }>(path, { method: "PATCH", body: JSON.stringify(body) });
   return res.data;
 }
-async function putData<T>(path: string, body: unknown): Promise<T> {
-  const res = await request<{ data: T }>(path, { method: "PUT", body: JSON.stringify(body) });
-  return res.data;
-}
 async function deleteData<T>(path: string): Promise<T> {
   const res = await request<{ data: T }>(path, { method: "DELETE" });
   return res.data;
@@ -327,12 +323,6 @@ interface RawSupplier {
 interface RawProject {
   id: string;
   name: string;
-  location?: string | null;
-  project_manager?: string | null;
-  description?: string | null;
-  start_date?: string | null;
-  status?: string | null;
-  progress?: number | null;
 }
 interface RawSpec {
   attribute_key: string;
@@ -468,6 +458,36 @@ function adaptBrandLink(raw: RawBrandLink): BrandLinkRow {
   return { id: raw.id, brand_id: raw.brand_id, brand_name: raw.brand?.name || "" };
 }
 
+// ── تأمین‌کننده‌های متریال — پاسخ GET /materials/{id}/suppliers ──────────────
+// Raw shape mirrors the backend dict exactly. The backend uses an atomic
+// column-level JOIN so `name` always comes from the suppliers table.
+interface RawMaterialSupplier {
+  id: string;
+  name: string;
+  phone: string | null;
+  contact_person: string | null;
+  location: string | null;
+}
+
+/** Clean UI-facing type for one supplier linked to a material. */
+export interface MaterialSupplier {
+  id: string;
+  name: string;
+  phone: string | null;
+  contact_person: string | null;
+  location: string | null;
+}
+
+function adaptMaterialSupplier(raw: RawMaterialSupplier): MaterialSupplier {
+  return {
+    id: raw.id,
+    name: raw.name,
+    phone: raw.phone,
+    contact_person: raw.contact_person,
+    location: raw.location,
+  };
+}
+
 // فایل پیوست — پاسخ بک‌اند (metadata؛ بایت‌ها از endpoint دانلود می‌آیند)
 interface RawAttachment {
   id: string;
@@ -1136,41 +1156,23 @@ export const api = {
     updateCanonicalUnit: async (id: string, canonical_unit_id: number): Promise<void> => {
       await patchData(`/materials/${id}`, { canonical_unit_id });
     },
+    // فهرست تأمین‌کننده‌های متصل به یک متریال — GET /materials/{id}/suppliers
+    listSuppliers: async (materialId: string): Promise<MaterialSupplier[]> => {
+      const raw = await getData<RawMaterialSupplier[]>(
+        `/materials/${materialId}/suppliers?page_size=100`,
+      );
+      return raw.map(adaptMaterialSupplier);
+    },
   },
 
   projects: {
     list: async (): Promise<Project[]> => {
       const raw = await getData<RawProject[]>(`/projects?page_size=${PAGE_SIZE}`);
-      return raw.map((p) => ({
-        id: p.id,
-        name: p.name,
-        location: p.location || "",
-        project_manager: p.project_manager || "",
-        description: p.description || "",
-        start_date: p.start_date,
-        status: p.status || "ACTIVE",
-        progress: p.progress != null ? Number(p.progress) : 0,
-      }));
+      return raw.map((p) => ({ id: p.id, name: p.name }));
     },
     create: async (p: Project): Promise<Project> => {
-      const raw = await postData<RawProject>("/projects", {
-        name: p.name,
-        location: p.location || "",
-        project_manager: p.project_manager || "",
-        description: p.description || "",
-      });
-      return {
-        id: raw.id,
-        name: raw.name,
-        location: raw.location || "",
-        project_manager: raw.project_manager || "",
-        description: raw.description || "",
-        status: raw.status || "ACTIVE",
-        progress: raw.progress != null ? Number(raw.progress) : 0,
-      };
-    },
-    delete: async (id: string): Promise<void> => {
-      await deleteData(`/projects/${id}`);
+      const raw = await postData<RawProject>("/projects", { name: p.name });
+      return { id: raw.id, name: raw.name };
     },
   },
 
@@ -1560,16 +1562,11 @@ interface RawUnitL { id: number; code: string; name_fa: string | null; }
 export interface UserRow {
   id: string;
   casdoor_id: string;
-  username?: string | null;
   first_name: string;
   last_name: string;
   phone: string | null;
-  role: "pm" | "procurement_manager" | "admin" | "supervisor" | null;
+  role: "pm" | "procurement_manager" | "admin" | null;
   role_label: string | null;
-  // لایه پنل‌ها (جایگزین نقش‌ها): {'procurement': 'full'|'limited', ...}
-  panels?: Record<string, string>;
-  // عضویت M:N پروژه‌ای — محدوده داده سطح limited
-  member_project_ids?: string[];
   project_id: string | null;
   project_name: string | null;
   // 1:N — every project this PM manages (oldest first).
@@ -1593,11 +1590,10 @@ export const apiV26 = {
           user: {
             id: string;
             casdoor_id: string;
-            username?: string;
             first_name: string;
             last_name: string;
             phone: string | null;
-            role: "pm" | "procurement_manager" | "admin" | "supervisor" | null;
+            role: "pm" | "procurement_manager" | "admin" | null;
             role_label: string | null;
             project_id: string | null;
             project_name: string | null;
@@ -1611,7 +1607,6 @@ export const apiV26 = {
         expires_in: res.data.expires_in,
         user: {
           ...u,
-          username: u.username || u.casdoor_id,
           display_name: `${u.first_name} ${u.last_name}`.trim() || u.casdoor_id,
         },
       };
@@ -1631,15 +1626,14 @@ export const apiV26 = {
   users: {
     me: async (): Promise<import("../store/auth").AuthUser> => {
       const data = await getData<{
-        id: string; casdoor_id: string; username?: string; first_name: string; last_name: string; phone: string | null;
-        role: "pm" | "procurement_manager" | "admin" | "supervisor" | null; role_label: string | null;
+        id: string; casdoor_id: string; first_name: string; last_name: string; phone: string | null;
+        role: "pm" | "procurement_manager" | "admin" | null; role_label: string | null;
         project_id: string | null; project_name: string | null;
         projects?: { id: string; name: string }[];
       }>("/users/me");
       return {
         id: data.id,
         casdoor_id: data.casdoor_id,
-        username: data.username || data.casdoor_id,
         first_name: data.first_name,
         last_name: data.last_name,
         phone: data.phone,
@@ -1663,13 +1657,8 @@ export const apiV26 = {
       first_name: string; last_name?: string; phone?: string | null;
       casdoor_id?: string | null; role?: "pm" | "procurement_manager" | "admin" | null;
     }): Promise<UserRow> => postData<UserRow>("/users", body),
-    updateRole: async (id: string, role: "pm" | "procurement_manager" | "admin" | "supervisor" | null): Promise<UserRow> =>
+    updateRole: async (id: string, role: "pm" | "procurement_manager" | "admin" | null): Promise<UserRow> =>
       patchData<UserRow>(`/users/${id}`, { role }),
-    // لایه پنل‌ها — تخصیص پنل + سطح دسترسی و عضویت پروژه‌ای (فقط ادمین)
-    setPanels: async (id: string, panels: Record<string, string>): Promise<UserRow> =>
-      putData<UserRow>(`/users/${id}/panels`, { panels }),
-    setPanelProjects: async (id: string, project_ids: string[]): Promise<UserRow> =>
-      putData<UserRow>(`/users/${id}/panel-projects`, { project_ids }),
     assignProject: async (id: string, projectId: string | null): Promise<UserRow> =>
       postData<UserRow>(`/users/${id}/project`, { project_id: projectId }),
     // همگام‌سازی هویت‌ها از Casdoor (ادمین/مدیر تدارکات) — نقش‌ها دست‌نخورده می‌مانند

frontend/src/lib/types.ts

@@ -31,12 +31,6 @@ export interface Material {
 export interface Project {
   id: string;
   name: string;
-  location?: string;
-  project_manager?: string;
-  description?: string;
-  start_date?: string | null;
-  status?: string;
-  progress?: number;
 }
 
 // مرحله‌ی پرداخت

frontend/src/pages/Admin/AdminPanel.tsx

@@ -15,7 +15,6 @@ const ROLE_LABELS: Record<string, string> = {
   pm: "مدیر پروژه",
   procurement_manager: "مدیر تدارکات",
   admin: "ادمین",
-  supervisor: "سرپرست پروژه",
 };
 
 // پنل مدیریت ادمین (فقط ادمین) — همگام‌سازی کاربران از Casdoor و
@@ -81,26 +80,6 @@ export function AdminPanel() {
     }
   };
 
-  // اعطا/لغو نقش «سرپرست پروژه» — کاربر فقطِ پنل مدیریت پروژه (PM)
-  const toggleSupervisor = async (u: UserRow) => {
-    setBusyId(u.id);
-    const target = u.role === "supervisor" ? null : "supervisor";
-    try {
-      await apiV26.users.updateRole(u.id, target as "supervisor" | null);
-      toast.success(
-        target === "supervisor"
-          ? `«${u.first_name} ${u.last_name}» سرپرست پروژه شد ✓`
-          : `نقش سرپرست پروژه از «${u.first_name} ${u.last_name}» گرفته شد`,
-      );
-      await load();
-      refreshProcurementStore();
-    } catch (err) {
-      toast.error(err instanceof Error ? err.message : "خطا در تغییر نقش");
-    } finally {
-      setBusyId(null);
-    }
-  };
-
   if (!isAdmin) {
     return (
       <div className="min-h-screen">
@@ -150,13 +129,12 @@ export function AdminPanel() {
                   <th className="py-2 pe-3">نام کامل</th>
                   <th className="py-2 pe-3">شناسه Casdoor</th>
                   <th className="py-2 pe-3">نقش فعلی</th>
-                  <th className="py-2">مدیریت نقش‌ها</th>
+                  <th className="py-2">مدیریت مدیر تدارکات</th>
                 </tr>
               </thead>
               <tbody>
                 {users.map((u) => {
                   const isPMgr = u.role === "procurement_manager";
-                  const isSup = u.role === "supervisor";
                   return (
                     <tr key={u.id} className="border-b border-line/50">
                       <td className="py-2 pe-3 font-semibold">
@@ -169,7 +147,6 @@ export function AdminPanel() {
                         </span>
                       </td>
                       <td className="py-2">
-                        <div className="flex flex-wrap items-center gap-1.5">
                         <button
                           disabled={busyId === u.id}
                           onClick={() => void toggleProcurementManager(u)}
@@ -181,18 +158,6 @@ export function AdminPanel() {
                         >
                           {busyId === u.id ? "…" : isPMgr ? "لغو نقش مدیر تدارکات" : "اعطای نقش مدیر تدارکات"}
                         </button>
-                          <button
-                            disabled={busyId === u.id}
-                            onClick={() => void toggleSupervisor(u)}
-                            className={`rounded-lg border px-3 py-1 text-[11.5px] font-bold ${
-                              isSup
-                                ? "border-red/30 bg-red/5 text-red hover:bg-red/10"
-                                : "border-green/30 bg-green/5 text-green hover:bg-green/10"
-                            } disabled:opacity-50`}
-                          >
-                            {busyId === u.id ? "…" : isSup ? "لغو نقش سرپرست پروژه" : "اعطای نقش سرپرست پروژه"}
-                          </button>
-                        </div>
                       </td>
                     </tr>
                   );

frontend/src/pages/Auth/LoginPage.tsx

@@ -77,35 +77,14 @@ export function LoginPage() {
         toast.error("نقش شما هنوز در سیستم تعیین نشده است — با مدیر سیستم تماس بگیرید");
         return;
       }
-      const hasProjects =
-        (Boolean(user.projects && user.projects.length > 0)) ||
-        (Boolean(user.member_project_ids && user.member_project_ids.length > 0));
-      if (user.role === "supervisor" && !hasProjects) {
-        toast.error("پروژه تخصیص داده نشده است — تا زمان تخصیص پروژه اجازه ورود ندارید");
-        return;
-      }
       setToken(access_token);
       setUser(user);
       // تحلیل رفتار (no-op بدون تنظیمات VITE_OPENPANEL_*)
       identifyUser({ id: user.id, name: user.display_name, role: user.role });
       track("login_success", { role: user.role });
-      // هدایت پس از ورود بر اساس پنل‌ها یا نقش:
-      const panels = user.panels ?? {};
-      if (panels.procurement === "full") {
-        navigate("/");
-      } else if (panels.procurement === "limited") {
-        navigate("/requester");
-      } else if (panels.inventory) {
-        navigate("/inventory");
-      } else if (panels.pm) {
-        navigate("/panel/pm");
-      } else if (user.role === "supervisor") {
-        navigate("/panel/pm");
-      } else if (user.role === "pm") {
-        navigate("/inventory");
-      } else {
-        navigate("/");
-      }
+      toast.success(`خوش آمدید، ${user.display_name}`);
+      // مدیر پروژه → پنل انبار؛ مدیر تدارکات/ادمین → دفتر پیشنهادهای خرید
+      navigate(user.role === "pm" ? "/inventory" : "/");
     } catch (err) {
       toast.error(err instanceof Error ? err.message : "خطا در ورود");
     } finally {
@@ -294,21 +273,10 @@ export function LoginPage() {
               <ClipboardList className="h-6 w-6" strokeWidth={2} />
             </span>
             <div>
-              <h1 className="text-[19px] font-extrabold leading-7">سامانه جامع مدیریت پروژه، تدارکات و انبار</h1>
-              <p className="mt-1.5 text-[12.5px] leading-6 text-muted">
-                درگاه یکپارچه ورود به سامانه مدیریت عملیات پروژه، تدارکات و انبارداری
+              <h1 className="text-[19px] font-extrabold leading-7">سامانه تدارکات و انبار</h1>
+              <p className="mt-1 text-[12.5px] leading-6 text-muted">
+                برای ورود، نام کاربری و رمز عبور سازمانی خود را وارد کنید
               </p>
-              <div className="mt-2.5 flex items-center justify-center gap-1.5 flex-wrap">
-                <span className="inline-flex items-center rounded-full bg-sky-50 px-2.5 py-0.5 text-[11px] font-semibold text-sky-700 border border-sky-200">
-                  مدیریت پروژه
-                </span>
-                <span className="inline-flex items-center rounded-full bg-indigo-50 px-2.5 py-0.5 text-[11px] font-semibold text-indigo-700 border border-indigo-200">
-                  تدارکات
-                </span>
-                <span className="inline-flex items-center rounded-full bg-emerald-50 px-2.5 py-0.5 text-[11px] font-semibold text-emerald-700 border border-emerald-200">
-                  انبارداری
-                </span>
-              </div>
             </div>
           </div>
 

frontend/src/pages/Dashboard/DashboardPage.tsx

@@ -18,16 +18,12 @@ import { LedgerTable } from "./LedgerTable";
 import { AppSwitcherMenu } from "../../components/AppSwitcherMenu";
 import { AcceptModal } from "./AcceptModal";
 import { EditModal } from "./EditModal";
-import { useAuthStore } from "../../store/auth";
 
 const EMPTY_FILTERS: Filters = { supplier: "", status: "", search: "" };
 
 export function DashboardPage() {
   useStoreData();
 
-  const user = useAuthStore((s) => s.user);
-  const canWrite = user?.role === "admin" || user?.role === "procurement_manager";
-
   const quotes = useQuotes();
   const suppliers = useSuppliers();
   const materials = useMaterials();
@@ -89,7 +85,7 @@ export function DashboardPage() {
   return (
     <div className="min-h-screen pb-20 md:pb-6">
       <Header
-        title="مدیریت تدارکات"
+        title="دفتر پیشنهادهای خرید"
         brand
         menu={<AppSwitcherMenu activeModule="procurement" />}
         actions={
@@ -114,11 +110,10 @@ export function DashboardPage() {
               className="inline-flex items-center gap-1.5 px-3.5 py-2 rounded-xl border border-gray-200 dark:border-zinc-700 bg-white dark:bg-zinc-800 text-gray-700 dark:text-zinc-200 text-xs font-semibold hover:bg-gray-50 dark:hover:bg-zinc-700 shadow-2xs transition-all no-underline"
             >
               <Ruler className="h-4 w-4 text-gray-500 dark:text-zinc-400" />
-              <span>ضرایب تبدیل</span>
+              <span>اقلام و ضرایب</span>
             </Link>
 
             {/* دکمه اصلی: افزودن پیشنهاد جدید */}
-            {canWrite && (
             <Link
               to="/wizard"
               className="inline-flex items-center gap-1.5 px-4 py-2 rounded-xl bg-blue-600 hover:bg-blue-700 active:bg-blue-800 text-white text-xs font-semibold shadow-sm hover:shadow transition-all no-underline"
@@ -126,7 +121,6 @@ export function DashboardPage() {
               <Plus className="h-4 w-4" />
               <span>افزودن پیشنهاد جدید</span>
             </Link>
-            )}
           </div>
         }
       />
@@ -154,12 +148,10 @@ export function DashboardPage() {
           onToggleExpand={toggleExpand}
           onAccept={setAcceptId}
           onEdit={setEditId}
-          canWrite={canWrite}
         />
       </PageLayout>
 
       {/* دکمه شناور اکشن (FAB) مخصوص نسخه موبایل */}
-      {canWrite && (
       <Link
         to="/wizard"
         aria-label="افزودن پیشنهاد جدید"
@@ -167,7 +159,6 @@ export function DashboardPage() {
       >
         <Plus className="h-7 w-7" />
       </Link>
-      )}
 
       <AcceptModal quoteId={acceptId} onClose={() => setAcceptId(null)} />
       <EditModal quoteId={editId} onClose={() => setEditId(null)} />

frontend/src/pages/Dashboard/LedgerTable.tsx

@@ -10,7 +10,6 @@ export interface LedgerTableProps {
   onToggleExpand: (id: string) => void;
   onAccept: (id: string) => void;
   onEdit: (id: string) => void;
-  canWrite?: boolean;
 }
 
 // دفتر پیشنهادها — فهرست کارت‌ها (واکنش‌گرا و بهینه برای موبایل)
@@ -21,7 +20,6 @@ export function LedgerTable({
   onToggleExpand,
   onAccept,
   onEdit,
-  canWrite = true,
 }: LedgerTableProps) {
   if (!quotes.length) {
     return (
@@ -42,7 +40,6 @@ export function LedgerTable({
           onToggleExpand={() => onToggleExpand(q.id)}
           onAccept={() => onAccept(q.id)}
           onEdit={() => onEdit(q.id)}
-          canWrite={canWrite}
         />
       ))}
       <div className="px-2 py-3 text-center text-[10.5px] leading-5 text-muted sm:py-1 sm:text-[11px]">

frontend/src/pages/Dashboard/QuoteCard.tsx

@@ -24,7 +24,6 @@ export interface QuoteCardProps {
   onToggleExpand: () => void;
   onAccept: () => void;
   onEdit: () => void;
-  canWrite?: boolean;
 }
 
 function InfoCell({ label, children, className }: { label: string; children: React.ReactNode; className?: string }) {
@@ -36,7 +35,7 @@ function InfoCell({ label, children, className }: { label: string; children: Rea
   );
 }
 
-export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit, canWrite = true }: QuoteCardProps) {
+export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit }: QuoteCardProps) {
   const sup = supplierById(store.suppliers, q.supplier_id);
   const expired = isExpired(q);
   const total = quoteTotal(q);
@@ -47,7 +46,7 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
   // ستون / دکمه پذیرش
   let acceptedCell: React.ReactNode;
   if (q.status === "offered") {
-    acceptedCell = canWrite ? (
+    acceptedCell = (
       <button
         onClick={(e) => {
           e.stopPropagation();
@@ -58,8 +57,6 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
         <Check className="h-3.5 w-3.5" />
         <span>پذیرش</span>
       </button>
-    ) : (
-      <span className="text-muted text-xs font-medium">در انتظار پذیرش</span>
     );
   } else if (q.accepted_date) {
     acceptedCell = <span className="tabular-nums font-medium">{fmtDateTime(q.accepted_date)}</span>;
@@ -188,7 +185,6 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
           )}
 
           {/* دکمه ویرایش */}
-          {canWrite && (
           <button
             type="button"
             className="inline-flex h-7 items-center justify-center gap-1 rounded-md border border-line bg-panel px-2 text-xs font-medium text-ink hover:bg-slate-50 dark:hover:bg-zinc-800 transition-colors sm:h-8 sm:px-2.5"
@@ -202,7 +198,6 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
             <Pencil className="h-3 w-3 text-muted" />
             <span className="hidden sm:inline">ویرایش</span>
           </button>
-          )}
 
           {/* دکمه فلش اکسپند در هدر */}
           <button

frontend/src/pages/Dashboard/RequesterHome.tsx

@@ -1,106 +0,0 @@
-import { useMemo } from "react";
-import { Link } from "react-router-dom";
-import { FilePlus2, Info } from "lucide-react";
-import { Header, PageLayout } from "../../components/layout/Header";
-import { AppSwitcherMenu } from "../../components/AppSwitcherMenu";
-import { useAuthStore } from "../../store/auth";
-import { useProjects } from "../../hooks";
-import { faNum } from "../../lib/formatters";
-
-// خانه کاربرِ «تدارکات — سطح limited»: افزودن استعلام برای پروژه‌های تخصیص‌یافته
-export function RequesterHome() {
-  const user = useAuthStore((s) => s.user);
-  const projects = useProjects();
-
-  // پروژه‌های کاربر از همه منابع موجود در سیستم (user.projects، user.project_id، member_project_ids و پروژه‌های عمومی)
-  const myProjects = useMemo(() => {
-    const list: { id: string; name: string }[] = [];
-    const seen = new Set<string>();
-
-    // ۱. پروژه‌های موجود در آرایه user.projects
-    for (const p of user?.projects ?? []) {
-      if (p.id && !seen.has(p.id)) {
-        seen.add(p.id);
-        list.push({ id: p.id, name: p.name });
-      }
-    }
-
-    // ۲. پروژه‌ی اختصاصی فعال (project_id)
-    if (user?.project_id && !seen.has(user.project_id)) {
-      seen.add(user.project_id);
-      list.push({ id: user.project_id, name: user.project_name || "پروژه تخصیص‌یافته" });
-    }
-
-    // ۳. پروژه‌های عضویت member_project_ids تطبیق‌یافته با لیست پروژه‌ها
-    const memberIdSet = new Set(user?.member_project_ids ?? []);
-    for (const p of projects) {
-      if (memberIdSet.has(p.id) && !seen.has(p.id)) {
-        seen.add(p.id);
-        list.push({ id: p.id, name: p.name });
-      }
-    }
-
-    // ۴. تطبیق نام پروژه در صورتی که فقط نام در نشست باشد
-    if (list.length === 0 && user?.project_name) {
-      const match = projects.find((p) => p.name === user.project_name);
-      if (match && !seen.has(match.id)) {
-        list.push({ id: match.id, name: match.name });
-      }
-    }
-
-    return list;
-  }, [user, projects]);
-
-  return (
-    <div className="min-h-screen">
-      <Header
-        title="افزودن استعلام"
-        brand
-        menu={<AppSwitcherMenu activeModule="procurement" />}
-      />
-      <PageLayout className="flex flex-col gap-4">
-        <div className="rounded-lg border border-blue/20 bg-blue/5 px-3 py-2 text-[12px] leading-6 text-muted">
-          <span className="inline-flex items-center gap-1.5">
-            <Info className="h-3.5 w-3.5" />
-            شما مجاز به ثبت استعلام برای پروژه‌های تخصیص‌یافته‌ی خود هستید.
-          </span>
-        </div>
-
-        {myProjects.length === 0 ? (
-          <div className="rounded-xl border border-dashed border-line bg-panel px-4 py-8 text-center text-[12.5px] text-muted">
-            هنوز پروژه‌ای به شما تخصیص داده نشده است — با مدیر سیستم تماس بگیرید.
-          </div>
-        ) : (
-          <>
-            <div className="grid grid-cols-1 gap-3 md:grid-cols-2">
-              {myProjects.map((p) => (
-                <Link
-                  key={p.id}
-                  to={`/wizard?project=${encodeURIComponent(p.name)}`}
-                  className="flex items-center justify-between rounded-xl border border-line bg-panel p-4 no-underline transition-colors hover:border-accent/50 hover:bg-canvas/40"
-                >
-                  <div>
-                    <b className="text-[13.5px]">🏢 {p.name}</b>
-                    <p className="mt-0.5 text-[11.5px] text-muted">ثبت استعلام خرید برای این پروژه</p>
-                  </div>
-                  <span className="flex h-10 w-10 shrink-0 items-center justify-center rounded-full bg-accent/10 text-accent">
-                    <FilePlus2 className="h-5 w-5" />
-                  </span>
-                </Link>
-              ))}
-            </div>
-
-            <Link
-              to="/wizard"
-              className="btn-line-file inline-flex items-center justify-center gap-2 no-underline"
-            >
-              <FilePlus2 className="h-3.5 w-3.5" />
-              افزودن استعلام جدید ({faNum(myProjects.length)} پروژه فعال)
-            </Link>
-          </>
-        )}
-      </PageLayout>
-    </div>
-  );
-}
-

frontend/src/pages/Inventory/ArrivalsPage.tsx

@@ -23,8 +23,6 @@ export function ArrivalsPage() {
   const user = useAuthStore((s) => s.user);
   const isAdmin = user?.role === "admin" || user?.role === "procurement_manager";
   const isPM = user?.role === "pm";
-  const isSupervisor = user?.role === "supervisor";
-  const canAccess = isAdmin || isPM || isSupervisor;
 
   const [items, setItems] = useState<PendingArrival[]>([]);
   const [warehouses, setWarehouses] = useState<Warehouse[]>([]);
@@ -35,9 +33,9 @@ export function ArrivalsPage() {
 
   const load = useCallback(async () => {
     try {
-      const activeProject = (isPM || isSupervisor) ? user?.project_id || undefined : undefined;
+      const activeProject = isPM ? user?.project_id || undefined : undefined;
       const [arr, whs] = await Promise.all([
-        // پروژه‌ی فعال صریحاً ارسال می‌شود؛ بک‌اند تخصیص PM / سرپرست را بررسی می‌کند
+        // پروژه‌ی فعال صریحاً ارسال می‌شود؛ بک‌اند تخصیص PM را بررسی می‌کند
         apiV26.pm.onTheWay(activeProject),
         apiV26.warehouses.list(activeProject),
       ]);
@@ -48,13 +46,13 @@ export function ArrivalsPage() {
     } finally {
       setLoading(false);
     }
-  }, [isPM, isSupervisor, user?.project_id]);
+  }, [isPM, user?.project_id]);
 
   useEffect(() => {
-    if (!canAccess) return;
+    if (!isAdmin && !isPM) return;
     setLoading(true);
     void load();
-  }, [canAccess, load]);
+  }, [isAdmin, isPM, load]);
 
   // سفارش‌ها: گروه‌بندی اقلام به‌ازای هر پیشنهاد (فقط سفارش‌های دارای قلمِ در راه/ناقص)
   const orders = useMemo(() => {
@@ -214,12 +212,12 @@ export function ArrivalsPage() {
     }
   };
 
-  if (!canAccess) {
+  if (!isAdmin && !isPM) {
     return (
       <div className="min-h-screen">
         <Header title="کالاهای در راه" backTo="/inventory" backLabel="بازگشت به داشبورد" />
         <PageLayout>
-          <EmptyState emoji="🔒" text="این بخش برای نقش کاربری شما مجاز نیست." />
+          <EmptyState emoji="🔒" text="این بخش فقط برای مدیر پروژه و مدیر تدارکات است." />
         </PageLayout>
       </div>
     );

frontend/src/pages/Inventory/ChangeInventoryPage.tsx

@@ -76,9 +76,8 @@ export function ChangeInventoryPage() {
     }
   }, [params]);
 
-  const isAdmin = user?.role === "admin";
-  const isSupervisor = user?.role === "supervisor";
-  const canModify = isSupervisor || isAdmin;
+  const isAdmin = user?.role === "admin" || user?.role === "procurement_manager";
+  const isPM = user?.role === "pm";
 
   const warehouses = data.warehouses;
   const whOpts = useMemo(
@@ -402,7 +401,7 @@ export function ChangeInventoryPage() {
 
   const meta = FORM_TYPES.find((f) => f.t === type)!;
 
-  if (!canModify) {
+  if (isAdmin) {
     return (
       <div className="min-h-screen">
         <Header title="تغییر موجودی" backTo="/inventory" backLabel="بازگشت به داشبورد" />
@@ -410,12 +409,22 @@ export function ChangeInventoryPage() {
           <div className="rounded-xl border border-line bg-panel p-8 text-center">
             <div className="text-3xl">🔒</div>
             <h3 className="mt-2 text-[15px] font-bold">دسترسی فقط‌خواندنی</h3>
-            <p className="mt-1 text-[12.5px] text-muted">امکان تغییر موجودی انبار منحصراً در اختیار سرپرست پروژه و ادمین است.</p>
+            <p className="mt-1 text-[12.5px] text-muted">نقش ادمین اجازه ثبت تغییر موجودی ندارد. این بخش برای مدیران پروژه فعال است.</p>
           </div>
         </PageLayout>
       </div>
     );
   }
+  if (!isPM) {
+    return (
+      <div className="min-h-screen">
+        <Header title="تغییر موجودی" backTo="/inventory" backLabel="بازگشت به داشبورد" />
+        <PageLayout>
+          <div className="text-[13px] text-muted">این بخش فقط برای مدیر پروژه است.</div>
+        </PageLayout>
+      </div>
+    );
+  }
 
   const isCount = type === "STOCK_COUNT";
   const isTransfer = type === "TRANSFER";

frontend/src/pages/Inventory/DailyControlPage.tsx

@@ -41,12 +41,10 @@ export function DailyControlPage() {
 
   const txByDay = useMemo(() => {
     const map = new Map<string, InventoryTransaction[]>();
-    const allowedWhIds = new Set(data.warehouses.map((w) => w.id));
     const projWhIds = projFilter
       ? new Set(data.warehouses.filter((w) => String(w.project_id) === String(projFilter)).map((w) => w.id))
       : null;
     data.transactions.forEach((t) => {
-      if (!isAdmin && !allowedWhIds.has(t.warehouse_id)) return;
       if (projWhIds && !projWhIds.has(t.warehouse_id)) return;
       const k = gregKey(new Date(t.transaction_date));
       const arr = map.get(k) || [];
@@ -55,7 +53,7 @@ export function DailyControlPage() {
     });
     map.forEach((arr) => arr.sort((a, b) => new Date(a.transaction_date).getTime() - new Date(b.transaction_date).getTime()));
     return map;
-  }, [data.transactions, data.warehouses, projFilter, isAdmin]);
+  }, [data.transactions, data.warehouses, projFilter]);
 
   const cells = useMemo(() => {
     const [ty, tm] = gregorianToJalali(anchor.getFullYear(), anchor.getMonth() + 1, anchor.getDate());
@@ -174,15 +172,11 @@ export function DailyControlPage() {
                 ))}
               </select>
             ) : (
-              <span className="font-semibold text-slate-800">
-                {user?.project_name ? `پروژه: ${user.project_name}` : "پروژه فعال"}
-              </span>
+              <span className="font-semibold text-slate-800">پروژه فعال</span>
             )}
-            {isAdmin && (
             <span className="text-[11.5px] text-slate-400">
               {projFilter ? "نمایش برای پروژه انتخابی" : "نمایش تمام پروژه‌ها"}
             </span>
-            )}
           </div>
 
           <Link

frontend/src/pages/Inventory/InventoryPage.tsx

@@ -51,11 +51,8 @@ export function InventoryPage() {
   const location = useLocation();
   const user = useAuthStore((s) => s.user);
   const { warehouses, inventory, transactions, lookup, loading } = useInventoryData();
-  const isManager = user?.role === "admin" || user?.role === "procurement_manager" || user?.role === "pm";
-  const isSupervisor = user?.role === "supervisor";
-  const isAdmin = user?.role === "admin";
-  // پنل انبار limited: تغییر موجودی مجاز است؛ full: طبق طراحی ممنوع
-  const canModify = isSupervisor || isAdmin || user?.panels?.inventory === "limited";
+  const isAdmin = user?.role === "admin" || user?.role === "procurement_manager";
+  const isPM = user?.role === "pm";
   const [params] = useSearchParams();
 
   const [filters, setFilters] = useState<{ warehouse: string; material: string; project: string }>({
@@ -70,10 +67,10 @@ export function InventoryPage() {
   const [expBrand, setExpBrand] = useState<string | null>(null);
 
   const visibleWarehouses = useMemo(() => {
-    if (isManager && filters.project) return warehouses.filter((w) => w.project_id === filters.project);
-    if (isManager) return warehouses;
+    if (isAdmin && filters.project) return warehouses.filter((w) => w.project_id === filters.project);
+    if (isAdmin) return warehouses;
     return warehouses.filter((w) => String(w.project_id) === String(user?.project_id || ""));
-  }, [warehouses, isManager, filters.project, user?.project_id]);
+  }, [warehouses, isAdmin, filters.project, user?.project_id]);
 
   const visibleIds = useMemo(() => new Set(visibleWarehouses.map((w) => w.id)), [visibleWarehouses]);
 
@@ -136,12 +133,12 @@ export function InventoryPage() {
   const hasFilter = !!(filters.warehouse || (isAdmin && filters.project));
 
   if (loading) return <div className="min-h-screen" />;
-  if (!user) {
+  if (!user || (!isAdmin && !isPM)) {
     return (
       <div className="min-h-screen">
-        <Header title="داشبورد انبار" backTo="/" backLabel="بازگشت" />
+        <Header title="داشبورد انبار" backTo="/inventory" backLabel="بازگشت به داشبورد" />
         <PageLayout>
-          <EmptyState emoji="🔒" text="لطفاً برای دسترسی به سامانه انبار وارد شوید." />
+          <EmptyState emoji="🔒" text="دسترسی به انبار فقط برای مدیر پروژه یا ادمین است." />
         </PageLayout>
       </div>
     );
@@ -153,10 +150,10 @@ export function InventoryPage() {
         title="سامانه مدیریت انبار"
         sub={inventorySubheader(user)}
         icon={<WarehouseIcon className="h-4.5 w-4.5" strokeWidth={2} />}
-        menu={<AppSwitcherMenu activeModule="warehouse" />}
+        menu={<AppSwitcherMenu activeModule="warehouse" canSwitchToProcurement={isAdmin} />}
         actions={
           <div className="hidden md:flex items-center gap-2">
-            <InventoryTopNav pathname={location.pathname} />
+            <InventoryTopNav pathname={location.pathname} variant={isAdmin ? "admin" : "pm"} />
           </div>
         }
       />
@@ -249,8 +246,8 @@ export function InventoryPage() {
           {/* فیلترهای پیشرفته — برچسب‌های لمسی بدون سلکت و بدون بیرون‌زدگی */}
           {showMobileFilters && (
             <div className="mt-2.5 border-t border-line/60 pt-2.5 flex flex-col gap-2.5">
-              {/* پروژه‌ها (مدیران و ادمین) */}
-              {isManager && lookup.projects.length > 0 && (
+              {/* پروژه‌ها (مخصوص ادمین) */}
+              {isAdmin && lookup.projects.length > 0 && (
                 <div>
                   <div className="mb-1.5 text-[11px] font-bold text-muted">پروژه:</div>
                   <div className="flex flex-wrap gap-1.5">
@@ -418,7 +415,7 @@ export function InventoryPage() {
       </PageLayout>
 
       {/* دکمه شناور تغییر موجودی */}
-      {canModify && (
+      {isPM && (
         <Link
           to="/inventory/change"
           className="fixed bottom-20 left-5 z-40 flex h-14 w-14 items-center justify-center rounded-full bg-blue-600 text-white shadow-xl shadow-blue-600/40 transition-all duration-200 hover:bg-blue-700 hover:scale-105 active:scale-90 md:bottom-8 md:left-8"

frontend/src/pages/Inventory/InventoryTopNav.tsx

@@ -1,27 +1,26 @@
 import { Link } from "react-router-dom";
 import { Button } from "../../components/ui/button";
 
-import { useAuthStore } from "../../store/auth";
-
 // ناوبری بالای صفحه در پنل انبار — هماهنگ با دیزاین‌سیستم دکمه‌ها
 export function InventoryTopNav({
   pathname,
+  variant = "pm",
 }: {
   pathname: string;
+  variant?: "pm" | "admin";
 }) {
-  const user = useAuthStore((s) => s.user);
-  const isAdmin = user?.role === "admin";
-  const isManager = user?.role === "procurement_manager" || user?.role === "pm" || isAdmin;
-  const isSupervisor = user?.role === "supervisor";
-  const canViewTabs = isManager || isSupervisor;
-
-  const items: { label: string; to: string; active: boolean }[] = [];
-  // برای تغییر موجودی از همان دکمه شناور دایره‌ای آبی (+) استفاده می‌شود و دکمه مستطیلی در بالای صفحه حذف شد
-  if (canViewTabs) {
-    items.push({ label: "کنترل روزانه", to: "/inventory/daily", active: pathname.startsWith("/inventory/daily") });
-    items.push({ label: "انبارها", to: "/inventory/warehouses", active: pathname.startsWith("/inventory/warehouses") });
-    items.push({ label: "کالاهای در راه", to: "/inventory/arrivals", active: pathname.startsWith("/inventory/arrivals") });
-  }
+  const items =
+    variant === "admin"
+      ? [
+          { label: "کنترل روزانه", to: "/inventory/daily", active: pathname.startsWith("/inventory/daily") },
+          { label: "کالاهای در راه", to: "/inventory/arrivals", active: pathname.startsWith("/inventory/arrivals") },
+          { label: "سازمان‌دهی", to: "/inventory/org", active: pathname.startsWith("/inventory/org") },
+        ]
+      : [
+          { label: "کنترل روزانه", to: "/inventory/daily", active: pathname.startsWith("/inventory/daily") },
+          { label: "انبارها", to: "/inventory/warehouses", active: pathname.startsWith("/inventory/warehouses") },
+          { label: "کالاهای در راه", to: "/inventory/arrivals", active: pathname.startsWith("/inventory/arrivals") },
+        ];
 
   return (
     <>

frontend/src/pages/Inventory/OrganizationPage.tsx

@@ -0,0 +1,354 @@
+import { useCallback, useEffect, useState } from "react";
+import { useNavigate } from "react-router-dom";
+import { toast } from "sonner";
+import { Header, PageLayout } from "../../components/layout/Header";
+import { useAuthStore } from "../../store/auth";
+import { inventorySubheader } from "./panelMenu";
+import { apiV26, type UserRow } from "../../lib/api";
+import { refreshProcurementStore } from "../../hooks";
+import { useInventoryData } from "./useInventoryData";
+import { faNum } from "../../lib/formatters";
+import { ProjectMultiSelect } from "../../components/ProjectMultiSelect";
+
+type Role = "pm" | "procurement_manager" | "admin" | null;
+
+const ROLE_LABELS: Record<string, string> = {
+  pm: "مدیر پروژه",
+  procurement_manager: "مدیر تدارکات",
+  admin: "ادمین",
+};
+
+// سازمان‌دهی (فقط ادمین / مدیر تدارکات) — کاربران، مدیران پروژه و انبارهای هر پروژه
+export function OrganizationPage() {
+    const navigate = useNavigate();
+  const user = useAuthStore((s) => s.user);
+  const data = useInventoryData();
+
+  const [users, setUsers] = useState<UserRow[]>([]);
+  const [loadingUsers, setLoadingUsers] = useState(true);
+  const [syncing, setSyncing] = useState(false);
+  const [busyId, setBusyId] = useState<string | null>(null);
+
+  const [newWh, setNewWh] = useState<Record<string, string>>({});
+  const [newWhDesc, setNewWhDesc] = useState<Record<string, string>>({});
+
+  const canManage = user?.role === "admin" || user?.role === "procurement_manager";
+  // فقط ادمین می‌تواند نقش‌ها را تغییر دهد/ارتقا دهد (RBAC) — مدیر تدارکات فقط
+  // پروژه‌ی مدیران پروژه را تعیین/جابه‌جا می‌کند.
+  const canChangeRoles = user?.role === "admin";
+
+  const loadUsers = useCallback(async () => {
+    try {
+      const list = await apiV26.users.list();
+      setUsers(list);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "خطا در دریافت کاربران");
+    } finally {
+      setLoadingUsers(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    if (canManage) void loadUsers();
+  }, [canManage, loadUsers]);
+
+  const syncUsers = async () => {
+    setSyncing(true);
+    try {
+      const { users: synced, created } = await apiV26.users.sync();
+      setUsers(synced);
+      toast.success(
+        created > 0
+          ? `همگام‌سازی انجام شد — ${faNum(created)} کاربر جدید از Casdoor اضافه شد ✓`
+          : "همگام‌سازی انجام شد — کاربر جدیدی یافت نشد",
+      );
+      await data.refresh();
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "خطا در همگام‌سازی با Casdoor");
+    } finally {
+      setSyncing(false);
+    }
+  };
+
+  if (!canManage) {
+    return (
+      <div className="min-h-screen">
+        <Header title="سازمان‌دهی" backTo="/inventory" backLabel="بازگشت به داشبورد" />
+        <PageLayout>
+          <div className="text-[13px] text-muted">این بخش فقط برای ادمین / مدیر تدارکات است.</div>
+        </PageLayout>
+      </div>
+    );
+  }
+
+  // ---------- actions: users ----------
+
+  const changeRole = async (u: UserRow, role: Role) => {
+    setBusyId(u.id);
+    try {
+      await apiV26.users.updateRole(u.id, role);
+      toast.success(`نقش «${ROLE_LABELS[role ?? ""] ?? "بدون نقش"}» برای ${u.first_name} ${u.last_name} ثبت شد ✓`);
+      await loadUsers();
+      refreshProcurementStore();
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "خطا در تغییر نقش");
+    } finally {
+      setBusyId(null);
+    }
+  };
+
+  // پروژه‌های متصل به یک کاربر (1:N) — با پشتیبانی از شکل قدیمیِ تک‌پروژه‌ای
+  const assignedProjectsOf = (u: UserRow) =>
+    u.projects ?? (u.project_id ? [{ id: u.project_id, name: u.project_name ?? "" }] : []);
+
+  // همگام‌سازی چند-انتخابیِ پروژه‌ها: افزودن/حذف هر اختلاف با یک PATCH
+  // (pm_user_id = کاربر برای اتصال، null برای جداسازی؛ مدیر قبلی جایگزین می‌شود)
+  const syncUserProjects = async (u: UserRow, nextIds: string[]) => {
+    const current = assignedProjectsOf(u).map((p) => p.id);
+    const added = nextIds.filter((id) => !current.includes(id));
+    const removed = current.filter((id) => !nextIds.includes(id));
+    if (!added.length && !removed.length) return;
+    setBusyId(u.id);
+    try {
+      for (const pid of added) await apiV26.projects.setPm(pid, u.id);
+      for (const pid of removed) await apiV26.projects.setPm(pid, null);
+      const names = nextIds
+        .map((id) => data.lookup.projects.find((p) => p.id === id)?.name)
+        .filter(Boolean)
+        .join("، ");
+      toast.success(
+        nextIds.length
+          ? `پروژه‌های «${u.first_name} ${u.last_name}» به‌روزرسانی شد: ${names} ✓`
+          : `«${u.first_name} ${u.last_name}» از همه‌ی پروژه‌ها جدا شد`,
+      );
+      await loadUsers();
+      await data.refresh();
+      refreshProcurementStore();
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "خطا در به‌روزرسانی پروژه‌ها");
+      await loadUsers(); // وضعیت واقعی سرور را برگردان
+    } finally {
+      setBusyId(null);
+    }
+  };
+
+  // ---------- actions: warehouses ----------
+
+  const addWarehouse = async (projectId: string) => {
+    const name = (newWh[projectId] || "").trim();
+    if (!name) return toast.error("نام انبار الزامی است");
+    try {
+      await apiV26.warehouses.create({ project_id: projectId, name, description: (newWhDesc[projectId] || "").trim() || null });
+      setNewWh((s) => ({ ...s, [projectId]: "" }));
+      setNewWhDesc((s) => ({ ...s, [projectId]: "" }));
+      toast.success(`انبار «${name}» اضافه شد ✓`);
+      await data.refresh();
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "خطا در افزودن انبار");
+    }
+  };
+
+  // انبار برای همیشه به پروژه‌ی والدش تعلق دارد — انتقال به پروژه‌ی دیگر وجود ندارد؛
+  // انبار فقط با حذف و ساخت دوباره زیر پروژه‌ی موردنظر جابه‌جا می‌شود.
+  const removeWarehouse = async (id: string) => {
+    if (!confirm("انبار حذف شود؟ (انبارهای دارای سابقه تراکنش قابل حذف نیستند)")) return;
+    try {
+      await apiV26.warehouses.delete(id);
+      toast.success("انبار حذف شد");
+      await data.refresh();
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "خطا در حذف انبار");
+    }
+  };
+
+  // مدیرِ مسئول یک پروژه (1:N — کاربر ممکن است مدیر چند پروژه باشد)
+  const pmOf = (projectId: string) =>
+    users.find(
+      (u) =>
+        u.role === "pm" &&
+        (u.projects?.some((p) => p.id === projectId) || u.project_id === projectId),
+    ) || null;
+
+  return (
+    <div className="min-h-screen">
+      <Header
+        title="سازمان‌دهی"
+        sub={inventorySubheader(user)}
+        backTo="/inventory"
+        backLabel="بازگشت به داشبورد"
+      />
+      <PageLayout className="flex flex-col gap-3">
+        <div className="rounded-lg border border-blue/20 bg-blue/5 px-3 py-2 text-[12px] leading-6 text-muted">
+          ℹ️ کاربران از Casdoor همگام می‌شوند و نقش‌ها اینجا (فقط توسط ادمین) تعیین می‌شوند؛
+          مدیر تدارکات فقط پروژه‌ی مدیران پروژه را تعیین/جابه‌جا می‌کند. پروژه‌ها از سیستم تدارکات می‌آیند و
+          هر مدیر پروژه به همه انبارهای پروژه خودش دسترسی دارد. همه تغییرات فوراً در داشبورد و فرم‌ها اعمال می‌شود.
+        </div>
+
+        {/* ---------- کاربران و مدیران پروژه ---------- */}
+        <div className="rounded-xl border border-line bg-panel p-4">
+          <div className="mb-2 flex flex-wrap items-center justify-between gap-2">
+            <h3 className="text-[14px] font-bold">👥 کاربران و مدیران پروژه</h3>
+            <button
+              onClick={() => void syncUsers()}
+              disabled={syncing}
+              className="rounded-lg border border-accent/40 bg-accent/5 px-3 py-1.5 text-[12px] font-bold text-accent disabled:opacity-50"
+            >
+              {syncing ? "در حال همگام‌سازی…" : "🔄 همگام‌سازی از Casdoor"}
+            </button>
+          </div>
+
+          {loadingUsers ? (
+            <div className="py-3 text-[12.5px] text-muted">در حال بارگذاری کاربران…</div>
+          ) : !users.length ? (
+            <div className="rounded-lg border border-dashed border-line px-3 py-3 text-[12px] text-muted">
+              کاربری ثبت نشده است — کاربران پس از اولین ورود (Casdoor) به‌صورت خودکار ساخته می‌شوند؛
+              یا دکمه‌ی «همگام‌سازی از Casdoor» را بزنید.
+            </div>
+          ) : (
+            <div className="overflow-x-auto">
+              <table className="w-full text-[12.5px]">
+                <thead>
+                  <tr className="border-b border-line text-right text-muted">
+                    <th className="py-2 pe-3">نام</th>
+                    <th className="py-2 pe-3">نقش</th>
+                    <th className="py-2 pe-3">پروژه (مدیر پروژه)</th>
+                    <th className="py-2">عملیات</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  {users.map((u) => (
+                    <tr key={u.id} className="border-b border-line/50">
+                      <td className="py-1.5 pe-3">
+                        <b>{u.first_name} {u.last_name}</b>
+                        <small className="block text-[10.5px] text-muted ltr">{u.casdoor_id}</small>
+                      </td>
+                      <td className="py-1.5 pe-3">
+                        {canChangeRoles ? (
+                          <select
+                            className="h-7 rounded-lg border border-line bg-panel px-2 text-[12px]"
+                            value={u.role ?? ""}
+                            disabled={busyId === u.id}
+                            onChange={(e) => void changeRole(u, (e.target.value || null) as Role)}
+                          >
+                            <option value="">— بدون نقش —</option>
+                            <option value="pm">مدیر پروژه</option>
+                            <option value="procurement_manager">مدیر تدارکات</option>
+                            <option value="admin">ادمین</option>
+                          </select>
+                        ) : (
+                          <span className={`rounded-lg px-2 py-1 text-[11px] font-bold ${u.role ? "bg-accent-bg text-accent" : "bg-slate-bg text-muted"}`}>
+                            {u.role ? ROLE_LABELS[u.role] : "بدون نقش"}
+                          </span>
+                        )}
+                        {!canChangeRoles && u.role && (
+                          <small className="block text-[10px] text-muted">(تغییر نقش فقط توسط ادمین)</small>
+                        )}
+                      </td>
+                      <td className="min-w-[240px] py-1.5 pe-3 align-top">
+                        {u.role === "pm" ? (
+                          <ProjectMultiSelect
+                            options={data.lookup.projects.map((p) => ({ id: p.id, name: p.name }))}
+                            values={assignedProjectsOf(u).map((p) => p.id)}
+                            onChange={(ids) => void syncUserProjects(u, ids)}
+                            disabled={busyId === u.id}
+                          />
+                        ) : (
+                          <span className="text-[11.5px] text-muted">—</span>
+                        )}
+                      </td>
+                      <td className="py-1.5">
+                        {u.role === "pm" && u.project_id && (
+                          <span className="rounded-lg bg-green/10 px-2 py-1 text-[10.5px] font-bold text-green">فعال</span>
+                        )}
+                      </td>
+                    </tr>
+                  ))}
+                </tbody>
+              </table>
+              <div className="mt-1 text-[11px] text-muted">
+                «بدون نقش» = حذف مدیر پروژه (از همه‌ی پروژه‌ها هم جدا می‌شود). هر مدیر پروژه می‌تواند به
+                چند پروژه متصل باشد؛ حذف هر چیپ (×)، فقط همان پروژه را جدا می‌کند و اتصال به یک پروژه، مدیرِ
+                قبلیِ آن پروژه را جابه‌جا می‌کند.
+              </div>
+            </div>
+          )}
+        </div>
+
+        {/* ---------- پروژه‌ها و انبارها ---------- */}
+        <div className="grid grid-cols-1 gap-3 lg:grid-cols-2">
+          {data.lookup.projects.map((p) => {
+            const whs = data.warehouses.filter((w) => w.project_id === p.id);
+            const pm = pmOf(p.id);
+            return (
+              <div key={p.id} className="rounded-xl border border-line bg-panel p-4">
+                <div className="mb-2 flex items-center justify-between">
+                  <h3 className="text-[14px] font-bold">🏢 {p.name}</h3>
+                  <span className="rounded-lg bg-panel px-2 py-1 text-[11px] text-muted">
+                    {faNum(whs.length)} انبار
+                  </span>
+                </div>
+
+                <div className="mb-3">
+                  <h4 className="mb-1 text-[12px] font-bold text-muted">👤 مدیر پروژه</h4>
+                  {pm ? (
+                    <div className="flex items-center gap-2 rounded-lg border border-line px-3 py-2 text-[12.5px]">
+                      <span className="font-semibold">{pm.first_name} {pm.last_name}</span>
+                      <span className="text-[10.5px] text-muted">(مدیر مسئول پروژه)</span>
+                    </div>
+                  ) : (
+                    <div className="rounded-lg border border-dashed border-line px-3 py-2 text-[11.5px] text-muted">
+                      مدیری تعیین نشده است — از جدول «کاربران و مدیران پروژه» بالا، نقش مدیر پروژه را بدهید و به این پروژه متصل کنید.
+                    </div>
+                  )}
+                </div>
+
+                <h4 className="mb-1 text-[12px] font-bold text-muted">🏬 انبارهای پروژه</h4>
+                {!whs.length ? (
+                  <div className="rounded-lg border border-dashed border-line px-3 py-2 text-[11.5px] text-muted">انباری ندارد — از فرم زیر اضافه کنید.</div>
+                ) : (
+                  <div className="mb-2 flex flex-col gap-1.5">
+                    {whs.map((w) => (
+                      <div key={w.id} className="flex items-center justify-between gap-2 rounded-lg border border-line px-3 py-2 text-[12.5px]">
+                        <div className="min-w-0 flex-1">
+                          <b>{w.name}</b>
+                          <small className="block truncate text-muted">{w.description || ""}</small>
+                        </div>
+                        <div className="flex flex-wrap items-center justify-end gap-1.5">
+                          <button
+                            className="rounded-lg border border-accent/40 bg-accent/5 px-2 py-1 text-[10.5px] font-bold text-accent"
+                            onClick={() => navigate(`/inventory?warehouse=${w.id}`)}
+                            title="داشبورد این انبار"
+                          >
+                            📊 داشبورد
+                          </button>
+                          <button className="text-muted hover:text-red" onClick={() => void removeWarehouse(w.id)} title="حذف انبار">✕</button>
+                        </div>
+                      </div>
+                    ))}
+                  </div>
+                )}
+                <div className="flex flex-col gap-2 sm:flex-row sm:items-center">
+                  <input
+                    className="h-8 w-full rounded-lg border border-line bg-panel px-2 text-sm sm:w-44"
+                    placeholder="نام انبار جدید"
+                    value={newWh[p.id] || ""}
+                    onChange={(e) => setNewWh((s) => ({ ...s, [p.id]: e.target.value }))}
+                  />
+                  <input
+                    className="h-8 w-full rounded-lg border border-line bg-panel px-2 text-sm sm:w-52"
+                    placeholder="توضیحات (اختیاری)"
+                    value={newWhDesc[p.id] || ""}
+                    onChange={(e) => setNewWhDesc((s) => ({ ...s, [p.id]: e.target.value }))}
+                  />
+                  <button className="w-full rounded-lg bg-accent px-3 py-2 text-[12px] font-bold text-white sm:w-auto sm:py-1.5" onClick={() => void addWarehouse(p.id)}>
+                    + افزودن انبار
+                  </button>
+                </div>
+              </div>
+            );
+          })}
+        </div>
+      </PageLayout>
+    </div>
+  );
+}

frontend/src/pages/Inventory/WarehousesPage.tsx

@@ -9,42 +9,52 @@ import { useInventoryData, projName } from "./useInventoryData";
 import { faNum } from "../../lib/formatters";
 import { isoToJalaliStr } from "../../lib/jalali";
 
-// انبارها — مدیریت انبارها برای مدیران (ادمین، مدیر تدارکات، مدیر پروژه)
+// انبارها — مدیر پروژه: مشاهده انبارهای پروژه خودش + افزودن/ویرایش/حذف (ادمین دسترسی ندارد)
 export function WarehousesPage() {
   const navigate = useNavigate();
   const user = useAuthStore((s) => s.user);
   const data = useInventoryData();
-  const isSupervisor = user?.role === "supervisor";
-  const canManage = user?.role === "admin" || user?.role === "procurement_manager" || user?.role === "pm" || isSupervisor;
+  const isAdmin = user?.role === "admin" || user?.role === "procurement_manager";
+  const isPM = user?.role === "pm";
 
   const [newName, setNewName] = useState("");
   const [newDesc, setNewDesc] = useState("");
-  const [selectedProjectId, setSelectedProjectId] = useState<string>("");
   const [editId, setEditId] = useState<string | null>(null);
   const [editName, setEditName] = useState("");
   const [editDesc, setEditDesc] = useState("");
 
-  if (!canManage) {
+  // ادمین / مدیر تدارکات به بخش «انبارها» دسترسی ندارد — مدیریت انبارها از «سازمان‌دهی»
+  if (isAdmin) {
     return (
       <div className="min-h-screen">
         <Header title="انبارها" backTo="/inventory" backLabel="بازگشت به داشبورد" />
         <PageLayout>
           <div className="rounded-xl border border-line bg-panel p-8 text-center">
             <div className="text-3xl">🔒</div>
-            <h3 className="mt-2 text-[15px] font-bold">دسترسی محدود</h3>
+            <h3 className="mt-2 text-[15px] font-bold">دسترسی ندارد</h3>
             <p className="mt-1 text-[12.5px] text-muted">
-              دسترسی به این بخش برای حساب کاربری شما فعال نیست.
+              بخش «انبارها» مخصوص مدیران پروژه است. مدیریت انبارها از بخش «سازمان‌دهی» انجام می‌شود.
             </p>
           </div>
         </PageLayout>
       </div>
     );
   }
+  if (!isPM) {
+    return (
+      <div className="min-h-screen">
+        <Header title="انبارها" backTo="/inventory" backLabel="بازگشت به داشبورد" />
+        <PageLayout>
+          <div className="text-[13px] text-muted">این بخش فقط برای مدیر پروژه است.</div>
+        </PageLayout>
+      </div>
+    );
+  }
 
   const addWarehouse = async () => {
     const name = newName.trim();
     if (!name) return toast.error("نام انبار الزامی است");
-    const projectId = isSupervisor ? user?.project_id : (selectedProjectId || user?.project_id || data.lookup.projects[0]?.id);
+    const projectId = user?.project_id;
     if (!projectId) return toast.error("پروژه انبار را انتخاب کنید");
     try {
       await apiV26.warehouses.create({ project_id: projectId, name, description: newDesc.trim() || null });
@@ -89,26 +99,13 @@ export function WarehousesPage() {
         backLabel="بازگشت به داشبورد"
       />
       <PageLayout className="flex flex-col gap-3">
-        {canManage && (
+        {isPM && (
           <div className="rounded-xl border border-line bg-panel p-3">
             <h3 className="mb-2 text-[13px] font-bold">+ افزودن انبار جدید</h3>
-            <div className="flex flex-wrap items-center gap-2">
-              {!isSupervisor && data.lookup.projects.length > 1 && (
-                <select
-                  className="h-9 rounded-lg border border-line bg-panel px-3 text-sm"
-                  value={selectedProjectId || user?.project_id || data.lookup.projects[0]?.id || ""}
-                  onChange={(e) => setSelectedProjectId(e.target.value)}
-                >
-                  {data.lookup.projects.map((p) => (
-                    <option key={p.id} value={p.id}>
-                      پروژه: {p.name}
-                    </option>
-                  ))}
-                </select>
-              )}
+            <div className="flex flex-wrap gap-2">
               <input
                 className="h-9 w-52 rounded-lg border border-line bg-panel px-3 text-sm"
-                placeholder="نام انبار (مثلاً انبار مرکزی)"
+                placeholder="نام انبار (مثلاً انبار موقت)"
                 value={newName}
                 onChange={(e) => setNewName(e.target.value)}
               />
@@ -151,7 +148,7 @@ export function WarehousesPage() {
                   >
                     📊 مشاهده داشبورد انبار
                   </button>
-                  {canManage && (
+                  {isPM && (
                     <>
                       <button
                         className="rounded-lg border border-line px-3 py-1 text-[11.5px]"
@@ -165,7 +162,7 @@ export function WarehousesPage() {
                     </>
                   )}
                 </div>
-                {editId === w.id && canManage && (
+                {editId === w.id && isPM && (
                   <div className="mt-2 flex flex-col gap-1.5 rounded-lg border border-dashed border-accent/40 p-2" onClick={(e) => e.stopPropagation()}>
                     <input
                       className="h-8 rounded-lg border border-line bg-panel px-2 text-sm"

frontend/src/pages/Inventory/panelMenu.ts

@@ -10,22 +10,20 @@ export function useLogout() {
 }
 
 const ROLE_LABELS: Record<string, string> = {
-  admin: "ادمین",
-  procurement_manager: "مدیر تدارکات",
   pm: "مدیر پروژه",
-  supervisor: "سرپرست پروژه",
+  procurement_manager: "مدیر تدارکات",
+  admin: "ادمین",
 };
 
 // زیرعنوان پویای سربرگ پنل انبار:
 //   [نام کاربر] | [نقش] – [پروژه / همه پروژه‌ها]
-// سرپرست پروژه → نام پروژه‌ی خودش؛ مدیران/ادمین → «همه پروژه‌ها».
-export function inventorySubheader(user: { username?: string; casdoor_id?: string; display_name?: string; first_name: string; last_name: string; role: string | null; role_label: string | null; project_name: string | null } | null | undefined): string {
+// مدیر پروژه → نام پروژه‌ی خودش؛ مدیر تدارکات/ادمین → «همه پروژه‌ها».
+export function inventorySubheader(user: { display_name?: string; first_name: string; last_name: string; role: string | null; role_label: string | null; project_name: string | null } | null | undefined): string {
   if (!user) return "در حال بارگذاری…";
-  const name = `${user.first_name || ""} ${user.last_name || ""}`.trim() || user.display_name || "کاربر";
-  const uname = user.username || user.casdoor_id || "-";
+  const name = user.display_name || `${user.first_name} ${user.last_name}`.trim() || "کاربر";
   const role = user.role_label || (user.role ? ROLE_LABELS[user.role] : "بدون نقش");
-  const proj = user.role === "supervisor" && user.project_name ? ` – پروژه: ${user.project_name}` : "";
-  return `${name} | نام کاربری: ${uname} | نقش: ${role}${proj}`;
+  const proj = user.role === "pm" ? user.project_name || "پروژه نامشخص" : "همه پروژه‌ها";
+  return `${name} | ${role} – ${proj}`;
 }
 
 // منوی همبرگریِ مختصر برای مدیر تدارکات/ادمین: بخش‌ها بالای صفحه هستند و
@@ -39,7 +37,8 @@ export function accountMenuItems(onLogout?: () => void): MenuItem[] {
   return items;
 }
 
-// منوی همبرگری سرپرست پروژه در پنل انبار
+// منوی همبرگری مدیر پروژه در پنل انبار — فقط «خروج از حساب»
+// (مدیر پروژه به دفتر تدارکات دسترسی ندارد و دکمه‌ی خروجِ تکی هم حذف شده).
 export function pmMenuItems(onLogout?: () => void): MenuItem[] {
   const items: MenuItem[] = [];
   if (onLogout) {
@@ -48,24 +47,33 @@ export function pmMenuItems(onLogout?: () => void): MenuItem[] {
   return items;
 }
 
-// آیتم‌های بخش‌های داخلی انبار
+// آیتم‌های منوی همبرگری پنل مدیریت انبار — با نشانگر پنل فعلی + «بازگشت به دفتر» + خروج
+//
+// دسترسی‌ها (v2.6):
+// - ادمین / مدیر تدارکات (یک نفر): داشبورد، کنترل روزانه، کالاهای در راه، سازمان‌دهی —
+//   بدون «تغییر موجودی» و بدون «انبارها».
+// - مدیر پروژه: داشبورد، تغییر موجودی، کنترل روزانه، انبارها، کالاهای در راه —
+//   بدون «سازمان‌دهی».
 export function panelMenuItems(pathname: string, role: string | null | undefined, onLogout?: () => void): MenuItem[] {
-  const isAdmin = role === "admin";
-  const isManager = role === "procurement_manager" || role === "pm" || isAdmin;
-  const isSupervisor = role === "supervisor" || isAdmin;
-
+  const isAdmin = role === "admin" || role === "procurement_manager";
+  const isPM = role === "pm";
   const items: MenuItem[] = [
     { label: "داشبورد انبار", to: "/inventory", active: pathname === "/inventory" },
   ];
-  // فقط سرپرست پروژه و ادمین می‌توانند تغییر موجودی بدهند
-  if (isSupervisor) {
+  if (isPM) {
     items.push({ label: "تغییر موجودی", to: "/inventory/change", active: pathname.startsWith("/inventory/change") });
   }
-  // کنترل روزانه و انبارها و کالاهای در راه برای مدیران و سرپرست پروژه
-  if (isManager || isSupervisor) {
   items.push({ label: "کنترل روزانه", to: "/inventory/daily", active: pathname.startsWith("/inventory/daily") });
+  if (isPM) {
     items.push({ label: "انبارها", to: "/inventory/warehouses", active: pathname.startsWith("/inventory/warehouses") });
+  }
   items.push({ label: "کالاهای در راه", to: "/inventory/arrivals", active: pathname.startsWith("/inventory/arrivals") });
+  if (isAdmin) {
+    items.push({ label: "سازمان‌دهی", to: "/inventory/org", active: pathname.startsWith("/inventory/org") });
+  }
+  if (isAdmin) {
+    items.push({ divider: true });
+    items.push({ label: "بازگشت به دفتر", to: "/" });
   }
   if (onLogout) {
     items.push({ divider: true });

frontend/src/pages/Inventory/useInventoryData.ts

@@ -26,8 +26,8 @@ export interface InventoryData {
 
 export function useInventoryData(): InventoryData {
   const user = useAuthStore((s) => s.user);
-  const isSupervisor = user?.role === "supervisor";
-  const projectId = isSupervisor || user?.role === "pm" ? user?.project_id || undefined : undefined;
+  const isPM = user?.role === "pm";
+  const projectId = isPM ? user.project_id || undefined : undefined;
 
   const [warehouses, setWarehouses] = useState<Warehouse[]>([]);
   const [inventory, setInventory] = useState<InventoryRow[]>([]);

frontend/src/pages/Organization/OrganizationPage.tsx

@@ -1,596 +0,0 @@
-import { useCallback, useEffect, useState } from "react";
-import { toast } from "sonner";
-import { Header, PageLayout } from "../../components/layout/Header";
-import { useAuthStore } from "../../store/auth";
-import { api, apiV26, type UserRow } from "../../lib/api";
-import type { Project } from "../../lib/types";
-import { refreshProcurementStore, useProjects } from "../../hooks";
-import { faNum } from "../../lib/formatters";
-import { ProjectMultiSelect } from "../../components/ProjectMultiSelect";
-import { AppSwitcherMenu } from "../../components/AppSwitcherMenu";
-
-type Role = "pm" | "procurement_manager" | "admin" | "supervisor" | null;
-
-const ROLE_LABELS: Record<string, string> = {
-  admin: "ادمین",
-  procurement_manager: "مدیر تدارکات",
-  pm: "مدیر پروژه",
-  supervisor: "سرپرست پروژه",
-};
-
-// پنل مستقل سازمان‌دهی (ادمین، مدیر تدارکات، مدیر پروژه) — مدیریت کاربران، نقش‌ها و تخصیص پروژه‌ها و پنل‌ها
-export function OrganizationPage() {
-  const user = useAuthStore((s) => s.user);
-  const storeProjects = useProjects();
-  const [directProjects, setDirectProjects] = useState<Project[]>([]);
-  const [loadingProjects, setLoadingProjects] = useState(false);
-
-  const [users, setUsers] = useState<UserRow[]>([]);
-  const [loadingUsers, setLoadingUsers] = useState(true);
-  const [syncing, setSyncing] = useState(false);
-  const [busyId, setBusyId] = useState<string | null>(null);
-
-  const canManage = user?.role === "admin" || user?.role === "procurement_manager" || user?.role === "pm";
-  const canChangeRoles = canManage;
-
-  const fetchProjects = useCallback(async () => {
-    try {
-      setLoadingProjects(true);
-      const list = await api.projects.list();
-      if (list && Array.isArray(list)) {
-        setDirectProjects(list);
-      }
-    } catch {
-      // fallback silently
-    } finally {
-      setLoadingProjects(false);
-    }
-  }, []);
-
-  const loadUsers = useCallback(async () => {
-    try {
-      setLoadingUsers(true);
-      const list = await apiV26.users.list();
-      setUsers(list);
-    } catch (err) {
-      toast.error(err instanceof Error ? err.message : "خطا در دریافت کاربران");
-    } finally {
-      setLoadingUsers(false);
-    }
-  }, []);
-
-  useEffect(() => {
-    if (canManage) {
-      void loadUsers();
-      void fetchProjects();
-    }
-  }, [canManage, loadUsers, fetchProjects]);
-
-  const projects = storeProjects.length > 0 ? storeProjects : directProjects;
-
-  const syncUsers = async () => {
-    setSyncing(true);
-    try {
-      const { users: synced, created } = await apiV26.users.sync();
-      setUsers(synced);
-      toast.success(
-        created > 0
-          ? `همگام‌سازی انجام شد — ${faNum(created)} کاربر جدید از Casdoor اضافه شد ✓`
-          : "همگام‌سازی انجام شد — کاربر جدیدی یافت نشد",
-      );
-      refreshProcurementStore();
-      void fetchProjects();
-    } catch (err) {
-      toast.error(err instanceof Error ? err.message : "خطا در همگام‌سازی با Casdoor");
-    } finally {
-      setSyncing(false);
-    }
-  };
-
-  if (!canManage) {
-    return (
-      <div className="min-h-screen">
-        <Header title="سازمان‌دهی" backTo="/" backLabel="بازگشت به دفتر" />
-        <PageLayout>
-          <div className="text-[13px] text-muted">این بخش فقط برای ادمین، مدیر تدارکات و مدیر پروژه است.</div>
-        </PageLayout>
-      </div>
-    );
-  }
-
-  // ---------- actions: users ----------
-
-  const changeRole = async (u: UserRow, role: Role) => {
-    setBusyId(u.id);
-    try {
-      await apiV26.users.updateRole(u.id, role);
-      toast.success(`نقش «${ROLE_LABELS[role ?? ""] ?? "بدون نقش"}» برای ${u.first_name} ${u.last_name} ثبت شد ✓`);
-      await loadUsers();
-      refreshProcurementStore();
-    } catch (err) {
-      toast.error(err instanceof Error ? err.message : "خطا در تغییر نقش");
-    } finally {
-      setBusyId(null);
-    }
-  };
-
-  // ---------- لایه پنل‌ها: تخصیص پنل + سطح دسترسی و عضویت پروژه‌ای ----------
-  const setPanel = async (u: UserRow, panel: "procurement" | "inventory" | "pm", level: "" | "full" | "limited") => {
-    setBusyId(u.id);
-    const next = { ...(u.panels ?? {}) };
-    if (level) next[panel] = level;
-    else delete next[panel];
-    try {
-      await apiV26.users.setPanels(u.id, next);
-      toast.success(`دسترسی «${u.first_name} ${u.last_name}» به‌روزرسانی شد ✓`);
-      await loadUsers();
-      refreshProcurementStore();
-    } catch (err) {
-      toast.error(err instanceof Error ? err.message : "خطا در ثبت دسترسی پنل");
-    } finally {
-      setBusyId(null);
-    }
-  };
-
-  const setMemberProjects = async (u: UserRow, nextIds: string[]) => {
-    setBusyId(u.id);
-    try {
-      await apiV26.users.setPanelProjects(u.id, nextIds);
-      toast.success(`عضویت پروژه‌ای «${u.first_name} ${u.last_name}» به‌روزرسانی شد ✓`);
-      await loadUsers();
-      refreshProcurementStore();
-    } catch (err) {
-      toast.error(err instanceof Error ? err.message : "خطا در ثبت عضویت پروژه‌ها");
-    } finally {
-      setBusyId(null);
-    }
-  };
-
-  const panelLabel = (level: string | undefined) =>
-    level === "full" ? "کامل" : level === "limited" ? "محدود" : "—";
-
-  // سرپرستان و مسئولان تخصیص‌یافته به یک پروژه
-  const supervisorsOf = (projectId: string) =>
-    users.filter(
-      (u) =>
-        (u.role === "supervisor" || u.role === "pm" || Boolean(u.panels?.pm)) &&
-        (u.projects?.some((p) => p.id === projectId) ||
-          u.project_id === projectId ||
-          u.member_project_ids?.includes(projectId)),
-    );
-
-  return (
-    <div className="min-h-screen">
-      <Header
-        title="سازمان‌دهی"
-        brand
-        menu={<AppSwitcherMenu activeModule="organization" />}
-      />
-      <PageLayout className="flex flex-col gap-5">
-        <div className="rounded-lg border border-blue/20 bg-blue/5 px-3.5 py-2.5 text-[12px] leading-6 text-muted">
-          ℹ️ کاربران در سامانه احراز هویت (Casdoor) تعریف شده و با کلیک بر روی دکمه «همگام‌سازی» اضافه می‌شوند. نقش‌های سازمانی و سطوح دسترسی هر پنل در جدول زیر توسط ادمین تعیین می‌گردد.
-        </div>
-
-        {/* ---------- بخش ۱: جدول یکپارچه کاربران، نقش‌ها و سطوح دسترسی پنل‌ها ---------- */}
-        <div className="rounded-xl border border-line bg-panel p-4">
-          <div className="mb-3 flex flex-wrap items-center justify-between gap-2">
-            <div>
-              <h3 className="text-[14px] font-bold">👥 کاربران، نقش‌ها و سطوح دسترسی پنل‌ها</h3>
-              <p className="mt-0.5 text-[11.5px] text-muted">
-                تعیین نقش سازمانی، تخصیص پنل‌ها (تدارکات، انبار، PM) و مشخص نمودن پروژه‌های عضویت کاربر
-              </p>
-            </div>
-            <button
-              onClick={() => void syncUsers()}
-              disabled={syncing}
-              className="rounded-lg border border-accent/40 bg-accent/5 px-3 py-1.5 text-[12px] font-bold text-accent hover:bg-accent/10 transition-colors disabled:opacity-50"
-            >
-              {syncing ? "در حال همگام‌سازی…" : "🔄 همگام‌سازی از Casdoor"}
-            </button>
-          </div>
-
-          {loadingUsers ? (
-            <div className="py-8 text-center text-[12.5px] text-muted">در حال بارگذاری کاربران…</div>
-          ) : !users.length ? (
-            <div className="rounded-lg border border-dashed border-line px-3 py-6 text-center text-[12px] text-muted">
-              کاربری ثبت نشده است — دکمه‌ی «همگام‌سازی از Casdoor» را بزنید.
-            </div>
-          ) : (
-            <div className="overflow-x-auto">
-              <table className="w-full text-[12.5px]">
-                <thead>
-                  <tr className="border-b border-line text-right text-muted">
-                    <th className="py-2.5 pe-3">نام و مشخصات</th>
-                    <th className="py-2.5 pe-3">نقش سازمانی</th>
-                    <th className="py-2.5 pe-3">پنل تدارکات</th>
-                    <th className="py-2.5 pe-3">پنل انبار</th>
-                    <th className="py-2.5 pe-3">پنل مدیریت پروژه (PM)</th>
-                    <th className="py-2.5">پروژه‌های عضویت (محدوده سطح محدود)</th>
-                  </tr>
-                </thead>
-                <tbody>
-                  {users.map((u) => {
-                    const isAdmin = u.role === "admin";
-                    const hasPanel = Boolean(u.panels?.procurement || u.panels?.inventory || u.panels?.pm);
-
-                    return (
-                      <tr key={u.id} className="border-b border-line/50 transition-colors hover:bg-canvas/30">
-                        {/* ۱. نام و نام کاربری */}
-                        <td className="py-2.5 pe-3">
-                          <div className="flex flex-col">
-                            <div className="flex items-center gap-1.5">
-                              <span className="font-bold text-foreground">
-                                {u.first_name} {u.last_name}
-                              </span>
-                              <span className="font-mono text-[10px] text-muted">
-                                ({u.username || "—"})
-                              </span>
-                            </div>
-                            {busyId === u.id && (
-                              <span className="text-[10px] text-accent animate-pulse font-medium">
-                                در حال ذخیره تغییرات…
-                              </span>
-                            )}
-                          </div>
-                        </td>
-
-                        {/* ۲. نقش سازمانی */}
-                        <td className="py-2.5 pe-3">
-                          {canChangeRoles ? (
-                            <select
-                              className="h-7 rounded-lg border border-line bg-panel px-2 text-[12px] focus:outline-none focus:ring-1 focus:ring-accent"
-                              value={u.role ?? ""}
-                              disabled={busyId === u.id}
-                              onChange={(e) => void changeRole(u, (e.target.value || null) as Role)}
-                            >
-                              <option value="">— بدون نقش —</option>
-                              <option value="admin">ادمین</option>
-                              <option value="procurement_manager">مدیر تدارکات</option>
-                              <option value="pm">مدیر پروژه</option>
-                              <option value="supervisor">سرپرست پروژه</option>
-                            </select>
-                          ) : (
-                            <span className="rounded bg-panel px-2 py-0.5 text-[11px] font-semibold text-muted">
-                              {ROLE_LABELS[u.role ?? ""] ?? "بدون نقش"}
-                            </span>
-                          )}
-                        </td>
-
-                        {/* ۳. پنل تدارکات */}
-                        <td className="py-2.5 pe-3">
-                          {isAdmin ? (
-                            <span className="text-[11px] text-muted">کامل (ادمین)</span>
-                          ) : canChangeRoles ? (
-                            <select
-                              className="h-7 rounded-lg border border-line bg-panel px-2 text-[12px] focus:outline-none focus:ring-1 focus:ring-accent"
-                              value={u.panels?.procurement ?? ""}
-                              disabled={busyId === u.id}
-                              onChange={(e) => void setPanel(u, "procurement", e.target.value as "" | "full" | "limited")}
-                            >
-                              <option value="">— بدون تخصیص —</option>
-                              <option value="full">کامل</option>
-                              <option value="limited">محدود (فقط استعلام)</option>
-                            </select>
-                          ) : (
-                            <span className="text-[11px]">{panelLabel(u.panels?.procurement)}</span>
-                          )}
-                        </td>
-
-                        {/* ۴. پنل انبار */}
-                        <td className="py-2.5 pe-3">
-                          {isAdmin ? (
-                            <span className="text-[11px] text-muted">کامل (ادمین)</span>
-                          ) : canChangeRoles ? (
-                            <select
-                              className="h-7 rounded-lg border border-line bg-panel px-2 text-[12px] focus:outline-none focus:ring-1 focus:ring-accent"
-                              value={u.panels?.inventory ?? ""}
-                              disabled={busyId === u.id}
-                              onChange={(e) => void setPanel(u, "inventory", e.target.value as "" | "full" | "limited")}
-                            >
-                              <option value="">— بدون تخصیص —</option>
-                              <option value="full">کامل (بدون تغییر موجودی)</option>
-                              <option value="limited">محدود (با تغییر موجودی)</option>
-                            </select>
-                          ) : (
-                            <span className="text-[11px]">{panelLabel(u.panels?.inventory)}</span>
-                          )}
-                        </td>
-
-                        {/* ۵. پنل مدیریت پروژه (PM) */}
-                        <td className="py-2.5 pe-3">
-                          {isAdmin ? (
-                            <span className="text-[11px] text-muted">کامل (ادمین)</span>
-                          ) : canChangeRoles ? (
-                            <select
-                              className="h-7 rounded-lg border border-line bg-panel px-2 text-[12px] focus:outline-none focus:ring-1 focus:ring-accent"
-                              value={u.panels?.pm ?? ""}
-                              disabled={busyId === u.id}
-                              onChange={(e) => void setPanel(u, "pm", e.target.value as "" | "full" | "limited")}
-                            >
-                              <option value="">— بدون تخصیص —</option>
-                              <option value="full">کامل</option>
-                              <option value="limited">محدود</option>
-                            </select>
-                          ) : (
-                            <span className="text-[11px]">{panelLabel(u.panels?.pm)}</span>
-                          )}
-                        </td>
-
-                        {/* ۶. پروژه‌های عضویت */}
-                        <td className="py-2.5">
-                          {isAdmin ? (
-                            <span className="text-[11px] text-muted">دسترسی خودکار به تمام پروژه‌ها</span>
-                          ) : hasPanel ? (
-                            <div className="w-72">
-                              <ProjectMultiSelect
-                                options={projects.map((p) => ({ id: p.id, name: p.name }))}
-                                values={u.member_project_ids ?? []}
-                                onChange={(nextIds) => void setMemberProjects(u, nextIds)}
-                                disabled={busyId === u.id}
-                              />
-                            </div>
-                          ) : (
-                            <span className="text-[11px] text-muted">— ابتدا پنل تخصیص دهید —</span>
-                          )}
-                        </td>
-                      </tr>
-                    );
-                  })}
-                </tbody>
-              </table>
-            </div>
-          )}
-        </div>
-
-        {/* ---------- بخش ۲: کارت‌های پروژه‌ها و سرپرستان مسئول ---------- */}
-        <div>
-          <div className="mb-2 flex items-center justify-between">
-            <div>
-              <h3 className="text-[14px] font-bold">🏢 پروژه‌ها و سرپرستان مسئول</h3>
-              <p className="text-[11.5px] text-muted">
-                مشاهده وضعیت پروژه‌ها و سرپرستان یا اعضای تخصیص‌یافته به هر پروژه
-              </p>
-            </div>
-            {loadingProjects && (
-              <span className="text-[11px] text-muted animate-pulse">در حال به‌روزرسانی پروژه‌ها…</span>
-            )}
-          </div>
-
-          {loadingProjects && !projects.length ? (
-            <div className="rounded-xl border border-line bg-panel p-6 text-center text-xs text-muted">
-              در حال دریافت اطلاعات پروژه‌ها…
-            </div>
-          ) : !projects.length ? (
-            <div className="rounded-xl border border-dashed border-line bg-panel p-6 text-center text-xs text-muted flex flex-col items-center gap-2">
-              <span>پروژه‌ای برای نمایش یافت نشد یا در دسترس نیست.</span>
-              <button
-                type="button"
-                onClick={() => void fetchProjects()}
-                className="rounded-lg bg-accent/10 px-3 py-1 text-xs font-semibold text-accent hover:bg-accent/20 transition-colors"
-              >
-                🔄 تلاش مجدد برای دریافت پروژه‌ها
-              </button>
-            </div>
-          ) : (
-            <div className="grid grid-cols-1 gap-3 md:grid-cols-2 lg:grid-cols-3">
-              {projects.map((p) => {
-                const sups = supervisorsOf(p.id);
-                return (
-                  <div key={p.id} className="rounded-xl border border-line bg-panel p-4 flex flex-col justify-between">
-                    <div>
-                      <div className="mb-2 flex items-center justify-between">
-                        <h4 className="text-[14px] font-bold text-foreground">🏢 {p.name}</h4>
-                        <span className="rounded-lg bg-canvas px-2 py-0.5 text-[11px] text-muted font-medium border border-line">
-                          {p.status || "پروژه فعال"}
-                        </span>
-                      </div>
-                      {p.description && (
-                        <p className="mb-3 text-[12px] text-muted line-clamp-2">{p.description}</p>
-                      )}
-                    </div>
-
-                    <div className="pt-2 border-t border-line/50">
-                      <h5 className="mb-1.5 text-[11.5px] font-bold text-muted">👤 سرپرست(های) مسئول:</h5>
-                      {!sups.length ? (
-                        <div className="rounded-lg border border-dashed border-line px-3 py-2 text-[11.5px] text-amber-600 dark:text-amber-400 bg-amber-500/5">
-                          ⚠️ سرپرستی تعیین نشده است — از جدول بالا، این پروژه را به عنوان عضویت تخصیص دهید.
-                        </div>
-                      ) : (
-                        <div className="flex flex-col gap-1">
-                          {sups.map((s) => (
-                            <div key={s.id} className="flex items-center justify-between rounded-lg border border-line bg-canvas/40 px-2.5 py-1.5 text-[12px]">
-                              <span className="font-semibold text-foreground">{s.first_name} {s.last_name}</span>
-                              <span className="text-[10px] text-muted font-mono">({s.username || ROLE_LABELS[s.role ?? ""] || "عضو"})</span>
-                            </div>
-                          ))}
-                        </div>
-                      )}
-                    </div>
-                  </div>
-                );
-              })}
-            </div>
-          )}
-        </div>
-
-        {/* ---------- بخش ۴: راهنما و توضیحات سطوح دسترسی پنل‌ها ---------- */}
-        <div className="rounded-xl border border-line bg-panel p-5">
-          <div className="mb-4 flex items-center justify-between border-b border-line pb-3">
-            <div>
-              <h3 className="flex items-center gap-2 text-[15px] font-bold">
-                <span className="flex h-7 w-7 items-center justify-center rounded-lg bg-accent/10 text-accent">
-                  📖
-                </span>
-                توضیحات پنل‌ها و راهنمای سطوح دسترسی
-              </h3>
-              <p className="mt-1 text-[12px] text-muted">
-                مفهوم، اختیارات و محدوده کاری هر سطح دسترسی (کامل / محدود) در هر یک از پنل‌های سامانه
-              </p>
-            </div>
-            <div className="hidden sm:flex items-center gap-2 text-[11px] text-muted bg-panel border border-line px-3 py-1.5 rounded-lg">
-              <span className="h-2 w-2 rounded-full bg-emerald-500 animate-pulse" />
-              مدل دسترسی ماژولار مبتنی بر پنل
-            </div>
-          </div>
-
-          <div className="grid grid-cols-1 gap-4 lg:grid-cols-3">
-            {/* کارت پنل تدارکات */}
-            <div className="flex flex-col rounded-xl border border-line bg-canvas/40 p-4 transition-all hover:border-sky-500/40">
-              <div className="mb-3 flex items-center justify-between">
-                <div className="flex items-center gap-2">
-                  <span className="flex h-8 w-8 items-center justify-center rounded-lg bg-sky-500/10 text-[18px]">
-                    🛒
-                  </span>
-                  <div>
-                    <h4 className="text-[13.5px] font-bold text-foreground">پنل تدارکات</h4>
-                    <span className="text-[10.5px] text-muted font-mono">Procurement</span>
-                  </div>
-                </div>
-                <span className="rounded-md bg-sky-500/10 px-2 py-0.5 text-[11px] font-medium text-sky-600 dark:text-sky-400">
-                  خرید و بازرگانی
-                </span>
-              </div>
-
-              <div className="flex-1 space-y-3">
-                <div className="rounded-lg border border-line/60 bg-panel/70 p-3">
-                  <div className="mb-1 flex items-center gap-1.5">
-                    <span className="inline-block h-2 w-2 rounded-full bg-emerald-500" />
-                    <span className="text-[12px] font-bold text-emerald-600 dark:text-emerald-400">سطح کامل (Full)</span>
-                  </div>
-                  <ul className="space-y-1 pe-2 text-[11.5px] leading-relaxed text-muted list-disc list-inside">
-                    <li>دسترسی کامل مدیریتی به تمامی بخش‌های تدارکات</li>
-                    <li>ثبت و ویرایش پیش‌فاکتورها، شرایط پرداخت و فاکتورها</li>
-                    <li>مدیریت تأمین‌کنندگان، اقلام و تصمیم‌گیری خرید در همه پروژه‌ها</li>
-                  </ul>
-                </div>
-
-                <div className="rounded-lg border border-line/60 bg-panel/70 p-3">
-                  <div className="mb-1 flex items-center gap-1.5">
-                    <span className="inline-block h-2 w-2 rounded-full bg-amber-500" />
-                    <span className="text-[12px] font-bold text-amber-600 dark:text-amber-400">سطح محدود (Limited - متقاضی)</span>
-                  </div>
-                  <ul className="space-y-1 pe-2 text-[11.5px] leading-relaxed text-muted list-disc list-inside">
-                    <li>فقط امکان ثبت درخواست استعلام قیمت و پیش‌فاکتور اولیه</li>
-                    <li>محدود منحصراً به پروژه‌هایی که کاربر در آن‌ها عضویت دارد</li>
-                    <li>عدم دسترسی به تأییدات نهایی، تغییر قیمت‌ها یا پروژه‌های غیرعضو</li>
-                  </ul>
-                </div>
-              </div>
-            </div>
-
-            {/* کارت پنل انبار */}
-            <div className="flex flex-col rounded-xl border border-line bg-canvas/40 p-4 transition-all hover:border-amber-500/40">
-              <div className="mb-3 flex items-center justify-between">
-                <div className="flex items-center gap-2">
-                  <span className="flex h-8 w-8 items-center justify-center rounded-lg bg-amber-500/10 text-[18px]">
-                    📦
-                  </span>
-                  <div>
-                    <h4 className="text-[13.5px] font-bold text-foreground">پنل انبار</h4>
-                    <span className="text-[10.5px] text-muted font-mono">Inventory</span>
-                  </div>
-                </div>
-                <span className="rounded-md bg-amber-500/10 px-2 py-0.5 text-[11px] font-medium text-amber-600 dark:text-amber-400">
-                  انبارداری و موجودی
-                </span>
-              </div>
-
-              <div className="flex-1 space-y-3">
-                <div className="rounded-lg border border-line/60 bg-panel/70 p-3">
-                  <div className="mb-1 flex items-center gap-1.5">
-                    <span className="inline-block h-2 w-2 rounded-full bg-emerald-500" />
-                    <span className="text-[12px] font-bold text-emerald-600 dark:text-emerald-400">سطح کامل (Full - مدیر/ناظر)</span>
-                  </div>
-                  <ul className="space-y-1 pe-2 text-[11.5px] leading-relaxed text-muted list-disc list-inside">
-                    <li>مشاهده موجودی و کاردکس کالا در تمامی انبارها و پروژه‌ها</li>
-                    <li>پایش و نظارت بر گردش کالا در کل سازمان و گزارش‌گیری کلان</li>
-                    <li className="font-semibold text-amber-700 dark:text-amber-300">بدون امکان تغییر مستقیم موجودی (جهت حفظ سلامت داده و کنترل نظارتی)</li>
-                  </ul>
-                </div>
-
-                <div className="rounded-lg border border-line/60 bg-panel/70 p-3">
-                  <div className="mb-1 flex items-center gap-1.5">
-                    <span className="inline-block h-2 w-2 rounded-full bg-amber-500" />
-                    <span className="text-[12px] font-bold text-amber-600 dark:text-amber-400">سطح محدود (Limited - انباردار کارگاه)</span>
-                  </div>
-                  <ul className="space-y-1 pe-2 text-[11.5px] leading-relaxed text-muted list-disc list-inside">
-                    <li>دسترسی فقط به انبارهای پروژه‌های عضویت کاربر</li>
-                    <li>امکان ثبت و تغییر موجودی، رسید کالا، حواله مصرف و تطبیق فیزیکی</li>
-                    <li>تفکیک دقیق موجودی و تراکنش‌های انبار بر اساس پروژه</li>
-                  </ul>
-                </div>
-              </div>
-            </div>
-
-            {/* کارت پنل مدیریت پروژه (PM) */}
-            <div className="flex flex-col rounded-xl border border-line bg-canvas/40 p-4 transition-all hover:border-indigo-500/40">
-              <div className="mb-3 flex items-center justify-between">
-                <div className="flex items-center gap-2">
-                  <span className="flex h-8 w-8 items-center justify-center rounded-lg bg-indigo-500/10 text-[18px]">
-                    📊
-                  </span>
-                  <div>
-                    <h4 className="text-[13.5px] font-bold text-foreground">پنل مدیریت پروژه (PM)</h4>
-                    <span className="text-[10.5px] text-muted font-mono">Project Management</span>
-                  </div>
-                </div>
-                <span className="rounded-md bg-indigo-500/10 px-2 py-0.5 text-[11px] font-medium text-indigo-600 dark:text-indigo-400">
-                  کنترل پروژه و اجرا
-                </span>
-              </div>
-
-              <div className="flex-1 space-y-3">
-                <div className="rounded-lg border border-line/60 bg-panel/70 p-3">
-                  <div className="mb-1 flex items-center gap-1.5">
-                    <span className="inline-block h-2 w-2 rounded-full bg-emerald-500" />
-                    <span className="text-[12px] font-bold text-emerald-600 dark:text-emerald-400">سطح کامل (Full - مدیر پروژه)</span>
-                  </div>
-                  <ul className="space-y-1 pe-2 text-[11.5px] leading-relaxed text-muted list-disc list-inside">
-                    <li>مدیریت جامع ساختار شکست کار (WBS)، زمان‌بندی و گانت چارت تعاملی</li>
-                    <li>تعریف و ویرایش فعالیت‌ها، ثبت خط مبنا (Baseline)، کنترل هزینه و منابع</li>
-                    <li>پایش شاخص‌های پیشرفت زمانی و مالی (EVM) و گزارش‌های تحلیلی</li>
-                  </ul>
-                </div>
-
-                <div className="rounded-lg border border-line/60 bg-panel/70 p-3">
-                  <div className="mb-1 flex items-center gap-1.5">
-                    <span className="inline-block h-2 w-2 rounded-full bg-amber-500" />
-                    <span className="text-[12px] font-bold text-amber-600 dark:text-amber-400">سطح محدود (Limited - سرپرست/کارشناس)</span>
-                  </div>
-                  <ul className="space-y-1 pe-2 text-[11.5px] leading-relaxed text-muted list-disc list-inside">
-                    <li>مشاهده فعالیت‌ها و تسک‌های مربوط به پروژه‌های عضویت کاربر</li>
-                    <li>به‌روزرسانی درصد پیشرفت فیزیکی و وضعیت انجام تسک‌ها</li>
-                    <li>تکمیل چک‌لیست‌های کنترل کیفیت (QC) و ثبت گزارش‌های اجرایی روزانه</li>
-                  </ul>
-                </div>
-              </div>
-            </div>
-          </div>
-
-          {/* نوار توضیحات تکمیلی و راهنمای عمومی */}
-          <div className="mt-4 grid grid-cols-1 md:grid-cols-2 gap-3 pt-3 border-t border-line text-[11.5px]">
-            <div className="flex items-start gap-2.5 rounded-lg border border-line/60 bg-canvas/30 p-2.5">
-              <span className="text-[16px] leading-none">👑</span>
-              <div>
-                <span className="font-bold text-foreground">دسترسی ادمین (Admin):</span>
-                <p className="mt-0.5 text-muted leading-relaxed">
-                  کاربر با نقش ادمین بالاترین سطح دسترسی سیستمی را داشته و به تمامی پنل‌ها و پروژه‌ها دسترسی کامل دارد و نیازی به تخصیص جداگانه پنل‌ها ندارد.
-                </p>
-              </div>
-            </div>
-
-            <div className="flex items-start gap-2.5 rounded-lg border border-line/60 bg-canvas/30 p-2.5">
-              <span className="text-[16px] leading-none">🎯</span>
-              <div>
-                <span className="font-bold text-foreground">کارکرد «پروژه‌های عضویت»:</span>
-                <p className="mt-0.5 text-muted leading-relaxed">
-                  هرگاه برای کاربری در هر پنلی سطح «محدود» انتخاب شود، دامنه داده‌ها و اختیارات وی دقیقاً به پروژه‌های انتخابی در ستون «پروژه‌های عضویت» محدود خواهد شد.
-                </p>
-              </div>
-            </div>
-          </div>
-        </div>
-      </PageLayout>
-    </div>
-  );
-}

frontend/src/pages/Projects/ProjectsPage.tsx

@@ -1,11 +1,11 @@
 import { useState } from "react";
 import { Link } from "react-router-dom";
 import { toast } from "sonner";
-import { Building2, Inbox, CheckCircle2, Truck, Phone, FolderKanban, MapPin, UserCircle2, Trash2, Plus, X } from "lucide-react";
+import { Building2, Inbox, CheckCircle2, Truck, Phone, FolderKanban } from "lucide-react";
 import type { Project, Quote, Store } from "../../lib/types";
+import { nextId } from "../../lib/api";
 import {
   useAddProject,
-  useDeleteProject,
   useMaterials,
   useProjects,
   useQuotes,
@@ -25,7 +25,6 @@ import { faNum, fmtDate } from "../../lib/formatters";
 import { Header, PageLayout } from "../../components/layout/Header";
 import { EmptyState } from "../../components/EmptyState";
 import { Button } from "../../components/ui/button";
-import { useAuthStore } from "../../store/auth";
 
 function projectQuotes(quotes: Quote[], name: string): Quote[] {
   return quotes.filter(
@@ -40,14 +39,23 @@ function projectQuotes(quotes: Quote[], name: string): Quote[] {
   );
 }
 
+// آیا این پیشنهاد برای «این» پروژه پذیرفته شده است؟
+// ملاک، پروژه‌ی هدفِ تصمیم خریدِ اقلام است (item_decisions.project_id) — نه
+// وضعیت سراسری پیشنهاد؛ پیشنهادی که فقط برای پروژه‌ی دیگری پذیرفته شده،
+// برای این پروژه همچنان «پیشنهاد شده» است.
 function acceptedForProject(q: Quote, name: string): boolean {
   return (q.line_items || []).some((li) => !li.rejected && li.target_project?.name === name);
 }
 
+// آیا اصلاً برای این پیشنهاد پروژه‌ی هدفی ثبت شده؟ (پیشنهادهای قدیمیِ
+// پیش از era تصمیم‌پروژه، طبق وضعیت سراسری دسته‌بندی می‌شوند)
 function hasTargets(q: Quote): boolean {
   return (q.line_items || []).some((li) => !!li.target_project);
 }
 
+// اقلام مربوط به این پروژه در یک quote:
+// اولویت با اقلامِ پذیرفته‌شده برای همین پروژه (تصمیم خرید)؛ سپس کاندیداهای
+// همین پروژه؛ و اگر هیچ اتصال قلم‌به‌قلمی نبود، همه‌ی اقلام فعال.
 function itemsForProject(q: Quote, name: string): Quote["line_items"] {
   const items = (q.line_items || []).filter((li) => !li.rejected);
   const targeted = items.filter((li) => li.target_project?.name === name);
@@ -65,97 +73,6 @@ function daysSince(iso: string | null): number | null {
   return Math.floor((Date.now() - d.getTime()) / 86400000);
 }
 
-// ----- مودال افزودن پروژه -----
-function AddProjectModal({
-  open,
-  onClose,
-  onSubmit,
-  loading,
-}: {
-  open: boolean;
-  onClose: () => void;
-  onSubmit: (p: Omit<Project, "id">) => void;
-  loading: boolean;
-}) {
-  const [name, setName] = useState("");
-  const [location, setLocation] = useState("");
-  const [projectManager, setProjectManager] = useState("");
-  const [description, setDescription] = useState("");
-  const [error, setError] = useState("");
-
-  const inputCls =
-    "w-full rounded-lg border border-line bg-surface px-3 py-2 text-sm shadow-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40";
-
-  const reset = () => {
-    setName(""); setLocation(""); setProjectManager(""); setDescription(""); setError("");
-  };
-
-  const handleClose = () => { reset(); onClose(); };
-
-  const handleSubmit = () => {
-    if (!name.trim()) { setError("نام پروژه الزامی است"); return; }
-    setError("");
-    onSubmit({ name: name.trim(), location: location.trim(), project_manager: projectManager.trim(), description: description.trim() });
-  };
-
-  if (!open) return null;
-
-  return (
-    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/40 backdrop-blur-sm" onClick={handleClose}>
-      <div
-        className="w-full max-w-lg rounded-2xl bg-panel shadow-2xl border border-line p-6"
-        onClick={(e) => e.stopPropagation()}
-      >
-        <div className="flex items-center justify-between mb-4">
-          <h2 className="text-base font-bold">افزودن پروژه جدید</h2>
-          <button type="button" onClick={handleClose} className="text-muted hover:text-on-surface transition-colors">
-            <X size={18} />
-          </button>
-        </div>
-
-        <div className="space-y-3">
-          {error && <p className="rounded-lg bg-red-50 border border-red-200 text-red-700 px-3 py-2 text-xs">{error}</p>}
-
-          <div>
-            <label className="mb-1 block text-xs font-semibold text-muted">نام پروژه *</label>
-            <input
-              value={name}
-              onChange={(e) => setName(e.target.value)}
-              onKeyDown={(e) => { if (e.key === "Enter") handleSubmit(); }}
-              placeholder="مثلاً: برج مسکونی آسمان"
-              className={inputCls}
-              autoFocus
-            />
-          </div>
-
-          <div className="grid grid-cols-2 gap-2">
-            <div>
-              <label className="mb-1 block text-xs font-semibold text-muted">محل پروژه</label>
-              <input value={location} onChange={(e) => setLocation(e.target.value)} placeholder="شهر / منطقه" className={inputCls} />
-            </div>
-            <div>
-              <label className="mb-1 block text-xs font-semibold text-muted">مدیر / سرپرست پروژه</label>
-              <input value={projectManager} onChange={(e) => setProjectManager(e.target.value)} placeholder="نام سرپرست" className={inputCls} />
-            </div>
-          </div>
-
-          <div>
-            <label className="mb-1 block text-xs font-semibold text-muted">توضیحات</label>
-            <textarea value={description} onChange={(e) => setDescription(e.target.value)} rows={2} placeholder="توضیحات تکمیلی پروژه..." className={`${inputCls} resize-none`} />
-          </div>
-
-          <div className="flex justify-end gap-2 pt-2">
-            <button type="button" onClick={handleClose} className="h-9 rounded-lg border border-line px-4 text-sm text-muted hover:bg-surface transition-colors">انصراف</button>
-            <button type="button" disabled={loading} onClick={handleSubmit} className="h-9 rounded-lg bg-accent px-4 text-sm font-semibold text-white hover:bg-accent/90 disabled:opacity-50 transition-colors">
-              {loading ? "در حال ذخیره..." : "افزودن پروژه"}
-            </button>
-          </div>
-        </div>
-      </div>
-    </div>
-  );
-}
-
 // صفحه‌ی پروژه‌ها — لیست + پنل جزئیات ۳ ستونه
 export function ProjectsPage() {
   useStoreData();
@@ -165,53 +82,54 @@ export function ProjectsPage() {
   const materials = useMaterials();
   const { standardConversions } = useUnits();
   const addProject = useAddProject();
-  const deleteProject = useDeleteProject();
   const topics = useAppStore((s) => s.topics);
-  const user = useAuthStore((s) => s.user);
-  const canManage = user?.role === "admin" || user?.role === "procurement_manager";
 
   const store: Store = { quotes, suppliers, materials, projects, standardConversions, topics };
 
   const [openProject, setOpenProject] = useState<string | null>(null);
-  const [showAddModal, setShowAddModal] = useState(false);
+  const [newName, setNewName] = useState("");
 
-  const handleAddProject = async (data: Omit<Project, "id">) => {
-    const dup = projects.some((p) => normalize(p.name) === normalize(data.name));
-    if (dup) { toast.error("این پروژه قبلاً ثبت شده است."); return; }
-    try {
-      await addProject.mutateAsync({ id: "", ...data });
-      setShowAddModal(false);
-      setOpenProject(data.name);
-      toast.success("پروژه با موفقیت اضافه شد.");
-    } catch {
-      toast.error("خطا در ثبت پروژه");
-    }
-  };
-
-  const handleDeleteProject = async (p: Project, e: React.MouseEvent) => {
-    e.stopPropagation();
-    if (!confirm(`آیا از حذف پروژه «${p.name}» مطمئن هستید؟`)) return;
-    try {
-      await deleteProject.mutateAsync(p.id);
-      toast.success("پروژه حذف شد.");
-      if (openProject === p.name) setOpenProject(null);
-    } catch (err: any) {
-      toast.error(err?.message || "این پروژه دارای پیشنهاد است و قابل حذف نیست");
+  const addProj = () => {
+    const name = newName.trim();
+    if (!name) return;
+    const dup = projects.some((p) => normalize(p.name) === normalize(name));
+    if (dup) {
+      toast.error("این پروژه قبلاً ثبت شده است.");
+      return;
     }
+    const p: Project = { id: nextId("p", projects), name };
+    void addProject.mutateAsync(p);
+    setNewName("");
+    setOpenProject(name);
+    toast.success("پروژه افزوده شد.");
   };
 
   return (
     <div className="min-h-screen">
-      <Header title="پروژه‌ها" sub="مدیریت پروژه‌های مشترک سامانه" backTo="/" backLabel="بازگشت به دفتر" />
+      <Header title="پروژه‌ها" sub="روی یک پروژه کلیک کنید تا جزئیات آن باز شود" backTo="/" backLabel="بازگشت به دفتر" />
       <PageLayout className="flex flex-col gap-4">
-        <div className="add-panel flex items-center justify-between">
-          <h4>پروژه‌های سامانه</h4>
-          {canManage && (
-            <Button onClick={() => setShowAddModal(true)} className="flex items-center gap-1.5">
-              <Plus size={15} />
-              افزودن پروژه
-            </Button>
-          )}
+        <div className="add-panel">
+          <h4>＋ افزودن پروژه‌ی جدید</h4>
+          <div className="grid max-w-md grid-cols-[1fr_auto] items-end gap-2">
+            <div className="field">
+              <label>نام پروژه *</label>
+              <input
+                type="text"
+                className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm shadow-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
+                placeholder="مثلاً برج آیتا - فاز ۳"
+                autoComplete="off"
+                value={newName}
+                onChange={(e) => setNewName(e.target.value)}
+                onKeyDown={(e) => {
+                  if (e.key === "Enter") {
+                    e.preventDefault();
+                    addProj();
+                  }
+                }}
+              />
+            </div>
+            <Button onClick={addProj}>افزودن پروژه</Button>
+          </div>
         </div>
 
         {!projects.length && !quotes.length ? (
@@ -223,37 +141,16 @@ export function ProjectsPage() {
               const open = openProject === p.name;
               return (
                 <div key={p.id} className="flex flex-col gap-1.5">
-                  <div className={`proj-item flex items-center gap-2 ${open ? "open" : ""}`}>
                   <button
                     type="button"
-                      className="flex flex-1 items-center gap-2 min-w-0 text-right"
+                    className={`proj-item ${open ? "open" : ""}`}
                     onClick={() => setOpenProject(open ? null : p.name)}
                   >
                     <span className={open ? "text-accent" : "text-muted"}>{open ? "▾" : "▸"}</span>
-                      <span className="font-medium truncate">{p.name}</span>
-                      {p.location && (
-                        <span className="flex items-center gap-0.5 text-[11px] text-muted shrink-0">
-                          <MapPin size={10} />{p.location}
-                        </span>
-                      )}
-                      {p.project_manager && (
-                        <span className="flex items-center gap-0.5 text-[11px] text-muted shrink-0">
-                          <UserCircle2 size={10} />{p.project_manager}
-                        </span>
-                      )}
-                      <span className="proj-count ms-auto shrink-0">{faNum(count)} پیشنهاد</span>
+                    <span className="font-medium">{p.name}</span>
+                    <span className="proj-count">{faNum(count)} پیشنهاد</span>
                   </button>
-                    {canManage && (
-                      <button
-                        type="button"
-                        onClick={(e) => handleDeleteProject(p, e)}
-                        title="حذف پروژه"
-                        className="text-muted hover:text-red-600 transition-colors p-1 rounded shrink-0"
-                      >
-                        <Trash2 size={13} />
-                      </button>
-                    )}
-                  </div>
+                  {/* جزئیات دقیقاً زیر همان پروژه باز می‌شود */}
                   {open && <div className="ms-2">{renderProjectDetail(store, p.name)}</div>}
                 </div>
               );
@@ -261,13 +158,6 @@ export function ProjectsPage() {
           </div>
         )}
       </PageLayout>
-
-      <AddProjectModal
-        open={showAddModal}
-        onClose={() => setShowAddModal(false)}
-        onSubmit={handleAddProject}
-        loading={addProject.isPending}
-      />
     </div>
   );
 }
@@ -276,6 +166,7 @@ export function ProjectsPage() {
 function renderProjectDetail(store: Store, name: string): React.ReactElement {
   const quotes = projectQuotes(store.quotes, name);
 
+  // جمع مبلغ هر ستون فقط روی اقلامِ همین پروژه
   const itemsTotal = (q: Quote) =>
     itemsForProject(q, name).reduce((s, li) => s + (lineItemTotal(li) || 0), 0);
   const sumBy = (list: Quote[]) => list.reduce((s, q) => s + itemsTotal(q), 0);
@@ -305,6 +196,10 @@ function renderProjectDetail(store: Store, name: string): React.ReactElement {
     );
   };
 
+  // دسته‌بندی ایزوله per-project:
+  // - پذیرفته/رسیده فقط وقتی حداقل یک قلمِ غیرردشده برای «این» پروژه پذیرفته شده باشد؛
+  // - پیشنهادی که صرفاً کاندیداست (یا فقط برای پروژه‌ی دیگری پذیرفته شده) → پیشنهاد شده.
+  // - پیشنهادهای قدیمیِ بدون پروژه‌ی هدف، طبق وضعیت سراسری می‌مانند.
   const offered = quotes
     .filter(
       (q) =>

frontend/src/pages/Suppliers/CategoryPage.tsx

@@ -14,7 +14,6 @@ import { Combobox } from "../../components/Combobox";
 import { SupplierCard, suppliersOfCategory } from "./supplierUtils";
 import { materialLabel } from "../../lib/quoteUtils";
 import { Button } from "../../components/ui/button";
-import { useAuthStore } from "../../store/auth";
 
 // صفحه‌ی تأمین‌کننده‌های یک دسته + فرم افزودن تأمین‌کننده
 export function CategoryPage() {
@@ -27,8 +26,6 @@ export function CategoryPage() {
   const addSupplier = useAddSupplier();
   const removeSupplier = useRemoveSupplier();
   const topics = useAppStore((s) => s.topics);
-  const user = useAuthStore((s) => s.user);
-  const canManage = user?.role === "admin" || user?.role === "procurement_manager";
 
   const cat = useMemo(() => topicByName(catParam, topics)?.name ?? null, [catParam, topics]);
 
@@ -124,7 +121,7 @@ export function CategoryPage() {
                 key={s.id}
                 s={s}
                 topic={cat}
-                deletable={canManage}
+                deletable
                 onDelete={removeSup}
                 materials={supMats.get(s.id) || []}
                 avgLeadTime={supLeadTimes.get(s.id)}
@@ -133,7 +130,6 @@ export function CategoryPage() {
           </div>
         )}
 
-        {canManage && (
         <div className="add-panel">
           <h4>
             <Plus className="me-1 inline h-4 w-4 text-accent" /> افزودن تأمین‌کننده‌ی جدید
@@ -186,7 +182,6 @@ export function CategoryPage() {
             ذخیره تأمین‌کننده
           </Button>
         </div>
-        )}
       </PageLayout>
     </div>
   );

frontend/src/pages/Suppliers/SupplierDetailPage.tsx

@@ -14,7 +14,6 @@ import { MultiSelectCombobox } from "../../components/MultiSelectCombobox";
 import { ConfirmDeleteDialog } from "../../components/ConfirmDeleteDialog";
 import { normalize } from "../../lib/normalize";
 import { PurchaseHistory } from "./PurchaseHistory";
-import { useAuthStore } from "../../store/auth";
 
 // تمیزکاری و استانداردسازی شماره برای شماره‌گیر خودکار موبایل (اندروید و iOS)
 function cleanPhoneForTel(phone?: string | null): string {
@@ -33,8 +32,6 @@ export function SupplierDetailPage() {
   const quotes = useQuotes();
   const materials = useMaterials();
   const topics = useAppStore((s) => s.topics);
-  const user = useAuthStore((s) => s.user);
-  const canManage = user?.role === "admin" || user?.role === "procurement_manager";
 
   const s = useMemo(() => suppliers.find((x) => x.id === id) || null, [suppliers, id]);
   const [pendingRemove, setPendingRemove] = useState<string | null>(null);
@@ -187,7 +184,6 @@ export function SupplierDetailPage() {
           </div>
 
           <div className="mt-4 flex items-center gap-2">
-            {canManage && (
             <Link
               to={`/wizard?topic=${encodeURIComponent(topicName)}&supplier=${encodeURIComponent(s.id)}`}
               className="btn-line-file no-underline bg-accent text-white hover:bg-accent-dark"
@@ -195,7 +191,6 @@ export function SupplierDetailPage() {
               <Plus className="h-3.5 w-3.5" />
               پیشنهاد جدید
             </Link>
-            )}
             {firstCat ? (
               <Link to={`/suppliers/category/${encodeURIComponent(firstCat)}`} className="btn-line-file no-underline">
                 ‹ بازگشت به دسته
@@ -221,23 +216,19 @@ export function SupplierDetailPage() {
               {linked.map((c) => (
                 <span key={c} className="spec-chip">
                   {c}
-                  {canManage && (
                   <button type="button" className="spec-chip-x" title="حذف متریال" onClick={() => setPendingRemove(c)}>
                     <X className="h-3 w-3" />
                   </button>
-                  )}
                 </span>
               ))}
             </div>
           )}
-          {canManage && (
           <MultiSelectCombobox
             values={[]}
             onChange={(cats) => saveCategories(cats)}
             options={materialOptions}
             placeholder="افزودن متریال..."
           />
-          )}
           {purchased.length > 0 && (
             <div className="mt-3 border-t border-line pt-2">
               <div className="mb-1 text-[11px] font-semibold text-muted">متریال‌های خریداری‌شده (از پیشنهادها):</div>

frontend/src/pages/Units/UnitsPage.tsx

@@ -1,6 +1,8 @@
 import { useCallback, useEffect, useMemo, useState } from "react";
+import { Link } from "react-router-dom";
 import { toast } from "sonner";
 import {
+  Building2,
   ChevronDown,
   Link2,
   Pencil,
@@ -12,7 +14,7 @@ import {
   TriangleAlert,
 } from "lucide-react";
 import type { StandardConversion } from "../../lib/types";
-import { api, apiV26, nextId, type BrandLinkRow, type MaterialUnitRow } from "../../lib/api";
+import { api, apiV26, nextId, type BrandLinkRow, type MaterialSupplier, type MaterialUnitRow } from "../../lib/api";
 import {
   refreshProcurementStore,
   useDeleteStandardConversion,
@@ -102,6 +104,12 @@ export function UnitsPage() {
   const [rowsLoading, setRowsLoading] = useState(false);
   const [brandLinks, setBrandLinks] = useState<BrandLinkRow[]>([]);
 
+  // تأمین‌کننده‌های متریال انتخاب‌شده — داده از GET /materials/{id}/suppliers
+  const [materialSuppliers, setMaterialSuppliers] = useState<MaterialSupplier[]>([]);
+  const [suppliersLoading, setSuppliersLoading] = useState(false);
+  // کلید پیشگیری از flicker: قبل از رسیدن پاسخ جدید، empty state نشان نمی‌دهیم
+  const [suppliersLoadedId, setSuppliersLoadedId] = useState<string | null>(null);
+
   // واحدها و برندهای سراسری (فهرست دیتابیس)
   const [units, setUnits] = useState<UnitLite[]>([]);
   const [allBrands, setAllBrands] = useState<string[]>([]);
@@ -253,6 +261,7 @@ export function UnitsPage() {
     if (!materialId) {
       setRows([]);
       setBrandLinks([]);
+      setMaterialSuppliers([]);
       return;
     }
     void loadRows(materialId);
@@ -263,6 +272,33 @@ export function UnitsPage() {
     setFormBrand("");
   }, [materialId, loadRows]);
 
+  // واکشی تأمین‌کننده‌های متصل به متریال انتخاب‌شده
+  useEffect(() => {
+    if (!materialId) {
+      setMaterialSuppliers([]);
+      setSuppliersLoadedId(null);
+      return;
+    }
+    let alive = true;
+    setSuppliersLoading(true);
+    api.materials
+      .listSuppliers(materialId)
+      .then((list) => {
+        if (alive) {
+          setMaterialSuppliers(list);
+          setSuppliersLoadedId(materialId);
+        }
+      })
+      .catch((err: unknown) => {
+        if (!alive) return;
+        setMaterialSuppliers([]);
+        setSuppliersLoadedId(materialId);
+        toast.error(err instanceof Error ? err.message : "خواندن تأمین‌کننده‌های متریال ناموفق بود");
+      })
+      .finally(() => { if (alive) setSuppliersLoading(false); });
+    return () => { alive = false; };
+  }, [materialId]);
+
   const brandNameFor = (row: MaterialUnitRow): string => {
     if (!row.brand_material_id) return "";
     return brandLinks.find((b) => b.id === row.brand_material_id)?.brand_name || "";
@@ -449,7 +485,7 @@ export function UnitsPage() {
   return (
     <div className="min-h-screen">
       <Header
-        title="ضرایب تبدیل"
+        title="اقلام و ضرایب"
         sub="متریال را انتخاب کنید — واحد مرجع و ضریب تبدیل همان متریال"
         backTo="/"
         backLabel="بازگشت به دفتر"
@@ -546,6 +582,77 @@ export function UnitsPage() {
               </div>
             ) : (
               <>
+                {/* ── تامین‌کنندگان متریال ── */}
+                <div className="mb-5 overflow-hidden rounded-xl border border-line bg-panel shadow-sm">
+                  {/* سرصفحه — همیشه نمایش داده می‌شود */}
+                  <div className="border-b border-line px-4 py-3">
+                    <h4 className="text-[14px] font-bold text-gray-900">تامین‌کنندگان متریال</h4>
+                  </div>
+
+                  {/* محتوا — min-h برای جلوگیری از layout shift */}
+                  <div className="min-h-[80px] p-4 transition-opacity duration-300 ease-in-out">
+                    {suppliersLoading || materialId !== suppliersLoadedId ? (
+                      /* اسپینر — نه empty state — تا پاسخ API برسد */
+                      <div className="flex h-[80px] items-center justify-center">
+                        <span className="h-5 w-5 animate-spin rounded-full border-2 border-muted border-t-transparent" />
+                      </div>
+                    ) : materialSuppliers.length === 0 ? (
+                      <p className="flex h-[80px] items-center justify-center text-sm text-muted">
+                        تامین‌کننده‌ای برای این متریال ثبت نشده است
+                      </p>
+                    ) : (
+                      <div className="flex flex-col gap-3 mt-4 max-h-[320px] overflow-y-auto">
+                        {materialSuppliers.map((s) => (
+                          <div
+                            key={s.id}
+                            className="flex flex-col md:flex-row md:items-center justify-between p-4 bg-white border border-gray-200 rounded-xl shadow-sm gap-4 w-full"
+                          >
+                            {/* نام تامین‌کننده */}
+                            <div className="flex-1 flex flex-col gap-1 text-right">
+                              <span className="text-xs font-medium text-gray-900">نام تامین‌کننده</span>
+                              <Link
+                                to={`/suppliers/${s.id}`}
+                                className="font-medium text-accent hover:underline decoration-dashed"
+                              >
+                                {s.name}
+                              </Link>
+                            </div>
+                            {/* نام مسئول */}
+                            <div className="flex-1 flex flex-col gap-1 text-right">
+                              <span className="text-xs font-medium text-gray-900">نام مسئول</span>
+                              <span className="text-gray-500">
+                                {s.contact_person || <span className="text-gray-500">ثبت نشده</span>}
+                              </span>
+                            </div>
+                            {/* تلفن */}
+                            <div className="flex-1 flex flex-col gap-1 text-right">
+                              <span className="text-xs font-medium text-gray-900">تلفن</span>
+                              {s.phone ? (
+                                <a
+                                  href={`tel:${s.phone}`}
+                                  dir="ltr"
+                                  className="font-medium text-accent hover:underline decoration-dashed"
+                                >
+                                  {s.phone}
+                                </a>
+                              ) : (
+                                <span className="text-gray-500">ثبت نشده</span>
+                              )}
+                            </div>
+                            {/* محل */}
+                            <div className="flex-1 flex flex-col gap-1 text-right">
+                              <span className="text-xs font-medium text-gray-900">محل</span>
+                              <span className="text-gray-500">
+                                {s.location || <span className="text-gray-500">ثبت نشده</span>}
+                              </span>
+                            </div>
+                          </div>
+                        ))}
+                      </div>
+                    )}
+                  </div>
+                </div>
+
                 {/* واحد مرجع متریال */}
                 <div className="ref-unit-box">
                   <div className="ref-title">
@@ -587,119 +694,6 @@ export function UnitsPage() {
                   </div>
                 </div>
 
-                {/* ضرایب متریال */}
-                <h4 className="sec-title">
-                  <Repeat className="me-1 inline h-4 w-4 text-accent" /> ضریب‌های تبدیل
-                </h4>
-                {rowsLoading ? (
-                  <div className="conv-empty">در حال بارگذاری…</div>
-                ) : !rows.length ? (
-                  <div className="conv-empty">هنوز ضریبی برای این متریال ثبت نشده است.</div>
-                ) : (
-                  rows.map((r) => (
-                    <div key={r.id}>
-                      <div className="cg-head">
-                        {unitDisplay(r.unit) || `واحد #${r.unit_id}`} ← {ref}
-                      </div>
-                      <div className="conv-row">
-                        <span className="cv-brand">{brandNameFor(r) || "همه برندها"}</span>
-                        <span className="cv-factor">{faNum(r.conversion_factor)}</span>
-                        <span className="cv-arrow">×</span>
-                        <span className="cv-unit">{ref}</span>
-                        <span className="conv-actions">
-                          <button type="button" title="ویرایش" onClick={() => startEdit(r)}>
-                            <Pencil className="h-3.5 w-3.5" />
-                          </button>
-                          <button type="button" title="حذف" onClick={() => void deleteMu(r)}>
-                            <Trash2 className="h-3.5 w-3.5" />
-                          </button>
-                        </span>
-                      </div>
-                    </div>
-                  ))
-                )}
-
-                {/* فرم افزودن ضریب */}
-                <div className="add-conv">
-                  <h4 className="mb-2 text-[13.5px] font-bold">
-                    {editingId ? (
-                      <>
-                        <Pencil className="me-1 inline h-3.5 w-3.5" /> ویرایش ضریب تبدیل
-                      </>
-                    ) : (
-                      <>
-                        <Plus className="me-1 inline h-3.5 w-3.5" /> افزودن ضریب تبدیل
-                      </>
-                    )}
-                  </h4>
-                  <div className="grid grid-cols-1 gap-2 sm:grid-cols-[1.2fr_0.6fr_1fr_0.8fr_auto] sm:items-end">
-                    <div className="field">
-                      <label>واحد پیشنهادشده</label>
-                      <Combobox
-                        value={formUnit}
-                        onChange={(it) => setFormUnit(it.label)}
-                        items={units.map((u) => unitDisplay(u)).filter(Boolean)}
-                        allowAdd
-                        addSuffix="به عنوان واحد جدید"
-                        placeholder="مثلاً حلقه"
-                        onInputChange={setFormUnit}
-                      />
-                    </div>
-                    <div className="field">
-                      <label>ضریب</label>
-                      <NumberInput
-                        value={factorNum()}
-                        onChange={(n) => setFormFactor(n != null ? String(n) : "")}
-                        placeholder="مثلاً 0.98"
-                        inputMode="decimal"
-                      />
-                    </div>
-                    <div className="field">
-                      <label>برند (خالی = همه برندها)</label>
-                      <Combobox
-                        value={formBrand}
-                        onChange={(it) => setFormBrand(it.label)}
-                        items={allBrands}
-                        allowAdd
-                        disabled={!!editingId}
-                        addSuffix="به عنوان برند جدید"
-                        placeholder="مثلاً راجین"
-                        onInputChange={setFormBrand}
-                      />
-                    </div>
-                    <div className="field">
-                      <label>به واحد (مرجع)</label>
-                      <input
-                        type="text"
-                        className="h-9 w-full rounded-lg border border-line bg-slate-bg px-3 text-sm text-muted"
-                        value={ref || "مرجع"}
-                        placeholder="مرجع"
-                        readOnly
-                      />
-                    </div>
-                    <div className="flex items-center gap-1.5">
-                      <Button size="sm" onClick={() => void saveConv()}>
-                        {editingId ? "ذخیره تغییرات" : "افزودن"}
-                      </Button>
-                      {editingId && (
-                        <Button
-                          size="sm"
-                          variant="slate"
-                          onClick={() => {
-                            setEditingId(null);
-                            setFormUnit("");
-                            setFormFactor("");
-                            setFormBrand("");
-                          }}
-                        >
-                          انصراف
-                        </Button>
-                      )}
-                    </div>
-                  </div>
-                  <div className="conv-live">{convLive}</div>
-                </div>
-
                 {/* واحدهای ناشناخته */}
                 {unknownUnits.length > 0 && (
                   <>
@@ -829,6 +823,121 @@ export function UnitsPage() {
                     تبدیل ثابت برای همه‌ی متریال‌ها اعمال می‌شود؛ ضریب یعنی: ۱ از واحد = ضریب × به واحد
                   </div>
                 </div>
+
+
+                {/* ضرایب متریال */}
+                <h4 className="sec-title">
+                  <Repeat className="me-1 inline h-4 w-4 text-accent" /> ضریب‌های تبدیل
+                </h4>
+                {rowsLoading ? (
+                  <div className="conv-empty">در حال بارگذاری…</div>
+                ) : !rows.length ? (
+                  <div className="conv-empty">هنوز ضریبی برای این متریال ثبت نشده است.</div>
+                ) : (
+                  rows.map((r) => (
+                    <div key={r.id}>
+                      <div className="cg-head">
+                        {unitDisplay(r.unit) || `واحد #${r.unit_id}`} ← {ref}
+                      </div>
+                      <div className="conv-row">
+                        <span className="cv-brand">{brandNameFor(r) || "همه برندها"}</span>
+                        <span className="cv-factor">{faNum(r.conversion_factor)}</span>
+                        <span className="cv-arrow">×</span>
+                        <span className="cv-unit">{ref}</span>
+                        <span className="conv-actions">
+                          <button type="button" title="ویرایش" onClick={() => startEdit(r)}>
+                            <Pencil className="h-3.5 w-3.5" />
+                          </button>
+                          <button type="button" title="حذف" onClick={() => void deleteMu(r)}>
+                            <Trash2 className="h-3.5 w-3.5" />
+                          </button>
+                        </span>
+                      </div>
+                    </div>
+                  ))
+                )}
+
+                {/* فرم افزودن ضریب */}
+                <div className="add-conv">
+                  <h4 className="mb-2 text-[13.5px] font-bold">
+                    {editingId ? (
+                      <>
+                        <Pencil className="me-1 inline h-3.5 w-3.5" /> ویرایش ضریب تبدیل
+                      </>
+                    ) : (
+                      <>
+                        <Plus className="me-1 inline h-3.5 w-3.5" /> افزودن ضریب تبدیل
+                      </>
+                    )}
+                  </h4>
+                  <div className="grid grid-cols-1 gap-2 sm:grid-cols-[1.2fr_0.6fr_1fr_0.8fr_auto] sm:items-end">
+                    <div className="field">
+                      <label>واحد پیشنهادشده</label>
+                      <Combobox
+                        value={formUnit}
+                        onChange={(it) => setFormUnit(it.label)}
+                        items={units.map((u) => unitDisplay(u)).filter(Boolean)}
+                        allowAdd
+                        addSuffix="به عنوان واحد جدید"
+                        placeholder="مثلاً حلقه"
+                        onInputChange={setFormUnit}
+                      />
+                    </div>
+                    <div className="field">
+                      <label>ضریب</label>
+                      <NumberInput
+                        value={factorNum()}
+                        onChange={(n) => setFormFactor(n != null ? String(n) : "")}
+                        placeholder="مثلاً 0.98"
+                        inputMode="decimal"
+                      />
+                    </div>
+                    <div className="field">
+                      <label>برند (خالی = همه برندها)</label>
+                      <Combobox
+                        value={formBrand}
+                        onChange={(it) => setFormBrand(it.label)}
+                        items={allBrands}
+                        allowAdd
+                        disabled={!!editingId}
+                        addSuffix="به عنوان برند جدید"
+                        placeholder="مثلاً راجین"
+                        onInputChange={setFormBrand}
+                      />
+                    </div>
+                    <div className="field">
+                      <label>به واحد (مرجع)</label>
+                      <input
+                        type="text"
+                        className="h-9 w-full rounded-lg border border-line bg-slate-bg px-3 text-sm text-muted"
+                        value={ref || "مرجع"}
+                        placeholder="مرجع"
+                        readOnly
+                      />
+                    </div>
+                    <div className="flex items-center gap-1.5">
+                      <Button size="sm" onClick={() => void saveConv()}>
+                        {editingId ? "ذخیره تغییرات" : "افزودن"}
+                      </Button>
+                      {editingId && (
+                        <Button
+                          size="sm"
+                          variant="slate"
+                          onClick={() => {
+                            setEditingId(null);
+                            setFormUnit("");
+                            setFormFactor("");
+                            setFormBrand("");
+                          }}
+                        >
+                          انصراف
+                        </Button>
+                      )}
+                    </div>
+                  </div>
+                  <div className="conv-live">{convLive}</div>
+                </div>
+
               </>
             )}
           </section>

frontend/src/pages/Wizard/Step4Projects.tsx

@@ -14,8 +14,6 @@ export interface Step4Props {
   onAssign: (tempId: string, proj: string) => void;
   onUnassign: (tempId: string, proj: string) => void;
   onAddProject: (name: string) => void;
-  /** سطح limited تدارکات: افزودن پروژه جدید ممنوع */
-  canAddProject?: boolean;
 }
 
 const ALL_KEY = "__all__";
@@ -113,7 +111,7 @@ function DroppableProject({
 }
 
 // مرحله ۴ — تخصیص پروژه‌ها با درگ‌اندروپ (یا کلیک-قلم بعد کلیک-پروژه)
-export function Step4Projects({ items, projects, assignment, onAssign, onUnassign, onAddProject, canAddProject = true }: Step4Props) {
+export function Step4Projects({ items, projects, assignment, onAssign, onUnassign, onAddProject }: Step4Props) {
   const [picked, setPicked] = useState<string | null>(null);
   const [newProj, setNewProj] = useState("");
 
@@ -213,14 +211,10 @@ export function Step4Projects({ items, projects, assignment, onAssign, onUnassig
               />
             ))}
             {!projects.length && (
-              <div className="dd-empty">
-                {canAddProject
-                  ? "هنوز پروژه‌ای تعریف نشده است — از پایین یک پروژه اضافه کنید."
-                  : "هنوز پروژه‌ای به شما تخصیص داده نشده است — با مدیر سیستم تماس بگیرید."}
-              </div>
+              <div className="dd-empty">هنوز پروژه‌ای تعریف نشده است — از پایین یک پروژه اضافه کنید.</div>
             )}
-            {/* افزودن پروژه به‌صورت درجا — زیر لیست پروژه‌ها (سطح limited: ممنوع) */}
-            <div className="mt-3 rounded-md border border-dashed border-line p-2" hidden={!canAddProject}>
+            {/* افزودن پروژه به‌صورت درجا — زیر لیست پروژه‌ها */}
+            <div className="mt-3 rounded-md border border-dashed border-line p-2">
               <div className="mb-1.5 text-[11.5px] font-semibold text-muted">افزودن پروژه‌ی جدید:</div>
               <div className="flex items-center gap-2">
                 <input

frontend/src/pages/Wizard/WizardPage.tsx

@@ -22,7 +22,6 @@ import { normalize } from "../../lib/normalize";
 import { faNum } from "../../lib/formatters";
 import { matchMaterial } from "../../lib/quoteUtils";
 import { Header, PageLayout } from "../../components/layout/Header";
-import { AppSwitcherMenu } from "../../components/AppSwitcherMenu";
 import { Stepper } from "./Stepper";
 import { Step1TopicSupplier } from "./Step1TopicSupplier";
 import { Step2LineItems, type ItemDraft, type MaterialRec } from "./Step2LineItems";
@@ -37,7 +36,6 @@ import {
   DialogHeader,
   DialogTitle,
 } from "../../components/ui/dialog";
-import { useAuthStore } from "../../store/auth";
 
 const TOTAL_STEPS = 5;
 
@@ -51,23 +49,6 @@ export function WizardPage() {
   const suppliers = useSuppliers();
   const materials = useMaterials();
   const projects = useProjects();
-  // سطح limited تدارکات: استعلام فقط برای پروژه‌های عضویت — بدون افزودن پروژه جدید
-  const user = useAuthStore((s) => s.user);
-  const isLimitedProcurement =
-    user?.panels?.procurement === "limited" && user?.role !== "admin";
-  const memberProjectNames = useMemo(() => {
-    const allowedIds = new Set([
-      ...(user?.member_project_ids ?? []),
-      ...(user?.projects ?? []).map((p) => p.id),
-      ...(user?.project_id ? [user.project_id] : []),
-    ]);
-    const matched = projects
-      .filter((p) => allowedIds.has(p.id))
-      .map((p) => p.name);
-    const directNames = (user?.projects ?? []).map((p) => p.name);
-    if (user?.project_name) directNames.push(user.project_name);
-    return [...new Set([...matched, ...directNames])];
-  }, [projects, user]);
   const topics = useAppStore((s) => s.topics);
   const createQuote = useCreateQuote();
   const addSupplier = useAddSupplier();
@@ -102,12 +83,12 @@ export function WizardPage() {
   const [emptyFields, setEmptyFields] = useState<{ label: string; step: number }[]>([]);
   const [confirmOpen, setConfirmOpen] = useState(false);
 
-  // ---------- prefill از لینک‌ها (?topic=&supplier=&project=) ----------
+  // ---------- prefill از لینک‌ها (?topic=&supplier=) ----------
   useEffect(() => {
     const t = params.get("topic");
-    if (t) {
+    if (!t) return;
     const topic = topicByName(t, topics);
-      if (topic) {
+    if (!topic) return;
     setSelectedTopic(topic.name);
     const sid = params.get("supplier");
     if (sid) {
@@ -117,22 +98,7 @@ export function WizardPage() {
         setSupplierInvalid(false);
       }
     }
-      }
-    }
-
-    const proj = params.get("project");
-    if (proj) {
-      setAssignment((cur) => {
-        const next = { ...cur };
-        for (const it of items) {
-          if (!next[it.tempId]?.length) {
-            next[it.tempId] = [proj];
-          }
-        }
-        return next;
-      });
-    }
-  }, [params, suppliers, topics, items]);
+  }, [params, suppliers, topics]);
 
   // ---------- اعتبارسنجی قبل از ترک هر مرحله ----------
   const completedSteps = useMemo(() => {
@@ -165,34 +131,13 @@ export function WizardPage() {
 
   // ---------- پروژه‌ها ----------
   const projectNames = useMemo(() => {
-    if (isLimitedProcurement) {
-      return memberProjectNames;
-    }
     const names = new Set<string>(projects.map((p) => p.name));
     quotes.forEach((q) => {
       if (q.project) names.add(q.project);
       (q.projects || []).forEach((n) => names.add(n));
     });
     return [...names];
-  }, [projects, quotes, isLimitedProcurement, memberProjectNames]);
-
-  // سطح محدود: در صورت داشتن یک پروژه، خودکار اقلام به آن پروژه تخصیص می‌یابند
-  useEffect(() => {
-    if (isLimitedProcurement && memberProjectNames.length === 1) {
-      const sole = memberProjectNames[0];
-      setAssignment((cur) => {
-        let changed = false;
-        const next = { ...cur };
-        for (const it of items) {
-          if (!next[it.tempId]?.length) {
-            next[it.tempId] = [sole];
-            changed = true;
-          }
-        }
-        return changed ? next : cur;
-      });
-    }
-  }, [isLimitedProcurement, memberProjectNames, items]);
+  }, [projects, quotes]);
 
   const assign = (tempId: string, proj: string) => {
     setAssignment((a) => {
@@ -470,9 +415,8 @@ export function WizardPage() {
       <Header
         title="افزودن پیشنهاد جدید"
         sub="اطلاعات را از تماس با تأمین‌کننده وارد کنید"
-        backTo={isLimitedProcurement ? "/requester" : "/"}
-        backLabel={isLimitedProcurement ? "بازگشت به استعلام‌ها" : "بازگشت به دفتر"}
-        menu={<AppSwitcherMenu activeModule="procurement" />}
+        backTo="/"
+        backLabel="بازگشت به دفتر"
       />
       <PageLayout>
         {/* نوار مراحل استپر */}
@@ -527,7 +471,6 @@ export function WizardPage() {
               assignment={assignment}
               onAssign={assign}
               onUnassign={unassign}
-              canAddProject={!isLimitedProcurement}
               onAddProject={(name) => {
                 void addProject.mutateAsync({ id: nextId("p", projects), name });
               }}

frontend/src/store/auth.ts

@@ -11,15 +11,11 @@ import { persist } from "zustand/middleware";
 export interface AuthUser {
   id: string;
   casdoor_id: string;
-  username?: string;
   first_name: string;
   last_name: string;
   phone: string | null;
-  role: "pm" | "procurement_manager" | "admin" | "supervisor" | null;
+  role: "pm" | "procurement_manager" | "admin" | null;
   role_label: string | null;
-  // لایه پنل‌ها (جایگزین نقش‌ها)
-  panels?: Record<string, string>;
-  member_project_ids?: string[];
   project_id: string | null; // پروژه‌ی فعال (PM) — با سوییچر عوض می‌شود
   project_name: string | null;
   projects?: { id: string; name: string }[]; // همه‌ی پروژه‌های تخصیص‌یافته (1:N)

frontend/src/store/index.ts

@@ -41,7 +41,6 @@ interface AppStore {
   deleteSupplier: (id: string) => void;
   addMaterial: (m: Material) => void;
   addProject: (p: Project) => void;
-  deleteProject: (id: string) => void;
   setStandardConversion: (sc: StandardConversion) => void;
   deleteStandardConversion: (id: string) => void;
 
@@ -86,7 +85,6 @@ export const useAppStore = create<AppStore>()((set) => ({
   deleteSupplier: (id) => set((s) => ({ suppliers: s.suppliers.filter((x) => x.id !== id) })),
   addMaterial: (m) => set((s) => ({ materials: [...s.materials, m] })),
   addProject: (p) => set((s) => ({ projects: [...s.projects, p] })),
-  deleteProject: (id) => set((s) => ({ projects: s.projects.filter((p) => p.id !== id) })),
   setStandardConversion: (sc) =>
     set((s) => {
       const idx = s.standardConversions.findIndex((x) => x.id === sc.id);

frontend/tsconfig.app.json

@@ -1,10 +1,11 @@
 {
   "compilerOptions": {
     "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
-    "target": "es2023",
-    "lib": ["ES2023", "DOM"],
+    "target": "ESNext",
+    "lib": ["ESNext", "DOM"],
     "module": "esnext",
     "types": ["vite/client"],
+    "strict": true,
     "allowArbitraryExtensions": true,
     "skipLibCheck": true,
 

sql/migration.sql

@@ -625,35 +625,4 @@ CREATE TABLE IF NOT EXISTS audit_log (
     details     JSONB       NOT NULL DEFAULT '{}'
 );
 
--- ---------- UNIFIED PROJECTS (PM & PROCUREMENT SHARED SCHEMA) ----------
-ALTER TABLE projects ADD COLUMN IF NOT EXISTS location TEXT DEFAULT '';
-ALTER TABLE projects ADD COLUMN IF NOT EXISTS project_manager TEXT DEFAULT '';
-ALTER TABLE projects ADD COLUMN IF NOT EXISTS planned_start DATE;
-ALTER TABLE projects ADD COLUMN IF NOT EXISTS planned_end DATE;
-ALTER TABLE projects ADD COLUMN IF NOT EXISTS actual_start DATE;
-ALTER TABLE projects ADD COLUMN IF NOT EXISTS actual_end DATE;
-ALTER TABLE projects ADD COLUMN IF NOT EXISTS status TEXT DEFAULT 'ACTIVE';
-ALTER TABLE projects ADD COLUMN IF NOT EXISTS progress DOUBLE PRECISION DEFAULT 0.0;
-ALTER TABLE projects ADD COLUMN IF NOT EXISTS updated_at TIMESTAMPTZ DEFAULT now();
-
-COMMIT;
-
--- ---------- PANEL ACCESS (جایگزین مدل نقش) ----------
--- تخصیص پنل + سطح دسترسی به ازای هر کاربر و عضویت M:N پروژه‌ای
-CREATE TABLE IF NOT EXISTS user_panels (
-    id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    user_id    UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    panel      TEXT NOT NULL CHECK (panel IN ('procurement', 'inventory', 'pm')),
-    level      TEXT NOT NULL CHECK (level IN ('full', 'limited')),
-    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-    UNIQUE (user_id, panel)
-);
-CREATE TABLE IF NOT EXISTS user_project_members (
-    id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    user_id    UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    project_id UUID NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
-    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-    UNIQUE (user_id, project_id)
-);
-
 COMMIT;